38

Someone is claiming to have sent me an email to my Hotmail account. I never received this email. They have forged an Outlook email showing the date and time that it was sent. How can I prove that their claim is forged?

Improve this question
9
  • 49
    How do you know they forged it?
    – TTT
    Sep 23, 2016 at 14:58
  • 5
    You didn't mention which email provider is used by the sender.
    – Lukas
    Sep 23, 2016 at 15:00
  • 37
    You already think it's forged, and you aren't going to change their mind about what they did either way, so why do you care? To whom are you trying to prove it? And what are their standards of proof? And why will they side with the other person in a your-word-against-mine argument? (And how do you know someone isn't accessing your Hotmail and deleting your email before you read it?)
    – TessellatingHeckler
    Sep 23, 2016 at 18:52
  • 17
    I think you are in the "proving a negative" problem. You would have to get their email provider to show proof in their logs that matches the user's proof.
    – schroeder ♦
    Sep 23, 2016 at 19:02
  • 18
    Remind "someone" that email doesn't provide any delivery guarantees or reliable proof-of-delivery mechanisms whatsoever.
    – Robert Harvey
    Sep 23, 2016 at 20:11

12 Answers 12

Reset to default
73

The SMTP logs of Hotmail, their provider or any trusted third-party involved in delivering the email could confirm if their servers did or did not process it. (There is no guarantee that logs are available and likely you won't be given that information without a court order.)

But either way you won't be able to prove that they forged it. That's because there are plenty of ways an e-mail can get lost. It might very well be an accident and from their point of view it's equally hard to prove that the email has actually been sent.

Improve this answer
9
  • 2
    "you will not be able to prove that they forged it." ...unless it's a bad forgery (most forgeries are). Sometimes you can zoom into a doctored screenshot with photoshop and show clearly that the fonts don't quite match, or something.
    – MGOwen
    Sep 24, 2016 at 2:20
  • 14
    @MGOwen True, but the easy way is to just open the DOM inspector and start modifying the page to whatever you want it to say (though not every forger will necessarily be aware of that option). I think it would be very difficult to prove it was a forgery in that case.
    – Nateowami
    Sep 24, 2016 at 4:05
  • 1
    There are tools that can detect manipulated images. google.com/search?q=detect+photoshopped+image
    – R891
    Sep 25, 2016 at 2:50
  • 2
    @Josh I'd propose to edit the date in the downloaded raw email file. No need to deal with image manipulation.
    – Arminius
    Sep 25, 2016 at 3:14
  • 1
    Please note you will likely have to subpoena this to get it.
    – Joshua
    Sep 25, 2016 at 15:31
24

It is like with snail mail: you cannot prove that somebody did not send something to you. It might have been that the message was send but got lost. Or in the case of e-mail you might have accidently deleted the message, it might have been marked as spam or the mail server might have dropped it because it looked too much like spam or because of malfunctions at the server.

Improve this answer
6
  • 2
    Yep, many mail systems are overzealous in deleting (or at least "quarantining") "spam".
    – Hot Licks
    Sep 23, 2016 at 18:41
  • If the sender's mail provider logs all outgoing messages that are uploaded to it, and you can get access to those logs, and you can trust that those logs are unaltered & complete in recording all sent emails, and those logs show no record of the supposedly sent email, then you could probably demonstrate that a given message was never sent to a reasonable degree of likelihood. But that's a lot of "ifs".
    – mostlyinformed
    Sep 23, 2016 at 20:25
  • 4
    @halfinformed: and the chance of getting these logs from Microsoft (i.e. hotmail) is probably zero unless you can convince a lawyer to get issue a warrant to get access to these data. And even if the message is not included in the logs you have no prove that it did not get send because the sender might have used a different server for delivery.
    – Steffen Ullrich
    Sep 23, 2016 at 20:42
  • @Steffen Ullrich I don't think that the snail-mail analogy is good. With snail-mail, you can indeed get proof that at least something was sent. In fact, you can even request a proof that the envelope was delivered to the recipient.
    – AndrejaKo
    Sep 25, 2016 at 10:29
  • @AndrejaKo You can also request such "proof" from email, it is just that most people don’t. (it is called DSN, Delivery Status Notification, e.g. in the Postfix documentation) Typically, it includes the message from the destination server where the destination server acknowledges reception of the message. That would at least prove that you sent it and that the destination system has accepted it; it is still possible for the destination to silently drop the mail though. In the absence of any digital signatures it is of course pretty forgeable.
    – Jonas Schäfer
    Sep 25, 2016 at 10:42
8

It sounds like you are having or considering a legal dispute. I very much doubt that there is any legal regime in which an ordinary, vanilla, email message satisfies any legal or contractual obligation relative to official notice of anything. Thus, it doesn't really matter if they typed it in and pressed send, or not. If they claim that they officially notified you of something, they are just wrong.

