Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Some time ago I bought something online from a reputable website. I paid through my credit card and everything worked fine. The thing which is important to note is that the name used on the credit card is different from the name I use everywhere else on the internet. Now I am getting spam emails with the name on my credit card to buy stuff. These emails are not from the website from which I bought the product. I do not understand how they managed to get my details. I use Windows 7 with Microsoft Security Essentials.

It is MoneyBookers. I am not blaming them. Just curious how it happened.

share|improve this question
2  
If you feel like sharing, I'm curious about the website. –  Lucas Kauffman Mar 31 '12 at 6:30
1  
you purchased something using moneybookers but it was not from moneybookers correct? what site is sending you the product? they may have obtained you name from moneybookers and then sold your information is my guess –  Mark S. Mar 31 '12 at 19:26
1  
This appears to be a known issue with MoneyBookers, I am affected by the same problem, I got spam AND scam emails. Googled it and found this: webhostingtalk.com/archive/index.php/t-1110225.html Its sad, but what can we do. –  sharp12345 Jan 29 '13 at 0:08
    
Blame Moneybookers. I started to receive spam after I registered there. I did not even manage to register my credit card, I did not even purchase anything. And I know that spammers got that dedicated address through Moneybookers not somewhere else. –  Hess Jan 30 '13 at 11:56
add comment

5 Answers

Either the website sold it or their database got compromised. There are more than these possibilities, but if they used SSL and your computer is secure, these ones are the most likely I think.

share|improve this answer
add comment

The most common reasons are:

  • One of your friends (parents, etc.) shared an address book entry, knowingly or unknowingly. There is a number of services that try to convince people to provide them with access to their mailbox "to find friends". Furthermore Android and iOS did not have proper protection of the address book against malicious apps until very recently.
  • The website or one of its partners might have sold it.
  • You used that name in a post to a forum, mailinglist or usenet.
share|improve this answer
    
As I mentioned earlier that I do not use this name anywhere and the emails I am getting are related to buying stuff from websites so it looks as they have got the information from the website. –  Fahad Uddin Mar 31 '12 at 12:24
add comment

I would confront the seller that you purchased from. You may have agreed to them selling your information, hopefully that is not the case but I've seen some crazy license/purchase agreements. If you want the spam to stop permanently and they refuse to cooperate check out http://www.angryox.com/vaspam/ who helps point you in the right direction to take legal action against the spammers. Save all emails, print out headers, etc. I'm in this process now with someone who got my email address when I replied back to an ad I posted on craigslist asking if I still had an item for sale. When I replied back to them I started receiving spam from the SAME domain name, which was very easy to track down.

share|improve this answer
add comment

It may also be possible that they themselves disclose your information to third parties (who may or may not have adequate security infrastructure) with whom they are affiliated. These third parties may then disclose your email addresses to their affiliated third parties. You should read their privacy policy which tells whe and to whom they can disclose the customer information. It can be found at: https://www.moneybookers.com/app/help.pl?s=privacy

share|improve this answer
add comment

Under the "How we use your information" section of their privacy policy, Moneybookers/Skrill has this to say:

[in order] to provide you with information, products or services that you request from us or which we feel may interest you.

and this:

We may disclose your personal information to any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries who are based in different countries within the EEA and in the USA.

They appear to have enough loopholes in the agreement that you voluntarily accepted to allow them to pass your information along to a third party, or to act on behalf of a third party.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.