A scam of some sort

@Patsy1011 Gmail has very good anti-phishing protection. You might try it.

Patsy1011 said:

Thanks for all that info. Absolutely correct - NOT an IT person. My question is - if all of this type of scam stuff gets into your email program, doesn't just a password change fix -- at least -- that one?
I did that late yesterday and as of this morning nothing from that sender has shown up. I am thinking all is ok again.

Click to expand...

It's likely your password had zero to do with this incident.

oldschool said:

@Patsy1011 Gmail has very good anti-phishing protection. You might try it.

Click to expand...

You're right, I have several gmail accounts, and they get very few SPAM or phishing emails. My domain email gets more, but I'm gradually tuning the SPAM filter to lower the volume.

The girlfriend and I have had normal personal Gmail accounts for decades, using some sort of derivative of our names..., the occasional spam gets through.
A number of throwaway accounts I've created were given very 'corporate' sounding monikers..., never get any spam in those.

Edwin said:

The girlfriend and I have had normal personal Gmail accounts for decades, using some sort of derivative of our names..., the occasional spam gets through.
A number of throwaway accounts I've created were given very 'corporate' sounding monikers..., never get any spam in those.

Click to expand...

Same here. My two Gmail accounts get very few spam emails. My Hotmail account, on the other hand, is a very different story.

I got one of these too. I just ignored it. It's clearly some chancer that's hoping you'll respond. My money's safe, that's all that matters.

Phishing and more broadly social engineering prey on two psychological aspects of humans; fear and empathy. Both of these can override a persons logical reasoning and trigger us to take action (paying the $600 or clicking some link to help someone in need etc)

Never reply to a phishing email, text etc this can and does trigger your contact information to be added to datasets as "active information and 'willingly engagement'" these datasets get sold on darkweb market places or to IABs (initial access broker) cyber criminal groups. These are more valuable since they know there is a better chance of engagement and profit. This translates into a higher likelihood of increase spam/phishing activity

How Did They Spoof Me?
Good question for sure and here's a bit of a breakdown.
Many companies employ an email security feature called DMARC which includes a DMARC policy, SPF and DKIM DNS records. These combined prevent spoofed emails from reaching intended targets. DMARC works great for custom domains, but when we're talking about at an email service provider level (aka yahoo, gmail etc) they all share the same DMARC policy. This allows the spoofing to happen because event though the from maybe spoofed the same DMARC, DKIM, and SPF are used and will come across as valid.


I saw it mentioned, but if you haven't, you can enter your email into the Have I Been Pwned website. This will tell you how many breaches and which data points where leaked due to the breach. This site is run by a well-known security professional Troy Hunt, whom also is a VP at Microsoft. Granted this is just breaches they have data on and there are likely plenty of breaches not mentioned.

Armed with your email attackers and programmatically blast out thousands or more emails with this type of low quality phishing email messaging and circling back to that fear element many folks may fall for this type of email. Based on the generic messaging of what you received it's likely just that a social engineering tactic to elicit fear. Often attackers will want to provide proof of compromise as that will often lead to greater success of payment.

Last point,
There are honestly hundreds if not thousands of breaches including the notable Experian breach which leaked almost every US citizens data including SSN, so you really can just assume your data is out there making it a completely moot point to even pay. Basically assume your data is leaked and keep your credit frozen at all times

Just to be on the safe side you might consider putting a credit freeze in place.

The will lock your information to anyone looking to open a credit card in your name. This prevents anyone, including you, to get a credit account.

You will get a pin to re-open/close access to your report. The only downside to this is if you want to open a credit card on the spot to save money at a store, you can't do that. You'll have to unlock it 1st using your pin.

More information is here.

While a credit freeze is in place, nobody can open a new credit account in your name, including you. If you need to do things like apply for new credit or a job, rent an apartment, or buy insurance, you can temporarily lift the freeze and put it back when you’re done.

Click to expand...

neemobeer said:

This site is run by a well-known security professional Troy Hunt, whom also is a VP at Microsoft.

Click to expand...

He's a regional director; he doesn't work there.

I have marked this as "unresolved" as I got another one. Same basic garbage as first one. I had changed my password but got one anyway after doing so. As an aside, I put a credit freeze on my accounts many years ago. I will notify my bank that this is happening to make them aware. Hopefully it is another scam and will go away and leave me alone without my responding to them. Even if I check where the breach occurred, which I did check, how can you stop them from happening? Password will be changed again but didn't seem to stop them. Thanks again.

Nobody needs a password to send you this email. Just ignore it.

I am going to do just that. So annoying this stuff!! Thanks again.

Picture it like this. I walk up to you on the street, total stranger (and strange), and I say to you exactly what’s in that email. Do you believe me?

neemobeer said:

Phishing and more broadly social engineering prey on two psychological aspects of humans; fear and empathy. Both of these can override a persons logical reasoning and trigger us to take action (paying the $600 or clicking some link to help someone in need etc)

Click to expand...

Apparently I didn't get that gene, that crap has never worked on me, and I'm too old to start being that gullible!

gunrunnerjohn said:

Apparently I didn't get that gene, that crap has never worked on me, and I'm too old to start being that gullible!

Click to expand...

I, too, didn't get that gene. Also, I'm stingy with money unless my wife's concerned!

I've had a few of these.. I got one years ago on my work email.. the usual stuff like "we have pictures of you, etc.".
My work laptop is so locked down, didn't even have an active camera and was always docked.
As mentioned above.. it's about FEAR of having something exposed.. pay us or else.
Report it as spam then DELETE the email.