Hacker News Reader

I have a very short email address and get lots of these. What I do is immediately log in to the service and change the password. Then, if possible, I log out any other devices that are logged in.

Then they can never access the account and continue to to use the service.

Where available, I will delete the account as well.

I found that if I don't do this, then I am just going to be receiving notification emails forever from that account.

If this was me and it was happening often enough to be such a nuisance I had to hijack people’s accounts, I’d just get a different email.

Mind you, I’m saying you should have to give up your email because other people have trouble spelling, just stating how I’d handle it.

I've had my gmail address for 14 years now (to the day actually). There is no way I'd give it up because of some morons.

I actually have dots in my Netflix account email address because somebody who wasn't me had previously started to register for Netflix using my email address.

I have had to do this with some other services as well. Some services won't allow the + in gmail addresses, which is pretty annoying.

If a service starts recognising the dots don't matter and denying the plus symbol, there's a good chance I won't be able to register without obtaining a new email address.

I wouldn't mind but my name is really not that common -- my surname is uncommon enough for me not to have met another with that surname outside my family.

Yeah, that. While the dots may present a marginal security risk, they provide a useful workaround for sites that fail to allow the owner of an email address to remove their address from another user's account.

Why can't you claim the original accounts?

The thought did cross my mind. But there's something that feels weird about claiming an account that I never set up, especially where it's not clear if the service allows payment or usage with an unverified email address.

I personally don't believe the penalty for putting my email address in instead of yours (which could be very close) should be complete account hijack. Instead, I usually just filter the messages to trash.

I would much prefer to be able to click a link saying "I didn't expect this email." Very few services actually do this.

There will be some people who read the OP and see treating dots in email addresses where dots don't matter as another thing on their todo list for a signup form.

A more considered approach would be to think about how you handle emails. A lot of the time the email is the most important thing -- access to the email address is often the only credential you need to get into the account, so you want it to be correct before anybody spends time entering details.

You can make sure there are no mistakes by giving users a link to click within a window of time (e.g. 7 days), before they can enter any data associated with that account. Provide a link that says "nothing to do with me." Do not count the account as real until the link has been visited.

In the case of the linked article, Netflix asking for billing information before confirmation of email address is a clear example of a threat vector that has far more to do with Netflix prematurely pestering for payment than it does with Gmail aliasing email addresses.

Same with me, I have someone who is in the US (I'm in the UK) who has registered for a university and attempted to buy a car using my email address.

They must be fairly disorganised as I keep getting emails about overdue library fees. No matter how many times I email these places, they never remove the email from their system. I'm hoping GDPR might give me a hand with that, though I'm doubtful if they're places like a US University.

Email validation is a must for all services, people make mistakes and clearly some people don't even know their own email address. This is a problem with both Google and Netflix. Netflix are being negligent and Google should retire this feature.

I have this problem a lot as well. There was someone with my name with a Bank of America account that regularly bounced checks, and BoA provided no way to disassociate my email address from the account.

These days I'll flag any email from a service as spam, no matter how well known, if there was no email verification step.

Yup. I had some guy's credit card bills appearing. It was actually super weird - somehow Google had metadata about the credit card bill that was not in the body of the email, so I'd get "reminders" on Google Now saying "pay $1200 to Notyourbank by the 1st of Octember", but I couldn't actually see that bill without logging in (which, obviously, I could not and did not try to).

Btw that meta data I believe it's in the body of the email. Hidden with some html tags that Google tells companies to use so they can do those things. Inspect the source of the html of the body and see if you can find it there.

I have the same issue, except I have a 6 character nickname using 3 unique characters at gmail and people use it for all sorts. Games, flights, utility bills, shopping sites, phone contracts, dating sites and much more. From all over the world. I had someone else's dropbox too, and even after the continued warnings they would cancel it and had cancelled it there were messages to access it still, that it was still there with the ability to view data.

The strangest by far though is the huge amount of gmail accounts created with my email as the backup. I have to assume that wording on some localisations indicate you need one so they mash the keys and pop in my gmail.

So I have hundreds of security alerts for recovery and notifications it has been set.

Funny old world.

Same here. I have a six character gmail address which includes a common name, and I get an average of between one and two misdirected emails a day, sometimes more. Stuff from all over the world, signup emails, invoices, love letters, confidential documents, etc. Mostly the non-dot version, but sometimes a version with one dot. It's infuriating, but I couldn't possibly change my email address at this point; it's tied to hundreds of accounts :(

It's funny, saying "email doppelgangers" reminded me that I have the same issue with phones and physical addresses (but not email since I use a unique domain name).

I get multiple snail mail bills for DirecTv to people with different names but my address. One of them apparently didn't pay, so now I'm also getting collections letters addressed to them at my address.

I've also had someone in Oregon use my google voice number at some doctor's clinic, so I was getting voice mail transcriptions about appointments and certain tests that needed to be run.

Turns out lots of people just can't figure out their own unique ids, whether they're email, phone, or home address.

Yep, same here. I've got a "DJ" in the US, but also a guy in India. The Indian guy is always getting legal threats for not paying his phone bill.. I feel a bit bad that he's not even getting the emails, but I have no idea how to actually contact either of these people...

Reply to the sender then, saying they have the wrong email account. That's what I do and over time it cuts down on the incorrect email I get.

Half the time these emails come from donotreply@domain.tld

I have a few.

On in New York used by to confirm a doctors appointment (with some information on their condition). They also gave my address to their broker who sent an account summary. Bond portfolio in the millions.

Some lunch delivery server in Mumbai sends sends out emails to the address provided with no option for me to remove my address.

Another one or two in the UK who put me down for random stuff.

I just got one for a hotel booking. Google usefully added it to my calendar.

"My" X-Box live account seems to have gone.

I did enjoy repeatedly rejecting "parental" permission for some kid to join Club Penguin though.

One of my emails is a "one name" gmail address so I get a few of these fairly often. I've tried doing the good thing where possible and trying to get it changed by contacting the provider but I just gave up. If I get more than a couple of emails from any account, I just hijack it permanently; I've found that deleting the account will only lead to the offender recreating it.

I have the same issue, but Uber has 2FA on the account through SMS. This way I can't login to cancel the account, and there is no 'unsubscribe here' link in the emails.

Also had someone use my email to sign up to an airline. After messing with the seat assignment and meal selection a few times it became old and customer service didnt know what to do, so I changed the associated email to 'helpdesk@airline.com'

Even funnier was how a gameshop website that I did have an account with actually changed my password and account details to be assigned to someone in another country. No notifications etc... So now there are a bunch of trade-in credits on my account, after changing it back to my own details.

> If you don't provide a way in the emails to say "that's not me", then I have no way to ever register for your service with my address.

This happened to me - someone registered an Uber account with my email address. So I password reset it and now I have an Uber account for no good reason.