Do you know about tagged email addresses? Briefly, it’s a way of adding information on-the-fly to your email address so you know when and where you used it. For example, with Google’s gmail, if you have the address example@gmail.com, and you’re signing up for a service on the web, you can type example+webservice@gmail.com and any email sent to that address will still show up in your example@gmail.com inbox, but with the “to:” address of example+webservice@gmail.com. Most email services support tagging with ”+” or ”-“. (gmail, iCloud, outlook use ”+”, yahoo uses ”-”.) I’ve run my own mail server since the previous century, and I’ve allowed tagging for most of that time. My tagging is a bit more subtle, though — many spammers scraping the web for addresses are savvy enough to strip at least ”+” and ”-” addresses.
Tagged email addresses are useful for several reasons:
-
If you start getting spam sent to
example+webservice@gmail.comthen you know that webservice sold or lost control of your email address. Be wary of them in the future, particularly if they failed to notify you of the breach! You can then block the tagged address, limiting the damage that webservice inflicted on you. -
Suppose you get an email that might be phishing, such as “Warning! Your webservice account is blocked due to suspicious activity! Sign in here to fix it.” But if that was sent to your untagged (or a differently-tagged) address, you know it isn’t legit. I’ve caught several otherwise high-quality credit card phishing attempts this way.
-
If you have a legitimate relationship with a company who can’t help but compose emails that look a lot like spam, your spam filter might have an allow-list that can let appropriately-tagged email addresses though.
Recently, I started getting emails from Paramount+. It’s a video streaming service, but that’s all I know — I really don’t watch enough TV to bother keeping track of all the streaming things. I certainly never signed up for any of their services. At first, I just thought it was phishing of the “we’ve charged this thing to your account, contact us if it’s in error” and when you contact them, they make you enter your personal details and maybe even a credit card number. (Just don’t!) But I traced the source (I usually report phishing emails to the internet providers who are facilitating it), and it was legitimate. They also seem to have my full name and an expired credit card number. They used a tagged email address, though. One that I only used with one long-defunct food delivery service. There’s no real explanation except that the delivery service sold or leaked their database of email addresses, names, and credit card numbers (probably along with addresses and phone numbers). Someone is using that database to sign up for Paramount+ free trial subscriptions.
So why does this make Paramount+ the fraudsters? Because they took absolutely no steps to verify the information in the signup. They didn’t email. They didn’t call. They didn’t do any kind of authentication whatsoever. And why, you might be wondering, would Paramount+ be so criminally negligent as to willingly accept stolen credit cards for account sign-ups? Because, no doubt, they get some billings and conversions that go through, and they can up their subscriber numbers and maybe get a little extra revenue or an unwitting subscriber. Who cares if they’re facilitating identity theft? Who cares if they’re making life miserable for the victims of identity theft? Certainly Paramount+ doesn’t care.
By the way, trying to report the fraud on Paramount+‘s horrible web site was impossible. Their “customer service” takes you to a “contact us” page that requires you specify a category, and of course they don’t have any that are remotely relevant. If you proceed anyway, they tell you to use their chatbot and “type ‘agent’ at any time to connect to a live person.” But if you try it, they just give you a link that takes you back to the “contact us” page.
Paramount+/ParamountPlus is willing to engage in fraud to get customers or revenue. Paramount+ can’t provide decent customer service. If you have a subscription, cancel it now before they screw you over, too. If they have “exclusive” content that you can only get by dealing with criminals, you might as well deal with honorable ones (arrrgh, matey!).
—2p