I’m very careful with privacy and security so I was surprised I got an obvious phishing email from “American Express”. I reported the email and moved on only to get another one today. I checked haveibeenpwned and it came back clear. I have never gotten a phishing email before the other day. As for the senders, they all came from generic IT sounding email addresses. They obviously weren’t American Express.

  • @[email protected]
    link
    fedilink
    English
    387 hours ago

    If you have signed up on dubious websites with questionable privacy policy, many of them legally sell this data to “data brokers” who then sell it to anyone willing to pay. This happens more than you’d think, for example in 2019 it was reported California DMV makes $50 million a year selling users information. https://www.caranddriver.com/features/a32035408/dmv-selling-driver-data/

    One neat trick is to signup for services with an email like [email protected], that way if you ever get spam you’ll know where you have been compromised.

    • @jaybone
      link
      44 hours ago

      I’ve used this many times before. But this is so well known I wonder, why wouldn’t spammers/scammers just remove the “+” and trailing characters before “@“?

        • @jaybone
          link
          34 hours ago

          Yeah that also usually comes up in these types of discussions. Even for technical people, that approach can be a pain to manage.

    • @T156
      link
      English
      167 hours ago

      Information might also be leaked through data breaches. An email is not a particularly hard thing to find, or even guess.

      A spammer could easily just have a computer iterate through all possible combinations of emails and usernames, and shotgun it.

      Especially for a name like OP’s. If their email is a similar name, it wouldn’t be difficult for generate one that is also two words.

      • @daggermoonOP
        link
        27 hours ago

        Nah, my email is my name. It’s a very uncommon name.

        • Optional
          link
          32 hours ago

          A program to send to [list of firstname.lastname pulled from the census]@gmail.com or whatever is pretty easy. Also merchants sell the email lists for $ so if you’ve bought anything with that email that could be it.

        • @SomeGuy69
          link
          35 hours ago

          And you have zero social media with your name?

    • @daggermoonOP
      link
      27 hours ago

      I might need to use your trick in the future. Thank you!