Gmail Dot Trick: How Scammers Use Gmail's Feature to Facilitate Fraud

In recent years, cybersecurity experts have witnessed an alarming rise in fraudulent activities, particularly in the realm of business email compromise (BEC) attacks. One tactics that has gained significant attention is the 'gmail dot trick,' a technique used by scammers to create multiple email accounts on various platforms using a single Gmail account.

But what exactly does it mean when we say that an individual or entity has been 'received' by the same Gmail account? In essence, this refers to the fact that all emails sent from different services are received by the same Gmail account. This is made possible by creating multiple accounts on each website within a short period of time, modifying the placement of periods in the email address for each account.

For instance, if someone creates an Amazon account using one Gmail address (e.g., 'john.doe@gmail.com'(mailto:john.doe@gmail.com)) and another account using a different variation of that address (e.g., 'johndoe@gmail.com'(mailto:johndoe@gmail.com)), both accounts will be associated with the same stolen identity, but all emails from these services will be received by the same Gmail account.

This tactic allows scammers to centralize their fraudulent activity around a small set of email accounts, thereby increasing productivity and making it easier for them to continue their malicious behavior. By using this technique, fraudsters can easily create multiple identities and apply for various services, such as disaster assistance, unemployment benefits, Social Security benefits, and even credit card applications.

For example, one group of BEC actors used the gmail dot trick to submit applications for FEMA disaster assistance under three different identities, apply for unemployment benefits under nine identities in a large US state, submit 11 fraudulent Social Security benefit applications, and many more. They were able to do this by creating multiple accounts on each website within a short period of time, modifying the placement of periods in the email address for each account.

Gmail's feature allowing users to create aliases provides an additional layer of complexity, making it difficult for law enforcement agencies and cybersecurity experts to track down these scammers. Aliases allow users to choose which email address to send mail from, sign in to their account with any of their aliases (which all use the same password), and access the same inbox, contact list, and account settings.

In contrast, when other email services also allow aliases, it can be challenging for users to detect fraudulent activity. This is because emails from different accounts may appear legitimate, making it harder for individuals to identify the scam.

To avoid falling victim to these scams, it's essential to keep your Gmail account password secure and monitor your account activity regularly. Additionally, be cautious when creating new accounts on various platforms and ensure that you don't reuse passwords or create variations of your email address with different periods.

In conclusion, the gmail dot trick is a tactic used by scammers to facilitate fraud by creating multiple email accounts using a single Gmail account. By understanding how this technique works, individuals can take steps to protect themselves from falling prey to these scams and stay one step ahead of fraudsters.

Gmail dot trick