Just wondering if anyone knows the purpose of tagging a spam email as phishing when it comes into my in box? Is it reported anywhere ie to Optus or does it just go to my junk to be deleted and no further action is done on the Optus server? Am I wasting my time being pedantic about selecting the “fishing hook”. I appreciate your advice.
1 Like
You will need to elaborate on what mail software you are using or whether you are using a web-based interface to email, and if the latter, which mail service provider?
If the answer to the above is: you are using an Optus email address (and presumably Optus is your ISP) and you are using a web-based interface to email then you would need to ask Optus.
Note that the behaviour for email could be quite different from the behaviour for text messages (on a mobile phone).
2 Likes
I use The Messaging Company for email. Their help pages are silent on the phishing hook. They talk at length about Blocking and how that will then direct it and subsequent messages to Trash.
My experience with marking TMC as Phishing is that “nothing” happens. It goes to the spam folder and subsequent messages arrive in my inbox. I report them to Scamwatch, so that may be where the real work is done.
Any TMC scams I report directly to TMC’s isspam email. They don’t seem to stop messages demanding subscriptions or urgent updates going to their customers, but I never get another from the same email / website after I report it to them.
I guess each company will vary in their vigilance.
4 Likes
If the company receives enough complaints (such as users marking emails as spam or phishing), then they often update their filters to capture these messages. Sometimes they use redirection to put the messages in spam/junk folders of the user so that the user can check if the email is indeed bad or good. TMC as part of their service have filtering in place, they do update the filters as required. As far as a user goes, this is a silent outcome to them, they don’t get feedback normally about filtering changes.
There are many TMC filters that came from their interaction with TPG, TPG used their own filters which TMC implemented on their behalf. When TPG finally stopped all email support, TMC took over the filters and they continue to tune the filtering. The few rubbish ones that slip through, and it is only a few (it may seem a lot to the end user) are those that the filtering needs tuning about. Sometimes to filter too harshly can impact legitimate emails, and if filtered at the server side can mean that an end user is not even aware they didn’t get a communication they required or was important for them. So a cautious moderate approach means some rubbish will get through rather than non-garbage is deleted.
5 Likes
A few years ago, when I used a Yahoo! Mail email address, I got a lot of spam, including phishing spam. For a few years there, I had enough time available to me to set Distributed Denial of Service software onto the spammer’s URL, and leave it sending 200,000 requests per second for a day or so. Yes, DDoS can be used for good, not just for evil. 
Two observations though:
- You might still be breaking the law. So really this is a bad idea.
- The spammer’s URL may be on a legitimate server that has been hijacked i.e. compromised. So you are making another innocent victim’s day worse.
I see a fair bit of the second bullet point, albeit that this is more “scam” than “spam”.
2 Likes
Certainly is a crime to use DDoS attacks even for “fun”.
And by definition a DDoS attack uses multiple devices to carry out the attack, so whose devices are being co-opted into that botnet?
2 Likes
Every time I’ve tried to block a spam/scam email with TMC a message pops up saying I need to report a valid address for it to be blocked! The emails have been sent from what look like legitimate addresses. So basically we can’t block any of these scam emails.
2 Likes
I left some wiggle room because it can easily be that absolutely all the computers involved are not located in Australia. Then you at best get into issues of extra-territoriality of Australian law and at worst Australian law simply isn’t applicable.
Also, I intended not to provide legal advice … as I’m not a lawyer and as this forum does not provide legal advice.
1 Like
I don’t know if the instructions on the linked page will help, hopefully they do. You may also need to check the header of the email to find the “real” address you want to block. Often spam emails come from an almost endless number of addresses, blocking them is a bit of whack a mole type process. Blocking is better suited to blocking real known addresses such as say a legitimate weekly newsletter you get but no longer wish to receive (assuming unsubscribe hasn’t worked).
https://support.themessaging.co/hc/en-au/articles/21738470046105-Managing-allow-block-lists
To report spam to TMC see the following link
https://support.themessaging.co/hc/en-au/articles/7974743330191-How-to-report-spam-emails
Setting up rules to filter emails and choosing the action/actions you want to happen is a good way of controlling the emails you see in your inbox.
https://support.themessaging.co/hc/en-au/articles/22034506859545-Set-up-email-rules-on-Webmail
2 Likes
Whether the computers are inside or outside Australia, if the offence involves Australian based devices (either the attacker or the attacked) it is a crime in Australia, and has been clearly stated by the relevant authorities that it is. If the person who creates the DDoS is in Australia they are subject to Australian law and judgement, and have committed an offence, regardless of the country of the resources they use to create the DDoS. If the attackers who create the DDoS originate from outside of Australia, the difficulty exists in finding and prosecuting the offenders, though most international authorities cooperate in dealing with the threats and perpetrators.
