The contact page on our website has a simple form: name, email address, message. For years, when somebody submitted it, two emails went out. One went to our customer service inbox. The other went to the address the visitor had typed, thanking them and repeating their name and message back to them so they had a copy.
In August somebody else noticed that second email. Over one weekend our form was submitted about nine thousand times by automated scripts, each time with a different stranger's address. The name field held a short line saying an account payment had failed, and the message field held a link to a page asking for card details. So nine thousand people received an email from our real domain, sent by our real mail service, which said thank you for contacting us above what looked like a payment problem.
Every check a receiving mail server makes passed, because the email really did come from us. That is exactly why it was worth doing. Our mail filtering, our domain authentication and our staff training all protect people from mail pretending to be us. None of them help when we send it ourselves.
We found out on the Monday, when our mail provider throttled our sending after a spike in spam complaints and the order confirmations from our trade website started arriving hours late. A few of the recipients were our own customers, and two rang their branch to ask why we wanted their card details.
The fix was mostly removal. The form no longer sends anything to the address typed into it. The visitor sees a confirmation on the page with a reference number, and customer service replies as a person. The form now checks for automated submissions and limits how often it can be used from one address. Then we searched our websites and portals for every other feature that emails an address a visitor supplies, and found three: a quote request, a newsletter sign up and a button to send a product to a friend. The last one we simply switched off.
Any feature that sends an email to an address a stranger supplies, containing words a stranger wrote, lets that stranger send email as you. Find those features before somebody else does.
– Serguey Shinder
Top comments (0)