5 ms·

My real estate agent has a @agentname.com domain which all my previous communication has run over. Last week I got an email notice that a payment was due for a

My real estate agent has a @agentname.com domain which all my previous communication has run over. Last week I got an email notice that a payment was due for a household bill. It came from mailer@constantcontact.com and contained a link to a Google Form which asked for a credit card number. The form itself even has Google's warning not to provide credit card numbers down the bottom. It never even named my agent, where I was living or what the bill was for or anything that made it believable. I forwarded it to them and said I wanted to report some potential phishing. A legitimate person responded from their mailbox noting that they don't accept excuses like that, and pointing out the bill must be paid and noone else had ever questioned it. I work so hard to train users about scams but I just have no idea what to do about the rest of the world.

trevyn 7y ago
>I just have no idea what to do about the rest of the world. Assume that it's only going to get worse and act accordingly.
thaumasiotes 7y ago
> The form itself even has Google's warning not to provide credit card numbers down the bottom. I received a PayPal phishing email once which included PayPal's actual security footer at the bottom. It helpfully pointed out that communications from PayPal will always address you by name, never as "Dear customer". I was amused by this, since the phishing email started off with "Dear customer". There must be some population of people out there who are looking for the footer, but not bothering to think about what it means. (Or possibly a population of scammers who copy the official formatting without checking whether it's something they really want.)
- _-___________-_ 7y ago
  There's a theory about phishing emails that they deliberately make them slightly more obvious in order to weed out people like yourself who are unlikely to fall for them, to increase the average ROI of time spent on dealing with responses.
  - jaakl 7y ago
    BTW legit Paypal footer does NOT include such warning at all
    - Angostura 7y ago
      From a recent email > How do I know this is not a Spoof email? PayPal is committed to preventing fraudulent emails. Emails from PayPal will always contain your full name. Spoof or "phishing" emails tend to have generic greetings such as "Dear PayPal member". To learn more, go to the PayPal website and click Security.
- andybak 7y ago
  Don't get me started on Paypal. They send emails from a domain that isn't paypal.com with login links in the email that point to a domain that isn't paypal.com I genuinely can't distinguish official Paypal emails from phishing emails - and that's because the Paypal emails look like bad phishing emails rather than because phishing emails are so sophisticated. EDIT: Good write up here: https://cantoriscomputing.wordpress.com/2017/03/04/paypals-emails-encourage-dangerous-habits/ https://cantoriscomputing.wordpress.com/2017/03/04/paypals-e...
  - PostOnce 7y ago
    Oh my god the closure on that link. You couldn't write satire this good. Bureaucracy distilled.
  - avianlyric 7y ago
    As a bank we do the same thing. Driven by the fact we don’t want our login emails to come from a domain that also sends “normal” emails in case spam filters start dropping emails from our primary domain. This isn’t a hypothetical concern either, having spam filter go crazy happens more often than you expect, and some of them drop emails completely rather than putting them into a spam folder (looking at you Microsoft). Unlike PayPal we make it easy to verify our domains. https://monzomail.com https://monzomail.com
  - avip 7y ago
    I've reported such emails to spoof@paypal.com and never got a reply. Maddening. I never open mails from PayPal now - better safe than sorry. Edit: https://news.ycombinator.com/item?id=15296425 https://news.ycombinator.com/item?id=15296425
    - steelframe 7y ago
