I’m very careful with privacy and security so I was surprised I got an obvious phishing email from “American Express”. I reported the email and moved on only to get another one today. I checked haveibeenpwned and it came back clear. I have never gotten a phishing email before the other day. As for the senders, they all came from generic IT sounding email addresses. They obviously weren’t American Express.

  • MojoLobo@lemmy.jrvs.cc
    link
    fedilink
    English
    arrow-up
    48
    ·
    8 days ago

    If you have signed up on dubious websites with questionable privacy policy, many of them legally sell this data to “data brokers” who then sell it to anyone willing to pay. This happens more than you’d think, for example in 2019 it was reported California DMV makes $50 million a year selling users information. https://www.caranddriver.com/features/a32035408/dmv-selling-driver-data/

    One neat trick is to signup for services with an email like name+website@domain.com, that way if you ever get spam you’ll know where you have been compromised.

    • T156@lemmy.world
      link
      fedilink
      English
      arrow-up
      22
      ·
      8 days ago

      Information might also be leaked through data breaches. An email is not a particularly hard thing to find, or even guess.

      A spammer could easily just have a computer iterate through all possible combinations of emails and usernames, and shotgun it.

      Especially for a name like OP’s. If their email is a similar name, it wouldn’t be difficult for generate one that is also two words.

        • Optional@lemmy.world
          link
          fedilink
          arrow-up
          4
          ·
          8 days ago

          A program to send to [list of firstname.lastname pulled from the census]@gmail.com or whatever is pretty easy. Also merchants sell the email lists for $ so if you’ve bought anything with that email that could be it.

          • daggermoon@lemmy.worldOP
            link
            fedilink
            arrow-up
            1
            ·
            7 days ago

            Correct. I ditched social media a few years ago. No regrets. I deleted every account I did have. Snapchat was the last hold out. I deleted it because I got a popup that required I give consent to be used for AI training or some shit so I deleted the account.

    • jaybone@lemmy.world
      link
      fedilink
      arrow-up
      4
      ·
      8 days ago

      I’ve used this many times before. But this is so well known I wonder, why wouldn’t spammers/scammers just remove the “+” and trailing characters before “@“?

      • xigoi@lemmy.sdf.org
        link
        fedilink
        English
        arrow-up
        2
        ·
        8 days ago

        True. A more reliable way to achieve this is to buy a domain and use addresses in the form websitename@your.domain.

        • jaybone@lemmy.world
          link
          fedilink
          arrow-up
          5
          ·
          8 days ago

          Yeah that also usually comes up in these types of discussions. Even for technical people, that approach can be a pain to manage.

  • elvith@feddit.org
    link
    fedilink
    arrow-up
    36
    ·
    8 days ago

    Some companies just blatantly sell your data. Others get breached and you are part of the package that gets sold by the hackers.

    The only “way around” is to use unique mail addresses for each signup/company so you can easily lock it and switch to another one when it gets known.

    Just assume, that everything that you type in a form online (or in any other way send to a company/another person digitally), every email you send, everything that gets digitized about you, etc. will be public one day. Either because the other side of the transaction sold it or because they (or you) will be hacked eventually.

    Btw: HaveIBeenPwned does not necessarily contain all breaches. I have several notifications of companies that got breached and leaked my data that are not listed in HIBP…

  • ContrarianTrail@lemm.ee
    link
    fedilink
    English
    arrow-up
    36
    ·
    edit-2
    8 days ago

    Doesn’t matter how careful you are if the people close yo you with that information aren’t.

    ‘Why yes ofcourse you can access my address book in order for me to play candy crush.’

  • Sir_Kevin@lemmy.dbzer0.com
    link
    fedilink
    English
    arrow-up
    19
    ·
    8 days ago

    A few months ago was the largest data breach possibly ever. Something like 300GB of personal information. Basically everyone in the US. They have everything on everyone and it’s being passed all around on the dark web like skittles. The mainstream media didn’t cover this for whatever reason.

