Mail Using Someone Else's Username; Not Mine?

[Tissue Paper]

I noticed something fishy happening a couple of weeks ago when I checked my email and noticed that the username under an email sent to someone wasn't my own. It's my email but the handle/username under the email is not mine.

Today the same thing happened with a different username. What's going on? Did anyone experience something like this?

The username is of someone I randomly met online like more than 15 years ago--if not more. I don't correspond with this person at all.

Should I be concerned?

Note: I'm using Google mail with Apple Mail's client on my Mac and on my phone I'm using Spark. I saw it first in my phone, so I thought maybe it's a hiccup from the phone's end. When I checked my computer, it's the same thing.

 

[Honza1]

Unluckily, terminology and description are such, that I cannot figure out what happened.
There is e-mail address - but Mail.app may be showing you some name/alias. Mail.app does not know any user names or handles. That is important distinction since address is "somone@address.com" and this text is manipulated by clients for display. For example, Mail.app on MacOS will replace what it shows you with nickname or name in macOS address book in case this e-mail address is associated with contact there. So if your old contact in your address book has somehow your e-mail associated with different name, you will see it. But Mail.app keeps also another list of prior contacts, which also is used for this. So it is very difficult to figure out why some "name" is shows for specific e-mail address.

You can have multiple e-mail addresses (I have quite a few). In this case you see your name for multiple e-mail addresses, which can be confusing. It may even be possible to have same e-mail address associated with multiple names and then it gets messy.

E-mail can be sent to someone and your e-mail could be included as CC or BCC. Depending on client this may show weird way.

If you want to punish yourself, try this - open message in Mail.app on MacOS and go it "View"> "Message">"Show all headers". Its a lot of gibberish records of where this message went through, but you may be able to guess from there which e-mail addresses this was addressed to and how it got to you. But I warned you, this is computer gibberish for experts.

 

[amstel78]

Should I be concerned?

Concerned enough to figure out what happened and take corrective action? Yes. What you describe has never happened to me since I started using email in 1995.

Concerned to the point that all logical rationale goes out the window? No. We're not quite there yet.

 

[xraydoc]

I noticed something fishy happening a couple of weeks ago when I checked my email and noticed that the username under an email sent to someone wasn't my own. It's my email but the handle/username under the email is not mine.

Today the same thing happened with a different username. What's going on? Did anyone experience something like this?

The username is of someone I randomly met online like more than 15 years ago--if not more. I don't correspond with this person at all.

Should I be concerned?

Note: I'm using Google mail with Apple Mail's client on my Mac and on my phone I'm using Spark. I saw it first in my phone, so I thought maybe it's a hiccup from the phone's end. When I checked my computer, it's the same thing.

The problem is on your end, not the sender's end. Your email address, "bunchofletters@provider.com" doesn't in any way transmit your real name, forum handle, or anything else, nor does someone else's send their name to you. Your computer or phone replaces the email address with a first name/last name out of your contacts lists.

I'd start looking in your phone's & computer's address books and see if there are errors in your contacts' information. If you're using Google Contacts, look in there on the web as well and make sure your password & account is secure to make sure someone isn't screwing up your contacts.

 

[Tissue Paper]

That makes sense but the weird thing when I check my aliases for each email, they're in tact. Nothing has changed. This is why I'm confused. A couple of weeks ago when this happened, it was my own alias associated to another email, but this is NOT EVEN MY OWN alias. This is why I find it so weird. This is a random person I haven't contacted in like over a decade. It would make more sense for an email client to mix up using my own aliases because I have a bunch of them.

Not sure what to do about this. I tried deleting the contact from my list, but that didn't fix the problem.

 

[Tissue Paper]

The problem is on your end, not the sender's end. Your email address, "bunchofletters@provider.com" doesn't in any way transmit your real name, forum handle, or anything else, nor does someone else's send their name to you. Your computer or phone replaces the email address with a first name/last name out of your contacts lists.

I'd start looking in your phone's & computer's address books and see if there are errors in your contacts' information. If you're using Google Contacts, look in there on the web as well and make sure your password & account is secure to make sure someone isn't screwing up your contacts.

