3

I recently bought a new domain name "familyname.net" and I redirect emails to this domain to my normal email address.
Recently I received various emails, one of which came from Groupon to confirm the purchase of some things. The user used an email address sarah@familyname.net
Groupon were useless in dealing with this, so I logged on to that account and asked it to send me a password, which they did. I then changed the password, but I noticed that the so-called user had a real name and had left her credit card details.
What is happening here?

closed as off-topic by Lucas Kauffman, Xander, schroeder, Steve, ThoriumBR May 31 '15 at 17:39

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Lucas Kauffman, Xander, schroeder, Steve, ThoriumBR
If this question can be reworded to fit the rules in the help center, please edit the question.

  • What's happening is that you just locked a real person out of their valid Groupon account. – schroeder May 29 '15 at 19:31
  • 1
    what do you mean by "valid". They used my email address. – Stuart May 30 '15 at 18:38
  • they had a valid Groupon account with their name and credit card details - perhaps they simply had a typo in the email address they used to sign up? It happens to me all the time. – schroeder May 30 '15 at 19:24
5

The user, intentionally or accidentally, likely left a mocked email address of which GroupOn did not validate. As a result, you were able to identify as the account holder because you were able to access the account's email. This is the users' problem for using mocked emails for their account and is a living example of why email verification is important.

  • Groupon seem very lax with validating accounts. I don't see how anyone would leave their credit card details on an account that they have no access to. – Stuart May 30 '15 at 18:39
  • @Stuart: All the reasons to learn from the story and not become them. :) – Unihedron May 30 '15 at 19:31
  • It's still going on today. I got an email from Groupon asking me to confirm my account. I did the same as the OP to access the account (recovered the account). There were no CC details, however, but the name of someone in a city different from mine. I chatted with the Groupon support mentioning it was fraud, and they very quickly (less than a minute) confirmed someone else did the account creation, and they disabled the account before I even asked. It seems they have a "workflow" for that in support :-) – Fuhrmanator Jun 11 '18 at 15:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.