<story><title>The dots do matter: how to scam a Gmail user</title><url>https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-gmail-user</url></story><parent_chain><item><author>Pxtl</author><text>I have multiple &amp;quot;e-mail doppelgangers&amp;quot; - confused people who don&amp;#x27;t know their own email address and so accidentally use my address when they register stuff.&lt;p&gt;One&amp;#x27;s in Chile. I have almost no knowledge of Spanish.  The other is in California.&lt;p&gt;Having experienced this:&lt;p&gt;Services need to email new email accounts they become aware of ASAP.  They have literally &lt;i&gt;zero&lt;/i&gt; UI available to me to notify them that this is an invalid email address.  The very first interaction when a user registers an account with their email on the service needs to be &amp;quot;Welcome username to MyCompany.com!  If you didn&amp;#x27;t create an account with MyCompany, click here to let us know and we&amp;#x27;ll remove the email address from this user&amp;#x27;s account!&amp;quot;&lt;p&gt;If Netflix does not do this, Netflix is doing it wrong.  It also would solve your security issue - by immediately notifying the address that a new account has been created on them, it notifies the user to expect additional emails and allows them to take action immediately.&lt;p&gt;This also prevents another problem: What happens if somebody has already accidentally claimed my email address on a service I want to join?  If you don&amp;#x27;t provide a way in the emails to say &amp;quot;that&amp;#x27;s not me&amp;quot;, then I have no way to ever register for your service with my address.</text></item></parent_chain><comment><author>jjeaff</author><text>I have a very short email address and get lots of these. What I do is immediately log in to the service and change the password. Then, if possible, I log out any other devices that are logged in.&lt;p&gt;Then they can never access the account and continue to to use the service.&lt;p&gt;Where available, I will delete the account as well.&lt;p&gt;I found that if I don&amp;#x27;t do this, then I am just going to be receiving notification emails forever from that account.</text></comment>
<story><title>The dots do matter: how to scam a Gmail user</title><url>https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-gmail-user</url></story><parent_chain><item><author>Pxtl</author><text>I have multiple &amp;quot;e-mail doppelgangers&amp;quot; - confused people who don&amp;#x27;t know their own email address and so accidentally use my address when they register stuff.&lt;p&gt;One&amp;#x27;s in Chile. I have almost no knowledge of Spanish.  The other is in California.&lt;p&gt;Having experienced this:&lt;p&gt;Services need to email new email accounts they become aware of ASAP.  They have literally &lt;i&gt;zero&lt;/i&gt; UI available to me to notify them that this is an invalid email address.  The very first interaction when a user registers an account with their email on the service needs to be &amp;quot;Welcome username to MyCompany.com!  If you didn&amp;#x27;t create an account with MyCompany, click here to let us know and we&amp;#x27;ll remove the email address from this user&amp;#x27;s account!&amp;quot;&lt;p&gt;If Netflix does not do this, Netflix is doing it wrong.  It also would solve your security issue - by immediately notifying the address that a new account has been created on them, it notifies the user to expect additional emails and allows them to take action immediately.&lt;p&gt;This also prevents another problem: What happens if somebody has already accidentally claimed my email address on a service I want to join?  If you don&amp;#x27;t provide a way in the emails to say &amp;quot;that&amp;#x27;s not me&amp;quot;, then I have no way to ever register for your service with my address.</text></item></parent_chain><comment><author>dpwm</author><text>I actually have dots in my Netflix account email address &lt;i&gt;because&lt;/i&gt; somebody who wasn&amp;#x27;t me had previously started to register for Netflix using my email address.&lt;p&gt;I have had to do this with some other services as well. Some services won&amp;#x27;t allow the + in gmail addresses, which is pretty annoying.&lt;p&gt;If a service starts recognising the dots don&amp;#x27;t matter and denying the plus symbol, there&amp;#x27;s a good chance I won&amp;#x27;t be able to register without obtaining a new email address.&lt;p&gt;I wouldn&amp;#x27;t mind but my name is really not that common -- my surname is uncommon enough for me not to have met another with that surname outside my family.</text></comment>