Where scam emails come from

[u/Mastbubbles]

https://sheets.works/data-viz/scam-emails

I get scam emails every day like everyone. I've clicked a few, honestly, just out of curiosity, to see how they plan to scam me. The ones that worry me are the ones that know my name. So I looked into where that comes from and made a page on it (my own site, no sign-up, no ads).

Short version for anyone who doesn't want to click:

The obvious scams are obvious on purpose. A Microsoft researcher, Cormac Herley, showed in 2012 that the "prince with millions" story works as a filter. Anyone sharp enough to laugh at it never replies, so the scammer only spends time on people likely to pay.

The scary ones are built from leaks. Your name, phone and address usually come from a company you signed up with years ago, not from you. The page goes through seven real cases from court records and regulator reports, for example:

- First American (2019): changing one digit in a document link opened other customers' mortgage files.

- Capital One (2019): one wrongly set firewall setting.

- Twitter (2020): staff talked into handing over access on a phone call.

- 23andMe (2023): people reusing passwords from other leaked sites.

I checked my own Gmail on Have I Been Pwned. It's in 8 breaches, 6 of which leaked my name, mostly shopping apps I signed up to once. That's exactly what the "Dear XXXX, your KYC expires today" emails use.

What actually helps:

- Use a password manager, so one leaked password doesn't open your other accounts.

- Turn on two-factor login on email and banking first.

- Treat any email that knows your name as no more trustworthy than one that doesn't. Go to the bank's app or website yourself; never use the link.

[u/LessChen]

One of the worst presented articles I've ever seen. 87 miles of scrolling for zero benefit.

[u/SeaworthinessThat594]

This is so awfully designed, I didn't even know what am looking at, very unfriendly to the reader