38

Someone is claiming to have sent me an email to my Hotmail account. I never received this email. They have forged an Outlook email showing the date and time that it was sent. How can I prove that their claim is forged?

closed as off-topic by Xander, Bryan Field, D.W., Dmitry Grigoryev, Rory Alsop Sep 26 '16 at 16:40

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Xander, Bryan Field, Dmitry Grigoryev, Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 49
    How do you know they forged it? – TTT Sep 23 '16 at 14:58
  • 5
    You didn't mention which email provider is used by the sender. – Lukas Sep 23 '16 at 15:00
  • 37
    You already think it's forged, and you aren't going to change their mind about what they did either way, so why do you care? To whom are you trying to prove it? And what are their standards of proof? And why will they side with the other person in a your-word-against-mine argument? (And how do you know someone isn't accessing your Hotmail and deleting your email before you read it?) – TessellatingHeckler Sep 23 '16 at 18:52
  • 17
    I think you are in the "proving a negative" problem. You would have to get their email provider to show proof in their logs that matches the user's proof. – schroeder Sep 23 '16 at 19:02
  • 18
    Remind "someone" that email doesn't provide any delivery guarantees or reliable proof-of-delivery mechanisms whatsoever. – Robert Harvey Sep 23 '16 at 20:11

12 Answers 12

73

The SMTP logs of Hotmail, their provider or any trusted third-party involved in delivering the email could confirm if their servers did or did not process it. (There is no guarantee that logs are available and likely you won't be given that information without a court order.)

But either way you won't be able to prove that they forged it. That's because there are plenty of ways an e-mail can get lost. It might very well be an accident and from their point of view it's equally hard to prove that the email has actually been sent.

  • 2
    "you will not be able to prove that they forged it." ...unless it's a bad forgery (most forgeries are). Sometimes you can zoom into a doctored screenshot with photoshop and show clearly that the fonts don't quite match, or something. – MGOwen Sep 24 '16 at 2:20
  • 14
    @MGOwen True, but the easy way is to just open the DOM inspector and start modifying the page to whatever you want it to say (though not every forger will necessarily be aware of that option). I think it would be very difficult to prove it was a forgery in that case. – Nateowami Sep 24 '16 at 4:05
  • 1
    There are tools that can detect manipulated images. google.com/search?q=detect+photoshopped+image – Josh Sep 25 '16 at 2:50
  • 2
    @Josh I'd propose to edit the date in the downloaded raw email file. No need to deal with image manipulation. – Arminius Sep 25 '16 at 3:14
  • 1
    Please note you will likely have to subpoena this to get it. – Joshua Sep 25 '16 at 15:31
24

It is like with snail mail: you cannot prove that somebody did not send something to you. It might have been that the message was send but got lost. Or in the case of e-mail you might have accidently deleted the message, it might have been marked as spam or the mail server might have dropped it because it looked too much like spam or because of malfunctions at the server.

  • 2
    Yep, many mail systems are overzealous in deleting (or at least "quarantining") "spam". – Hot Licks Sep 23 '16 at 18:41
  • If the sender's mail provider logs all outgoing messages that are uploaded to it, and you can get access to those logs, and you can trust that those logs are unaltered & complete in recording all sent emails, and those logs show no record of the supposedly sent email, then you could probably demonstrate that a given message was never sent to a reasonable degree of likelihood. But that's a lot of "ifs". – mostlyinformed Sep 23 '16 at 20:25
  • 4
    @halfinformed: and the chance of getting these logs from Microsoft (i.e. hotmail) is probably zero unless you can convince a lawyer to get issue a warrant to get access to these data. And even if the message is not included in the logs you have no prove that it did not get send because the sender might have used a different server for delivery. – Steffen Ullrich Sep 23 '16 at 20:42
  • @Steffen Ullrich I don't think that the snail-mail analogy is good. With snail-mail, you can indeed get proof that at least something was sent. In fact, you can even request a proof that the envelope was delivered to the recipient. – AndrejaKo Sep 25 '16 at 10:29
  • @AndrejaKo You can also request such "proof" from email, it is just that most people don’t. (it is called DSN, Delivery Status Notification, e.g. in the Postfix documentation) Typically, it includes the message from the destination server where the destination server acknowledges reception of the message. That would at least prove that you sent it and that the destination system has accepted it; it is still possible for the destination to silently drop the mail though. In the absence of any digital signatures it is of course pretty forgeable. – Jonas Schäfer Sep 25 '16 at 10:42
8

It sounds like you are having or considering a legal dispute. I very much doubt that there is any legal regime in which an ordinary, vanilla, email message satisfies any legal or contractual obligation relative to official notice of anything. Thus, it doesn't really matter if they typed it in and pressed send, or not. If they claim that they officially notified you of something, they are just wrong.

