Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

daedal.io

Post reply on HN
Print view View original

171–180 of 242 posts

Re: FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

#171

Post by ilamont »

eblume wrote: post #168
ilamont wrote: post #159

Earlier quoted context omitted.

Wasn't expecting this comment to go far. This took place about a month ago. For those who are interested, here is the address I sent the police report and cover letter to: Google LLC Attn: Legal Department – Custodian of Records 1600 Amphitheatre Parkway Mountain View, CA 94043 In the cover letter I outlined the problem and the desired remedy (shut down the gmail account and preserve IP and other information for law…

Having worked in compliance engineering I have also reported through the IC3 portal, and spoken with lawyers and analysts who register with FinCEN (which, to be clear, is maybe just a step beyond "My Uncle works at Nintendo...") and I have heard that those reports do get reviewed and often acted on, but yes, you will typically never hear back from them. (FinCEN has its own reporting structure, but we also submitted c…

Honestly, the "acted upon" part needs to be highlighted in tangible ways, otherwise people will be suspicious that nothing ever happens to our reports, leading to fewer reports being submitted.

During the IC3 reporting process I was asked to submit the name of people behind the scam, if known. I knew one of them because the scammer asked for a wire transfer to a named account at a bank in Oregon. Probably a mule.

Does anyone at the FBI or other agencies actually do anything with this information, such as contacting the bank in question or correlating it with other investigations? That's what I would expect if law enforcement were serious about enforcing the laws on the books. But there is no indication that anything happened, other than a confirmation number being spit out on a web page that my report had been received. That's why I made the "black hole" comment earlier.

If the IC3 portal highlighted specific cases or stats ("thanks to reports submitted to IC3, n investigations were initiated/suspects charged/convictions secured") that would really help convince ordinary victims that the government is taking tangible steps to fight this scourge of small-scale scams and frauds that affect millions of people every year.

Re: FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

#172

Post by Cpoll »

ilamont wrote: post #105

I got a human being at Google to look into my problem and take action after sending a police report to Google‘s legal department certified mail return receipt along with a letter describing how someone was impersonating me and my business using a Gmail address in an attempt to commit fraud. Yes, it was a pain to take all of these steps and it probably took about 3 hours but it was absolutely necessary considering the…

What stopped them from continuing with a new similar Gmail address?

Re: FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

#173

Post by avian »

vk6flab wrote: post #162
silvershell wrote: post #154

Earlier quoted context omitted.

Yes. I got the same issue… and when someone replies, all users in the mailing list receive it… that’s why I would see a ton of replies saying please remove me from your mailing list. Very annoying. The only solution I found was to create an inbox rule to reject those, as I couldn’t unsubscribe

The headers actually contain an unsubscribe email address that actually works. The format is something like googlegroups-manage+{groupName}+unsubscribe@googlegroups.com Just send an email there and they stop coming (for that list). Source: I was getting spam like this, a fellow victim did some tests and confirmed that it stopped the onslaught of messages.

I just block the group address on the MTA, but it doesn't matter. In all instances so far when it came to my attention the group was already deleted. Next time they will use a different group and I don't want to blanket ban all Google Group mail for my users.

It's not even that much of a hassle. What worries me is that I don't understand why someone would go through the trouble of doing this for no apparent benefit. I hope I'm not somehow unknowingly enabling some sort of an attack on any of the entities sending these automated replies.

Re: FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

#174

Post by rvnx »

Cpoll wrote: post #172
ilamont wrote: post #105

I got a human being at Google to look into my problem and take action after sending a police report to Google‘s legal department certified mail return receipt along with a letter describing how someone was impersonating me and my business using a Gmail address in an attempt to commit fraud. Yes, it was a pain to take all of these steps and it probably took about 3 hours but it was absolutely necessary considering the…

What stopped them from continuing with a new similar Gmail address?

Motivation I guess

Re: FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

#175

Post by ilamont »

Cpoll wrote: post #172
ilamont wrote: post #105

I got a human being at Google to look into my problem and take action after sending a police report to Google‘s legal department certified mail return receipt along with a letter describing how someone was impersonating me and my business using a Gmail address in an attempt to commit fraud. Yes, it was a pain to take all of these steps and it probably took about 3 hours but it was absolutely necessary considering the…

What stopped them from continuing with a new similar Gmail address?

Yes, they could easily spin up another gmail address.

