Scam and phishing emails

[RG1947]

Hi,

Since 6th January I have been inundated with scam email, I have reported some 3 - 400 emails. I’ve had numerous chats (half of which cut me off halfway through the chat) with TT technicians, been assured a case manager had been assigned, and that the manager would call me back, but no such call occurred.

I have tried marking these mails as “spam” in the webmail site, I have forwarded them to the “advised, phishing & scam addresses” I’ve created rules to discard them, but they still keep bypassing the TT filters.

These emails seem to just add different reference numbers, an # numbers, and also sent”via” different senders, and this is somehow getting them through the net.

I must have had approximately 60- 70 emails this weekend alone.

The whole thing is sending me crazy, according to these emails I must have won every “air fryer” in the UK, and McFee have sent me more warnings that my protection has expired, than I can count.

During the last chat, (after going through the same scenario all over again) I was told it was still under investigation, after some 6 weeks!!!

Very poor form TT tech.

[Gondola · Accepted solution]

I don't have any influence over TalkTalk Technical Support or Customer Service Managers. They're paid good money to represent TalkTalk.

I'm a volunteer to Community representing me and only me and here to help you as best I can.  A humble Cinnamon swirl would be nice to keep me going but even that, when promised by a senior TalkTalk manager in return for identifying the reason for a fault, doesn't arrive.

I appreciate the valuable Content Team help pages, one of which is Report a phishing or spam email. Here you will see that Spam reporting / notification is by the Mark as Spam button in TalkTalk Mail. If you have that button you're fortunate. I'm still waiting, for nearly 4 years now, for TalkTalk to add that missing button for two of my three mail accounts.

To report a phishing attempt, I agree with you, that you simply forward the mail to phishing@talktalk.co.uk and then, only if subsequently requested, extract and send the header information from the email.

You can also report phishing to the UK Government: Forward the email to report@phishing.gov.uk and The National Cyber Security Centre (NCSC) will investigate it. You'll get an emailed acknowledgement and the NCSC does shut down phish farms.

The bottom line is not to get stressed by things out of your control. My advice is always to take back control yourself. Yes, reporting is fine as an action to help the greater good. But the scammers and criminals still have your email address. So whilst these nasty, vicious people in need of psychiatric treatment are still there, take away the one thing that keeps them there repeatedly pestering you, trolling you. Your email address.

[RG1947]

Gondola, thanks again for your assistance, but it doesn’t exonerated the poor service I received from TT tech.

For instance:

Throughout the chat sessions several were cut off by the “bot” system, and despite providing a contact phone number, in case of being cutoff,  not one them called back. So in every subsequent chat, I had to start all over again explaining my situation.

Several of the chat agents kept on insisting that I had to forward the “senders header details” which contradicts the instructions on the TT help pages, that state “forward emails directly to the “scam, or phishing addresses “ 

In the last but one chat session I was assured that I had been allocated a “case manager “ who would definitely call me back, the following day. That callback was never made!!!

So all in all, I am not impressed.

[Gondola]

I equate it to moving home. When moving home I don't have any option other than to notify contacts of my new postal address. Although I can get postal mail forwarded for, typically, 6 months I'd expect everyone to be using my new postal address within 6 months.

You can take time to notify people of a new email address and gradually migrate them during the year. And then be happy to delete the email address and deny that to the current and any future spammers.

[RG1947]

Thanks for your explanation Gondola.

It was the spambot incident that was named in the breach, and your explanation gives me a better insight of the situation.

As for dumping my email address, I feel a bit reluctant to do so, as I have many accounts and contacts that would have to be changed. I think I’ll plod on for a little while longer and see what happens.

Thanks again.

[Gondola]

2017 was when Onliner Spambot malware got hold of millions of email addresses and it's not unusual for spammers to work their way through these addresses.

You're doing the right thing to Mark as Spam as that reports the spam to TalkTalk's network filtering operated by CloudMark and CloudMark sender intelligence takes on board reports from multiple users and honey-pot spam traps etc to fingerprint the content as spam and then block from the network. It always seems to take a long lead time to block specific spam senders.  It certainly doesn't work instantly.

I always say to users that if an address has been discovered by spammers then it's a relentless task to keep marking as spam / deleting mail / setting up filter rules etc that it's better to migrate contacts to a newly created email address and delete the old.

[RG1947]

Hi Gondola,

Thanks for your reply, I have no idea how my email address has been compromised, I did the check as you suggested, it shows two breaches, one in 2013 and another in 2017.

Seems strange that it’s taken this severe attack to start after such a long time.

But that’s not helping me to stop these messages, and why TT can’t stop them!!

[Gondola]

Are you aware of how your email address became known to spammers? Enter the email address at the haveibeenpwned website and if the screen turns red then your email address has been implicated in known data breaches and the website will tell you each one.