Ask Slashdot: Someone Else Is Using My Email Address

periklisv writes: I daily receive emails from adult dating sites, loan services, government agencies, online retailers etc, all of them either asking me to verify my account, or, even worse, having signed me up to their service (especially dating sites), which makes me really uncomfortable, my being a married man with children... I was one of the early lucky people that registered a gmail address using my lastname@gmail.com. This has proven pretty convenient over the years, as it's simple and short, which makes it easy to communicate over the phone, write down on applications etc. However, over the past six months, some dude in Australia (I live in the EU) who happens to have the same last name as myself is using it to sign up to all sorts of services...

I tried to locate the person on Facebook, Twitter etc and contacted a few that seemed to match, but I never got a response. So the question is, how do you cope with such a case, especially nowadays that sites seem to ignore the email verification for signups?
Leave your best answers in the comments. What would you do if someone else started giving out your email address?

Comments

Reverse the role

[Anonymous Coward]

When you find you have been signed up for a legit company site. Go to the site using your email and press the forgot password on the site. When you get the email back, log on and maybe you can get the information that you need to track him down.

Re:Reverse the role

[BarbaraHudson]

Why bother. Just mark it as spam. Eventually they'll need to reset their password or otherwise confirm their identity, and fail. If they ever contact you when they realize their mistake, mark that as spam too. They'll be like the protagonist in "I have no mouth and I must scream." Never heard again.

Re:Reverse the role

[Anonymous Coward]

I've heard of people having this problem, but I still don't understand the issue.

If my e-mail address is johnsmith@gmail.com why would somebody else use that address, other than deliberately fucking with me (e.g., sign me up for a bunch of shit that I don't want)?

Are there people so completely brain dead that they don't know what their e-mail address is, so they just use name@gmail.com and think that it will actually work?

Re:Reverse the role

[BarbaraHudson]

From the comments, I'd say that es, there really are people who are that brain-dead. They forget that they couldn't get their name because they signed up later, so used a letter or a number to differentiate it, and now just blithely give your email addy because they forget to include the extra symbol.

That's one of the advantages of being an early adopter - you get to use your name. If you forget your name, you're too far gone to be using email anyway.

Re:Reverse the role

[JTD121]

I did something similar to this for one account; the only difference is a period in the middle of the e-mail address. Apparently Google treats them as the same thing.

Re:Reverse the role

[arth1]

People are that stupid.
I have a domain name that seems to be attractive enough that people want an address on it. And some start using the e-mail address before attempting to acquire the e-mail address. This is especially sad when I get e-mails from friends and relatives of a person.
However, I do not bounce e-mail the sender to tell them that the e-mail is wrong. Once I did that and was threatened with lawyers for "stealing" someone's e-mail...

In other words, there are few limits to how stupid people are. And we still allow them near computers. What could possibly go wrong?

Re: Reverse the role

[Anonymous Coward]

This is incorrect, Gmail does not allow and has never allowed two addresses to be registered that differ only by a dot. See https://support.google.com/mail/answer/10313?hl=en

Re:Reverse the role

[gweihir]

That may make you look pretty stupid when they file a criminal complaint against you. The proxy does not help, or have you forgotten that they have your email address?

Re:Reverse the role

[gweihir]

This does not go to court. It goes to ICANN arbitration. And unless it is a valid complaint, it will just get rejected directly.

Re:Reverse the role

[Lorens]

Once I was nasty. I got a mail from the person's boss saying that I was a bad person for traumatizing their employee.

Once I was nice. I got a nice excuse and a follow-up question. After four or five exchanges, she apologized for being forward and asking a personal question, but was I married, 'cause she really liked talking to me?

After having proved to myself in this way that I really could take over the world if I wished, I now mostly ignore mis-addressed mails.

Re:Reverse the role

[Vlad_the_Inhaler]

Similar case but with a twist - I have been using a first-name.last-name@domain (not google) address for around 20 years now. Someone else wanted it, saw it was already in use and settled for first-name_last-name@domain instead.