      The last time I attempted to sell something on eBay, twice in a row a scammer -- presumably in the Ukraine -- won the auction and then proceeded to send me a spoofed Paypal payment confirmation (from: service@intl.paypal.com) written in Cyrillic. The mailing address was a drop ship company in New Jersey. Then they were aggressive about sending me messages like, "I paid, have you sent it yet??" I ignored them and sent the spoofed emails to the spoof addresses at both eBay and Paypal, which seemed to be entirely ignored. After the required amount of time passed I reported the auction winners as non-paying, and I finally got my seller's fees "refunded" to my eBay account. Then, a couple of weeks ago, I attempted to get eBay to actually transfer my fee credit to my bank account. eBay responded with, "We would really love to help you out with this. but due to COVID-19 we can't." Somehow one of the fraudulent buyers has had an eBay account since 2012, and it's still active and has a 92% positive feedback rating. Their current auctions include a used gynecological examination chair. It's as if they're flaunting the fact that they can get away with whatever they're doing without being held accountable by either eBay or Paypal.
- mehrdadn 7y ago
  I'm always skeptical of when companies say they will "never" do something. How in the world do all your employees know to never do that thing? Are you constantly reminding people every day in your office of the list of things to never do? Even if you're one person that's an insanely strong promise to make to anyone about your future actions. How does a company have such confidence in the future? The only way I can imagine this working is if they make it impossible for themselves to do that thing, which itself is practically impossible in these cases.
  - im3w1l 7y ago
    I would assume that only certain employees are authorized to email customers at all, and they have been trained to follow the policies.
    - mehrdadn 7y ago
      I mean, in theory, yes, but I mean, I'm sure you've seen your share of mishaps, right? Like when companies send "Dear $CUSTOMER..."? When something that blatantly obvious can get through, what confidence do you have that training is enough to prevent more subtle things like this for all eternity?
      - im3w1l 7y ago
        I can't recall an instance of Dear $CUSTOMER sent to me personally. If it has happened it must have been very long ago.
        dmd 7y ago
        Amusingly enough, I got a Dear %{CUSTFIRSTNAME} from my auto loan provider less than an hour ago.
        tialaramex 7y ago
        This isn't even restricted to email. I have a paper letter here from my dentist, the purpose of which is to explain that they've cancelled all routine appointments, because duh, of course they have. The letter addresses me as "Mr" in some places and as "MrNicholas" (no space) in other places. But to be fair it also claims the problem is COVID-9 (not COVID-19) so I'm guessing that correctness was not the number one focus of the person typing it.
- im3w1l 7y ago
  I think people might read the footer the first time they get an email. That's why it's there. And on subsequent emails people only look for rough visual similarity as a sanity check. That's why scams keep it there.
- lb1lf 7y ago
  -My bank sent an (authentic, it turned out) E-mail including the ‘We’ll always use your first name in our correspondence with you to prove we’re who we claim to be.’ The E-mail started «Dear $FORNAVN...» (Where ‘fornavn’ is Norwegian for ‘first name’) When I called them up to ask, the helpdesk rep just sighed and suggested that the mail merge script had probably crapped out. Again.
aquadrop 7y ago
You need to expose that kind of stuff. By hiding them behind @agentname.com you just help them.
- pdehaan 7y ago
  In this case wouldn't naming the agent also increase the likelihood that they're targeted? The clients have already been primed to follow the phishing link, so it'd just be a matter of getting a target list. Most agents I'm aware of stick to a local region/market, so targeted ad buys ("people in X county buying homes")/email lists/etc could be worth it for a motivated phisher.

