Almost two years ago, I received the kind of email that everyone dreads: a contrite semi-apology from a frequently-used platform notifying me that it had been hacked and my email address and password had been stolen.
Cue panic, an immediate and hasty password change (to something convoluted under the misapprehension that if I couldn’t guess it, no hacker could), followed by a more level-headed click of haveibeenpwned to face the scale of the problem.
The news wasn’t good. The email wasn’t the only data breach I had suffered, just the only one I had been notified about. There had been 16 other breaches.
My next steps were clear: I deleted old accounts, changed all the passwords (to those that were safely stored, sensible and required frequent updates) and removed personal data. And then I waited.
I used this as an excuse for a pity party. I felt unsafe. It seems obvious now, but in 2018 I had not understood how casual my relationship with technology had been. I used so many apps and websites, with little forethought about their security before downloading and accepting those teeny-tiny-fonted user terms. Digital walls felt paper-thin and joy had been stolen. I no longer felt comfortable playing mobile games, and berated myself for registering with a site (to browse products I couldn’t afford!) a mere week before the site’s data was breached. Could the internet ever be trusted again?
After a week, there was a chink of light in my fraidy-cat armour: Nobody seemed to have logged in to my 20-year-old (yes, you read that correctly) email account, which I realised was long overdue around 19 spring cleans. Digital scrubbing took ages. And while I deleted chains of random email chains (for you Gen Zs — what us oldies used prior to the invention of the DM) with 30 people I cannot remember meeting, the first strange new email arrived. The first and the worst.
You may have heard of it. You may have even received it. The title itself was intended to be petrifying: It was one of my older, simpler passwords. However, in my case, that password is a funny phrase (which I won’t share, look how I’ve grown!) making me feel both chilled and amused. The body of the email took a more sinister turn:
“I know your password and I can see you. I am watching you right now. What you’re doing is disgusting. ”
I jumped. Even though what I was doing was eating cookies and delighting in a picture I’d emailed myself of a gorgeous grey cat snapped on a decade-old trip to Amsterdam. Okay, so crumbing all over the keyboard wasn’t the cleverest, but it was hardly a crime, or a secret. I kept reading, and the penny dropped.
“I will tell everyone what you’ve done unless you wire [obscene amount of money] to me immediately!”
Of course, this was spam that had been sent from someone who had my hacked email address and old password and was using them to intimidate me — as they were doing to thousands of other people.
It didn’t work. Okay, it did work. My heart beat much faster for a good 24 hours, and that feeling of being watched through the laptop is forever burned into my brain. I may or may not be covering the laptop camera with my hand while typing this.
But I didn’t give anyone any money. Luckily, I have no relationship whatsoever with webcam porn, which I think is what the spammer was getting at (taking Jeffrey Toobin’s word for it). This first email was sent before the pandemic blindsided the world, so I can only imagine how terrified a casual Zoom user would feel receiving this email in 2020.
I deleted and blocked the email. Let’s call that the end…of Phase 1.
Phase 2 began. Phase 2 was a dedicated onslaught of this type of ‘we’re watching you’ email, sent to me every hour for weeks. Yes, yes, dear spammers you have made your point, you’re fascinated with shaming me for my behaviour (if only they knew — a check-in with Deux Moi is as racy as it gets).
I read many of these emails, which were all a slight variation on the stalking theme. And at first they elicited the same response: a sharp intake of breath, some paranoid thinking, followed by the necessary delete and block. Eventually, a reverse-Pavlovian effect occurred, my heart rate remained stable and I moved straight to blocking and reporting. The emails died off. I concluded that the spammers decided that I wasn’t worth the trouble. Go me.
Then came Phase 3.
Now, I preface this, thus: Nowadays we assume Google, Amazon and Facebook know everything there is to know about their users; where we live, what we like, how we spend our time, even how we feel and so on. However, my spammers were slightly less accurate in their personal information sources.
Initially, I danced the delete, report, block cha-cha-cha, but the mails were now coming so thick and fast I couldn’t keep up. I read some out of boredom and intrigue. Having had more than a year of such attention at this point, I then caught myself logging into my email account and going straight to Junk. To my shame, I felt….popular?
Cut to this week, a year later, and I have 162 new spam emails in my Junk folder. The spammers are nothing if not dedicated. My email address has clearly been sold or passed on to many people. So I decided to turn the terror into fun, and group the emails to see if I could ascertain any kind of theme.
What I found was that the emails fell into one of six distinct groups. See if any of these sound familiar:
Group A — AKA ‘You have a penis, and you’re unhappy with it.’
