Is someone trying to gain access to my email account?

July 26, 2019 9:05 AM

I recently started getting a slew of messages to my email account from a number of job-search sites. My email is my first initial+last name, so I often get emails for people with similar names, but most of these new emails are coming from sites I've never heard of before. And, when I went to a couple of the sites and entered my email on the sign-in screen with the intent of resetting the password and deleting the account, there was no record of an account with that email! How worried should I be?

Let's say my name is Alice Crabapple, at acrabapple@gmail, so I sometimes get emails for Adam Crabapple or Anne Crabapple who have clearly entered an email incorrectly while signing up for something. I originally thought this was another case of the same thing, since all the emails were addressed to the same person ("Annette") and all the jobs they were sending me were located in one of two places (Macon, GA and Fort Hood, TX), but now I'm a little suspicious. Not only did this person somehow enter their email incorrectly in a half dozen sites in a row, but also, with the exception of an email from ZipRecruiter, I've never heard of these sites: neuvoo.com, jobtreadle.com, sparklyquest.com... (although they do appear to be actual websites, when I google for them). And, when I went to a couple of those sites (by googling for their name, not clicking on links in the email) and entered my email in the "forgot your email"/sign-in pages, there was no record of an account with that email!

I was stupid and clicked on a couple of the job links in a couple of the emails before a possible scam occurred to me, as well as on a couple of the "unsubscribe me from this email" links. The job links did seem to go the actual sites, and nothing asked me to enter passwords or personal information, but I'm nonetheless worried I may have compromised my gmail account, which would be terrible as I basically conduct my entire life from it. I have two-factor authentication set up, and I keep track of where/what devices my account has been signed in from, and there have been no security notifications on that front, but what else, if anything, should I do to keep safe, and how worried should I be?

posted by Meow Face to Computers & Internet (11 answers total)

Best answer: On most job sites, you can create an alert to have them email you jobs without actually registering an account. That may be what you're encountering here -- someone who doesn't know her own email address is creating alerts all over the place.
posted by jacquilynne at 9:11 AM on July 26, 2019 [3 favorites]

So this happened to me one time (I mean, it has happened a lot but this one specific time) where some person put in my email address for their kids' school stuff. I started getting PII about the kids in my email (what??) so I called the number on the email to get it to stop. What the lady said to me then, I've repeated a million times since -- people literally are told to fill in their email and if they don't have one they will make it up just to pass the hurdle. As in, they do not understand how email works.

So am guessing you are running into the same situation.
posted by Medieval Maven at 9:42 AM on July 26, 2019 [2 favorites]

This situation can't possibly pose a threat. And there's no real reason to thing someone's "trying something". Trash and move on. Any other action only opens up your vulnerabilty.
posted by humboldt32 at 10:08 AM on July 26, 2019

It's happened to me with job hunts and other things. It's a real person who is either just filling in a field to check a box, filling in a legit email address incorrectly (and consistently), or who thinks it will be their email if they believe it is. As Medieval Maiden says, they just don't understand how email works.

It's heartbreaking to think they are trying to find work and messing up their contact information. I used to try and help the parties connect, but since there's no way to contact the person using your email, it's hopeless.
posted by quarterframer at 10:32 AM on July 26, 2019 [1 favorite]

I'm going to disagree with humboldt32 here. If you want to hide something, and you can't make the needle smaller, you make the haystack bigger.

Probably nothing nefarious is going on, but one way that someone trying to get away with something (changing passwords, updating account information, changing service) will try to enhance their odds is they'll flood you with irrelevant e-mails. Basically, if you have a hundred junk mails coming in, you're more likely to miss the important ones.

Again, /probably/ nothing nefarious. Go change all your passwords, and enable 2FA anyway.
posted by Zudz at 11:04 AM on July 26, 2019 [1 favorite]

The Asker said they already have 2FA set up. I run into the same issue regularly. This is no more than an annoyance. Either set up a rule to send emails from these sites to trash or send them to a new label, mark them as read and ignore. My guess is that the unsubscribe button would work, but not worth the risk of trying. Just ignore.

