15

Suppose a spam email tells you that you've earned $1m. To get the funds the email goes on to tell you to email [email protected]. My question revolves around why Gmail doesn't block "[email protected]" on the spot when it detects such an obvious fraud (which it correctly marks as spam), so that less savvy users don't take the unfortunate step of getting defrauded out of their savings with little to no recourse.

A real life equivalent might seem to be a driver who waits for the hitchhiker they picked up while the latter does a bank heist, and continues on with their passenger after they're done. Surely such a well meaning albeit naive driver wouldn't stand a chance in court if they said that it's because they've a section 230-like protection.

Also, given the amount of spam I receive that actually use Gmail accounts, I presume -- but have not checked -- that the accounts do not get disabled quickly by Gmail and others. (Some do answer, with amusing results.) This is on the basis that fraudsters would use an actual domain name if email account providers did block these emails quickly.

Why do Gmail, Hotmail, etc. get away with enabling bank wire fraud? Is section 230 indeed the reason that they do? Has this ever been tested in court as a class action in the US or elsewhere to see where it leads?

To clarify what is being asked:

This is not about blocking e.g. Gmail accounts that send spam, nor is it about detecting spam. Rather, the question is about blocking e.g. [email protected] in emails that Gmail already identifies as spam (with near 100% accuracy) in a format that revolves around:

Congratulations, someone gave you lots of moneys. Please email [email protected] for instructions on how to collect it.

Further, the question is not why doesn't Gmail stop such emails from being sent. Rather, it is: Is section 230 indeed the reason that they get away with not shutting down accounts like "[email protected]" in the above example quickly when they detect such emails without being held liable? Has this ever been tested in court as a class action in the US or elsewhere to see where it leads?

Improve this question
12
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Dale M ♦
    Commented Mar 5, 2020 at 0:38
  • 1
    If the info in the deleted comment is that important, it should be in the question.
    – Dale M ♦
    Commented Mar 5, 2020 at 0:50
  • 1
    @DaleM: As it happens the information is in the question. But apparently some read comments more often than the question in whole.
    – Denis de Bernardy
    Commented Mar 5, 2020 at 8:00
  • 1
    The legal aspect of this question is in fact answered in the linked Wikipedia article in the question. Yes, 230 is the main reason, and yes it has been tested, with things far more terrible than wire fraud.
    – ttbek
    Commented Mar 5, 2020 at 14:56
  • 1
    Your question has some weak spots - like: "Did the email originate REALLY" from that gmail-account ... In many cases spam of this kind comes from hijacked "peanut" services - but tell me to send answer to "X" .. likewise I received spam that after checking the header seemed to originate from my own address ... Header manipulation is a given, the more sinister the intends of the source
    – eagle275
    Commented Mar 5, 2020 at 15:57

5 Answers 5

Reset to default
52

Surely such a well meaning albeit naive driver wouldn't stand a chance in court if they said that it's because they've a section 230-like protection.

Because Section 230 of the Communications Decency Act explicitly protects computer service providers from such charges. A driver is not a computer service provider, and the US legislature has never voted to offer similar protection to drivers picking up hitchhikers.

You say that an email can easily be classified as fraudulent, but that's not true. Spam detection has gotten pretty sophisticated, but they still get plenty of false positives. They were a lot less sophisticated back in 1996 when the Communications Decency Act was passed.

Improve this answer
8
  • 32
    @DenisdeBernardy (shrug), I see some spam that makes is through the filters, but more importantly I have occasionally lost important messages that got classified as spam.
    – Charles E. Grant
    Commented Mar 2, 2020 at 21:34
  • 17
    @DenisdeBernardy Google has the advantage of handling billions of emails and a lot of the spam filtering is handled through user feedback, i.e. the report as spam button. If a mail is often reported as spam, all other users that receive a similar email have it flagged as spam automatically. If there was a new email provider to start up, it wouldn't have the amount of emails and user feedback to reliably set up a similar system. In a way, such a law would establish the big existing email providers as oligopolies, barring new competitors from entering the market.
    – user21396
    Commented Mar 3, 2020 at 7:25
  • 2
    @Morfildur Also note that a similar mechanism is probably on the "Delete" button. Many users will just delete spam, without reporting it. And the danger of false positives is present there even more.
    – Sulthan
    Commented Mar 3, 2020 at 14:01
  • 4
    @DenisdeBernardy False positives does not mean the filter does not catch spam. It means the filter falsely catch non-spam. For example an important email from your boss telling you to be in a meeting
    – slebetman
    Commented Mar 4, 2020 at 17:30
  • 2
    even worse, it's quite easy to spoof the origin of an email message. I can send you an email that appears to the casual observer at least to come from a gmail address that isn't mine, and never originated from any gmail account at all for example.
    – jwenting
    Commented Mar 5, 2020 at 5:12
38

This is a technical answer rather than a legal one. If those are unwelcome here, let me know

My question revolves around why Gmail doesn't block "[email protected]" on the spot when it detects such an obvious fraud

They often do. I am an admin on a G-suite domain, and I get several emails every month titled "Alert: User suspended due to suspicious activity". It usually means someone re-used a password, their account got compromised, and it is now being used to send spam.

