Summary: Can email be intercepted and modified by a 3rd-party during transit from the sender to the receiver? If so, can this interception be detected?

Details:

  1. My friend (A) (mailbox at popular freemail example.com) ordered some goods from seller (B) (mailbox at gmail.com).
  2. B says he mailed pro-forma invoice A. (PDF exported from Excel, all text can be selected by mouse.)
  3. A did not receive invoice from B, but instead, with 10 hrs delay A received invoice from person C (PDF containing bitmap image looking like invoice from B, with contact and payment information altered to C.) It was sent from mailbox at gmail.com, too. Address of C is like of B, with one letter in long user name removed (example: BBBBBemmaBBBBB@gmail vs. BBBBBemaBBBBB@gmail).
  4. A did not notice the difference and sent the payment to C. B said no payment was received. C asks for payment tracking number and asks for additional money.
  5. When investigating, B has re-sent original invoice to A. This time it reached A (first time) and A found it is different from invoice by C. Forwarded (re-sent) message from B also contains text header showing original sending timestamp, but this is weak proof.)

Is B and C the same person, playing double role? Or is there another possible explanation how C could stop sent invoice from B and deliver modified one instead?

Both e-mail providers are large public freemails, so I cannot imagine how step 3 could happen if B was telling the truth (if person B is not C).

(Additional question: what can be done/checked about that?)

  • Mimicking email addresses is entirely possible, one mechanism that is already in place in a lot of email clients is reply chains / threads. While this is almost certainly done because grouping replies together makes sense, it would also mitigate this risk as well. Email as a protocol was never made to be secure, relying on it for sensitive matters is not a good idea. – Seth M. Larson Feb 5 '16 at 16:55
  • It could be a 3rd-party and there's no way to tell. If your friend paid with credit card, they should contact the card provider to explain the fraud. – Neil Smithline Feb 5 '16 at 16:56
  • @NeilSmithline – bout how could 3rd-party break into e-mail communication of two large-scale e-mail services? In other words, can 3rd party intercept e-mail going between e.g. gmail.com and hotmail.com? – miroxlav Feb 5 '16 at 17:01
  • 1
    A weak password on your friends account could allow an attacker (C) to login, see the invoice and perform the fraud. – wireghoul Feb 5 '16 at 20:26
  • 1
    C Could have compromised A's account and simply retrieved and deleted the original invoice, created a clone invoice, and sent it from a bogus email account. – user1751825 Feb 5 '16 at 22:10
up vote 1 down vote accepted

Plenty of things could have happened.

To start with, emails which are not digitally signed cannot be trusted:

  • they can be tampered with in transit (not very likely when the exchange is between two large providers)
  • the sender can simply fake the email (such an email may not be accepted by the recipient's system and one could check the path it took to reach it (if the headers were available, which is usually not the case with webmail providers))

So we do not know who sent which email (B, C or someone else). This is not interesting enough for an authority (police or other) to get involved so the hope to find out is close to none.

Now the sending itself: we do not know whether B's account is secure. Maybe C got access to it. From there on he can do plenty of things, including catching outgoing emails, redirecting incoming ones etc.

So to summarize: we do not know what happened and will not know, even by looking closely (especially if this is webmail from larger providers). The only reasonable thing which B can do is to change his credentials and review his filters (in the webmail system). And your friend to use an escrow system for payments, if available.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.