Improve this answer
1
  • 1
    My thoughts exactly. And in this case he should be doing better than to ask the opinion of random stranges in the net. Stack is awesome, but not for legal issues. Worse yet if it is some kind of collection agent shenanigans at work.
    – Mindwin Remember Monica
    Sep 23, 2016 at 19:12
8

The analogy between emails and postcards not only works with respect to privacy, but also with respect to reliability: Most of the time they get to their recipient, but there never is proof. Nor can anyone prove they sent a postcard/email. Email alone is simply not capable of being used for legally bound communication. It is even easier to fake than postcards (until digital signatures are involved).

Improve this answer
6
  • 1
    But even with digital signatures (or encryption), the answer to the titular question does not change.
    – gerrit
    Sep 23, 2016 at 18:54
  • @gerrit Indeed, that's why I put that in parentheses.
    – Tobias Kienzler
    Sep 23, 2016 at 19:07
  • 1
    Email used to have really good reliability before spam filters. I remember it having better reliability than post mail.
    – Joshua
    Sep 25, 2016 at 15:32
  • @Joshua Indeed, though not only spam filters are to blame but spam itself, causing heavy additional traffic which sometimes is too much for some mail servers... Nonetheless, email is just as inadequate for legal binding as are postcards, which is why e.g. why only banking only notifies you of new messages but not of the message's content itself.
    – Tobias Kienzler
    Sep 26, 2016 at 7:18
  • 1
    "Email alone is simply not capable of being used for legally bound communication." : Do you mean "legally binding communication"? Because if so, you are simply wrong. In England and Wales emails are treated as "writing", and can be legally binding. We don't require absolute reliability or unforgability in paper letters, and we don't require them in emails either.
    – Martin Bonner supports Monica
    Sep 26, 2016 at 11:18
7

Mail just gets lost, it happens. The original SMTP protocol argues that in case a relay cannot forward mail it shall do a best effort to notify the sender. But thanks to the amount of spam today, not even this is followed since it would allow spammers to scan for valid email addresses.

As far as mail tracing is possible the sender (the guy who argues that has sent an email to you) can prove that their email left their MTA and arrived at the next hop. He can do it by providing logs from their MTA. For example, my postfix sending email to someone at google would log this (all on a single line):

Sep 20 00:30:22 orion postfix/smtp[5074]: AC9A7C5F: to=<***@***.com>,
relay=smtp.gmail.com[74.125.206.109]:587,
delay=1.5, delays=0.02/0.04/0.44/1, dsn=2.0.0,
status=sent (250 2.0.0 OK 1474341452 u185sm18955035amu.20 - gsmtp)

This means that gmail accepted this message. Of course, such a log can be forged, it is just a piece of text that belongs to the guys that wants to prove that the email was sent.

But now that ball is in gmail (or hotmail's, as in your case) court since they should log that that email was accepted by their server. It may not be easy to get those logs from hotmail (or gmail), it is unlikely that they would want to give them for free or without a judicial order.

In summary, it is possible to track what happened to an email based on MTA logs. But that requires access to all mail relays that the mail went through (and a good deal of resources to achieve that). It is like with the snail mail analogy: you can go around all the streets that the postman went through and ask people in their residences whether the postman passed through the street in the last week. But just like with people you may be unlucky and someone may not want to talk to you or have forgotten (erased the MTA logs).

Improve this answer
4
  • Actually, logs can also be forged.
    – WGroleau
    Sep 23, 2016 at 19:11
  • 3
    @WGroleau - Yeah, MTA logs from someone willing to prove something are very likely to be forged. But hotmail would not give out forged incoming mail logs (assuming that they actually would give you that), the liability of that (if proved) would be huge.
    – grochmal
    Sep 23, 2016 at 19:37
  • Does this mean mail is not sent via TCP/IP? Is it sent via UDP? (I am a networking noob, not sure if this question makes much sense.) I am just wondering, since TCP/IP detects packet loss and guarantees delivery/awareness of failure.
    – HC_
    Sep 23, 2016 at 23:28
  • @HC_ - Ehmm... nope. It is all pretty much TCP/IP. Mail goes through SMTP most of the time (and through POP3 or IMAP in the other cases), all those protocols run over TCP and over IP. IP is on OSI layer 3, TCP is layer 4 and SMTP is layer 5 or 6 (depending on implementation/interpretation).
    – grochmal
    Sep 24, 2016 at 1:23
6

To show an sent e-mail is by no means proof that the person received it for several reasons.