  • 1
    My thoughts exactly. And in this case he should be doing better than to ask the opinion of random stranges in the net. Stack is awesome, but not for legal issues. Worse yet if it is some kind of collection agent shenanigans at work. – Mindwin Sep 23 '16 at 19:12
8

The analogy between emails and postcards not only works with respect to privacy, but also with respect to reliability: Most of the time they get to their recipient, but there never is proof. Nor can anyone prove they sent a postcard/email. Email alone is simply not capable of being used for legally bound communication. It is even easier to fake than postcards (until digital signatures are involved).

  • 1
    But even with digital signatures (or encryption), the answer to the titular question does not change. – gerrit Sep 23 '16 at 18:54
  • @gerrit Indeed, that's why I put that in parentheses. – Tobias Kienzler Sep 23 '16 at 19:07
  • 1
    Email used to have really good reliability before spam filters. I remember it having better reliability than post mail. – Joshua Sep 25 '16 at 15:32
  • @Joshua Indeed, though not only spam filters are to blame but spam itself, causing heavy additional traffic which sometimes is too much for some mail servers... Nonetheless, email is just as inadequate for legal binding as are postcards, which is why e.g. why only banking only notifies you of new messages but not of the message's content itself. – Tobias Kienzler Sep 26 '16 at 7:18
  • 1
    "Email alone is simply not capable of being used for legally bound communication." : Do you mean "legally binding communication"? Because if so, you are simply wrong. In England and Wales emails are treated as "writing", and can be legally binding. We don't require absolute reliability or unforgability in paper letters, and we don't require them in emails either. – Martin Bonner Sep 26 '16 at 11:18
7

Mail just gets lost, it happens. The original SMTP protocol argues that in case a relay cannot forward mail it shall do a best effort to notify the sender. But thanks to the amount of spam today, not even this is followed since it would allow spammers to scan for valid email addresses.

As far as mail tracing is possible the sender (the guy who argues that has sent an email to you) can prove that their email left their MTA and arrived at the next hop. He can do it by providing logs from their MTA. For example, my postfix sending email to someone at google would log this (all on a single line):

Sep 20 00:30:22 orion postfix/smtp[5074]: AC9A7C5F: to=<***@***.com>,
relay=smtp.gmail.com[74.125.206.109]:587,
delay=1.5, delays=0.02/0.04/0.44/1, dsn=2.0.0,
status=sent (250 2.0.0 OK 1474341452 u185sm18955035amu.20 - gsmtp)

This means that gmail accepted this message. Of course, such a log can be forged, it is just a piece of text that belongs to the guys that wants to prove that the email was sent.

But now that ball is in gmail (or hotmail's, as in your case) court since they should log that that email was accepted by their server. It may not be easy to get those logs from hotmail (or gmail), it is unlikely that they would want to give them for free or without a judicial order.

In summary, it is possible to track what happened to an email based on MTA logs. But that requires access to all mail relays that the mail went through (and a good deal of resources to achieve that). It is like with the snail mail analogy: you can go around all the streets that the postman went through and ask people in their residences whether the postman passed through the street in the last week. But just like with people you may be unlucky and someone may not want to talk to you or have forgotten (erased the MTA logs).

  • Actually, logs can also be forged. – WGroleau Sep 23 '16 at 19:11
  • 3
    @WGroleau - Yeah, MTA logs from someone willing to prove something are very likely to be forged. But hotmail would not give out forged incoming mail logs (assuming that they actually would give you that), the liability of that (if proved) would be huge. – grochmal Sep 23 '16 at 19:37
  • Does this mean mail is not sent via TCP/IP? Is it sent via UDP? (I am a networking noob, not sure if this question makes much sense.) I am just wondering, since TCP/IP detects packet loss and guarantees delivery/awareness of failure. – HC_ Sep 23 '16 at 23:28
  • @HC_ - Ehmm... nope. It is all pretty much TCP/IP. Mail goes through SMTP most of the time (and through POP3 or IMAP in the other cases), all those protocols run over TCP and over IP. IP is on OSI layer 3, TCP is layer 4 and SMTP is layer 5 or 6 (depending on implementation/interpretation). – grochmal Sep 24 '16 at 1:23
6

To show an sent e-mail is by no means proof that the person received it for several reasons.

