213 votes

Someone is using my (or has the same) email

Is it a scam? First of all, make sure that you actually got the letter from a court. This might very well be a scam - it sure sounds like one. Do this to verify that the letter is real: Make sure ...
Anders's user avatar
  • 65.2k
186 votes
Accepted

Why do phishing e-mails use faked e-mail addresses instead of the real one?

While one could create a mail with @amazon.com as SMTP envelope and/or From field of the mail header, the mail would likely be blocked since this domain is protected with Sender Policy Framework (SPF),...
Steffen Ullrich's user avatar
145 votes

Someone is using my (or has the same) email

(Assuming US) No court is going to pre-emptively demand a settlement of $20K for a misdemeanor(!!!) before you've even had a chance to testify. Furthermore, threats are a criminal matter; this isn't a ...
Ivan's user avatar
  • 6,338
102 votes
Accepted

Email received regarding Security flaw in website

TL;DR: It's probably well-intentioned and not a scam, but just poorly written. I don't know of any kind of scam that would be based on this. Certainly there have been attempts to extort website ...
David's user avatar
  • 16k
62 votes
Accepted

Reply to potentially spoofed email

You are focused on the person existing and not the account. Consider that Eve exists, did not send the email, but someone with access to her account did, and has entered an email rule to prevent your ...
schroeder's user avatar
  • 127k
58 votes
Accepted

Is it possible to fake 'received' field in the e-mail?

It is possible to add arbitrary fields to the mail and this includes Received headers. But, any proper mail transport server will add a new Received header on top of the mail which means that, ...
Steffen Ullrich's user avatar
35 votes

Email received regarding Security flaw in website

Does not appear to be a scam, though it might be a type of mass-mailing due to lack of details. Maybe some guy needs money, runs Nessus on a bunch of sites and is now angling for a small reward from ...
Tom's user avatar
  • 10.2k
31 votes

Can an email be doctored to appear from a different sender on an earlier date?

Yes, there are a bunch of different ways to forge emails. Almost the entire contents of the email your receive is sent as data over SMTP, and as such, the headers are just as forgeable as the body: ...
bk2204's user avatar
  • 9,194
30 votes
Accepted

"Undelivered Mail" I never sent (after registration on website)

It looks like the web service in question has configured their system to forward the welcome emails to an internal address on their end, but misconfigured their system such that the From: line is the ...
AJAr's user avatar
  • 2,372
27 votes

Reply to potentially spoofed email

If you don't know Eve, I see no reason to follow up. If you do business with the company she claims to represent, you could reach out to a regular contact you use at that business. Don't try to engage ...
Adam Katz's user avatar
  • 10.8k
26 votes
Accepted

Why would PayPal send messages from another domain?

Should the practice of sending messages from somecompany.com using anothercompany.com become established, it will be virtually impossible to us users telling if a website is legit or a scam. ...
Mark Beadles's user avatar
  • 3,982
24 votes

I received an "Undelivered Mail", is my email address used maliciously?

In addition to @SteffenUllrich, you might also want to double check the headers of the attached mail. In particular, pay a lot of attention to the Received: from header (well.. the header is just ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
23 votes

Why do phishing e-mails use faked e-mail addresses instead of the real one?

To complement Steffen Ullrich's answer, note that: Historically, it was indeed possible to spoof anything you wanted, no one checked, everybody trusted everybody. However, with the rise of spam, ...
jcaron's user avatar
  • 3,585
21 votes

How do I investigate where personal information in a fraudulent email was leaked from?

This could be related to almost anything, personal information are sold just like any other "things" on the darkweb and even on the "web" by relatively legal entities, Databrokers are selling personal ...
Soufiane Tahiri's user avatar
19 votes

Somebody is spoofing my email to send spam messages, and I have no idea how to block

I have now added this : v=spf1 include:_spf.google.com ~all The ~all at the end just causes a soft fail, that is that mail will still be delivered. If you want to have a permanent fail use -all. Of ...
Steffen Ullrich's user avatar
18 votes

Email received regarding Security flaw in website

This is called fear marketing or fear appeal. It's a marketing method that uses fear as the trigger for action. https://en.wikipedia.org/wiki/Fear_appeal The email contains the 3 basic stages of ...
Reactgular's user avatar
17 votes

Why do phishing e-mails use faked e-mail addresses instead of the real one?