  1. May be a forgery. Most email clients allow printing the unsent email in the outbox as if was actually sent.
  2. The email could be lost in the the way. Any server between your accuser and yours may have misplaced the email.
  3. Hotmail could have swallowed the e-mail. Hotmail is not nearly flawless.
  4. It can have be marked as spam. Anti spam software is not as intelligent as we want.
  5. You can have deleted it without reading it. It can happen with anyone.

There is many things to go wrong. That is why sending a single email without asking for confirmation is the weakest of the evidences.

As someone said you can contact Hotmail asking for the confirmation, but usually this is an overkill. Just state that you did not received it, that should got lost between their server and Hotmail or flagged by hotmail as spam. Ask to be sent again to see if you will receive the next one.

If they are charging you without reiteration or trying to contact you some other way they are excessive in my opinion.

Improve this answer
3

You haven't indicated what this proof of sending is about and so we can't comment on the risks and impacts.

However, just to be very clear. Showing you some text does not constitute "proof" in any way. So if there are legal implications you can simply say thanks politely and state that you did not receive it, you've checked your spam folder & searched. And state that the "evidence" cannot be accepted as proof.

If this were important, the sender should have asked for a receipt in the form of a return email. If they didn't get that, they should have sent a registered letter, e.g. one that requires your signature as proof of delivery.

As a little historical light relief, this is exactly what FAX was good for as it was established that the FAX receipt was suitable legal proof that the FAX was received. Most Email systems do not have this level of proof built in though X.400 systems can do so.

Improve this answer
1

Another factor here: I have had trouble with Hotmail swallowing email from certain domains. I've never seen it do it to a big guy, but with amateurs in charge, or with ISPs in China it can be a problem. I think it's a matter of being automatically dumped if the sending server isn't configured perfectly. (DNS records matching the server, the incoming mail coming from the IP that the records say it should come from.)

Whitelisting such a sender does nothing to avoid this and the offending messages simply vanish, they don't go to spam. The sender is not notified of the failure.

Perhaps the offending message vanished this way.

Improve this answer
-1

Proof must come from both sides. The sender must prove they sent you one. In the sender email's server, an administrator can prove an email went out by the header information in the email, and it went to the right email address and email server. Once that is proven, the receiver server admin can check what happened on the receiving end. There will be information in the email header information on where it went, why it was rejected, or that it's waiting to be received, it will also show if it was delivered to your mailbox.

Improve this answer
-2

If your system did not receive the mail, there is no real evidence to support this.

Possibly have the sending user verify the email sent successfully through their logs.

Improve this answer
1
  • 4
    Logs can be spoofed, and if not, provide no evidence of successful delivery-- only successful sending.
    – Ivan
    Sep 23, 2016 at 16:06
-3

You probably did receive it -in the spam section.

Try to send them a screenshot of the emails (be careful with your information) you received that day or date & time with the same way they did.

Improve this answer
1
  • 2
    unless they, too, believe any evidence was faked ... the question is about how to prove the lack of sending, not the lack of receiving
    – schroeder ♦
    Sep 23, 2016 at 20:07
-3

Very simple, if the e-mail was that important it should have being sent to you with a delivery and read receipt, ask them for those receipt as the proof for the e-mail going out. If an e-mail is that important, we don't send it without those receipts precisely to proof it was sent.

Good Luck...!!!

Improve this answer
3
  • This does not provide an answer. What do you even call email receipts? (and for sec.Se purposes, how are they implemented)
    – grochmal
    Sep 24, 2016 at 13:51
  • 1
    Requests for read reciepts for e-mail are also just that, requests. The MUA is perfectly within its rights to not send a read receipt for any of a number of reasons, everything from the user opting out of sending one to the MUA not supporting that functionality.
    – user
    Sep 24, 2016 at 17:08
  • Does Hotmail provide read receipts? I think this answer has limited applicability.
    – schroeder ♦
    Sep 24, 2016 at 18:08

Not the answer you're looking for? Browse other questions tagged .