Also, given the amount of spam I receive that actually use Gmail accounts, I presume -- but have not checked -- that the accounts do not get disabled quickly by Gmail and others.

Several things come in to play here:

  • Google is definitely more aggressive in tagging a message as spam than it is suspending an account (I get "G Suite Alert - You have users sending spam through your SMTP relay" emails warning me that suspension is imminent much more often than I get "Alert: User suspended due to suspicious activity" emails). This discrepancy is probably where the bulk of the problem comes from.
  • Emails can be retroactively tagged as scams, so the account might have been suspended by the time you read the email. From the scammers point of view, as long as this only happens some of the time, this is not that a big problem. This is a bulk business.
  • "FROM" in an email is super easy to spoof, so they might not actually be using Gmail accounts. Consider the following scenario:

EvilAlice wants to scam VictimBob. She creates the account [email protected]. She then uses another non-Gmail server (or botnet infected computer) to send a message to [email protected]. She instructs her server to tell the Gmail server that it is a Gmail server. Gmail knows she is lying (for several reasons, search for SPF and DKIM records if you are interested), so Gmail marks the message as a scam. Gmail can't really suspend [email protected] though, because as far as Gmail is concerned the real [email protected] hasn't done anything. Someone was just trying to impersonate her. VictimBob opens the message and replies. Gmail tries to warn him, but he is insistent. What is Gmail to do? The only return address on that message was [email protected], so Gmail sends the reply there. From Gmail's point of view, [email protected] has now received an unsolicited offer of money from VictimBob. Gmail can't suspend her account for that, otherwise I could suspend everyone's account by emailing them and offering them money. And so the scam communication is complete. Eventually Gmail builds up enough confidence that it thinks it's justified in suspending [email protected], but Gmail accounts are easy to make. EvilAlice just creates [email protected] and the process continues.

If you want to know if a message really came from the domain it claimed to come from, hit the 3 dots on the message in Gmail, click "Show Original", and look for "SPF PASS" and "DKIM PASS". If those are failures, someone is impersonating the domain.

Improve this answer
2
  • I will point out that the Stack is a collaborative knowledge base building tool. While there's little legalese in this particular answer, it compounds with the other answers and provides a fresh point of view on why the email providers can't be liable. It gets my upvote for adding to the greater picture even though it is slightly off-topic on its own. Sometimes you can't just slap quotes of legislation.
    – Mindwin Remember Monica
    Commented Mar 4, 2020 at 17:17
  • 1
    This answer is technical, but it also raises some legal issues as well. If Google starts automatically suspending addresses, and random innocent people start losing email (in some cases services they're paying for) that creates liability for Google. If Google proactively suspends an address simply because it appears in a scam email, then I can arbitrarily shut down your email by simply sending a scam email with your address in it. Publishing a random email kill switch to the general public is going to end badly for whoever does it, both technically and legally.
    – barbecue
    Commented Mar 5, 2020 at 16:40
14

So many people have come up with ideas about spam that there is actually a standard "fill in the blanks" form for answering them! A copy can be found here.

Filling in the blanks for your solution:-

Your post advocates a

(X) technical ( ) legislative ( ) market-based (X) vigilante

approach to fighting spam.

As well as the technical side, it requires the ISP to act as a vigilante. Without any kind of due process, the ISP would shut down email addresses based only on the assumption that the person with that email address sent the email. (And because of the nature of email, actually proving it is virtually impossible.)

Your idea will not work. Here is why it won't work.

Here we go...

(X) Mailing lists and other legitimate email uses would be affected

Suppose one of your newsgroup users sends spam to the group inbox, which is forwarded to the rest of the group.

(X) Users of email will not put up with it

Too many false positives.

(X) Microsoft will not put up with it

Because it's a huge amount of work for no income.

(X) The police will not put up with it

Because there's no due process in cutting people off, and getting a common standard of law across the world doesn't happen.

(X) Anyone could anonymously destroy anyone else's career or business

ISPs can't unilaterally spot spam, so they're dependent on users reporting what's spam.

Specifically, your plan fails to account for

(X) Lack of centrally controlling authority for email

(X) Open relays in foreign countries

(X) Jurisdictional problems

(X) Huge existing software investment in SMTP

(X) Armies of worm riddled broadband-connected Windows boxes

(X) Eternal arms race involved in all filtering approaches

(X) Extreme profitability of spam

(X) Joe jobs and/or identity theft

I'll let you check how each of these applies to your solution.

and the following philosophical objections may also apply:

(X) Ideas similar to yours are easy to come up with, yet none have ever been shown practical

(X) SMTP headers should not be the subject of legislation

(X) Blacklists suck

(X) We should be able to talk about Viagra without being censored

(X) Countermeasures should not involve sabotage of public networks

(X) Countermeasures must work if phased in gradually

(X) Why should we have to trust you and your servers?

