People on my subscribers list getting spoofed emails

• 

  muzzahk · Member · Jan 16, 2022 at 9:26 pm

  • Copy link
  • Add topic to favorites

  Over the last twelve months I’ve been contacted by friends who have received emails bearing my name, but with an incorrect email address, and with links they’ve been encouraged to click. Mostly these people don’t know each other and the only thing they seem to have in common is that they all subscribed to the family travel blog I posted on WordPress throughout 2019.

  Does this sound like it could be a WordPress hack? If so is there anything I can do?

  Thanks for reading this,
  Russell

  The blog I need help with is: (visible only to logged in users)

• 

  kokkieh · Staff · Jan 17, 2022 at 5:24 am

  • Copy link

  Hi Russell,

  It sounds like someone is spoofing your email address, i.e. sending emails to people, making it appear that the emails are coming from you.

  Email addresses of subscribers to a site on WordPress.com aren’t visible to anyone besides the site owner, and if the email subscriber also has a WordPress.com account, the email is not visible at all. So unless someone gained access to your WordPress.com account, there’s no way they could have gotten those people’s emails from us.

  I checked your account’s logs, and see no evidence that anyone has accessed your account in the past two years – it appears even you haven’t been logging in. I don’t see any unusual activity on your account prior to that either. So the people doing this didn’t get those emails from us.

  More likely someone gained access to your contacts list from your email account. They could have done this by gaining access to your email account itself, or with any app or website where you use the Google login option, or allowed the app access to contacts on your phone, that app/service could have been compromised, allowing someone access to the data.

  At this point there’s not really anything you can do about this – whoever stole the email addresses have them now, and you can’t prevent them from spoofing your email as the sender either. But this might be a good time to review what apps and services have access to your Google account, and also review app permissions on your phone to make sure that only apps that absolutely need it have access to your contacts list.