3

I have a friend who has been getting quite a lot of traffic to his personal email account that is not his activity. This would include someone in California requesting auto insurance quotes. This would include someone in Minnesota requesting free tickets to an event. And the prompt for this question, in the last month or so, several people (half a dozen or so) making online purchases and using his email as their contact information. My friend has been reaching out to the companies to tell them that the email they are using does not belong to that person.

At least one of the 'customers' has ordered, then attempted to cancel, and the company said cancelling was impossible because the order had already shipped, which made us think that this was the scam. However, a little snooping (because we had the customer's name and address) showed that it was a real address and said customer's name is tied to the property record for the address -- in short, seems like the worst way to execute a scam of some sort using your real contact information.

My friend has been closely monitoring his credit reports and accounts. There is no evidence that any of these people have access to any real information to attempt some kind of identity theft.

So, this is why I am here. Apart from getting some annoying emails that aren't really for him, given the scenario I laid out above, is there any risk to my friend that we're overlooking? As I wrote in the title, it feels very scammy in some way, but we just don't understand how simply directing emails to a different account allows anything untoward to occur.

I would appreciate any thoughts this community has here and thanks in advance.

p.s. The email he's using is two common-ish words on a fairly ubiquitous service, and well, I think we all have a throw-away email when a web form requires something (I hereby publicly apologize if I have been doing this same annoyance to a real person at [email protected]). Just moving emails would be a significant hassle as he has had this same one for 15+ years now. Furthermore, as above, it is not just spam going to the email, but what appears to be mostly legitimate business -- just initiated by someone else using his email.

9
  • 2
    FWIW the same thing has happened to me, although at a slower rate.
    – Ben Voigt
    Jun 7, 2021 at 14:51
  • 3
    There is a Mike Harvey in Florida, and I used to know all about his videos rentals and a loan he tookout to buy furniture. Jun 7, 2021 at 14:53
  • 2
    I think I had a similar experience - money.stackexchange.com/questions/110531/… . My circumstances are similar to your friend in that the emails were for someone with a similar or same name on a major email service. My brother has received similar messages with FIRSTINITIAL.MIDDLEINITIAL.LASTNAME for completely different people. The common cause seems to be people not actually knowing their own email address or it being transcribed improperly.
    – Freiheit
    Jun 7, 2021 at 15:49
  • 2
    Are you sure it is different people using the same email address, or at least, someone pretending to have different names using the same email address?
    – TTT
    Jun 7, 2021 at 18:04
  • 2
    @R.Hamilton Agreed! However, at least in the case of insurance quotes, many of those systems request an email, and after you provide it, they show you the quotes on the page. (The email requirement turns out to be just for their own marketing purposes.) So what matters is whether the person thinks the email is actually going to be used, instead of whether or not it actually is used. I suppose many could fall into that category, but perhaps not all. For requesting tickets via email, that seems pretty obvious that you would need access to the email account, I think.
    – TTT
    Jun 7, 2021 at 18:35

3 Answers 3

6

It could be a mistaken email address, it could be a scam attempt: without studying the emails in more detail it would be difficult to tell with any certainty.

If it is an attempted scam, the two common techniques are (a) include an infected attachment ("Thank you for your order of $1,232. Open the attached invoice for full details."), or (b) try to direct you to a fake website to get you to enter personal details ("Your order for $1,232 is being processed. Visit scammer.example.com if you need to amend or cancel."). Of course, the true destination would be disguised to look "real".

Therefore, whatever else your friend does, they should not open any attachments, and not follow any links in the emails. If they were to follow-up in any way, they should find independent ways of contacting the companies that apparently sent the emails.


Regarding:

However, a little snooping (because we had the customer's name and address) showed that it was a real address and said customer's name is tied to the property record for the address -- in short, seems like the worst way to execute a scam of some sort using your real contact information.

If it is a scam, the address wouldn't be that of the scammers (unless they were very stupid). They would pick a random real address (very possibly an earlier victim) so that if anyone does do some digging, it will look legitimate, thus increasing the chance that the recipient will open an attachment or follow a phoney link.