The other part of the scam involved sending money to a bank account in Oregon with someone else's name attached to it. I notified the bank in a similar manner and hope they shut it down (not confirmed; my next step is to notify the Oregon banking regulator about the incident).

The hope is that once the bank account and gmail account are shut down the scammer will stop or move on. But I am concerned this could be a whack-a-mole problem that doesn't go away.

Re: FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

#177

Post by canadapups »

LiamPowell wrote: post #110
alpaca128 wrote: post #97

Earlier quoted context omitted.

On YouTube I reported bot accounts for a couple days, the only reaction I got was that at some point it showed a popup that told me too many false reports would lead to a ban. Not sure what Google gets out of it, but there is no way they could be that bad at fighting bots unless they're not even trying. Even trivial tricks like copy-pasted texts keep working.

They're not trying. I've seen an advertiser remain active for months with literally tens of thousands of ads where clicking them directly downloads a malicious exe file that most antivirus scanners flag.

They're definitely not trying - in any form. I run a marketplace for dogs (i.e. craigslist for puppies & dogs) and scammers are always trying to post fakes ads. They always use Gmail accounts. Every time I ban a gmail address, they scammers will just get a new one. Same scammer/person has created thousands of gmail accounts and Google doesn't care. I have reported this to Google. For the amount of info Google has on people, trivial for them to prevent some of this.

Re: FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

#178

Post by jeffbee »

Cpoll wrote: post #172
ilamont wrote: post #105

I got a human being at Google to look into my problem and take action after sending a police report to Google‘s legal department certified mail return receipt along with a letter describing how someone was impersonating me and my business using a Gmail address in an attempt to commit fraud. Yes, it was a pain to take all of these steps and it probably took about 3 hours but it was absolutely necessary considering the…

What stopped them from continuing with a new similar Gmail address?

You can't send high volume through new accounts. Usually when a gmail account is being used for real spamming, it's an established one that's been taken over and the spammers are just discharging the accumulated reputation of the account.

Re: FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

#179

Post by eblume »

ilamont wrote: post #171
eblume wrote: post #168

Earlier quoted context omitted.

Having worked in compliance engineering I have also reported through the IC3 portal, and spoken with lawyers and analysts who register with FinCEN (which, to be clear, is maybe just a step beyond "My Uncle works at Nintendo...") and I have heard that those reports do get reviewed and often acted on, but yes, you will typically never hear back from them. (FinCEN has its own reporting structure, but we also submitted c…

Honestly, the "acted upon" part needs to be highlighted in tangible ways, otherwise people will be suspicious that nothing ever happens to our reports, leading to fewer reports being submitted. During the IC3 reporting process I was asked to submit the name of people behind the scam, if known. I knew one of them because the scammer asked for a wire transfer to a named account at a bank in Oregon. Probably a mule. Doe…

There are strict rules about not talking about open investigations because of so-called "Tipping-off" rules. It can carry some pretty serious penalties - jail time, fines. I agree it would be nice if the FBI itself made some announcements about these sorts of things, and they might do that in aggregate, but if you're a bank or fintech employee and you're in communication with the FBI you absolutely cannot say anything about it. Even confirming that an investigation existed could be penalized.

Re: FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

#180

Post by jasomill »

ilamont wrote: post #171
eblume wrote: post #168

Earlier quoted context omitted.

Having worked in compliance engineering I have also reported through the IC3 portal, and spoken with lawyers and analysts who register with FinCEN (which, to be clear, is maybe just a step beyond "My Uncle works at Nintendo...") and I have heard that those reports do get reviewed and often acted on, but yes, you will typically never hear back from them. (FinCEN has its own reporting structure, but we also submitted c…

Honestly, the "acted upon" part needs to be highlighted in tangible ways, otherwise people will be suspicious that nothing ever happens to our reports, leading to fewer reports being submitted. During the IC3 reporting process I was asked to submit the name of people behind the scam, if known. I knew one of them because the scammer asked for a wire transfer to a named account at a bank in Oregon. Probably a mule. Doe…

My assumption is that they at least have an intern read them, but only act on reports likely to lead to major cases, for some value of "major" that includes cases where terrorism, large sums of money, or Important People are involved, or more generally cases that could lead to seriously good/bad PR if pursued/ignored.

De minimis non curat FBI.

They may also flag certain cases to be passed to other relevant authorities like FinCEN, the Secret Service, the Postal Inspection Service, various military investigative services, or even the intelligence community (assuming NSA doesn't already intercept the mailbox which would be a very reasonable thing to do).

Post reply on HN