  • ohwhatfollyisman@lemmy.world
    link
    fedilink
    arrow-up
    17
    ·
    8 days ago

    employees of companies with whom you’ve registered that email id sell it for some quick cash on the side.

    i can aver this confidently since i know someone from dominos pizza has leaked my email id. i have a convoluted gmail id which i use to register to all these services and – because it’s gmail – i can set up random dots and a custom phrase behind a + to register specific variants to specific companies (e.g., abcxyz123@gmail vs. ab.c.xyz123+dominos@gmail).

    all the spam and pseudo-phishing email is sent only to the variant which i’ve registered to dominos and not to a different variant (e.g., a.bcxyz123+bankname@gmail) registered to any other company.

    the leaked email id doesn’t contain a name and is too random for it to just be “guessed” by the spammers.

  • Lem Jukes@lemm.ee
    link
    fedilink
    English
    arrow-up
    18
    arrow-down
    2
    ·
    edit-2
    8 days ago

    This is gonna sound silly but check here:

    https://haveibeenpwned.com/

    Might have some info if you’ve had creds leak or get exposed somewhere.

    Nvm, just re-read your post and saw you already did. Leaving this up for the link for others. Sorry to bother!

    • WhiteOakBayou@lemmy.world
      link
      fedilink
      arrow-up
      1
      ·
      8 days ago

      I’ve used that website in the past with no problem but a heads up I had to turn on js and off antifingerprinting to get it to load this time. For all those more security conscious than I

        • WhiteOakBayou@lemmy.world
          link
          fedilink
          arrow-up
          1
          ·
          7 days ago

          Firefox for Android. Wouldn’t load the list of beaches for me until I turned off shelter. Just kept reloading whatever frame is beneath the text input.

  • edric@lemm.ee
    link
    fedilink
    arrow-up
    14
    ·
    edit-2
    8 days ago

    Someone who you’ve corresponded with over email had their address book compromised and it was used in a mass phishing email campaign. It’s not necessarily targeted at you. I actually have experience of this happening. I had an email address that I used only to correspond to a single person. I never gave the email to anyone else and never signed up for anything. Well that person’s email was compromised and I started getting spam/phishing emails shortly after that.

  • unexposedhazard@discuss.tchncs.de
    link
    fedilink
    arrow-up
    8
    ·
    8 days ago

    Have you given your email address to any other people you know? If so they probably put it into their contacts. They then use apps like whatsapp, insta, snap, etc which request access to their contacts. These companies then sell that information to ad companies. Tadaaa.

  • palordrolap@fedia.io
    link
    fedilink
    arrow-up
    4
    ·
    8 days ago

    One possibility is that you have a fairly common username part and a similarly common domain like, say, gmail.

    There’s nothing stopping a spammer from taking existing addresses and word lists, then taking them apart and putting them together in different ways to make up completely new addresses to send spam to. It doesn’t matter if 99% of the addresses they make up don’t exist because they’re only interested in the 1% of the 1% of successes who will fall for their scam. They don’t even get the rejections because the From address is usually bogus too.

    e.g. I bet whoever owns john dot smith at gmail gets a huge amount of spam whether he’s in any databases or not.

  • bstix@feddit.dk
    link
    fedilink
    arrow-up
    4
    ·
    8 days ago

    It can happen in many ways. If you’ve ever used your mail for anything, then the address is out there.

    Just the other day I got an email addressed to 50+ people with every email in the “to” field. Ironically the mail was about online security…

    Obviously it’s a breach on GDPR, but the damage is already done. If just one of the other recipients has been hacked or has forwarded to someone who is or has allowed some dodgy app to syncronize contracts, the scamners now has all the emails.

    There’s absolutely nothing I could have done to prevent it.

    • daggermoon@lemmy.worldOP
      link
      fedilink
      arrow-up
      6
      ·
      8 days ago

      This just makes me think being online sucks like 50% of the time. I try to tell people to be careful online and not give up personal data when it can be avoided. People are so willing to give up everything for convenience sake. I complain about data collection and shitty tech companies and I’m called a paranoid schizo. Then again, I did everything right and still got fucked. Welcome to the internet. Sorry if this came off as negative. I don’t know what else to say.

      • Goldmage263@sh.itjust.works
        link
        fedilink
        arrow-up
        1
        ·
        7 days ago

        There is not much else to say. I got a text from “my bank” that a payment was due. They shorthanded the bank name, spoofed the correct area code, and even knew my normal payment date. Nothing is sacred and that’s the new reality.