6 ms·

Spam is getting horrible lately. I get all sorts of new techniques including: - using legitimate sites to bypass filters, like sending you a bill through a leg

Spam is getting horrible lately. I get all sorts of new techniques including: - using legitimate sites to bypass filters, like sending you a bill through a legitimate bill-creation site - pretending to be a tracking service for something you supposedly ordered, then over the course of days pretending the package got lost on the way and offering a discount code for the 'purchased' amount, expecting you to use it on their phising site. Gmail not only fails at spam classification, they classify these messages as important and nag you with first priority notifications and summaries.

traviswingo 5mo ago
I can’t prove it, but it feels like the world recently decided that spamming/scamming is acceptable, so the number of spammers/scammers has increased dramatically. The number of spam calls, texts, emails, iCloud account unlock requests, etc I’ve received in the last year is insane.
- abirch 5mo ago
  It's AI that's doing a lot of it. For a lot of spam, scammers would want to exclude anyone who may not fall for the scam due to the costs associated with dealing with people who won't pay you. Now that AI decreases the need for a human scammer to scam, expect them to start to widen their scam nets.
  - BLKNSLVR 5mo ago
    The decline had been happening long before AI hit mainstream. It's been a _lot_ of years that I've hesitated to answer calls from unknown numbers.
    - afavour 5mo ago
      Yeah this feels like one of those cases where the term "AI" gets broadened out so far it becomes meaningless. This stuff is automated. The ability to automate spam calls (using the same form of APIs developers love, like Twilio) make it absurdly easy for one person to set up a spam machine. No AI required.
      - abirch 5mo ago
        You're correct about the calls, but the ability to talk with the people was the rate limiter. Even if you have many people in Cambodia or India, the scammers still needed to scam more than they paid out. Now you can have AI bots that do the first level of filtering. Unfortunately scamming is a business and if certain actions become less expensive, I would expect more of them.
      - mapt 5mo ago
        The lead generation was automated ten years ago ("Hello?"), but the actual scam conversation was not. Until recently, you still had to pay somebody in South Asia better than the prevailing wage of ~$1/hr to have these conversations, as well as set them up in an office with computers and managers, and bribe local police (call it $5/hr of fully burdened work product). If your success rate is ~1% and the average human portion of the scam lasts 12 minutes, you're getting 0.05 successes per hour, and you better be netting an average of $100 per successful scam (accounting for financial clearing issues / reversals!) or you're losing money on every hour worked.
- adrian_b 5mo ago
  I believe that these spammers now concentrate their efforts towards e-mail addresses hosted by major providers, like Gmail. The reason is that I have an opposite experience, during the last couple of years I have received much less spam messages than before. I have hosted my own e-mail server for more than 2 decades. Previously, I had to filter large quantities of spam messages, but lately the number of spam messages is much less than 10% of the total number of received messages.
  - bix6 5mo ago
    I’m considering self hosted. I’m so tired of the major providers not even trying. And I have no serious control over blocklists.
    - lysium 5mo ago
      [dead]
    - dotancohen 5mo ago
      My personal domain has the MX records pointing at Gmail. It gets far less spam than my Gmail address does.
    - throwaway2037 5mo ago
      What about fastmail.com or hey.com or proton.me? I have heard good things about all of them.
      - frizlab 5mo ago
        I use fastmail, I love it. I have a catchall and thus can use a different address per service. Leads to sometimes awkward conversations as to why the email address contains the company name in it, but can also be a life saver. For instance, free recently got hacked and all their email db was online. I can just block this email address and not receive the spam. Fastmail itself is reliable and fast on the web, but I only use it through IMAP anyways. It works perfectly.
- torben-friis 5mo ago
  I think part of it is AI allowing sophistication at scale, but there's also a generational factor. The techbro + business shark culture, influencers who manipulate people being role models, and so on.
  - deaton 5mo ago
    [dead]
- bix6 5mo ago
  AI + FCC weakening
  - ryandrake 5mo ago
    Not just the FCC but the entire regulatory apparatus is completely non-functional when it comes to regulating commerce. The clear, unspoken message in the USA is now: "Enrich yourself in any way you can, as fast as you can. Buyer Beware is the law of the land."
- thewebguyd 5mo ago
  Lack of accountability for the companies that allow their services & platforms to be used for spam/scamming. Take DocuSign for instance. Still, this many years later, is a major source of phishing emails from their free trials. DocuSign could easily shut this down today by either requiring a CC for the trial, or forcing a call with a sales rep to start a trial. But they don't, they continue to allow their service to be used for wide scale phishing. Atera, an RMM, is another one that has been a big source of malware delivery, also via the free trials. Shutting down the trial accounts after the fact does nothing, the emails already went out.
  - Analemma_ 5mo ago
    I feel like there's no way for them to win, though. The kind of accountability you're talking about what require them to do essentially tons of KYC/AML vetting, and HN would be equally outraged about that.
    - duskwuff 5mo ago
      It's a little hard to get outraged about that hypothetical, given that legitimate usage of DocuSign typically involves sending them documents containing all sorts of sensitive information.
- ge96 5mo ago
  I get these voicemails almost daily it's a cutoff message talking about "a loan just came across my desk" It's such a good tactic too to start the voicemail with the conversation already going people are like "what? who?"
- Ajakks 5mo ago