I did. Everything looked normal to me. The person's alias was from a Wordpress comment. I didn't even email this person directly. That's why I'm very very confused. I'm 80% certain it's a technical glitch, but I don't know. It's not even a contact in my list, but it seems Google saved that email alias and email in my contact list. I tried deleting it, but didn't work or didn't solve the problem. I'll try again

 

[xraydoc]

I did. Everything looked normal to me. The person's alias was from a Wordpress comment. I didn't even email this person directly. That's why I'm very very confused. I'm 80% certain it's a technical glitch, but I don't know. It's not even a contact in my list, but it seems Google saved that email alias and email in my contact list. I tried deleting it, but didn't work or didn't solve the problem. I'll try again

I’m not sure what you mean by “email alias” but Google can do strange things with adding wrist it things are recent senders to its contacts list. Look though Google Contacts on the web and see what’s in there, including recent contacts.

 

[Tissue Paper]

I’m not sure what you mean by “email alias” but Google can do strange things with adding wrist it things are recent senders to its contacts list. Look though Google Contacts on the web and see what’s in there, including recent contacts.

Your email alias is what shows up next to your email address or what you call yourself as a sender. In Mail's app, when you compose an email message, it lets you choose from a drop down menu which email you want to send from and in that list you can see your email and next to it is your sender's name or alias. When someone sends you an email, it also adds your alias after "TO". It doesn't show the entire email address. So for example if I'm sending you an email, in your app it shows, "email sent to XRAYDO only. This name (alias) may not be part of the email address. You can choose anything you like. So your email could be 900@900.com but your name is XRAYDO.

So my problem was when I received emails, it was telling me the email was sent to an alias that isn't associated with any of my emails. So let's say the email was sent to 123@123.com. It tells me the email was sent to NightSky. In my email app, NightSky is not associated with 123@123.com. NightSky is the handle of someone I was in contact with over 10 years ago that made a comment on a blog I had that doesn't exist anymore.

I checked my mail preferences and it clearly shows me that 123@123.com's alias or sender's name is my own. So I'm confused why emails I'm received are directed at NightSky but under preferences it still says my name.

It's just weird. I hope this clarifies what I meant. Sorry about the confusion.

 

[AL2TEACH]

Your email alias is what shows up next to your email address or what you call yourself as a sender. In Mail's app, when you compose an email message, it lets you choose from a drop down menu which email you want to send from and in that list you can see your email and next to it is your sender's name or alias. When someone sends you an email, it also adds your alias after "TO". It doesn't show the entire email address. So for example if I'm sending you an email, in your app it shows, "email sent to XRAYDO only. This name (alias) may not be part of the email address. You can choose anything you like. So your email could be 900@900.com but your name is XRAYDO.

So my problem was when I received emails, it was telling me the email was sent to an alias that isn't associated with any of my emails. So let's say the email was sent to 123@123.com. It tells me the email was sent to NightSky. In my email app, NightSky is not associated with 123@123.com. NightSky is the handle of someone I was in contact with over 10 years ago that made a comment on a blog I had that doesn't exist anymore.

I checked my mail preferences and it clearly shows me that 123@123.com's alias or sender's name is my own. So I'm confused why emails I'm received are directed at NightSky but under preferences it still says my name.

It's just weird. I hope this clarifies what I meant. Sorry about the confusion.

sounds like you should have a chat with Apple Support.

 

[Honza1]

After re-reading your e-mails again I think you are in the wrong forum. Since this happens on Spark on iOS and Mail.app on macOS, the common is that it is Google account. Looks like Google has this this somewhere and this has nothing to do with Apple or Apple software. It just shows what Gmail provides. Sounds like this shoudl be directed to some Gmail support group.
Have you checked web interface for Gmail? Is it there?

 

[Tissue Paper]

After re-reading your e-mails again I think you are in the wrong forum. Since this happens on Spark on iOS and Mail.app on macOS, the common is that it is Google account. Looks like Google has this this somewhere and this has nothing to do with Apple or Apple software. It just shows what Gmail provides. Sounds like this shoudl be directed to some Gmail support group.
Have you checked web interface for Gmail? Is it there?