trevyn 7y ago

>I just have no idea what to do about the rest of the world. Assume that it's only going to get worse and act accordingly.

thaumasiotes 7y ago

> The form itself even has Google's warning not to provide credit card numbers down the bottom. I received a PayPal phishing email once which included PayPal's actual security footer at the bottom. It helpfully pointed out that communications from PayPal will always address you by name, never as "Dear customer". I was amused by this, since the phishing email started off with "Dear customer". There must be some population of people out there who are looking for the footer, but not bothering to think about what it means. (Or possibly a population of scammers who copy the official formatting without checking whether it's something they really want.)

_-___________-_ 7y ago
There's a theory about phishing emails that they deliberately make them slightly more obvious in order to weed out people like yourself who are unlikely to fall for them, to increase the average ROI of time spent on dealing with responses.
- jaakl 7y ago
  BTW legit Paypal footer does NOT include such warning at all
  - Angostura 7y ago
    From a recent email > How do I know this is not a Spoof email? PayPal is committed to preventing fraudulent emails. Emails from PayPal will always contain your full name. Spoof or "phishing" emails tend to have generic greetings such as "Dear PayPal member". To learn more, go to the PayPal website and click Security.
andybak 7y ago
Don't get me started on Paypal. They send emails from a domain that isn't paypal.com with login links in the email that point to a domain that isn't paypal.com I genuinely can't distinguish official Paypal emails from phishing emails - and that's because the Paypal emails look like bad phishing emails rather than because phishing emails are so sophisticated. EDIT: Good write up here: https://cantoriscomputing.wordpress.com/2017/03/04/paypals-emails-encourage-dangerous-habits/ https://cantoriscomputing.wordpress.com/2017/03/04/paypals-e...
- PostOnce 7y ago
  Oh my god the closure on that link. You couldn't write satire this good. Bureaucracy distilled.
- avianlyric 7y ago
  As a bank we do the same thing. Driven by the fact we don’t want our login emails to come from a domain that also sends “normal” emails in case spam filters start dropping emails from our primary domain. This isn’t a hypothetical concern either, having spam filter go crazy happens more often than you expect, and some of them drop emails completely rather than putting them into a spam folder (looking at you Microsoft). Unlike PayPal we make it easy to verify our domains. https://monzomail.com https://monzomail.com
- avip 7y ago
  I've reported such emails to spoof@paypal.com and never got a reply. Maddening. I never open mails from PayPal now - better safe than sorry. Edit: https://news.ycombinator.com/item?id=15296425 https://news.ycombinator.com/item?id=15296425
  - steelframe 7y ago
    The last time I attempted to sell something on eBay, twice in a row a scammer -- presumably in the Ukraine -- won the auction and then proceeded to send me a spoofed Paypal payment confirmation (from: service@intl.paypal.com) written in Cyrillic. The mailing address was a drop ship company in New Jersey. Then they were aggressive about sending me messages like, "I paid, have you sent it yet??" I ignored them and sent the spoofed emails to the spoof addresses at both eBay and Paypal, which seemed to be entirely ignored. After the required amount of time passed I reported the auction winners as non-paying, and I finally got my seller's fees "refunded" to my eBay account. Then, a couple of weeks ago, I attempted to get eBay to actually transfer my fee credit to my bank account. eBay responded with, "We would really love to help you out with this. but due to COVID-19 we can't." Somehow one of the fraudulent buyers has had an eBay account since 2012, and it's still active and has a 92% positive feedback rating. Their current auctions include a used gynecological examination chair. It's as if they're flaunting the fact that they can get away with whatever they're doing without being held accountable by either eBay or Paypal.
mehrdadn 7y ago
I'm always skeptical of when companies say they will "never" do something. How in the world do all your employees know to never do that thing? Are you constantly reminding people every day in your office of the list of things to never do? Even if you're one person that's an insanely strong promise to make to anyone about your future actions. How does a company have such confidence in the future? The only way I can imagine this working is if they make it impossible for themselves to do that thing, which itself is practically impossible in these cases.
- im3w1l 7y ago
  I would assume that only certain employees are authorized to email customers at all, and they have been trained to follow the policies.
  - mehrdadn 7y ago
    I mean, in theory, yes, but I mean, I'm sure you've seen your share of mishaps, right? Like when companies send "Dear $CUSTOMER..."? When something that blatantly obvious can get through, what confidence do you have that training is enough to prevent more subtle things like this for all eternity?
    - im3w1l 7y ago
      I can't recall an instance of Dear $CUSTOMER sent to me personally. If it has happened it must have been very long ago.
      - dmd 7y ago
        Amusingly enough, I got a Dear %{CUSTFIRSTNAME} from my auto loan provider less than an hour ago.
        tialaramex 7y ago
        This isn't even restricted to email. I have a paper letter here from my dentist, the purpose of which is to explain that they've cancelled all routine appointments, because duh, of course they have. The letter addresses me as "Mr" in some places and as "MrNicholas" (no space) in other places. But to be fair it also claims the problem is COVID-9 (not COVID-19) so I'm guessing that correctness was not the number one focus of the person typing it.
im3w1l 7y ago
I think people might read the footer the first time they get an email. That's why it's there. And on subsequent emails people only look for rough visual similarity as a sanity check. That's why scams keep it there.
lb1lf 7y ago
-My bank sent an (authentic, it turned out) E-mail including the ‘We’ll always use your first name in our correspondence with you to prove we’re who we claim to be.’ The E-mail started «Dear $FORNAVN...» (Where ‘fornavn’ is Norwegian for ‘first name’) When I called them up to ask, the helpdesk rep just sighed and suggested that the mail merge script had probably crapped out. Again.

aquadrop 7y ago

You need to expose that kind of stuff. By hiding them behind @agentname.com you just help them.

pdehaan 7y ago
In this case wouldn't naming the agent also increase the likelihood that they're targeted? The clients have already been primed to follow the phishing link, so it'd just be a matter of getting a target list. Most agents I'm aware of stick to a local region/market, so targeted ad buys ("people in X county buying homes")/email lists/etc could be worth it for a motivated phisher.