  Oh no - you can definitely 100% prove it, this is the direct consequence, the exact intended consequences, of Trump gutting consumer protections - across the board, not only online but with food and laws about not dumping chemicals in rivers. The man is the absolute worse person - unless your a rich guy, who wants to make more money by screwing over people who mostly don't even know it. Anyone who reads this, I dare you to find out why that thing in your life you hate so much, sucks so bad - nothing is ever by accident or unintentional. The United States, and its People, will be discovering/realizing different ways we have been absolutely f-d by that grifter for likely the rest of my millenial life, thankfully (silver lining!!) US life expectancy has dropped substantially for the 150 million Americans in the bottom 50% of income - rich people in America have to deal with this bs for almost 8 more years than we do Oh yeah, if you want a faster out even yet - just make 30k or less per year, your life caps at 71 then. I joke but I hate so much that people will read this and then promptly go back to sustaining this system at their job. We work our lives away so the rich dont have to and they get to live 14 more years on average than poor people.
  - account42 5mo ago
    Curb your TDS, this trend has been going on much longer than the bad orange man.
    - array_key_first 5mo ago
      Acknowledging reality = TDS. While you're correct that this is a trend that has been going on for a while, the keyword is trend. Do you understand what a trend is? It's a direction. Meaning, under Trump, it has gotten worse, and that is directly related to the piss-poor policy choices of this administration. I won't mince words here. People who think policy is completely detached from outcomes are dim, and should spend less time talking because it wastes everyone's brain space.
    - Ajakks 5mo ago
      Oh, I was just really upset having found out that the IRS is going to settle Trumps 10 billion lawsuit against the IRS, for releasing his tax returns but showed he payed 0 dollars in taxes - AND, the terms of the settlement are that the IRS cannot investigate his family or any of their businesses in the future. That is the most corrupt thing a Leader in a western country has ever done in the modern world.
- harrall 5mo ago
  New tools like LLMs probably make previously unscalable techniques scalable.
- testudovictoria 5mo ago
  In addition, it feels like the past 5 years have brought on more marketing spam. I've been slowly reappearing onto marketing lists that I either never signed up for or unsubscribed from. They're coming from legitimate companies that I've done business with.
- xnx 5mo ago
  > I can’t prove it, but it feels like the world recently decided that spamming/scamming is acceptable In the US, we elected a well-known scammer ... twice!
  - account42 5mo ago
    You mean 60 times? It's not like you get on the ballot by being an honest person.
- xboxnolifes 5mo ago
  Every single day since around the start of the year I get at least 1 text with the content of roughly: "FROM TRUMP: You could be the next winner of this PRIZE/MONEY!", "Click here to receive your $10,000 tariff refund!", "DEMOCRATS are trying to DESTROY EVERYTHING!". Plus I get almost daily calls that immediately hang up, and leave a 30 second voicemail with no audio. I've always had some level of political spam, usually only close to voting months, but this year has been the worst for me.
  - account42 5mo ago
    The first two don't sound like political spam, just politically-themed regular scams.
- account42 5mo ago
  It's the natural progression of hustle culture. Profit makes right, nothing else matters.
thisislife2 5mo ago
If I put on my tinfoil hat, it seems to be something deliberate, to push us all towards accepting hardware / software attestation and better "online id" stuff - "Don't you want to identify and stop the spammers and phishers?". Email scanning and file scanning (on our computer) became acceptable when the level of spam and malware became intolerable. But it was at cost of our privacy. Today, Gmail scans all your mails and makes money from it. Both Windows and macOS have built-in anti-virus or malware scanners, and file indexers, and thus know all the applications and files in your system (which provides for more data on your profile with them). Now with both OSes, and even browsers like Chrome and Firefox, including AI, they will now use our own computers to not only collect our personal data, but even process it on our system and use it to build even better profiles to more profitably exploit us.
- Daishiman 5mo ago
  It doesn't have to be deliberate; it's just the economic incentives at work. AI providers are inclined to sell AI to everyone with a pulse, and it just so happens that a lot of its use will for towards spam generation. It also just happens that they're the ones best positioned to provide attestation and identity services.
- intended 5mo ago
  Eh - conspiracy territory. There’s been a massive evolution in phishing and spams with LLMs. > Evaluating Large Language Models' Capability to Launch Fully Automated Spear Phishing Campaigns: Validated on Human Subjects > https://arxiv.org/abs/2412.00586 https://arxiv.org/abs/2412.00586 LLMs make phishing absurdly profitable, and can now make profits from targets who were previously economically unviable to target.
glitchc 5mo ago
Spam is now AI powered. Let that sink in for a bit.
cjbgkagh 5mo ago
Gmail spam filtering is so bad that I believe it has to be intentional. I think they see email as a long term ad revenue opportunity and want to desensitize people to the spam.
- gambiting 5mo ago
  I wonder how come I have such a diametrically different experience. I don't remember the last time any spam email got through the automatic filter into my inbox, and I had a gmail account for 20 years now.
  - cjbgkagh 5mo ago
    Could be an A/B test. I’ve had mine for 17 years, it only became an issue 5 years ago.
whywhywhywhy 5mo ago
> pretending to be a tracking service for something you supposedly ordered There’s a leak or someone is selling the data in a lot of the delivery companies in my country. I order something then without fail the fake text message pretending to be the delivery service. Only thing they screw up is claiming it’s failed to deliver too soon and the weird urls. Messed up these companies are either selling it or being irresponsible with data.
- lovich 5mo ago
  Seems to be involved with government services too. I signed up for a welfare program that had me input all my data before denying me the service a few months ago, and the next day I started receiving spam calls and texts using some unique pieces of information that I had submitted in that form. Called my state senators to complain about it and ask for assistance. Enjoyed the complete lack of follow through.
gorbachev 5mo ago
I'm not seeing any of this, and I've have been using the same email address that forwards to gmail for decades at this point, and it's in every major email data breach. I get, maybe, one actual spam email per year through gmail's spam filters. I get more actual spam at my work email, which is not hosted by gmail, even though the email volume of emails sent from outside of my employer's network is orders of magnitude smaller than my personal email volume.
nutjob2 5mo ago
> like sending you a bill through a legitimate bill-creation site Why aren't these things opt-in? Ditto for every other thing that sends you email. I reflexively mark anything I didn't sign up for as spam on principle.

