When You Send Spam to Yourself

July 1, 2000

Carl Toups usually doesn't blink at unsolicited junk mail in his Hotmail account, but a piece of spam recently caught his eye. It looked like he sent an ad for a dream vacation to himself, because his email address appeared on the "sender" line.

"The funny thing about it was that there was no sponsor name anywhere to be found on the message," said Toups, a construction mechanic for the Navy in Gulfport, Mississippi. "They did ask for all of your demographics, including credit card information."

Toups isn't the only Hotmail customer receiving unsolicited self-addressed spam.

Pauline Mang, a marketing consultant in Ontario, said she received two similar spam messages with her Hotmail email address listed as the sender -- one promoting university degrees and another with a tongue-in-cheek header "Tired of Spam?"

"The other one contained an HTML page with two clickable lines, and I think it was headed up, 'Tired of Spam? Click here,'" she said. "Of course I don't click those puppies because I'm pretty sure it's a way to scan my login and password."

Microsoft's free Hotmail and other free email service providers expressed no surprise at Toups' and Mang's findings. They say concealing the actual sender's email address with the recipient's address is an old-school tactic spammers use to trick people into clicking on their message.

"You can pretty much make the 'from' address be whatever you want it to be," said John Movena, co-founder and vice president for the anti-spam group Coalition Against Unsolicited Commercial Email (CAUCE). "Spammers have always put fake addresses, they never use their real addresses. But for some reason, they try to confuse people by using the recipient's address instead."

Elisa Batista, Wired News

«