Bouncebacks
Sign in

Bouncebacks

Information Security Professiona

Sooner or later, you will receive a “bounceback” email, which reads something like, “I'm sorry to have to inform you that your message could not be delivered to one or more recipients.” Funny thing is, you didn’t send a message to those people, and you may also have no idea who those recipients are, or what the email is about. There are two common explanations.

One is that the spammer truly did get hold of your email address, either when you clicked on his unsubscribe link (whose sole purpose is to trap innocent people who believe they truly will be removed from future mailings), or by surfing and posting information to legitimate websites which commonly catalog email addresses, such as online job search agents. In this case, he is using your email address to obscure his own identity. The other likely scenario is that someone who has your email address in his email program’s contacts list picked up a virus, which trolled through the list and sent out emails using your name as the sender. Most of the time the destination email addresses are just guesses of possible addresses, and the spammer has no idea whether they correspond to real email addresses. When the message cannot be delivered to what most likely is a non-existent email address within a given domain, the automated postmaster of that domain tells you about it by sending you a bounceback message.

Like any commercial venture, spam works because the numbers allow it to work. Email is cheap, and electronic crimes offer a volume discount. If I’m a technophobe scam artist, and choose to limit my dirty craft to traditional communications media, I’m far less likely to succeed. If I rely on the telephone to reach out to potential victims, I am going to spend a lot of time dialing, waiting for an answer, listening to busy signals, etc. And I have to pay for the phone calls, albeit pretty cheap these days thanks to VoIP and Skype. A con job based on “snail mail” would cost the perpetrator at least the going bulk postage rate (which, regrettably is not high enough to discourage legitimate advertisers, given the pile of recyclable paper I deal with each week). Further, our investigative and judicial systems are far better equipped to respond to old-fashioned in-person, phone- and mail-based scams.

But if I can send literally billions of messages for the same cost as one message, then even if only 0.0001% of the recipients fall for the scam, I can make money. And the email addresses of recipients are auto-generated, so even that task does not require too much time on the scammer’s part. Bam! It’s cheap. It’s fast. It’s spam.

What It Means: if you want to shoot pigeons in a park, use a shotgun rather than a BB gun.

start_blog_img