6

I own a domain, which I will call example.com.

In June, I received an email, purporting to be from the Play Station Network, addresses to first.last@example.com. (I receive all the email for the domain. "First" and "Last" are distinctive names which are not my name.)

It was an account registration confirmation. I wasn't sure how anyone could have signed up as first.last@example.com, as it's my domain and most web sites require a confirmation link to be clicked.

I changed all my passwords, just in case.

first.last@example.com then opened a PayPal account and has been successfully sending small (~$10) payments to MicroSoft Payments and other vendors. No money has been stolen from me, yet, so I have no reason to involve the police.

I sent these emails to PayPal's fraud address, but I was ignored.

Today, I have received multiple emails from PayPal saying that "my" bank has declined payments. Once again, no money has been stolen from me.

What is going on? I am nervous that I am being targeted for a scam.

Thoughts:

  1. If they actually had access to my email account, they could have reset my passwords and stolen a few domains from me. This has not happened.

  2. Are any of the emails that I've received at first.last@example.com actually from the purported senders? They all seem to come through mail2world.com and have a open, red padlock in gmail.

  3. Who can I contact about this to have it stopped? PayPal do not respond. Should I contact the companies they've paid?

|improve this question
  • You may post bits of the question on stackoverflow or security.stackexchange. You can get insight into how it happened and technical stuff to prevent it. The money aspect of this are valid here. – Dheer Oct 10 '16 at 13:23
  • Before clicking on any link, just hover over the link and confirm where it is redirecting you to. That link should raise up alerts if it is diverting you to a shady web address. – DumbCoder Oct 10 '16 at 13:45
  • Is it possible to find out if the registration confirmation email came from a site that allows registration without verifying the email is valid? – TTT Oct 10 '16 at 18:35
  • 1
    Since you are the email address owner, you do have the ability to change the person's password and then login to their account. I don't recommend doing that because even though that would stop the usage of the account, you might be breaking some laws... – TTT Oct 10 '16 at 18:36
1

You've already done what's necessary, by not confirming the subscription request.

The only thing you know has happened is that someone typed your user ID into a registration field, which could just have been a typing error.

Nothing else appears to be at risk.

|improve this answer
  • The Play Station Network email was a confirmation email, as if an earlier "click to verify" link had been clicked. I never saw any such email. The PayPal emails are the most worrying. – fadedbee Oct 10 '16 at 12:45
  • 10
    They are trying to get you talking to them. Getting you worried about something that never happened is a standard way to start. The confirmation, if you looked more carefully, was probably forged. If you thought it was real, you should investigate it by going straight to the company, not by clicking on any link in the message. – keshlam Oct 10 '16 at 16:46
  • 1
    Accepted because of the comment above, which is better than the answer itself. – fadedbee Mar 22 '18 at 13:35
4

You've been targeted by an attempt of phishing. Nowadays it's quite easy to fake an email from PayPal etc.

So they're trying to make you believe that you need to click on the links from PayPal and login to figure out what's going on. Don't ever do that. If you did, change all your passwords quickly.

|improve this answer
2

It's hard to say if this is a scam or not because of the, um, free-wheeling way PayPal does things.

Someone recently opened a Paypal account using a secondary email address of mine (one that Comcast forced me to create, and which was in a recent breach). Paypal does not confirm they have access to the email, but lets them set up an account and add a phone number for confirmation, making it impossible for me to just reset the password and close the account.

Paypal is remarkably reluctant to do anything about this; I've not been able to get them to do anything at all in several months. So far the person using the account has not defrauded anyone, but who knows. Try calling Paypal and insisting to speak to someone in the fraud department, and mention that you are planning to report this to your local police or the FBI if they don't do something about it. Maybe you'll have better luck.

|improve this answer
2

The one question that hasn't been answered is how did they fake the email from your domain. That is very simple - they used what's called an open relay.

An open relay server (most email servers are configured not to do this) will allow emails to be sent from wherever without verification. Think of it as like sending a letter to someone and writing a return address on the envelope - no one can verify this.

I could send an email from bill.gates@microsoft.com using an open relay. When you look at the headers of the message, you'll see the origin of the email which will most likely be an IP address.

|improve this answer
  • We're under a barrage of Robocalls and the Do Not Call list is useless because the callers are changing their phone numbers faster than I can type this comment (g). "Anne" calls me several times a day from different numbers regarding health insurance. What surprised me is that recently, per my caller ID, I have been receiving robocalls from myself. Any idea how they are getting around the phone company and achieving this? – Bob Baerker Oct 20 '18 at 13:58
  • First of all, if you liked my answer, could you give me an upvote? With phones I'm not entirely sure but my guess is they're calling from overseas on some kind of VoIP network. My guess is they're able to do something similar. There is an open source VoIP system called Askterisk and maybe it can be hacked to do this, but that's a guess. – Tensigh Oct 21 '18 at 4:50
1

No money has been stolen from me, yet, so I have no reason to involve the police.

Attempting to commit a crime can be reported. This is no different from someone planning to rob a bank, but not done yet. Agreed that given your scenario police may not act.

Best is block email on domain. You may be using some mail service. Generally the emailid is restricted.

It is unclear how the scammer got some control of email address. Possible some sites don't verify the email via link, or the scammer used alternative method to authenticate the email.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.