Two years ago I was trying to register for a service using another email address which I did not otherwise use, it turned out that the address had been deleted because I had not used it for too long.

While I was sorting this mess out, he registered for the same service but accidentally gave my.address rather than his_address. I thought things were now fixed and confirmed the mail (do you recognise customer numbers?). Some details did not match so I realised something was wrong and rang the helpline to withdraw the confirmation. This failed, they probably thought I was playing with them.
Then I started getting his bills, along with his postal address. I used the address to trace his number, rang him (his wife) and discovered I actually know the guy - we work for the same company and sometimes get phone calls or mails for each other at work.

It took three months to fix the problem, I was forwarding his bills to him for that long.

Re: Reverse the role

[Entrope]

RFC 821 and 2821 both specify that while the host name in an email address must be case-insensitive, the "local" part (before the @ sign) must be treated case-sensitively by other systems. The receiving system may treat it case-insensitively, but anyone sending mail to that address must preserve the case of the local part as originally given.

Re: Reverse the role

[unrtst]

I don't think you understood the GP.
From that very same link (https://support.google.com/mail/answer/10313?hl=en):

Receiving someone else's mail
If you're getting someone else's emails, check the reasons below to get help.
* The email address has different periods or dots than mine
If the sender added or removed dots from your email address, the message will still go to your inbox. Your email address is unique; people can't set up an identical account even with a different number or placement of dots.

For example, messages sent to these addresses will go to the same Gmail account:

johnsmith@gmail.com
jo.hn.smith@gmail.com
john.smith@gmail.com
If you still think the message was meant for someone else, contact the sender to let them know they mistyped the email address.

Note: If you use Gmail through work, school, or other organization (like yourdomain.com or yourschool.edu), adding dots to your username changes your email address. To change the dots in your username, contact your admin.

Just to check, I tried to create a new gmail account. I used my existing username, and added a period/dot in a random position in the name. It then prints an error:

Someone already has that username. Note that we ignore periods and capitalization in usernames. Try another?

That's a server-specific feature. The standard is that the domain is case insensitive, but the local part (before the @) is case-sensitive.
I was surprised to see that the wikipedia page on it (https://en.wikipedia.org/wiki/Email_address) says, "Although the standard specifies the local part to be case-sensitive, in practice the mail system at example.com may treat John.Smith as equivalent to JohnSmith or even as johnsmith". AFAIK, on virtually all other email servers, "john.smith" and "johnsmith" are two separate accounts, but maybe I'm just not aware of all the others that are ignoring periods. On gmail, those refer to the same account.

Lastly, I also tried logging into my existing email account with a username that included extra periods. That worked. That's news to me, and a bit surprising.

I may start using that to differentiate different types of sites I sign up for. I had tried doing this in the past using standardized subaddressing (ie. appending "+somestring" to the local part of the email address, such as "johnsmith+slashdot@example.com", https://en.wikipedia.org/wiki/...), but most sites reject that, and I'm not sure gmail handled it right either. Using the dot is something that should pass all forms, and pseudo-secretly allow me to categorize sources based on if/where the period was placed. Is anyone else doing this in practice?

I have a similar problem

[sombragris]

I live in Paraguay. I got into Gmail back when it was invite-only and I was able to select the precise handle I wanted. Some years later I began to receive mail from a dude who apparently lives in Spain. Seems like the dude registered as his handle the exact word I used, only that he inserted a period. Looks like a period (.) is approved as a different handle but is treated as the same. Thankfully I have no lost incoming emails (apparently), but I also get all kinds of mail directed to such person. Baffling, indeed. Hope Google can solve this.

Re:I have a similar problem

[sombragris]

Yeah, I thought exactly that, but then this dude's address is supposedly the same as mine but with a dot inserted. Looks like something is not working according to specification == bug.