In 2013 Australia signed (with reservations on some articles) into the Convention on Cybercrime (COC), this treaty also has a UN Convention twin called Convention against Cybercrime (short version of the title) which has been adopted and will be finally ratified this year 2025 when the 40th signatory signs the Convention in Vietnam.
The 2001 COC document
The UN draft CAC
Thanks! I read this after I’d got rid of today’s lot, so will try these suggestions tomorrow.
1 Like
What may be SPAM to me - eg anything Real Estate, Climate, Electricity Company Plans (not my own) which I loathe - could be coming from a legitimate business, but their ethical filter is busted.
So Optus, Yahoo etc aren’t going to block them - but on my Email Client will toss them in SPAM.
The OP was about phishing i.e. scam not spam. We, the participants in this topic, may get closer agreement about what is a scam, as compared with what is spam.
But for sure any spam filter trained locally by you, for you, will be more accurate (fewer false negatives, false positives) than a generic filter running in the mail service provider, as far as your personal beliefs go.
Operating a spam filter in your email client has the disadvantage that you pay the performance price of actually downloading all the spam and then deciding to toss it away. Maybe if you have a 1 Gbit/sec internet connection, you won’t care about that.
Note that email from a legitimate business can still be spam. It is spam if it is unsolicited i.e. you have not given prior consent, either by consenting to receive their missives or by consensually entering into a commercial arrangement with them (and in the former case not subsequently withdrawing that consent).
2 Likes
I’m working my way towards ditching TMC because their filtering is overly aggressive yet lets plenty of scam emails through, including those that impersonate TMC. Until I add contacts to the TMC contacts folder, they block about 50% of legitimate emails as “unverified” and don’t even let them through to my Outlook spam folder. I don’t want to have to add my contacts to their system because I use Outlook for reading my emails and have to go back to their webmail to add to their address book.
One thing I wonder is how companies like TMC are supposed to detect scams and phishing if they don’t read our emails. TMC says it doesn’t read them (unlike Google and Microsoft). I like the idea of the email provider not scanning my emails but it’s a toss-up whether that’s preferable to receiving a bunch of malicious emails.
1 Like
I asked Microsoft why I couldn’t always see an email address on malicious emails and showed them an example. They told me that some emails are not sent from an email address - hence you can’t block them and you can’t report them.
2 Likes
Because of the way servers work, an email must have a From address, this doesn’t mean that the address has to be a valid address as it could be a spoofed (such as your own address), fake or non existent address. If an email doesn’t have a From address, servers usually reject it as spam. Some servers also check to see if the address provided is a real address, not all do.
Headers provide more than just the return/senders addresses, they also provide the path that the email took to get to the recipient. Reporting a spam email can be done even if there is no sender address that is valid. So report it to your email client provider, report to ACMA (Spam complaint form | ACMA), use filters, don’t click unsubscribe links, don’t click any links from the email, report spam abuse to your RSP/ISP and report it to the originating ISP/RSP.
The following link explains a way to identify and use details from the header to report spam to the ISP/RSP that the spam sender used. Please note the page has a lot of ads…so please use a private browser session to avoid gathering a lot of trash on the PC and close the browser after visiting the site.
An online header checker that is reputable
TPG was my email service provider for maybe 20 years - no problems at all with filtering. I use an email client on my PC and only rarely would use web access (their web app being quite hard/impractical to use on a mobile phone). The occasional dodgy/scam email I always reported to them.
Since TMC took over my TPG email account, the filtering has gone from woeful to annoying - more specifically, during the first year I was suddenly receiving 100-200 dodgy scam/spam emails per month, with all my reporting having no apparent effect. Now the annoying problem is that TMC will randomly block normal, desired emails - ones from addresses they had allowed to pass 2-3 times per month in the first year. They even blocked emails from the ATO! I was forced to use their (much better than TPG’s) web access to open the spam folder and report them as not phishing so they went to the Inbox. Repeatedly reporting emails from the same address as not phishing and adding the addresses to the TMC Contacts has had no effect.
Thank you to the person who posted details about the TMC Allow and Block lists - I now have hope! I have just now added 41 email addresses to the Allow List. I am confident this will work; I will just add to this list as needed.
3 Likes
Thank you Grahroll! You have given me hope, and most likely solved my TMC false filtering problem, with your information on the TMC Allow List (that I did not know existed).
3 Likes
Some spam filters ‘learn’ from marking of emails to assist in blocking future spam. This is often limited to the software used by individual user, and not shared through mail filters.
We use the Signal Spam plug-in for Thunderbird, and report spam emails not identified through inbuilt spam filters. We do this so spam can be identified, added to standard blacklists and hopefully action is taken against persistent spammers.
2 Likes