The latter is the key issue. Who says what spam looks like?

Furthermore, this is what I think about you:

(X) Sorry dude, but I don't think it would work.

Improve this answer
20
  • This answer is actually besides the point. The question isn't about blocking the spam, the question is about why email service providers aren't shutting down email addresses that they're finding in already identified spam that are likely scams to boot.
    – Denis de Bernardy
    Commented Mar 3, 2020 at 13:53
  • 8
    @DenisdeBernardy "Lack of centrally controlling authority for email", "Open relays in foreign countries", "Huge existing software investment in SMTP". You cannot "shut down" an email address. It is not technically possible. All you can do is block incoming emails. And tell me again how you identify spam, because "We should be able to talk about Viagra without being censored".
    – Graham
    Commented Mar 3, 2020 at 14:00
  • 3
    @Graham I'm pretty sure that Google can shut down a G-mail address; which is what the question was asking about. They can't prevent spoofing to appear from that email address; but I'm quite sure they can shut down accounts if they have sufficient reason.
    – JMac
    Commented Mar 3, 2020 at 14:58
  • 4
    @Graham You're re-framing the question implicitly. You need to make your assumptions explicit to avoid it looking like you're begging the question to anyone who can't imitate you train of thought well enough.
    – jpaugh
    Commented Mar 3, 2020 at 17:33
  • 3
    @JMac Gmail can shut down an email account, but they can't prevent third-parties from sending email with an address which is the same, or looks similar. At the end of the day, it's an arms race. The spammers intentionally do the least amount needed to thwart spam filters "often enough," since making the spam look obviously wrong to a typical reader filters out everyone who isn't naive wrt. spam, so they don't waste their time with those who might otherwise bite the hook but won't swallow.
    – jpaugh
    Commented Mar 3, 2020 at 17:38
3

This is also admittedly more of a technical explanation than a legal one but it's relevant.

The spammer presumably has control of multiple accounts. Whether the accounts were stolen from other users or created by the spammer themselves, they likely have not just one but hundreds, thousands, or even millions of accounts they can send scam mails from. It may be that you are in fact the first person to receive this spam from joe.shmoe specifically, and nobody has yet reported it as spam. Google may indeed take down accounts that are reported, but if the spammer can just steal/create more with almost no effort (likely through the use of bots), there's only so much they can do to keep up with the flood. Sure, they might notice hundreds of accounts being created by the same user at the same location, but there are ways of spoofing that as well, and any sophisticated spammer would be well aware of these. Spam detection tools may be increasing in quality, but so are spammer's tools. It's a never-ending arms race.

Improve this answer
2
  • The question is not about emails sent from Gmail accounts. It is about shutting down [email protected] when Gmail blocks scam emails (as spam) that contain "please contact [email protected]".
    – Denis de Bernardy
    Commented Mar 4, 2020 at 21:13
  • @DenisdeBernardy that's a confusing question that seems to have an obvious answer. How does that string of text appearing in the body of a message have any bearing on whether or not that email address is legitimate or not? Think of the potential for abuse. If Google blocked emails as you're indicating, all I'd have to do to shut someone else's email down was send spam containing their email address in plain text in the body.
    – dwizum
    Commented Mar 5, 2020 at 17:47
0

Suppose a spam email tells you that you've earned $1m. To get the funds the email goes on to tell you to email [email protected]. My question revolves around why Gmail doesn't block "[email protected]" on the spot when it detects such an obvious fraud (which it correctly marks as spam), so that less savvy users don't take the unfortunate step of getting defrauded out of their savings with little to no recourse.

Why would it? I can easily send a spam email that tells you to email "[email protected]" and the correct response is clearly not to block emails to "[email protected]". That's so obviously the wrong solution. If email providers did what you suggest, anyone who needed reliable email service simply wouldn't use those providers because they'd be too vulnerable to false flag attacks.

Email providers do respond to spam emails, but not that way. That doesn't make any sense at all and makes it way too easy to get other people's email shut down.

Improve this answer
3
  • You seem to be raising a strawman. If Gmail flags such an email as spam, it wouldn't be able to shut down the @whitehouse.gov email anyway. And it's not like whitehouse.gov is extending email accounts to scammers to begin with.
    – Denis de Bernardy
    Commented Mar 6, 2020 at 8:34
  • (Though admittedly, in the context of the current administration, one might argue that they do just that.)
    – Denis de Bernardy
    Commented Mar 6, 2020 at 8:35
  • @DenisdeBernardy It's a bad idea for many, many reasons. You've just listed even more of them. There is no situation in which it's a good idea, always for at least the reasons I mentioned. Sometimes also for the reasons you mentioned. (When someone uses an analogy to explain something. You have to ignore any differences between the analogy and the real situation that aren't relevant to the point the person is making. By focusing on them, you just miss the point of the analogy. You have chosen to miss the point.)
    – David Schwartz
    Commented Mar 6, 2020 at 9:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .