OT: PSA For anyone with a Gmail account

[Ian]

Has nothing to do with anything here, but I came across this after hearing about it, and it's apparently a big deal. Please take a moment to read this and don't click on the email they reference should something like this come to your email account:

Watch Out for This Sophisticated Phishing Email That Looks Like It's From Google

Google says it's rolling out a fix for a bug that allowed scammers to send a convincing-looking email to developer Nick Johnson about a subpoena request.

www.pcmag.com

One of my friends got hit with it, and they're locked out of their account. It looks legit when it comes through, so be careful until Google finally fixes this and gets it taken care of.

 

[DarrylS]

I got a rather looking official text from Easy Pass telling me I owed $.28, the only toll I have taken in the past month is the Newport Bridge and that toll with Easy Pass is $.83.... but have to wonder how many folks fall for this phishing effort???

 

[lancerman]

I got a rather looking official text from Easy Pass telling me I owed $.28, the only toll I have taken in the past month is the Newport Bridge and that toll with Easy Pass is $.83.... but have to wonder how many folks fall for this phishing effort???

I got one too. I just ignore ****.

 

[PancakeBlockPaul]

I'm constantly getting hit with emails from Microsoft and other big vendors asking me to reset my password and they are always a scam. Count on it daily...nothing saying I owe but I DO get texts/sms saying I owe SunPass from going through tolls and of course it says to reply to an Outlook or Hotmail email account to get it 'resolved'...never click on anything YOU did not request. Doesn't matter if it comes from grandma, mom, the cat, the neighbor's son's kid....NEVER do it.

 

[Thelonious]

I got one too. I just ignore ****.

I get them continuously as text messages. I assume it works on some people.

 

[borisman]

I got a rather looking official text from Easy Pass telling me I owed $.28, the only toll I have taken in the past month is the Newport Bridge and that toll with Easy Pass is $.83.... but have to wonder how many folks fall for this phishing effort???

I got these texts as well but I used Mass Pike a couple of times prior to that so I almost fell for it. I got the DOT bill in the mail and after I paid it on their site I started getting these texts.

 

[jmt57]

I get those texts to pay your toll all the time. Lately they've become much more aggressive and threatening in tone.

Really wish a law enforcement agency would partner with the carriers to crack down on this crap. I have to assume many people are falling for it, or they wouldn't keep sending them.

 

[raduray]

What I do is check the email address of the sender. If the domain's is wrong, it goes to the junk folder. If the domain looks correct, I still don't click on the link, but rather log into that particular account using my browser.

 

[Ian]

What I do is check the email address of the sender. If the domain's is wrong, it goes to the junk folder. If the domain looks correct, I still don't click on the link, but rather log into that particular account using my browser.

I do the same, but that's apparently the weird thing about this one. It's able to spoof the sent email to look like it came from google.com due to an issue with the authenticator (which they were apparently alerted to a while back and ignored). That's what makes this one challenging because it bypasses Google detecting it as a bogus email and the "from" looks legitimate. Unless you check the header (which is still somewhat convincing), it's tough to spot this based on how it was shown. Fortunately, it looks like Google is finally patching the vulnerability, which it's a little crazy that they didn't do it before now.

 

[Pape]

I got a rather looking official text from Easy Pass telling me I owed $.28, the only toll I have taken in the past month is the Newport Bridge and that toll with Easy Pass is $.83.... but have to wonder how many folks fall for this phishing effort???

i have gotten a few of those lately... those texts are indeed a scam.

 

[SlowGettingUp]

it's tough to spot this based on how it was shown.

And it takes you to sites.google.com which looks like it is an official google domain - but it's the site where users can build their own page.

 

[PancakeBlockPaul]

The best was the illoveyou worm that sent itself to everyone in your contact list. Emails were coming from a known se set so lots of people thought they were legit. Really no reason not to tbh. Honestly kinda surprised that we haven’t heard about similar things going on. I guess there isn’t enough $ in it…

 

[Patjew]

I'm constantly getting hit with emails from Microsoft and other big vendors asking me to reset my password and they are always a scam. Count on it daily...nothing saying I owe but I DO get texts/sms saying I owe SunPass from going through tolls and of course it says to reply to an Outlook or Hotmail email account to get it 'resolved'...never click on anything YOU did not request. Doesn't matter if it comes from grandma, mom, the cat, the neighbor's son's kid....NEVER do it.

I open whatever my cat sends me without a second thought.

 

[PancakeBlockPaul]

I open whatever my cat sends me without a second thought.

Its hard to resist our furry friends’s emails.

 

[BennyBledsoe]

Government communications of any importance or significance are pretty much never done just through e-mail or a phone call.

If you get someone claiming to be from any agency, find their real number and call them, if you're worried.

 

[TommyD4207]

Government communications of any importance or significance are pretty much never done just through e-mail or a phone call.

If you get someone claiming to be from any agency, find their real number and call them, if you're worried.

This is really good advice, and the one thing people get tripped up on by government-type scammers.
They'll only contact you through regular mail first, with a number to call in the correspondence if it's something that needs to be addressed quickly.

They will never contact you via text or email first.
The amount they'll contact you by phone first, is incredibly rare, it's not *never*, but it's close to never.

 

[BTTA]

This is really good advice, and the one thing people get tripped up on by government-type scammers.
They'll only contact you through regular mail first, with a number to call in the correspondence if it's something that needs to be addressed quickly.

They will never contact you via text or email first.
The amount they'll contact you by phone first, is incredibly rare, it's not *never*, but it's close to never.

Yeah, it is the last meaningful use of snail mail. But snail mail is broken...95% of what comes to my house gets recycled without opening or review. And important letters are discovered in magazines, months later.

 

[n1997y]

I do the same, but that's apparently the weird thing about this one. It's able to spoof the sent email to look like it came from google.com due to an issue with the authenticator (which they were apparently alerted to a while back and ignored). That's what makes this one challenging because it bypasses Google detecting it as a bogus email and the "from" looks legitimate. Unless you check the header (which is still somewhat convincing), it's tough to spot this based on how it was shown. Fortunately, it looks like Google is finally patching the vulnerability, which it's a little crazy that they didn't do it before now.

Now you’ve got me wanting to track down examples of that. It’s been ages since I decoded any really interesting email headers.

 

[Bill Lee]

Really wish a law enforcement agency would partner with the carriers to crack down on this crap. I have to assume many people are falling for it, or they wouldn't keep sending them.

This stuff could have been so much more bullet proof if decades ago, but it would have involved more messaging under the covers to confirm the sender was who they said it was, and the big players didn't want to pay for that.

In fact the easier they make it to spam the more paying traffic they get, and the harder they make it to spam the more unpaid work they need to do.

Pretty easy choice for the ****head MBA "winners" who make the decisions.

What I do is check the email address of the sender. If the domain's is wrong, it goes to the junk folder. If the domain looks correct, I still don't click on the link, but rather log into that particular account using my browser.

Well, yeah, but try to teach this to elderly people. Some can manage, but many cannot.

 

[PP2]

Government communications of any importance or significance are pretty much never done just through e-mail or a phone call.

If you get someone claiming to be from any agency, find their real number and call them, if you're worried.

Not just government, but also all types of law enforcement, those claiming legal action, and those urging immediate action on financial matters, and especially your financial institution(s).