You may be right. I checked my mail again, it's gone. It's very weird. No it's not on the web interface, but that's not necessarily an indicator, because even in my mail app now the handle is gone and it's back to the correct one. I'm cleaning and resetting things now. Hopefully that fixes the issue. Thank you so much for trying to help. I really appreciate it.

 

[Unsupported]

Since this happens on Spark on iOS and Mail.app on macOS, the common is that it is Google account. Looks like Google has this this somewhere and this has nothing to do with Apple or Apple software.

"Hello, Pizza Hut?"

-- No sir. Google Pizzeria.

"Ah, excuse me ... wrong number ..."

-- No sir, it's the correct number. Google bought the Pizza Hut chain.

"Ah well ... then write down my order, please ..."

-- The usual?

"How do you know what I'm asking for?"

-- According to your mobile, your street and your number, and the last 12 times, you ordered a large Neapolitan with ham.

"Yes, that's what I want ..."

-- May I suggest a pizza without salt, with ricotta, broccoli, and dried tomato?

"No! I hate vegetables!"

-- Your cholesterol is not good, sir.

"How do you know?"

-- We cross reference data with the NHS and we have the results of your last 7 blood tests. I see that your triglycerides have a value of 180 mg / DL and your LDL is ...

"Enough, enough! I want the Neapolitan! I take my medicine!"

-- Sorry sir, but according to our database you don't take it regularly. The last box of Lipitor of 30 tablets that you bought was last December 2 at 3:26 p.m.

"But I bought more at another pharmacy!"

-- The data of your credit card consumption does not prove it.

"I paid in cash, I have another source of income!"

-- Your last income statement doesn't show that. We don't want you to have problems with the Inland Revenue, sir ... Also yesterday you bought Viagra to use with your neighbor, as evidenced by the recording of her call at 8:45 pm. According to your WhatsApp history, you download a lot of pornography from your friend ...

"I do not want anything now!"

-- Sorry sir, we just want to help you.

"Help me? I'm sick of Google, Facebook, Twitter, WhatsApp, Instagram! I'm going to an island without internet, cable or mobile telephony!"

-- I understand sir, but here I see that your passport has expired 5 months ago.

Welcome to the future! ...

 

[Tissue Paper]

"Hello, Pizza Hut?"

-- No sir. Google Pizzeria.

"Ah, excuse me ... wrong number ..."

-- No sir, it's the correct number. Google bought the Pizza Hut chain.

"Ah well ... then write down my order, please ..."

-- The usual?

"How do you know what I'm asking for?"

-- According to your mobile, your street and your number, and the last 12 times, you ordered a large Neapolitan with ham.

"Yes, that's what I want ..."

-- May I suggest a pizza without salt, with ricotta, broccoli, and dried tomato?

"No! I hate vegetables!"

-- Your cholesterol is not good, sir.

"How do you know?"

-- We cross reference data with the NHS and we have the results of your last 7 blood tests. I see that your triglycerides have a value of 180 mg / DL and your LDL is ...

"Enough, enough! I want the Neapolitan! I take my medicine!"

-- Sorry sir, but according to our database you don't take it regularly. The last box of Lipitor of 30 tablets that you bought was last December 2 at 3:26 p.m.

"But I bought more at another pharmacy!"

-- The data of your credit card consumption does not prove it.

"I paid in cash, I have another source of income!"

-- Your last income statement doesn't show that. We don't want you to have problems with the Inland Revenue, sir ... Also yesterday you bought Viagra to use with your neighbor, as evidenced by the recording of her call at 8:45 pm. According to your WhatsApp history, you download a lot of pornography from your friend ...

"I do not want anything now!"

-- Sorry sir, we just want to help you.

"Help me? I'm sick of Google, Facebook, Twitter, WhatsApp, Instagram! I'm going to an island without internet, cable or mobile telephony!"

-- I understand sir, but here I see that your passport has expired 5 months ago.

Welcome to the future! ...

loooooooooool Good one.

 

[gilby101]

Should I be concerned?

Possibly. If you want to get to the bottom of it you need to see the message headers. I am a little confused as to whether this is a message sent or received. But please post all the message headers from View -> Message -> Raw Source. And if this is part of a conversation (e.g. it was a reply or forward) do the same for the original message. and read my comment below to xraydoc.

