As random as this is for this space, I feel like I need to get this story to as many people as possible, as a warning.

Two weeks ago, on the morning of August 7, I had my Gmail account up in my browser to read through my mail, and suddenly I looked up and there was something like 1000 unread mails instead of 100, and they just kept pouring in. Hundreds if not thousands of different spoofed sender addresses, the mail content was just gibberish text blocks made up of random snippets from various novels. In the end there were over 26,000 of these, split roughly evenly between the inbox and the spam box, from about 9am onward. I spent all day watching this in fascinated horror, curious how far it would go. According to the time stamps on the mails, they stopped sending around 2pm, but there were so many that they kept arriving well into the evening, with a small trickle of the last few extending across the following week.

However, by an extraordinary stroke of luck, around 4pm, I happened to be looking at the Gmail window and saw a different sort of mail in there as the page refreshed with the latest incoming garbage. It was a mail about my order from Bose.com. I didn't order anything from Bose.com. When I went back to look at it minutes later by searching "bose", it turned out there were actually two of them. The orders were under my name, my e-mail, an address a half hour away from me, and a phone number that was just a recorded advertisement from some kind of phone service when I called to check it. So I called the Bose customer service number, told them I didn't know what these orders were, a scam, a typo, whatever, and the guy said "Okay, I'll take care of it." I checked my main credit card that I use for things (which gets its number stolen and used for fraudulent purchases roughly once a year) and didn't see a Bose charge on there, so I wasn't sure yet if it was a fraud attempt under the cover of thousands of e-mails or just a guy nearby with the same name as me who mistyped his e-mail address.

So couple days later, I logged into Bill Me Later to pay off my eBay purchases for the prior month. I've found that to be easier than maintaining a balance in Paypal. What did I discover, why, there were the Bose.com charges! Already refunded by Bose, too. Over $2000 worth. Knowing now exactly what had happened, I checked the UPS tracking link from the invoice, it had been an overnight shipment but they intercepted it and it never reached the address, which no doubt belonged to somebody who was out of town that week. So fraud guy at least didn't get any free home stereo equipment.

I changed my password, of course, and I sent a message to Bill Me Later to tell them about it, just so they know what the new scam method is, maybe warn people about it. The bad charges were already gone, I wasn't worried about that. I got a letter in the mail yesterday from them, they reacted like the credit card companies do when your card number gets stolen "Okay we have shut down your account, please go over this list of charges and check off which ones were you and which were not." Now, when that happens with a credit card, what they actually cancel is the number, and they issue you a new card with a different number and move the account over to that. But Bill Me Later doesn't use the account number for anything, it functions off your e-mail address and password. So, what does "shut down" mean in this case, I can't use that e-mail address with a Bill Me Later account anymore? I called them, and that's exactly what it means. My account is dead, permanently, and I can never use Bill Me Later again. I was told this is because whoever had access to my account could have read off my birthday and social security number, and so there's no stopping them from opening an account in my name in the future, so they just have to blacklist me. Funny thing is, I can't even find my birthday and soc sec number in my account info when I log in. So they were blowing smoke up my ass, but I'm sure it's some federal policy, not their own, that requires this.

Morals of the story, which is the main bit I want to spread the word on: If your e-mail inbox suddenly has thousands of gibberish text mails in it, it's a smokescreen for somebody buying stuff with something that is tied to your e-mail address so they can't avoid you getting notice of it. Delete them as fast as you can until you find the evidence of the order(s), then call the vendor right away to try to have it stopped. If this is your Bill Me Later account that was breached, and the vendor refunds the payment okay, and you still want to use the account, don't tell Bill Me Later a thing about it. Change your password and be glad you dodged a bullet. Naturally if you discover everything too late, you're not responsible for the charges anyway, but nor do you have the satisfaction of thwarting whoever hacked your password.