traviswingo 5mo ago

I can’t prove it, but it feels like the world recently decided that spamming/scamming is acceptable, so the number of spammers/scammers has increased dramatically. The number of spam calls, texts, emails, iCloud account unlock requests, etc I’ve received in the last year is insane.

abirch 5mo ago
It's AI that's doing a lot of it. For a lot of spam, scammers would want to exclude anyone who may not fall for the scam due to the costs associated with dealing with people who won't pay you. Now that AI decreases the need for a human scammer to scam, expect them to start to widen their scam nets.
- BLKNSLVR 5mo ago
  The decline had been happening long before AI hit mainstream. It's been a _lot_ of years that I've hesitated to answer calls from unknown numbers.
  - afavour 5mo ago
    Yeah this feels like one of those cases where the term "AI" gets broadened out so far it becomes meaningless. This stuff is automated. The ability to automate spam calls (using the same form of APIs developers love, like Twilio) make it absurdly easy for one person to set up a spam machine. No AI required.
    - abirch 5mo ago
      You're correct about the calls, but the ability to talk with the people was the rate limiter. Even if you have many people in Cambodia or India, the scammers still needed to scam more than they paid out. Now you can have AI bots that do the first level of filtering. Unfortunately scamming is a business and if certain actions become less expensive, I would expect more of them.
    - mapt 5mo ago
      The lead generation was automated ten years ago ("Hello?"), but the actual scam conversation was not. Until recently, you still had to pay somebody in South Asia better than the prevailing wage of ~$1/hr to have these conversations, as well as set them up in an office with computers and managers, and bribe local police (call it $5/hr of fully burdened work product). If your success rate is ~1% and the average human portion of the scam lasts 12 minutes, you're getting 0.05 successes per hour, and you better be netting an average of $100 per successful scam (accounting for financial clearing issues / reversals!) or you're losing money on every hour worked.
adrian_b 5mo ago
I believe that these spammers now concentrate their efforts towards e-mail addresses hosted by major providers, like Gmail. The reason is that I have an opposite experience, during the last couple of years I have received much less spam messages than before. I have hosted my own e-mail server for more than 2 decades. Previously, I had to filter large quantities of spam messages, but lately the number of spam messages is much less than 10% of the total number of received messages.
- bix6 5mo ago
  I’m considering self hosted. I’m so tired of the major providers not even trying. And I have no serious control over blocklists.
  - lysium 5mo ago
    [dead]
  - dotancohen 5mo ago
    My personal domain has the MX records pointing at Gmail. It gets far less spam than my Gmail address does.
  - throwaway2037 5mo ago
    What about fastmail.com or hey.com or proton.me? I have heard good things about all of them.
    - frizlab 5mo ago
      I use fastmail, I love it. I have a catchall and thus can use a different address per service. Leads to sometimes awkward conversations as to why the email address contains the company name in it, but can also be a life saver. For instance, free recently got hacked and all their email db was online. I can just block this email address and not receive the spam. Fastmail itself is reliable and fast on the web, but I only use it through IMAP anyways. It works perfectly.
torben-friis 5mo ago
I think part of it is AI allowing sophistication at scale, but there's also a generational factor. The techbro + business shark culture, influencers who manipulate people being role models, and so on.
- deaton 5mo ago
  [dead]
bix6 5mo ago
AI + FCC weakening
- ryandrake 5mo ago
  Not just the FCC but the entire regulatory apparatus is completely non-functional when it comes to regulating commerce. The clear, unspoken message in the USA is now: "Enrich yourself in any way you can, as fast as you can. Buyer Beware is the law of the land."
thewebguyd 5mo ago
Lack of accountability for the companies that allow their services & platforms to be used for spam/scamming. Take DocuSign for instance. Still, this many years later, is a major source of phishing emails from their free trials. DocuSign could easily shut this down today by either requiring a CC for the trial, or forcing a call with a sales rep to start a trial. But they don't, they continue to allow their service to be used for wide scale phishing. Atera, an RMM, is another one that has been a big source of malware delivery, also via the free trials. Shutting down the trial accounts after the fact does nothing, the emails already went out.
