Is this a case of simple email spoofing or has my email account been compromised?

Question

I just arrived home and when got to my computer I checked my mail box and it was with a message coming from my own email address that was sent almost at the same time I got home.

I promptly identified it as bank scam, but it really worries me that it comes from my own address, so I'm just around an hour looking up the web how mail spoofing works and so and whether it's possible to forge an email address like this. After so many spams, it's a bit strange for me this one slipped through the spam filter, I guess because it's from my own address.

I checked my gmail account activity and it seems all fine, access solely from my cellphone and my macbook when I get home.

This is the email's source: http://pastebin.com/gj6J8CUb

Can anyone confirm whether it's most probably a simple spoof forging my email address or whether it's more potential that my account has been compromised?

None of the IPs in this message are from the range I use, they're all foreign.

Another question is, with such a bunch of authentication failings in the message as can be checked, how can the gmail spam filter let it go into my inbox?

Answer 1

TL;DR: Spoofing sender address is as simple as sending any other e-mail. It's a common practice for scammers to use your or any "reputable" e-mail address as the sender to make the scam look more trustworthy. The timing is likely a coincidence, the mail apparently went through gmail's servers so it must have been sent from the Internet.

Long version:

E-Mail works in many respects just like a regular postal service.

There are two unrelated use cases in using both mail and e-mail:

1. sending mail
2. receiving mail

Sending mail is the process of putting a message into an envelope, writing a sender and receiver address on it and giving it to a postal service to deliver. This same happens with e-mail. You can write whatever you want on the envelope and you don't even have to have a mailbox of your own to send a mail - you can just grab a paper and envelope at your local store, write whatever you want and then give it to the Post to deliver. This process usually ends by the postal service delivering the envelope to the specified mailbox. Again this is the same for regular post and e-mail.

Receiving mail is you opening your mailbox and getting all the mails in there to you for reading. You do the same when getting both paper mail and e-mail.

E-mail usually comes in a convenience package where these two separate use cases are bundled together. It's still just a bundle of two separate services, just nicely packaged to look the same.

What I miss here though is how did you receive the e-mail? If you read it through gmail's webmail interface, it's likely a scam. If you received it via some software mail client (such as Thunderbird), there is (always) a chance your computer is compromised but in this situation I'd bet on a simple scam anyway.

Answer 2

It is stupidly trivial to spoof an email address (I have a very small Python script that does this). It is a common tactic of spammers to use the target as the sender so it doesn't look obviously faked.

There are ways that your email provider could protect against this, but it's up to your provider.

Lesson learned: Always read the sender info.