Cybercriminals are using Gmail "dot accounts" to open fraudulent credit card accounts, file fake tax returns, file for fraudulent unemployment benefits and perform other fraudulent activities, according to email security provider Agari.
Gmail dot accounts refer to the "dotted" versions of a single email address. Google interprets all versions of a Gmail address with and without dots; for example, all emails sent to john.smithgmail.com and j.o.h.n.s.m.i.t.hgmail.com will go directly to the same Gmail account.
Conversely, credit card companies, online services providers and other businesses frequently view each Gmail address as a separate entity. This means a cybercriminal can use all dotted variations of a Gmail address to set up multiple accounts under different names with a company – despite the fact that all of the email addresses are linked to the same person.
How Are BEC Threat Actors Using Gmail Dot Accounts?
The Agari Cyber Intelligence Division (ACID) reported business email compromise (BEC) threat actors have used Gmail dot accounts to perform the following fraudulent activities since early 2018:
Cybercriminals are increasingly using Gmail dot accounts to launch and scale fraudulent activities, Agari indicated. However, searching for instances of excessive dots in newly created Gmail accounts can help companies quickly stop Gmail dot account attacks.
Furthermore, MSSPs can educate their customers about Gmail dot attacks and other cyber threats. They also can provide email security services and conduct regular audits to help their customers address such issues.