Re:I have a similar problem

[BarbaraHudson]

GMail treats embedded dots in the name portion as identical to the name without the embedded dot. my.name@example.org is the same as myname@example.org. Check (1) that the tld is identical - gmail.es (spain) isn't the same as gmail.py. (paraguay). Also check that the characters in the name portion really are identical, and not just appearing so in your browser because of font substitution. One way to do this is reply to it and see if the reply goes to you as well. If not, then the local parts are not in fact the same, even if they look the same on your system.

Also, standard fonts allow lots of substitutions that look the same but aren't. For example, BankOfArnerica is NOT the same as BankOfAmerica. The first one is spam bait (if you can't see the difference, cut-n-paste it into an editor and select fixed-width font).

Re: I have a similar problem

[Chuck Chunder]

I think that is generally true but I also think there are some historical exceptions to Google's handling of that, either that or a knock on effect from when Google couldn't use gmail.com in some countries for trademark reasons and had to issue googlemail.com addresses in those countries and then later tried to merge them.

Re: I have a similar problem

[DigiShaman]

This happened to me. Some lady signed up as first-initial.middle-initial.lastname@gmail.com when in fact mine is the exact same but with no periods. To this day I get random order confirmations from Sears and medical info. I even know her name and address from the registration to the sites. No, I'm not going to pay her a visit or anything. It only happens a few times a year. But people really need to be clued in on this behavior of GMail. And I agree, it needs to be put to an end from Google.

Re:I have a similar problem

[LostOne]

I think you'll find this turns out *not* to be true. What is significant in the "local part" of the email address is *up to the local system* as long as it is in the set of characters that are permitted. Of course, Google (and anyone else for that matter) is perfectly allowed to ignore dots in the local part. But everyone is also perfectly allowed to treat them as significant.

Also, your wiki link does not back up your assertion that "A.BC" and "ABC" must be the same mailbox. It only gives rules on where a dot can appear unquoted in the local part. It does not say that it is to be ignored when routing.

Additionally, decades of operational practice on the Internet also directly violates your assertion. Dots have *always* been potentially significant for a local part. They were required for compuserve addresses back in the beginning, for instance.

NOTE: I am NOT saying that Google is doing things wrong. What they are doing is allowed. They are free to interpret the local part however they want. However, they are NOT required to ignore dots.

It's probably not one person.

[mellon]

The problem is that there are so many people that just a typo will do it. This is why big email aggregators are a bad idea (there are reasons why they are a good idea, of course, or they wouldn't exist, but this is one of the reasons why they aren't).

Unfortunately there is no way to prevent these--there's no test that will reveal them as errors.

Obligatory XKCD

[Anonymous Coward]

https://www.xkcd.com/1279/

Take over!

[mhkohne]

If this person has used your e-mail for his sign-ups, it should be possible for you to take over their accounts by doing password reset.
Do so.
Change the passwords and lock them out.
Shut off any functionality that annoys you, or that costs them money, but try to leave the account intact so they can't re-acquire it.

They'll be forced to re-acquire the account with an e-mail they actually control, at which point perhaps they'll stop accidentally hassling you.

Of course, have a talk with your spouse before doing this, you don't want to create drama at home.

Re:Take over!

[thegarbz]

If this person has used your e-mail for his sign-ups, it should be possible for you to take over their accounts by doing password reset.

He's not. He's clearly giving out this email for things he doesn't care about or wants to use as a burner. Otherwise he'd never get the activation emails in the first place.

Cash in

[Nkwe]

Treat it as a gift. They have just given you an account for whatever service it is. If they sign up with a credit card, even better. Just reset the password and go to town. Clearly by using your email address they intended for you to have the account.

I use President@whitehouse.gov

[jfdavis668]

Four administrations now, and the Secret Service hasn't called me yet.

Re:I use President@whitehouse.gov

[Anonymous Coward]

Is that you Hillary?

Re: I use President@whitehouse.gov

[Anonymous Coward]

Nyet. Is Putin. I have idiot assistant send me emails now, using the twitter.