The problem is on your end, not the sender's end. Your email address, "bunchofletters@provider.com" doesn't in any way transmit your real name, forum handle, or anything else, nor does someone else's send their name to you. Your computer or phone replaces the email address with a first name/last name out of your contacts lists.

That is not correct. The sender does transmit their 'friendly' name. For a message in Apple Mail use View -> Message -> Raw Source. As well as info about how the message was transmitted (which includes the email address of the recipient), look for the "From:" line. For a message sent by your bunch of flowers example, the From line is likely to have something along these lines: Bunch of Flowers <bunchofletters@provider.com>. And Apple Mail will display the sender as Bunch of Flowers.

Problems arise when you get an email purporting to be from Bunch of Flowers asking you to reply (with your credit card to pay an outstanding email), but the senders address is really "scam@x.y.com". So you gullibly reply with your credit card thinking it is going to Bunch of Flowers whilst in reality it goes to scam@x.y.com.

If you want to punish yourself, try this - open message in Mail.app on MacOS and go it "View"> "Message">"Show all headers".

The trouble is that this is incomplete and has been massaged by apple Mail. You need to show the Raw Source which shows exactly what has been received by Apple Mail.

 

[Unsupported]

Should I be concerned?

Possibly. If you want to get to the bottom of it you need to see the message headers. I am a little confused as to whether this is a message sent or received. But please post all the message headers from View -> Message -> Raw Source.

Command+Option+U works too on the open message.

 

[gilby101]

Command+Option+U works too on the open message.

Thanks. I didn't know that.

 

[Unsupported]

Thanks. I didn't know that.

It's quick and useful to expose the servers and fake "Return-Path:" addresses on those phishing attempts 😉

For example (I've substituted my real email address with "phishing_victim@example.net") here, but the rest shows it did not originate from Vodafone España, my telecom provider. Apart from the fact they spell "Espana" without the "ñ":

Return-Path: <sng-academy@sng-academy.com>
Delivered-To: phishing_victim@example.net
Received: from drive130.123servers.com
by drive130.123servers.com with LMTP
id wFxTHkGZVWAzGQAAtv3j3w
(envelope-from <sng-academy@sng-academy.com>)
for <phishing_victim@example.net>; Sat, 20 Mar 2021 02:42:09 -0400
Return-path: <sng-academy@sng-academy.com>
Envelope-to: phishing_victim@example.net
Delivery-date: Sat, 20 Mar 2021 02:42:09 -0400
Received: from 76.56.151.203.sta.inet.co.th ([203.151.56.76]:50089 helo=whpka171.nxcloud.inet.co.th)
by drive130.123servers.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.94)
(envelope-from <sng-academy@sng-academy.com>)
id 1lNVJ8-0000hv-42
for phishing_victim@example.net; Sat, 20 Mar 2021 02:42:02 -0400
Received: by whpka171.nxcloud.inet.co.th (Postfix, from userid 10001)
id 3569917E6B38; Sat, 20 Mar 2021 13:27:24 +0700 (+07)
To: phishing_victim@example.net
From: Mi Vodafone <MiVodafone19849@whpka171.nxcloud.inet.co.th>
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
X-Mailer: PHP/7.4.16
Message-Id: <20210320062724.3569917E6B38@whpka171.nxcloud.inet.co.th>
Date: Sat, 20 Mar 2021 13:27:24 +0700 (+07)
X-Spam-Status: Yes, score=9.4
X-Spam-Score: 94
X-Spam-Bar: +++++++++
X-Spam-Report: Spam detection software, running on the system "drive130.123servers.com",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Vodafone Cliente de Vodafone Espana, en esta factura aparecen
valores mensuales que corresponden unicamente a los dias de uso real del
servicio. Cliente: phishing_victim@example.net
Content analysis details: (9.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------

<snipped!>

X-Spam-Flag: YES
Subject: ***SPAM*** Mi Vodafone - phishing_victim@example.net , cliente de vodafone tu factura esta vencida paga ahora y evita una multa ID- 12845