- Analemma_ 5mo ago
  I feel like there's no way for them to win, though. The kind of accountability you're talking about what require them to do essentially tons of KYC/AML vetting, and HN would be equally outraged about that.
  - duskwuff 5mo ago
    It's a little hard to get outraged about that hypothetical, given that legitimate usage of DocuSign typically involves sending them documents containing all sorts of sensitive information.
ge96 5mo ago
I get these voicemails almost daily it's a cutoff message talking about "a loan just came across my desk" It's such a good tactic too to start the voicemail with the conversation already going people are like "what? who?"
Ajakks 5mo ago
Oh no - you can definitely 100% prove it, this is the direct consequence, the exact intended consequences, of Trump gutting consumer protections - across the board, not only online but with food and laws about not dumping chemicals in rivers. The man is the absolute worse person - unless your a rich guy, who wants to make more money by screwing over people who mostly don't even know it. Anyone who reads this, I dare you to find out why that thing in your life you hate so much, sucks so bad - nothing is ever by accident or unintentional. The United States, and its People, will be discovering/realizing different ways we have been absolutely f-d by that grifter for likely the rest of my millenial life, thankfully (silver lining!!) US life expectancy has dropped substantially for the 150 million Americans in the bottom 50% of income - rich people in America have to deal with this bs for almost 8 more years than we do Oh yeah, if you want a faster out even yet - just make 30k or less per year, your life caps at 71 then. I joke but I hate so much that people will read this and then promptly go back to sustaining this system at their job. We work our lives away so the rich dont have to and they get to live 14 more years on average than poor people.
- account42 5mo ago
  Curb your TDS, this trend has been going on much longer than the bad orange man.
  - array_key_first 5mo ago
    Acknowledging reality = TDS. While you're correct that this is a trend that has been going on for a while, the keyword is trend. Do you understand what a trend is? It's a direction. Meaning, under Trump, it has gotten worse, and that is directly related to the piss-poor policy choices of this administration. I won't mince words here. People who think policy is completely detached from outcomes are dim, and should spend less time talking because it wastes everyone's brain space.
  - Ajakks 5mo ago
    Oh, I was just really upset having found out that the IRS is going to settle Trumps 10 billion lawsuit against the IRS, for releasing his tax returns but showed he payed 0 dollars in taxes - AND, the terms of the settlement are that the IRS cannot investigate his family or any of their businesses in the future. That is the most corrupt thing a Leader in a western country has ever done in the modern world.
harrall 5mo ago
New tools like LLMs probably make previously unscalable techniques scalable.
testudovictoria 5mo ago
In addition, it feels like the past 5 years have brought on more marketing spam. I've been slowly reappearing onto marketing lists that I either never signed up for or unsubscribed from. They're coming from legitimate companies that I've done business with.
xnx 5mo ago
> I can’t prove it, but it feels like the world recently decided that spamming/scamming is acceptable In the US, we elected a well-known scammer ... twice!
- account42 5mo ago
  You mean 60 times? It's not like you get on the ballot by being an honest person.
xboxnolifes 5mo ago
Every single day since around the start of the year I get at least 1 text with the content of roughly: "FROM TRUMP: You could be the next winner of this PRIZE/MONEY!", "Click here to receive your $10,000 tariff refund!", "DEMOCRATS are trying to DESTROY EVERYTHING!". Plus I get almost daily calls that immediately hang up, and leave a 30 second voicemail with no audio. I've always had some level of political spam, usually only close to voting months, but this year has been the worst for me.
- account42 5mo ago
  The first two don't sound like political spam, just politically-themed regular scams.
account42 5mo ago
It's the natural progression of hustle culture. Profit makes right, nothing else matters.