Happened to me, too

[AtariDatacenter]

I had this guy who thought my ancient [first initial][lastname] email address was his own. He was using it for various things, including signing up for his new credit card. Apparently, his credit card company did not valid an email address before it started sending reward statements, which included a partial card number. The credit card company did NOT provide an unsubscribe feature (unless I logged into the other customer's account which, of course, was not possible). Actually, there was no mechanism for me NOT to get his reward statements!

After escalating to the credit card company's executive customer service (the customer service of last resort when you write to the company's CEO) , they evidently got ahold of the guy to inform him that this email address is bad, and to get his real one.

My recent problems with someone else trying to use my email address have since stopped.

Tips.

[blubdog]

I've had similar problems. One thing you can do is to create filters to send emails from those sites you don't use directly to trash. Or unsubscribe if you get repeated emails from a mailing list. With a little work, you should be able to clean up your inbox.

I'd also take measures to make sure he can't log into your Gmail account. Change your password to something very strong and turn on two-factor authentication.

I punked a snapchat user who did this

[Anonymous Coward]

I live in Australia and have a name common in the U.K. Some English teenager set his snapchat recovery email to my email address. (Firstname.Lastname@gmail.com).
When I received a password reset I got into his account and I fired up conversations with all the girls on there telling them how I've always desired them and want to have hot steamy sex with them.
One responded with "hey I'm your sister!!" I replied "Game of Thrones. Let's do this"
Fun times.

I forward them on to my family for kicks...

[aaarrrgggh]

I have a common first.last@gmail.com. Mostly they are typos; several of my dim-witted namesakes forgot either a number or middle initial when sharing their email address. The one really peculiar one though comes from Nigeria... this being odd since I have a very Irish name... and he doesn't.

But, I do get a kick hearing about the old rugby team meeting up, other people's family news, my gay namesake's dating issues, and other such joys. So, unless you are in Nigeria trying to use an Irish name, please keep it up; it makes for interesting entertainment, especially when in Gaelic.

Re:Baffling

[thegarbz]

Why? I mean we get asked for contact details so often by companies who have no interest in contacting us for anything other than to send us spam. I often just enter the first two words words that come into my head. For a while there was a Bob Dylan record laying next to the computer. I really hope his email isn't bob@dylan.com because he would have been signed up for a shitload of stuff.

Just like every web form that verifies post codes in the state ultimately has a disproportionately high number of users from Beverly Hills, many thanks to the the TV show Beverly Hills 90210. It's the only valid USA post code that a lot of people know.

Humans suck at making up junk data.

Ditto. There's nothing you can do

[seoras]

Back in '97 I registered a personal domain [firstname][lastname].com and I have a very common Anglo name.
Email address is [firstname]@[firstname][lastname].com

There's a real estate agent in Florida who's been happily giving out my email address to clients, lawyers, banks etc for a decade now.
I've had very personal information emailed to me, bank loan applications etc.
I even had one person start an email fight with me, refusing to believe I wasn't who they thought I was, which I ended by point them at the "whois" ownership record of my domain.

There's nothing I can do about it, nor can you. Just delete the emails that come in and filter. Or create a new email account.

The year before I registered my email address I had been using [lastname].freeserve.co.uk which was the UK's first large scale ISP.
I had some idiot email me a plan to rob their local supermarket which I passed on to the authorities...

Snail mail

[RyoShin]

This happened to me many years back. I had managed to get commonnickname.middleinitial.lastname@gmail.com, intending to use it for "professional" purposes. My name, however, is highly common (even including the middle initial), and after having it for about a year I started getting sign-ups and order confirmations that were obviously not for me.

At first, I ignored it. I figure there was a letter difference, or the other guy wanted meant to use @yahoo.com. After a few confirmation e-mails went unanswered, surely he would realize the problem? But he didn't. And then I started getting personal correspondence, as if he was giving it to acquaintances. I replied to two or three, and those did seem to stop, but the sign-ups and orders didn't. I started reporting them to the respective sites, hoping that if stuff stopped showing up he might get the hint, but it never did.