The phisher may be hoping to get any replies to send to that address. They are trying to avoid the various frameworks that exist to prevent spoofed "from" fields from being perceived as authentic by a ...
ShapeOfMatter's user avatar
17 votes
Accepted

How Concerning Is This X-CU-modified: FAKECU Text Attack?

From my understanding the message originally tried to fool the user into clicking some seemingly expected link (as shown in the text) which in reality is a different link (href attribute in the actual ...
Steffen Ullrich's user avatar
16 votes

Someone is using my (or has the same) email

Given the additional information in comments, I have a gmail account and use Mac. He wants to delete evidence. He used the original one, edited it, printed it, presented to his lawyer and deleted the ...
Andrew Leach's user avatar
16 votes

Can an email be doctored to appear from a different sender on an earlier date?

Existing answers are correct, but incomplete. I would like to highlight two other scenarios. First, about SMTP. Under some conditions, someone can connect directly to the final SMTP server and deliver ...
user1532080's user avatar
14 votes

Security of SPF vs SPF and DKIM in email

What benefit would DKIM provide if SPF is already used? If a domain has SPF configured the receiving mail server can check if the claimed sender of the mail according to the SMTP dialog (i.e. MAIL ...
Steffen Ullrich's user avatar
13 votes
Accepted

Got a spam mail with an htm attachment, is the script harmful?

What is it? I decoded your "garbage." This is base64 encoding, and is far too large to place here. Here's the decoded result: http://pastebin.com/NBV4iY2s This seems to be an attachment of login ...
Mark Buffalo's user avatar
  • 22.6k
11 votes
Accepted

I'm getting spam e-mail...from myself?

SMTP messages have a host of header values that are used by mail servers (Qmail) and mail clients (Outlook, Gmail) for different things. It's possible your email was set as either the From or the ...
u2702's user avatar
  • 2,086
11 votes

Using email as individual validation

It is as easy to spoof the sender of the email as you can lie about the sender on the envelope of snail mail. It is also not only easy but heavily used: the majority of spam and phishing mails use ...
Steffen Ullrich's user avatar
11 votes
Accepted

Why don't banks sign their email using S/MIME?

It's usually a costs vs. benefits decision. Costs: Create your own CA infrastructure or buy a public certificate for each sender Teach employees how to use it Teach employees how not to use it, ...
Steffen Ullrich's user avatar
11 votes

Is it enough to look at the sender's email address?

Email is a very old plain-text protocol (dating from the 1970s/1980s). Anyone who controls a mail-server can send out mail from their mailserver using any return address (including ones at other ...
dr jimbob's user avatar
  • 39.2k
10 votes

How to create email that will fool DKIM verifier?

First, nice question. I've checked how Thunderbird behaves by modifying an existing mail and it actually takes the first headers for display of From, To and Subject while the DKIM signature mechanism ...
Steffen Ullrich's user avatar
10 votes
Accepted

Can DMARC's SPF alignment be spoofed?

Yes. SPF can be spoofed, but it's not easy. The only reliable ways to do it are with DNS hijacking (such as a MitM attack, which DNSSEC spoils) or with IP spoofing like BGP hijacking. Both of these ...
Adam Katz's user avatar
  • 10.8k
9 votes

Somebody is spoofing my email to send spam messages, and I have no idea how to block

From the mail it looks like they are sending from a google account, circumenting the SPF record.Misread the respective headers. It's not the case My recommendation would be to roll out DMARC and ...
tarleb's user avatar
  • 1,200
9 votes

Reply to potentially spoofed email

A long time ago when I was just out of short trousers and working my first gig as a system administrator I replied to a spam email asking them to stop spamming me. It turned out the FROM address was ...
symcbean's user avatar
  • 18.5k

Only top scored, non community-wiki answers of a minimum length are eligible