What’s the Scam?

To subscribe to my monthly email newsletter, you have to enter your information on the webpage, and then reply to an automatically generated email. This is, of course, to prevent people from subscribing addresses other than their own.

Starting last weekend, I have been receiving a lot of individual responses to those emails. Always one line:

Thank you for the positive impact your emails have had on my life.
Your emails are a game-changer.
Your emails are a constant reminder of why I subscribed.
Your emails rock.
Thank you for the time and effort you put into creating these informative emails.
Thank you for the passion and enthusiasm you infuse into your email content.
Your emails consistently exceed my expectations. Thank you for the exceptional value!

I responded to the first few, because sometimes I do get these nice emails from readers and I hadn’t yet realized it was all fake. But so many, and all at once—this is obviously AI. And obviously a scam, except I can’t figure out what the scam is.

The addresses are things like:

jnnvcddghjgfdryhj67@gmail.com
nbhgdfhjedty896565@gmail.com
jesikawells6873@gmail.com
niffelatopserean92@gmail.com
reinareyes983@gmail.com
htfhtfhhjkgth@gmail.com

All Gmail. None of the addresses has actually subscribed to Crypto-Gram. They could; whoever is sending the emails could easily have confirmed the subscription.

My first thought was pig butchering—wanting me to respond and turn this into a conversation—but no one has responded to any of my responses. Anyone have any idea?

Posted on September 1, 2026 at 1:36 PM4 Comments

Comments

Alan September 1, 2026 1:46 PM

My thought is Pig Butchering but:
(a) you don’t respond fast enough (by the time you respond, the email address has already been suspended), or
(b) it’s just not working right, or they’re still trying to get it going.

M September 1, 2026 1:56 PM

To make Google’s fraud detection think that these accounts are not going to be used for nefarious purposes.
So aging them and having “genuine” conversations, with real human operated addresses is probably helpful.
Getting you to respond is probably even better and it seem to have worked.
Probably doing that with various people, before it’s time for business.

Bruce September 1, 2026 2:16 PM

Unless SPF, DMARC, DKIM etc pass muster, the From header is probably garbage. The sender can put whatever they want (probably email addresses taken from a dump of compromised accounts.)

Stu September 1, 2026 2:27 PM

Came here to say something to “M” above…my guess is this is the modern equivalent of “laundering” email addresses…exercizing them enough that they are old/trusted/used enough that they pass various fraud detection methodologies.

Leave a comment

Blog moderation policy

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.