smapgourmet system helps avoid scam emails

[Guest]

One of the advantages of spam gourmet is that when for example your bank or cradit card company sends you an email you know that it came from them. i was just reading about an email scam which prompted customers to input their card and pin details. Of course anyone who would be stupid enough to fall for that wouldn't be smart enough handle spamgourmet I guess (not that it requires much in the way of brains but anyway...)

regards,
Ben

[Robmonster]

Another thing that Spamgourmet is great for is playing with the spammers

When I get one of those Nigeriam scams, or the lottery win scams at a SG account I always reply to them, trying to string them along for as long as possible. All the time they waste sending mail to my SG address is time they wont spend trying to fool others.

Address Masking makes this possible.

[Another Guest]

Because I give a different spamgourmet address to each and every one of my contacts, I have been able to identify 4 computers (belonging to friends) hijacked by spam remailers and 6 scams. Most of the scams were obvious, of course, such as the 'friend' who gave the 'Nigerian' guy my email address; I knew from the spamgourmet address that my 'friend' was my dog's Petfinder posting.

The latest of these of these scams, however, is a real winner.

As of this moment, I believe someone is running a Phishing operation FROM A SUBDOMAIN IN MY ISPs OWN SERVER (I will not name the ISP until I am dead-dead certain). If I am right, this is one BRILLIANT operator: His relay gets raw material dynamically from the ISPs own normal page, and only replaces a little bit of boilerplate text with a form for the victim to enter account and password. This way, his pages look not just real, but real-time; if the ISP changes their page, the scammer's page shows those changes instantly.

The best part is that using spamgourmet shows me that my emails to the fraud department are being intercepted and THE SCAMMER IS REPLYING TO THEM. I sent my report anonymously, from an unrelated server, using a spamgourmet return address. No one at the ISP could connect my name or ISP account with my report; yet I received the same 'that URL is legitimate, and thank you' message at both MY ACCOUNT EMAIL ADDRESS AND THE SPAMGOURMET ADDRESS. Therefore, the thank you note had to be a fraud, and my report had to have been intercepted!

Josh and Syskoll should partner up with Sherlock Holmes...

[SysKoll]

I am impressed. You sure it's not some clever browser frame trick?

[jms1]

Any update on what happened? Did you ever physically go to the ISP and show their admins what you've found, or is this a huge national ISP and you can't physically go to the office (one of the biggest reasons I stick with the local guys, I can visit the office and I know their admins- as a former ISP admin I have helped them track down stuff like this.)

Are you now able to name the ISP in question?

If you'd rather not say in a public forum, the username to the left is also my spamgourmet username, make up an alias and let me know directly... in my mind an ISP staff member conducting phishing attacks is abusing the trust of his users and is no better than a crooked cop- he doesn't deserve to keep his job (and also doesn't deserve oxygen, but that's a separate discussion...)