Robert Heller wrote: > At Thu, 8 Oct 2026 17:20:45 -0500 nwe <[email protected]> wrote: > >> >> Granted, not a safe habit, but I cheated several times: >> >> I've sometimes just opened the PDFs in question in atril (maybe a bad >> idea?). So far, they pretty much always did not contain what they >> claimed, instead containing a button to click to access the promised >> document... >> >> On some I did click that button, it popped open a login with: Please log >> into your email: with fields for my email address and password. Aha! If >> I entered my credentials, they would be able to log into my email account. >> >> Got one of those just the other day. I clicked on it and it displayed >> what appeared to be my mail provider's login form for that email >> account. The only difference I could see was the website address in the >> browser was NOT the mail provider's address. I entered made-up >> credentials, and clicked login, then it redirected me to my mail >> provider's front page. That specific mail account has been receiving >> that form of spam from other users on that domain who apparently >> provided their real credentials and got their account compromised. Each >> time a new version shows up I forward it to support@ that provider. > > I get these all the time. *I* don't use a webmail system (I get my E-Mail by > a comletely different way). I also get these sorts of messages to E-Mail > addresses that don't even have a mailbox (or any kind of login) -- these are > "fake" e-mail addresses that feed into a ticket system (RT). Ha!
yep, they just want you to call that number so they can get information from you to exploit, banking information, account numbers, identity, etc. one message like this i got months ago which was a supposed Amazon charge, they didn't use my real name in the message nor did they give a valid Amazon contact phone number. i called Amazon (a fun trip there as you have to work through the waste of time menus before talking to a real person) to verify that the e-mail address attempting to being phished was not an active Amazon account. at first the Amazon person wanted even more information and i kept saying that i just wanted to verify that the e-mail address was not being used without giving them any more information which they did eventually do. the rediculous phone menu system and wading through the bs took more time than it should have, but it did get done. never call a phone number provided in an e-mail without verifying it using some other way (visiting their actual website using a link not in the e-mail sent to you). e-mails often have fake links in them along with fake sender information i always look at the headers of such messages. unsolicited e-mails aka SPAM is rarely legit and even if it is legit and coming from an actual company and/or person it is rarely anything i have any use for. wasting time to unsubscribe just verifies they have a live e-mail address and usually makes things worse - delete it and move on. i'm wasting too much time on this. ... :) songbird