From a comment:

however why would one do that if one were to request insurance quotes? Or asking for tickets to be emailed to you? Or make an online order and I would assume expect the tracking information to be mailed to you when your order ships? Why give out a fake email address when one can more than reasonably assume that one will be contacted and given useful/requested information via email? This is what has us baffled.

If these are genuine emails from the companies they purport to come from, then as TTT says in a comment, then – for things like insurance quotes, at least – people might give a false email address just so that they're not added to a marketing database just for making an inquiry. (But, as you point out, there are many cases where using a false email address doesn't make sense).

However, if they are some kind of scam email, this doesn't matter. It's almost certain that the emails won't be coming from the companies they appear to... it won't be a scammer trying to place an order with Walmart using your friend's email address and trying to scam either them or Walmart. Instead, it will be a scammer sending fake emails that look like they come from Walmart etc., in the hope that the recipient will open an attachment or follow a link.

My personal inclination, based on what's in the question, would be to just delete and ignore the emails.

2
  • There aren't any attachments to the emails, the emails are orders and correspondence from real companies. We're talking WalMart, Lowe's, and similar. Someone is placing orders with these companies, with valid cc numbers and addresses and the like. Just using my friend's email address. It does appear that at least twice now, said someone has tried to cancel the order right after it was processed, but the company said it was too late as the parcel was already on its way. But then I'm back to real names and addresses -- again, seems a really poor way to orchestrate a scam. Jun 8, 2021 at 13:19
  • @R.Hamilton As I said, it's entirely possible these emails aren't scams. I was simply pointing out one reason why they might use real names/addresses if they were scams. Also, just because the emails appear to come from Walmart etc. doesn't mean they actually did.
    – TripeHound
    Jun 8, 2021 at 14:11
3

I think the issue might be that your friend has an email that is very close to other peoples' and it is being misspelled when those people enter their email addresses.

This doesn't sound like a scam of any kind, or anything untoward. Just a common honest mistake.

1
  • This is a possibility, but without disclosing his actual email address, I would find this unlikely. Not impossible. Just doesn't seem probably given his email address and the frequency. Jun 8, 2021 at 13:16
2

I would suggest two possibilities, in addition to those already mentioned.

First one: there could be a serious problem here, completely not scam related. If your friend has ever done business with the company in question, he may have given his email address as the email to use for that business. All fine so far. But now the company is sending things to it, for no obvious reason. That screams the possibility of their database having been corrupted.

Corrupted at the minimum to the point that emails in it are no longer valid. That some emails are now linked to customers they were never part of, and their own emails are no longer linked to anything. Or are corrupted to be linked to a third customer. So... "orphaned" or "living with the wrong family."

If so, one must wonder what else got corrupted. Was it just email address links? Relational databases can be complex, very fine-grained, so quite possibly, even if some untoward event whacked the database. But it could be far broader. The records could have a LOT of jumbling and your friend's information could be going out into the world for unfortunate effect. Or even if so, it might not matter much, to him or anyone. Especially if he does not current business with the company. So even if the "unfortunate events" involved hacking and stealing data or just damaging it for fun or profit, he may not care.

Second one: I can surely see how a company, or fraudster, could use the approach for a scam.

We've all gotten the kind of email mentioned elsewhere, the "You have successfully paid $1,232.04 for your new iPhone ... blah blah ... If you think there was an error in the payment or the transaction is not yours, click the button above to have it removed" kind. Easily recognized as fraud and one would never click the button. (Sadly, many DO click "in" the email, on whitespace, to further investigate things, see links, and so on, only to find the whole thing, whitespace and all, is "the real button" and they've already activated the HTML file that will begin the hosing. Peeps need to move such to Junk Mail and then look at it, or forgo the learning process altogether. After all, one can lead a rich life never examining a violent mugging-gone-bad by being the victim.)