thisislife2 5mo ago

If I put on my tinfoil hat, it seems to be something deliberate, to push us all towards accepting hardware / software attestation and better "online id" stuff - "Don't you want to identify and stop the spammers and phishers?". Email scanning and file scanning (on our computer) became acceptable when the level of spam and malware became intolerable. But it was at cost of our privacy. Today, Gmail scans all your mails and makes money from it. Both Windows and macOS have built-in anti-virus or malware scanners, and file indexers, and thus know all the applications and files in your system (which provides for more data on your profile with them). Now with both OSes, and even browsers like Chrome and Firefox, including AI, they will now use our own computers to not only collect our personal data, but even process it on our system and use it to build even better profiles to more profitably exploit us.

Daishiman 5mo ago
It doesn't have to be deliberate; it's just the economic incentives at work. AI providers are inclined to sell AI to everyone with a pulse, and it just so happens that a lot of its use will for towards spam generation. It also just happens that they're the ones best positioned to provide attestation and identity services.
intended 5mo ago
Eh - conspiracy territory. There’s been a massive evolution in phishing and spams with LLMs. > Evaluating Large Language Models' Capability to Launch Fully Automated Spear Phishing Campaigns: Validated on Human Subjects > https://arxiv.org/abs/2412.00586 https://arxiv.org/abs/2412.00586 LLMs make phishing absurdly profitable, and can now make profits from targets who were previously economically unviable to target.

glitchc 5mo ago

Spam is now AI powered. Let that sink in for a bit.

cjbgkagh 5mo ago

Gmail spam filtering is so bad that I believe it has to be intentional. I think they see email as a long term ad revenue opportunity and want to desensitize people to the spam.

gambiting 5mo ago
I wonder how come I have such a diametrically different experience. I don't remember the last time any spam email got through the automatic filter into my inbox, and I had a gmail account for 20 years now.
- cjbgkagh 5mo ago
  Could be an A/B test. I’ve had mine for 17 years, it only became an issue 5 years ago.

whywhywhywhy 5mo ago

> pretending to be a tracking service for something you supposedly ordered There’s a leak or someone is selling the data in a lot of the delivery companies in my country. I order something then without fail the fake text message pretending to be the delivery service. Only thing they screw up is claiming it’s failed to deliver too soon and the weird urls. Messed up these companies are either selling it or being irresponsible with data.

lovich 5mo ago
Seems to be involved with government services too. I signed up for a welfare program that had me input all my data before denying me the service a few months ago, and the next day I started receiving spam calls and texts using some unique pieces of information that I had submitted in that form. Called my state senators to complain about it and ask for assistance. Enjoyed the complete lack of follow through.

gorbachev 5mo ago

I'm not seeing any of this, and I've have been using the same email address that forwards to gmail for decades at this point, and it's in every major email data breach. I get, maybe, one actual spam email per year through gmail's spam filters. I get more actual spam at my work email, which is not hosted by gmail, even though the email volume of emails sent from outside of my employer's network is orders of magnitude smaller than my personal email volume.

nutjob2 5mo ago

> like sending you a bill through a legitimate bill-creation site Why aren't these things opt-in? Ditto for every other thing that sends you email. I reflexively mark anything I didn't sign up for as spam on principle.