Beware Missing Dot in Email Address - Scam Alert - AARP Bulletin Scams & Fraud

Missing Dot in Email Address Could Be a Costly Mistake

Typo might send personal data to crooks not company

Photo by Rob Atkins/Getty Images Stay safe: Be careful what you type. First came "typosquatting." In this common , cyber-criminals buy Internet addresses that differ from big-name ones by just a letter or two, then capitalize on sloppy typing. Someone who wants to go to xyxcorp.com but accidentally types xyzcorp.com ends up at the scammer's site. Now comes another trick to hook the fumble-fingered, courtesy of a keystroke omission rather than a misspelling: a missing dot in an email address. The goal is the same: to , infect the visitor's computer with a virus or as a prized brand-name product. This newly uncovered scheme, targeting the all-important dot in corporate communications systems, can route email into the hands of scammers, giving them any and all confidential information that the messages contain. The scammers' key tool is a "doppelganger" domain, an Internet address that is spelled identically to a legitimate site but is missing the crucial dot, typically found between what's known as a subdomain and domain in the address.

Related

Doppelganger domains would include "mailyahoo.com" instead of the correct "mail.yahoo.com," or "seibm.com" instead of the correct "se.ibm.com" that IBM uses for its division in Sweden.

Beware the Doppelganger

Doppelganger is a German term for a "ghostly counterpart of a living person" — and it's an apt name for this scam. The crooks purchase a doppelganger, then set it up on the Internet so that all mail that's mistakenly addressed without the dot comes to their server, note researchers of the security consulting firm Godai Group in an eye-opening report (PDF) released Sept. 6. Godai's Peter Kim and Garrett Gee spent six months measuring the doppelganger danger by setting up dot-missing variations of legitimate email domains run by every Fortune 500 company. Over that time they were able to collect more than 120,000 misaddressed emails, some containing trade secrets, contracts and invoices complete with credit card information. Users' email login information and employee data were also harvested. Overall, the researchers concluded that nearly one-third of the Fortune 500 are susceptible to such attacks. In fact, some of those companies, including Dell, Cisco, Yahoo and DuPont, had already been targeted by doppelgangers registered to addresses in China that were previously associated with scammer attacks. The doppelganger domain emailkohls.com, aimed at the Kohl's department store chain, was registered to a Canadian post office box.

The Bounce-Back Solution

The take-home message of the study: Companies should themselves buy up doppelganger domains to prevent scammers from using them. To combat more traditional typosquatting, many companies already purchase Internet addresses that are misspelled versions of their legitimate websites. And while mistyping an email address often (but not always) results in the message being bounced back to the sender, no bounce-back occurs if it goes to a doppelganger domain set up by a scammer. Also of interest: Sid Kirchheimer is the author of Scam-Proof Your Life, published by AARP Books/Sterling. Cancel You are leaving AARP.org and going to the website of our trusted provider. The provider’s terms, conditions and policies apply. Please return to AARP.org to learn more about other benefits. Your email address is now confirmed. You'll start receiving the latest news, benefits, events, and programs related to AARP's mission to empower people to choose how they live as they age. You can also by updating your account at anytime. You will be asked to register or log in. Cancel Offer Details Disclosures

Close In the next 24 hours, you will receive an email to confirm your subscription to receive emails related to AARP volunteering. Once you confirm that subscription, you will regularly receive communications related to AARP volunteering. In the meantime, please feel free to search for ways to make a difference in your community at Javascript must be enabled to use this site. Please enable Javascript in your browser and try again.