So, those must have a very low rate of pay for scammers. And this matters because those scum often work as long and hard at it as a human being does at a real job. I listened to a fellow in Hungary once complaining about how little he makes for averaging six hours a day after his day job. It's a grind and like anyone with a brain, they want more for any given amount of work. So how to raise the number of clicks on "the button"? One way would be to engage the person BEFORE his brain sees the fraud and runs down that path. What if one got the brain to see the "oh no, someone's facing unhappiness for this and all I have to do to help out is click here, write a couple sentences, and all will be better and I'll have been a good boy!"... and his brain heads down that path, never to examine the fraud thought again. (Or, once in a while, like your friend, maybe he does. But maybe long after he "was a good boy.")

And so the click. Whether this installs the encryption and monitoring software that lets the scum really encrypt your storage and monitor your camera and the porn sites, er-r-r, websites you visit and what you are doing whilst at them, or just leads to a (probably pretty apparently fraud related) place to let them know they mixed up their emails and whatever (maybe scammy) future that leads to... Or simply leads to a website where you might end up looking about "as long as you're there" or maybe because now that they have you there, they tell you you can have a "15% discount on any purchase today" as a reward for your helpfulness (not as "compensation" for it as that generates a very different "mouthfeel" (as chef's often say) when reading it).

Even the last is actually scammy because they were just using the fake, though real-looking mishap, to generate "foot traffic" on the site for sales, or even as a middleman being paid to generate clicks to the site. Consider that I do this. I send you one of the emails that goes on about errors on your website and you curse at me, then delete it. I send you a few more, as different people. All deleted. So I change up my campaign. I send SEO emails: "I can help you, and you don't pay unless I generate clicks!" What you assume is I do something in some magical way like Google might. In truth, I set up this scam to get folks to MY website, then they read how helpful they were, what good people they are, and about the 15% discount (which you have authorized me to offer folks... after all, you offer 15% yourself all the time for the same reason, a first sale to someone). My page is set up to look like yours: I just go to the appropriate-looking place, save your page, then regenerate it as input to my site, and my hacking software pulls all the logos and format, but inserts the necessary text to make it look like you were a good boy (remember, my customer knows nothing of this happening, I'm faking a web page to just look like it's one of theirs), and when you click to go search their products, it really takes you there to do so. So I have filled my bargain with them, generated a real click by someone with a discount they will honor... but in about the scummiest way one might do so.

Might've tried a few other things with your click to go search products, but I might not want their effects (maybe window pop up and you kill the whole browser instance instantly) to lose my click-fee. Of course, in a year or two (or ten as this is a low impact fraud and might take long to be recognized and joked about enough to become widely known) when the scam doesn't generate much... signing up websites is hard to achieve... I might still do it without click-fee customers, but rather whatever I can pack in, maybe some of that encrypt and monitor software, maybe just 200 pop ups, maybe install a couple ad-blockers on you and collect fees from those scum. But for now, maybe it's sort of honest in the sense of while the way I got you there is utterly unethical and scummy, you make a real decision to buy, o not, something due to the 15% discount (and the bump up in things like cortisol ad endorphins I achieved with my fraudulent "I'm a good boy!" scam pushing you further than your original mental state would have).

And of course, to paraphrase (a lot, really a lot) Clifford Irving when he pointed out to the Guinness Book of World Records that his number one fraudster of all time (having specified a list of tenth to second already) was "Mr. X" who by definition got cleanly away with his fraud, there could be a hundred or a thousand other scams I simply can't or haven't thought of that are the real case.

Or none at all. (See, for one way of such, the first thought presented.)

1
  • I appreciate the response even to an old post like this and I don't understand why it was getting downvotes. I have but one upvote to give, so I did so. What you wrote is good info how phishers do work today to try to find someone live on the other end and certainly a possibility. I do think my friend was careful about not clicking links in the email itself and confirming the orders directly on the retailer's own sites, so, this isn't the vector as near as we can tell. All that said, the rates of these emails is basically 0 today. Was a burst of them for 2-3 months and now nothing. Apr 24 at 15:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .