The dots do matter: how to scam a Gmail user

I get it, but I absolutely use that gmail feature to give out different versions of my address to see where things come from. I'd hate to see it go.

Something very similar happened to me because of the whole dot issue and Netflix not verifying their customer's email addresses (double opt-in). Someone created a Netflix account using a dot-variant of my Gmail and at some point, I received a similar email asking me to update my payment info. Right from the email, I saw it wasn't my account and thought someone else used my email by mistake (this happens a lot to me because I have a common name and a short email address).

What I usually do is request a password reset and delete the account or just remove my email address from the account. But in the Netflix case, the "update payment" button on the email log you to the account without asking for the password or anything. For the most part, people sign up to junk services/games or is just creating a throwaway account. But this was looking like a legit mistake. This person was actually using the Netflix account and had the payment info there and everything. I tried to just change the email address to something else but it required to confirm the password to change the email. I could just request a new password and change the email, but I was trying to be careful here because I didn't want to screw this person. I started to investigate a little bit more. Maybe this person had the account connected to Facebook, so it would be okay to change the password and remove my email and the account owner would still be able to log in. But it wasn't the case. I checked the watch history, just Peppa Pig and movies for kids. The name in the account was a female name. Probably a mom that created a Netflix account for her child. At this point, I was feeling super guilt to remove my email address and lock this person out of the account. All I could think of was a monday morning, the password not working, the kid crying out loud, the mom trying to figure it out. Anyway, I was just trying to not cause someone trouble.

So I thought about trying to find this person on Facebook or something. She had a not very common name so it shouldn't be hard. The payment method on Netflix was direct debit, so I had her bank account number. From the bank account number, I got the number of the bank's agency, and a quick google I discovered in which city her bank's agency was located, so it made the Facebook search very precise. There I was looking at her Facebook page. The profile picture it was a happy family of three: mom, dad, and the little child. Browsing a little bit her public feed I learned that her kid had my name (Vitor) and that explained why the account name had her name and the email address was a different name (her kid). So, either she created an email address for a 1-2 years old and mistyped it, or she just typed whatever email and created the account. The second option seemed more plausible. In any case, she seemed pretty much clueless and I thought about how to approach this and explain to her what was going on. So, I started to write a message... but it sort of started to sound weird/creepy, like how I got her contacts, and I was worried that she was going to think I was trying to scam her or something, so I gave up and said whatever. I still receive her (I mean, her kid's) movies recommendations.

The two security issues are user phishing and Netflix not performing canonicalization of email addresses. he signup process itself is not a security issue.

The issue from the perspective of the user should be that the author clicked on a link in an html email, when he should have instead gone to Netflix.com. He clicked first and only then checked. Gmail even warned him of the phishing possibility, and he still clicked on the link! He is the vulnerability that was almost exploited.

It is true that there are other issues with user interactions, such as Netflix allowing signups without email verification, however those were purposefully designed that way by Netflix. They are features not bugs.

There is no bug in Gmail. This bug has nothing to do with Gmail, it is with Netflix not clearly communicating when verifying the address a user claims to own.

When this happens to me, I reset the password and abandon the account. I assume whoever created the account made a mistake, but I have no way to contact them. When they have to sign in again, they’ll have to create a new account, but they’ll hopefully use their own email address.

It’s never happened to me with a paid account, but if it did, I’d cancel it.