How can I prevent my E-mail address from being used as the sender for fraudulent/scam messages?

Question

Recently, me and at least one other person I know received an obvious scam E-mail that starts off something like this:

We considered your resume to be very attractive and we thought the vacant position in our company could be interesting for you.

Our firm specializes in consultation services in the matter of bookkeeping and business administration. We cooperate with different countries and currently we have many clients in Europe. Due to this fact, we need to increase the number of our destination representatives' regular staff.

This was an obvious scam E-mail, as I don't live in Europe, and have not sent my Resume or CV to anyone recently. So I marked it as spam in Thunderbird and thought nothing more of it.

A week later (today), my inbox was deluged with about 15 E-mail "return to sender" failures over a span of about 20 minutes. The relevant part of an example "Mail delivery failed" message is (most of them are to the .hu domain):

------ This is a copy of the message, including all the headers. ------

Return-path: <[email protected]>
Received: from [202.70.75.205]
    by autofort1.autofort.hu for [email protected]
    id 1XQUZr-0004iq-6L; Sun, 07 Sep 2014 06:59:51 +0200
From: <[email protected]>
To: <[email protected]>

I immediately changed my mail password, just to be safe. Fortunately, I also use E-mail forwarders (aliases) for everything but personal E-mail traffic, so the listed E-mail originator ([email protected]) is actually a forwarder to [email protected], that I normally use for professional type E-mails. Still, I hate to delete ("burninate") this alias just because of some scam-email.

My E-mail account and domain account appear to still be secure, since they are using my forwarder, not my real address, and I checked my domain and all the settings still seem to be in order. So it's somewhat obvious they are using made-up or forged E-mail headers. Possibly related, I googled and found this fraud alert

Is there anything I can do to prevent them from tarnishing my good name (or E-mail address), besides just abandoning this alias/forwarder and shutting it down with a "return to sender" message on it? Is there any way to prevent this type of scam from re-using my E-mail address in this way in the future?

Answer 1

Is there anything I can do to prevent them from tarnishing my [...] E-mail address

In short: no. In general, you can't prevent anyone from using your email address and sending email on your behalf.

You can do a little something by using forwarders that adopt SPF. This means that to be able to send an email to me, pretending to be from you, someone would have to send that email through one of the permitted senders for your email domain. Otherwise, in seeing an email from [email protected], my mail server would think, "Hmmm, this email is from psalm33.ogr, so it should come to me courtesy of mail.psalm33.ogr, and instead it comes from a whorefarm in North Nowherestan..." and reject the email as forged.

And if someone sent to mail.psalm33.ogr an email pretending to be from you, that server being your own server, it should be able to verify the authentication information, and drop the email if it did not come from the approved sender.

But all this relies on my server doing checks. Mine does. Many others do not. Also, some SPF checks are more cursory than others, some SPF records are poorly maintained or not strict enough so as to accommodate lazy administrators.

So in the end, there will still be lots of servers out there that will blithely accept any email from any Tom, Dick or Harry pretending to be you.

However, usually, should the need arise, you should be able to demonstrate that with all probability some email did not originate from you; the headers would show that quite clearly.

(In theory it's still remotely possible that someone would send a "deniable" email with his own authentic name but from a forged account, in order to be able to disown the email should the need arise; sort of like forging your own signature; but that's another, completely different scenario).

Another thing you can do, but not erga omnes, is to use cryptographic signatures. Then make it known to everyone you deal with that you do so, and any correspondence not cryptographically signed is to be considered forged. Again, this will not protect your reputation among strangers who never corresponded with you and do not know you sign your emails. On the other hand, possibly one's reputation among nameless strangers is of less concern.

Answer 2

You can't. The way the mail system is designed does not ensure that sender email addresses must be verified. The email system we used was originally designed for a closed environment where all the members of the network were known and trusted, security and verification of sender address was not a requirement. When the internet was created there was no forward thinking (at least none that was listened to at the time) of the consequences of the lack of security on basic services like email and DNS, hence service providers simply rolled out these systems with all their flaws.

On one hand the simplicity and low cost of implementation ensured that these services would be extremely successful with billions of users, on the other hand it means we are now living with the negative aspects, and one of those is that people can send an email with any email address they like.

Answer 3

No. Anyone can claim to send mail from any address. A spammer can easily put your email address in the return-to and from email fields, thereby spoofing your email address.

How to fix this? Use methods of social pressure. Complain to the ISP that provides Internet service to the spammers. Very often these spammers are located out of the country complicating your attempts to shut them down. Consider hiring a lawyer and suing the spammers. Consider reporting the spammers to the various responsible governments.

Good luck.