I just received a perfectly authentic-looking email which purported to be from "Google Pay," which told me that a "Visa card ending with 2331" had just been added to "my account."

Two problems: (1) I don't have a "Google Pay" account, and (2) I don't have a Visa card ending with "2331."

However, the eagerly-animated (and entirely authentic-looking) button invited me to push it.

So: I wonder just how many people who do have such an account would actually bother to "look into their wallets?" The visual appearance of this email ... which I very promptly deleted ... was perfect.

Reminds me of the phone call about my Microsoft Windows operating system being hacked. After I said Linux there was a click and a dial tone.

Vektor

What is utterly mystifying(!) to me is that email has never "generally adopted" the very-fundamental principles of "data integrity and provenance" that – thanks to LetsEncrypt – we are finally able to sort-of enjoy in this space.

I underscore the word, "adopted," because two data-security-plus-data-integrity standards have always existed within "the email space." (1) PGP®/GPG, and (2) S/MIME. Take your choice.

The world's most prominent e-mail provider, "GMail®," after having fought away most other providers by claiming to better prevent "spam," initially provided access to encrypted and/or signed messaging. But, very shortly thereafter, they removed it from their public presence.

I continue to use "email client" programs – never "web-mail" – and these interfaces allow for seamless encryption of those messages which "I wish to remain private."

But, as to the public at large, and to the "web-mail" interfaces which routinely supply all of them, I truly remain astonished: Today, is there absolutely nothing that anyone "wishes to remain private?"

Just an aside, but . . . .

My friend received such an email last week; it claimed that she had made a purchase she never made. She knew right off that it was a con and a scam.

What befuddles me is that so many persons, when they read stuff on their computer screens, well, their defenses seem to go down and they lose their ability to think critically. They believe stuff written in electrons when they wouldn't believe the same stuff if it were written in ink.

When I use an "https" web-site like this one ... thank you, "LetsEncrypt!" ... I know that I am actually talking to the intended site and that my posts are being "delivered to me 'as tendered.'"

How very different(!) it would be if "email" could routinely offer the same assurances.

Well, in fact it can. Both "message encryption" and, separately, "message signing." Consumer-grade but very strong.

What truly baffles me, then, is that "easily the world's most popular email web-portal," gmail, once provided message-signing and message-encryption, but then ... silently took it out.

Businesses throughout the world are therefore forced to use a message-transport system which effectively contains no "provenance," let alone "privacy," whatsoever. Even though it very-easily can.

It's absolutely trivial to provide for an: "Alert! This message didn't come from 'Southwest Airlines!'"

Absolutely trivial. Existing technology. Perfected. Available. Not Used.

Why not, Google? "Microsoft, Linux, etc., why is this still a 'plug-in?'"

P.S.: I am now getting quite a few "Google Pay" e-mails every day. The scam is very much "in play."

How very easy it would be to re-cast the "email" system to completely eliminate this problem. If "Google Mail (gmail)" alone(!) took some action, using existed and tested technologies, the entire world would immediately – and, gratefully – follow suit.

My wife got a text message “from the USPS” with a link to a phishing page advising that there was 30 cents postage due on a piece of email. “Click here and enter your credit card to pay for it…” She told me about it when I got home because the page wouldn’t accept the card number.
I suspect it was because the bank had that vendor blocked (whew)…or she mistyped the number (possible)

We had a(nother) conversation about how to ID spam/phishing attempts. Pointed out that the post office doesn’t know our mobile numbers, and simply wouldn’t do such a thing anyway…but it does give one pause.

I once had the good fortune to have a guy "from Microsoft" call me with that scam on a Saturday when I had nothing better to do. I kept him on the phone for almost an hour and he even brought his "supervisor" onto the call when when nothing I did under his instruction seemed to work (because I was on linux). At one point, I had to remote in to an actual Windows box so I could convincingly describe what he expected me to see in the event log. They eventually caught on to me only because my son, whom I had invited to sit in on the call, couldn't keep his laughter to inaudible levels (I couldn't blame him as I was having trouble that way myself). Then these guys acted like -I- was the bad guy for leading them on and they said mean things about my mother! I was about fifteen minutes into the call before I thought to start recording it.

As far as email scams v/v google pay are concerned, I haven't got any of those yet but I also -don't- use google pay. I do, however, have my system configured such that, with the click of a button, my browser will be reset to a pristine state that I saved as soon as I had the browser configured the way I wanted it. This way, I can click on that scam button just to see what happens and if it's really an attack on the browser, as opposed to an attack on a credit card, no harm done. Worst case, I might have to reboot and lose my "uptime" (currently 127 days).

As I'm sure you know, but for the benefit of others, never assume HTTPS is secure. If you're using a VPN that requires the installation of a CA certificate, or if you've a corporate managed laptop or VPN then there are multiple ways to perform SSL packet inspection. Usually by presenting a SSL certificate to the browser "signed" by the VPN provider / corporate CA which the browser will accept.

Sometimes this can be spotted by looking at the certificate presented to the browser, it may be signed or issued by an "unexpected" CA. However, unless you know the CA that the website uses it can be hard to even spot.

There's always another way to break security where it exists. But, inexplicably and unnecessarily, conventional email has no security nor accountability at all. It does not have to be this way. Why have we invested so much security-concern with web sites, and absolutely none with email? Particularly when we effortlessly can?

Notice that "digital signing" and "encryption" are two separate ideas. An unencrypted message can be signed. All encrypted messages are also signed.

If "digital signing" were a standard practice, "spoof" emails would disappear.