  1. May be a forgery. Most email clients allow printing the unsent email in the outbox as if was actually sent.
  2. The email could be lost in the the way. Any server between your accuser and yours may have misplaced the email.
  3. Hotmail could have swallowed the e-mail. Hotmail is not nearly flawless.
  4. It can have be marked as spam. Anti spam software is not as intelligent as we want.
  5. You can have deleted it without reading it. It can happen with anyone.

There is many things to go wrong. That is why sending a single email without asking for confirmation is the weakest of the evidences.

As someone said you can contact Hotmail asking for the confirmation, but usually this is an overkill. Just state that you did not received it, that should got lost between their server and Hotmail or flagged by hotmail as spam. Ask to be sent again to see if you will receive the next one.

If they are charging you without reiteration or trying to contact you some other way they are excessive in my opinion.

3

You haven't indicated what this proof of sending is about and so we can't comment on the risks and impacts.

However, just to be very clear. Showing you some text does not constitute "proof" in any way. So if there are legal implications you can simply say thanks politely and state that you did not receive it, you've checked your spam folder & searched. And state that the "evidence" cannot be accepted as proof.

If this were important, the sender should have asked for a receipt in the form of a return email. If they didn't get that, they should have sent a registered letter, e.g. one that requires your signature as proof of delivery.

As a little historical light relief, this is exactly what FAX was good for as it was established that the FAX receipt was suitable legal proof that the FAX was received. Most Email systems do not have this level of proof built in though X.400 systems can do so.

1

Another factor here: I have had trouble with Hotmail swallowing email from certain domains. I've never seen it do it to a big guy, but with amateurs in charge, or with ISPs in China it can be a problem. I think it's a matter of being automatically dumped if the sending server isn't configured perfectly. (DNS records matching the server, the incoming mail coming from the IP that the records say it should come from.)

Whitelisting such a sender does nothing to avoid this and the offending messages simply vanish, they don't go to spam. The sender is not notified of the failure.

Perhaps the offending message vanished this way.

-1

Proof must come from both sides. The sender must prove they sent you one. In the sender email's server, an administrator can prove an email went out by the header information in the email, and it went to the right email address and email server. Once that is proven, the receiver server admin can check what happened on the receiving end. There will be information in the email header information on where it went, why it was rejected, or that it's waiting to be received, it will also show if it was delivered to your mailbox.

-2

If your system did not receive the mail, there is no real evidence to support this.

Possibly have the sending user verify the email sent successfully through their logs.

  • 4
    Logs can be spoofed, and if not, provide no evidence of successful delivery-- only successful sending. – Ivan Sep 23 '16 at 16:06
-3

You probably did receive it -in the spam section.

Try to send them a screenshot of the emails (be careful with your information) you received that day or date & time with the same way they did.

  • 2
    unless they, too, believe any evidence was faked ... the question is about how to prove the lack of sending, not the lack of receiving – schroeder Sep 23 '16 at 20:07
-3

Very simple, if the e-mail was that important it should have being sent to you with a delivery and read receipt, ask them for those receipt as the proof for the e-mail going out. If an e-mail is that important, we don't send it without those receipts precisely to proof it was sent.

Good Luck...!!!

  • This does not provide an answer. What do you even call email receipts? (and for sec.Se purposes, how are they implemented) – grochmal Sep 24 '16 at 13:51
  • 1
    Requests for read reciepts for e-mail are also just that, requests. The MUA is perfectly within its rights to not send a read receipt for any of a number of reasons, everything from the user opting out of sending one to the MUA not supporting that functionality. – a CVn Sep 24 '16 at 17:08
  • Does Hotmail provide read receipts? I think this answer has limited applicability. – schroeder Sep 24 '16 at 18:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.