Finally, I got fed up with it, and after yet another order confirmation I used my e-mail address to reset the password for his account, log into it, and get his physical address. Then I typed up a stern-yet-polite message to him to stop using my @)*(*$%&*)@*( e-mail address! One stamp and off it went.

I think that must have done the trick, because the rate started to decrease, but not long after I just got my own domain name and use that now, instead. The gmail account has probably lapsed since. In hindsight, I probably could have gotten in trouble if he was the vengeful type, but I suspected him to be an older guy with only a passing understanding of the internet in general.

Obviously the charge for postage from EU to AUS will be quite a bit higher than my 30 cents I spent at the time. In the meantime, you might make use of the modifier: gmail allows you to use username+modifier@gmail.com (e.g. tukaro+slashdot@), and with various websites you can use a common modifier and set up a filter to deem it "legitimate". Everything else can be shunted to a quasi-spam folder, which will be easier to sort through.

You may also report the sign-ups as being invalid. Most websites I contacted said they would close the account in question (one music site misinterpreted my notice as a claim of fraud), and if a physical letter doesn't work (or you want to use that as a last resort) this may correct the habit.

Re:nothing unusual

[93 Escort Wagon]

Never ascribe to malice what can adequately be explained by incompetence.

Re:Reset the password on the accounts.

[aquabat]

Although the odds are good that, if you didn't have to respond to a confirmation email to sign up, they probably won't have countermeasures on the reset email either.

Happens to me occasionally.

[heypete]

I have [firstname]@[myslashdotusername].com. My domain name is now 18 years old and, outside of certain administrative addresses like postmaster@, abuse@, etc. (all of which forward to my address), mine is the only email address that has ever existed on the domain.

Even so, I occasionally get seemingly-legitimate people entering my address for things like an appointment at an Apple Store to get their iDevice repaired and for other purposes. Fortunately not as much as the original poster, but it does happen on occasion. I usually end up canceling the appointments and whatnot just so they stop. Very odd, as they have very different names than I.

Also annoying: somehow my email address has gotten around as someone in Dubai who is a position to offer employment, so I get tons of unsolicited CVs and cookie-cutter job applications from people living in Dubai. When asked, they say they received my email address at a job fair, trade show, etc. I've not yet had the pleasure of visiting the UAE, so I have no idea how my email has gotten around in those circles. Somehow it's also been picked up by those offering real estate and other services in the UAE, so I get a bunch of spam relating to that. Very odd.

I also have [myslashdotusername]@ and [myslashdotusername1]@gmail.com, and have had them since Gmail first started (both were invite accounts). I mostly got them to reserve the name and, later, for other Google services like YouTube and Google Voice. I occasionally get some guy in Australia, oddly enough, who has [myslashdotusername01]@gmail.com, but either he or the people he correspond with omit the digit 0 and I get his mail. I contacted him through other means (one of the emails "he" received included his phone number) and he is more careful now, but there's occasional screw-ups. Since I don't use the email address for email, I have an auto-responder set saying "If you're trying to reach [guy] in Australia, you have the wrong address."

Autocomplete compounds the problem

[Chuck Chunder]

I think autocomplete might compound the problem. People get it wrong once and their browser helpfully offers the wrong email in future forms. They send a group email with a wrong address, people reply-all and then everyone's email client thinks it's a known address and helpfully offers it as an autocomplete option in future. I have a first name last name @ gmail account and I get it quite a bit. Sometimes included on some family emails, sometimes emails from lawyers. Some guys Xbox account (who are you Cationicllama88?). Once someone's uber/lyft account, which I presumably could have used. Mostly I just ignore them if it is just some random site someone has signed up to. If it's personal/business then I normally reply pointing out the mistake and then delete the email, those people are generally appreciative of the effort. The ride sharing company was a pleasant surprise, I expected them to be a faceless void but got a real person who sorted it out quickly.

Re:Dkim domain validation

[DeHackEd]

No, wrong problem. DKIM and SPF are to prevent joe jobs where someone sends email address faked to be sent from you as a malicious act. This is about a user whose email address is the recipient resulting from (presumably) user incompetence.