No one should ever assume gender based on a person’s name. I identify as female and back in those halcyon days of treating digital forms as personal agony aunts, I have many times revealed this to the world. The spammers got my address and my password, but they didn’t get the memo that I don’t have the necessary equipment to appreciate these mails. Of all the spam I receive, the vast majority are about enhancement, with a liberal usage of the word liberator. It is weird and depressing.
Sample email header from MaleElongator: ‘I cut off my manhood and then found out how to add 3"’
If you do have the, er, equipment and are reading this, please I implore you, DO NOT DO THIS.
A sub-category of Group A are emails that come from Date Cute Asian and Russianwomenonline which are the names of two printable accounts I receive. The things some spammers put in an email title! Wow. Just, wow.
Group B — AKA ‘Bitcoin Millionaires are where it’s at, amirite?’
Although I occasionally still receive correspondence from wealthy non-European benefactors desperate to give me exactly $321,657 (it’s never a round number) once I send over my bank details — after the hacking, these messages have been replaced with a theme of get bitcoin or die trying. And how does one get bitcoin? By clicking that ugly, big, green button.
Sample email header from BitcoinEra: ‘The time is now! Insanely easy way to get really rich in 2020'
Much as I enjoy an adverb or three, it’s still a no from me. Oddly, many Bitcoin emails arrive directly from someone calling themselves Mark Rilance, not to be confused with this wonderful creature:
Group B also includes the sub-category: from one of many online casinos, but in these senders’ defense, those messages always suggest an element of risk, focusing on questions like: ‘How big a bonus will you find’.
My answer is always the same: we will never know.
Group C — AKA ‘CBD heebiejeebies’
To be honest, gummies don’t sound that bad. Could the spam finally turn me into a customer? CBD products are legal, they can be helpful and yet, the emails always require the clicking of that ugly, big button to find out more. Sample email from Powerful Gummies: ‘Learn the secret and transform your health’
Just tell me the secret already! Also see vision vitamins, your healthy life, gummy sharktank (I’ve never worked out the connection). Moving on to…
Group D — AKA ‘I don’t remember sending this to myself…’
The Spoofed emails almost worked on me. I’ve self-mailed for years (see aforementioned cute cat), but there was something a bit off with these titles. Sample email from me(*cough*): Can we lower your broadband bill?
I’m not sure, can we? Also, when did we start emailing ourselves in the plural? That being said, we do like saving money, don’t we?
A sub-category of this group is the spoofed famous service provider email. Some businesses who really must have a thing for me based on the sheer volume of personal emails sent include: Netflix, NETFLIX, Amazon, Amazon Prime and Amazon Holdings.
While writing this piece I magically received another email from myself entitled: Never eat this veggie again — although perhaps that’s from future me?
Group E — ‘You’re really, really sick, but we have the cure.’
I had no idea how bad my sight and hearing were, thank god for spammers! With the tension headaches, need for hair regrowth, desire for safe breath (ahem) and the diabetes (to be fair I eat a lot of sugar) it has been a struggle. These mails are always from the strangest senders. Sample email address: stive.martindazbe-nisabaraxupsaa@ncvyuiq.com. Bet you can’t say that three times fast.
Recently, these mails have morphed into a special COVID-19 sub-category. And although it’s reassuring to know that spammers are also moving with the times, has anyone let the authorities know that coronavirus itself has mutated into being able to personally write email? Amazing.
Sample email from The Encyclopedia of Medical Breakthroughs: Doctors Use This Secret Book of Alternative Medicine.
The email obviously did not mention the name of the book (well, it is a secret), but I did have the option of a ‘physical opt out’ if I just clicked on — you guessed it — that big, ugly button.
And lastly we have the correspondence from my favourite group:
Group F — AKA ‘Wait…What?’
These are wild, sometimes offensive and often hilarious. Here’s a sample:
- Final Message!! — did you send any previous messages? Forgive me, my junkmail is overflowing with elongator mails trying to liberate me.
- RE:XrB1VJOzl1gNPW/u1fHY22UfvDGkDPpQZKmCE8UHmn32ejkkFqiDCSvQ7tTqWpTd! — Is this code?
- You’re Approved — Great, thanks.
- YOUR TINDER REQUEST HAS BEEN APPROVED — stop shouting, my boyfriend might hear.
- Huge Tummy — ouch, so rude. I do sit ups, I’ll have you know!
- Exercise not working? — apparently not.
- Military Grade Tactical Flashlight now 75% off — actually quite flattered to get this one.
- I Can Read Book Club — shame, the I can’t read book club is more my speed, having recently learned from Group E about my failing eyesight.
- Funeral Quote Today — do you know something I don’t?
If you’ve been hacked and/or receive lots of spam, I hear you. I hope this goes a little way to alleviating your anxieties.
I’ll finish with a snippet of my absolute favourite spam mail:
