Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Some time ago I bought something online from a reputable website. I paid through my credit card and everything worked fine. The thing which is important to note is that the name used on the credit card is different from the name I use everywhere else on the internet. Now I am getting spam emails with the name on my credit card to buy stuff. These emails are not from the website from which I bought the product. I do not understand how they managed to get my details. I use Windows 7 with Microsoft Security Essentials.

It is MoneyBookers. I am not blaming them. Just curious how it happened.

share|improve this question
If you feel like sharing, I'm curious about the website. – Lucas Kauffman Mar 31 '12 at 6:30
you purchased something using moneybookers but it was not from moneybookers correct? what site is sending you the product? they may have obtained you name from moneybookers and then sold your information is my guess – Mark S. Mar 31 '12 at 19:26
This appears to be a known issue with MoneyBookers, I am affected by the same problem, I got spam AND scam emails. Googled it and found this: Its sad, but what can we do. – sharp12345 Jan 29 '13 at 0:08
Blame Moneybookers. I started to receive spam after I registered there. I did not even manage to register my credit card, I did not even purchase anything. And I know that spammers got that dedicated address through Moneybookers not somewhere else. – Hess Jan 30 '13 at 11:56
Not to self: Don't use moneybookers. – Frank May 5 '14 at 18:50

Under the "How we use your information" section of their privacy policy, Moneybookers/Skrill has this to say:

[in order] to provide you with information, products or services that you request from us or which we feel may interest you.

and this:

We may disclose your personal information to any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries who are based in different countries within the EEA and in the USA.

They appear to have enough loopholes in the agreement that you voluntarily accepted to allow them to pass your information along to a third party, or to act on behalf of a third party.

share|improve this answer

Either the website sold it or their database got compromised. There are more than these possibilities, but if they used SSL and your computer is secure, these ones are the most likely I think.

share|improve this answer

The most common reasons are:

  • One of your friends (parents, etc.) shared an address book entry, knowingly or unknowingly. There is a number of services that try to convince people to provide them with access to their mailbox "to find friends". Furthermore Android and iOS did not have proper protection of the address book against malicious apps until very recently.
  • The website or one of its partners might have sold it.
  • You used that name in a post to a forum, mailinglist or usenet.
share|improve this answer
As I mentioned earlier that I do not use this name anywhere and the emails I am getting are related to buying stuff from websites so it looks as they have got the information from the website. – Fahad Uddin Mar 31 '12 at 12:24

I would confront the seller that you purchased from. You may have agreed to them selling your information, hopefully that is not the case but I've seen some crazy license/purchase agreements. If you want the spam to stop permanently and they refuse to cooperate check out who helps point you in the right direction to take legal action against the spammers. Save all emails, print out headers, etc. I'm in this process now with someone who got my email address when I replied back to an ad I posted on craigslist asking if I still had an item for sale. When I replied back to them I started receiving spam from the SAME domain name, which was very easy to track down.

share|improve this answer

It may also be possible that they themselves disclose your information to third parties (who may or may not have adequate security infrastructure) with whom they are affiliated. These third parties may then disclose your email addresses to their affiliated third parties. You should read their privacy policy which tells whe and to whom they can disclose the customer information. It can be found at:

share|improve this answer

Quoting their privacy policy:

5. Disclosure of Your Information

5.1. Group Companies
We may disclose your personal information to any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries who are based in different countries within the EEA and in the USA. This may be necessary in order to, among other things, fulfil your request, process your payment details, provide support services and monitor fraudulent activities.

5.2. Merchants and other Skrill Customers
When sending money to another Skrill Account holder or a merchant who you wish to pay we will, at a minimum, pass on your email address to the recipient. Depending on the requirements of the merchant and the type of payment involved, we may also send other personal details such as your name, address and country of residence if the recipients request this information from us in order to improve the payment process, to reconcile payments with the commercial transaction or to conduct their own anti-fraud and anti-money laundering checks.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.