Gmail scam: Hackers target users with con that’s elusive even to the trained eye

dailystar.co.uk:

scammers in emails, text messages or phone calls that convince their victims they’re calling from a big company or public body and trick them into downloading a virus or giving access to their personal data.Regular phishing emails can be recognised via certain red flags, such as the email address of the sender not matching the email addresses used by the company they are impersonating, or through suspicious-looking links in the email.But in this latest explosion of attacks, scammers have deployed a new method of tricking the system into displaying an email address different to that of the sender, making the emails appear totally legitimate.They’ve done this by exploiting Google's SMTP (Simple Mail Transfer Protocol) relay service that the company uses to send out mass emails.According to Avanan, scammers have discovered that they can spoof companies if those companies have set their DMARC policy to 'none'.DMARC, which stands for Domain-based Message Authentication, Reporting & Conformance, is an email authentication protocol which lets domain owners decide what action to take when an email is impersonating them.

Cyber security experts recommend strict DMARC policies as it helps stop bad actors from imitating domains. This tactic not only tricks victims into believing the emails they have received are official, but also tricks systems set up to detect and filter spam emails as well.

On their website Avanan said: "An SMTP relay service can be a valuable service for organizations that like to send out mass emails.

Many organisations offer this service. Gmail does as well, with the ability to route outgoing non-Gmail messages through Google."However, these relay services have a flaw.