Re:I....

[Just Some Guy]

And everyone stood up and clapped.

Re:Reset the password on the accounts.

[ShaunC]

Yes, exactly. I have the same problem with my Gmail account. Over the years many hundreds of people have mistaken it for their email address, distributed it far and wide, and entered it into all sorts of things. Sometimes I just let it go, especially if a site only sends one "thanks for registering" email. I hit delete and move on. But if the service is a particularly spammy one, I'll use the "forgot password" link, login, change the password, turn off all email-related options, etc.

I used to look for an option to delete the account entirely, but that invariably led to the same people signing back up for the same services again. Occasionally I'll try to do the other guy a favor and tell the sender that they have the wrong address. It usually isn't worth the effort. Someone has a Royal Bank of Scotland account registered to my email and no amount of emailing, filling out their contact form, or tweeting at them ever did any good so I just filtered that domain out.

Not much you can do about people sending random unsolicited communications, though. I've received some really interesting misdirected mail over the years, including some stuff from the European Space Agency, and being cc'd on an NFL player's contract negotiations with a new team.

Re:Baffling

[dryeo]

There's always,
North Pole
Canada
HOH OHO
If you want an easy to remember real address and don't mind spamming Santa with snail mail.

Re:Annoying as hell

[pepsikid]

XBOX is just the worst! They *know* you're not their customer (whom they're emailing) so they refuse to do anything for you *including* not emailing you any more! My theory is that since an email is required to have an account, if they remove your email, they'll have to cancel the account. This puts them in the position of possibly refunding membership fees. It's about the money. You have to receive spam emails because they want to keep someone else's money.

Those emails come with an "unsubscribe" link, but it says something like, "you may receive email for up to 2 weeks anyway". Good ole Microsoft; bestest technology in teh werld, can't stop the emails instantly like everyone else. Ugh. You'll continue to get emails for months, actually. I think they reset the clock each time you click their unsubscribe link, too.

Re:Almost the exact same thing happened to me.

[cas2000]

i did the same. i'm in Australia and my gmail account gets mail all the time from Americans signing up for things with my gmail address. Including bank accounts, car purchases, and travel itineraries (including boarding passes). Idiots.

i either flag them as spam, delete/ignore them, or sometimes (if the sender is a real person and I'm in a helpful mood - like when some kid was trying to contact her uncle...oddly enough she had a similar name to my own niece) I try telling them that they've got the wrong address. The shock of learning that foreigners use the internet too sometimes gets them to contact their friend and tell them to stop using my gmail address.

i rarely use gmail (i have my own domains and mail server), so my gmail is 99.99999% spam, plus some mail for a bunch of idiots using my email address, and a tiny amount of real mail meant for me.

I wonder if it's a thing. If a store or something asks you for your email address and they already know your name. Just give them a fake email.

I have no idea what the average internet user does, but I make a new email alias for every online shop and everything i sign up for - easy if you run your own mail server. If they spam me or sell my email address, I just delete the alias (and permanently boycott the shop - I do not and will not do business with spammers). Problem solved.

Re: Reset the password on the accounts.

[Anonymous Coward]

Dear needlessly promiscuous 47 year old monkey

My name is Barrister j.c.don a Legal practitioner and member of the Institute of Advanced Legal Studies and Institute of International Affairs in my country.

I am forwarding this proposal to you out of the intuitive confidences I have about you and your ability to assist in the executtion of a certain straightforward transaction.

The transaction involves a cash investment of the sum of US$40,500,000.00 (Forty Million, Five Hundred Thousand United States Dollars) in Estate business or buying of shares in a strong reliable company in your country. The investment will be under your supervision, control and on behalf of my client, a former Military Governor of a State in Nigeria during the immediate past Military Regime. As a result of a very personal and political reason, he has decided to maintain anonymity for now pending a confirmation of your willingness to assist and co-operate in execution of the project....