As for 2FA, 6 months ago I switched to using a fob rather than an app or a text. I purchased said fob from Google. It is what their employees use. It is pretty simple to use.

True story. One day about 2 years ago, I started getting confirmations for signing up for some porn sites. Then I would get solicitations from sketchy sites. I set up a rule to send them to trash. This person, over the course of 2 years would sign up for all sorts of porn and sketchy sites. I once figured out that the person was in his 60s or so. Over the course of time I was able to ascertain his full name and the area in which he lived.

About a month ago, I received an email from a sex addict rehab center with instructions on what to bring and not to bring to his upcoming stay. I hope I get the discharge email saying how proud they are of him for completing his program.
posted by AugustWest at 11:22 AM on July 26, 2019 [5 favorites]

entered my email in the "forgot your email"/sign-in pages, there was no record of an account with that email!
You might want to double check that the emails are being sent to exactly [e-mail]. Gmail ignores dots, and everything after a +sign at the end. So [e-mail], [e-mail], [e-mail] will all end up in your email box. It’s possible that your alter ego is using something like this instead, and that the websites see these as different accounts.
posted by scorbet at 11:59 AM on July 26, 2019 [2 favorites]

Best answer: Some job websites require a viewer to enter an email address to get past a wall where they can see more, such as the job description or salary survey, but don’t require the person to actually verify the account. Possibly someone is using what they think is a made-up email address to access the deeper views of job listings. The reasons there’s not an account created could be that 1) the person didn’t bother finishing setting up an account once they got what they wanted from the site, and 2) the person also doesn’t have access to your email (which they think they invented) and cannot verify the account.
posted by Knowyournuts at 12:22 PM on July 26, 2019

I get[*] tons of emails from unfamiliar job sites to my work address, which I rarely hand out and which couldn't be mistaken for anyone else's ([e-mail]). I've no idea why. They started out quite focused (jobs in tech in the city I work in) but rapidly diversified to absolute rubbish, listings for jobs sharing a single word with my job title, mostly in countries in which I have no right to work. I use Gmail filters to filter them straight to oblivion; it's never even occurred to me to worry about them, and as anyone who knows me could tell you, worrying is my superpower. I don't think you should worry either. With 2FA set up, and keeping an eye on account activity, you'd know if your account had been compromised. Set up filters so you don't miss any wheat amongst the chaff, and forget about it.

[*]Using the present tense here, but I've been filtering them to the bin for years, so it's possible the torrent stopped at some point.

Incidentally, my personal account is (using your example) [e-mail], and that's the form in which I use it. So I know for sure that anything addressed to [e-mail] is either spam or a fellow Crabapple with poor attention to detail signing up for a site with sloppy signup processes, and either way, it's nothing I need to see. I filter all of those into a "probable spam" folder, and would happily recommend doing the same - in your case, for the variant with the dot rather than without it.
posted by ManyLeggedCreature at 5:31 PM on July 26, 2019

Best answer: For what it's worth, I signed up for some job listing emails, and they're starting to multiply into emails from sites I've never heard of. I think a lot of these sites are connected in some ways or give (probably sell) users' emails to one another. I just unsubscribe from the ones I don't want, and it seems to work.
posted by Leontine at 12:10 PM on July 27, 2019

Response by poster: Thanks, everyone! It sounds like it's probably not something to worry about, so *whew*. I feel a little silly now for worrying so much about this---I realized yesterday that a lot of this worry was probably a result of a recent medication change, which just happened to unfortunately coincide with a weird email thing. Thank you to everyone who responded, your reasonable explanations helped a lot while my brain chemicals were coming back online. :)
posted by Meow Face at 8:38 PM on July 29, 2019 [1 favorite]