Removing the dots and the pluses is not enough. Let's say that James Fisher also owns jameshfisher@yahoo.com. Eve finds that jameshfisher@gmail.com has a Netfl

Removing the dots and the pluses is not enough. Let's say that James Fisher also owns jameshfisher@yahoo.com. Eve finds that jameshfisher@gmail.com has a Netflix account, so she registers a new account with jameshfisher@yahoo.com. The scam proceeds the same way; if James registered for Netflix a while ago, he may not remember whether he registered with his Gmail address or with his Yahoo one (he has some services registered with the one, and some with the other). If he set up forwarding from his Yahoo account to his Gmail one, or if he's using a mail client, he may not even notice that the message went to a different address. So the solution in this case is for Google to disallow registering jameshfisher@gmail.com if jameshfisher@yahoo.com already exists? Or to display phishing warnings on every email that was sent to a different address (and possibly forwarded)? Maybe Netflix should simply verify the address upon registration after all.