However I've recently been bitten by my catch-all, using a money transfer service with the email worldremit@mycatchall.com (guess the company). When they asked for additional documents to verify my account after many months, they never received my reply and I ended up banned. I could not login anymore. When I reached out from another email address, they refused to process the documents because they originated from another, unauthorized email address, and asked that I resent the original email from the registered email. I suspect their anti-phishing filters just ban any email containing "worldremit", so it never got through and despite multiple thorough explanations I could never get someone to listen or reinstate the account.
I'm still getting the newsletter though, because unsubscribing requires logging in first... But then I can just ban this email address, so at least the anti-spam strategy works!