this post was submitted on 17 Feb 2025
171 points (95.2% liked)

Privacy

34127 readers
696 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
k_o_t@lemmy.ml
tmpod@lemmy.pt
Yayannick@lemmy.ml
ranok@sopuli.xyz
171
Watch out for proton phishing emails (lemm.ee)
submitted 5 days ago by dan00@lemm.ee to c/privacy@lemmy.ml
34 comments fedilink hide all child comments
 

Hi yall, I have been receiving these email for a while now. The email address is no-reply@notify.proton.me but I’m pretty sure this is a phishing attack because not the first email (the one in blue) or the second account name (the one in red) are my proton account.

Someone knows these 2 gmail accounts and knows I have a proton one but doesn’t know the correct proton account name. Ofc my proton account is not linked these emails, not even for recovery situations.

Just heads up, this was not easy to spot.

all 35 comments
sorted by: hot top controversial new old
[–] TheHobbyist@lemmy.zip 44 points 5 days ago (1 children)

In this case, without clicking any links in the email, why don't you just simply go to the proton website manually and log in for good measure?

[–] dan00@lemm.ee 20 points 5 days ago

I did, I have the app on the phone and the account is fine, no notifications or emails. Nothing… it happened already some weeks ago and i ignored it.

[–] lemmyknow@lemmy.today 29 points 5 days ago (1 children)

Don't Proton emails come starred or marked as oficial? At least on the Android app, for me, it shows 'Oficial'

[–] Lemjukes@lemm.ee 10 points 5 days ago (1 children)

Can confirm in the iOS app that messages from proton official have a special badge

[–] dan00@lemm.ee 4 points 5 days ago (1 children)

Oh, really? This one didn’t have any badge at all. I’m confused.

[–] Lemjukes@lemm.ee 7 points 5 days ago (1 children)

To clarify, they have a badge in the proton client you’re in the ios mail app. Everything I can tell from this email makes it seem legit, this may be a false positive on you’re end ‘mfraid.

[–] dan00@lemm.ee 4 points 5 days ago

Ah okay, yes the official one does. Yes, I think its a false positive… ¯\_(ツ)_/¯

[–] SaltyIceteaMaker@lemmy.ml 23 points 5 days ago (2 children)

does it have the "official" tag? it should look like this:

[–] GroundedGator@lemmy.world 9 points 5 days ago (1 children)

OP stated this was sent to their Gmail, so wouldn't have the tag.

[–] SaltyIceteaMaker@lemmy.ml 3 points 5 days ago

i linked up my Gmail anf proton. so my gmail stuff gets forwarded to proton with a specific tag

[–] Lemjukes@lemm.ee 11 points 5 days ago (1 children)

This looks like they’re using the iOS mail client

[–] dan00@lemm.ee 5 points 5 days ago

Yes this is the mail app in ios

[–] WreckingBANG@lemmy.ml 23 points 5 days ago (3 children)

Isnt proton.me their real url, or does it lead you somewhere else when you click it?

[–] AbsolutelyNotAVelociraptor@sh.itjust.works 23 points 5 days ago

Proton.me is their real url, but is that link taking you to proton.me?

[–] dan00@lemm.ee 4 points 5 days ago (1 children)

It seems to lead to proton.me but maybe I’m not expert enough.

[–] EtherWhack@lemmy.world 10 points 5 days ago

They may have the 'official' url in the link, but there's a good chance they might be piped/redirected through a malicious server under the spammer's control to log your keystrokes.

[–] EtherWhack@lemmy.world 16 points 5 days ago

I've seen at least a couple times a similar trick but with payment req websites like cash app or venmo. Everything looks legit, but if you were to look closely at the url they want you to click, it is almost always routed through a server under the phisher's control.

[–] GroundedGator@lemmy.world 9 points 5 days ago

Wondering if someone somehow linked your Gmail (email you received this on) to their proton account. I was looking for an email you could forward this to to report it to proton but could not find one.

As always, if an email looks suspect, don't click anything. Just wish there was a way to report it.

[–] fmstrat@lemmy.nowsci.com 1 points 3 days ago

https://proton.me/support/inactive-accounts

If you have been inactive on all Proton services for one year, we will give you advance notice 30 days, 15 days, and 7 days before your account is deleted.

[–] shifty@leminal.space 10 points 5 days ago (1 children)

That is their official email address. Did you make an Alias or something and you forgot?

[–] dan00@lemm.ee 2 points 5 days ago (2 children)

I’m starting to think I’m wrong somehow... Maybe i made an account long ago and forgot? I really don’t think so tho.

[–] shifty@leminal.space 4 points 5 days ago* (last edited 5 days ago)

Its possible some wires got crossed behind scenes, some database/software mixup.

Maybe email proton support if you're concerned? I've had some similar mixup happen with banking and they got it all sorted after I complained (I was getting emails intended for someone else).

Edit: either way, I think you should let them know in case its phishing or something broken on their end.

[–] ReversalHatchery@beehaw.org 2 points 5 days ago* (last edited 5 days ago)

the address there can be faked, maybe your email client did not warn about it. if you can check the mail's headers (maybe easier on desktop), look at all the addtesses you see in there and if thry seem suspicious.

also check the link they sent. Don't open it, but copy it only.

[–] xxd@discuss.tchncs.de 9 points 5 days ago

I'm not sure if this is how proton notifies you, but it could also be that someone else (the other address you're seeing) put you in as their recovery mail. they haven't logged in in a while, and now get notified that their account might get deleted due to lack of activity. They might have just mistyped the intended recovery email or randomly put in yours. Either way, nothing you need to do.

[–] kekmacska@lemmy.zip 2 points 4 days ago

is no-reply@news.proton.me legit? i got an email like that

[–] retiolus@lemmy.cat 6 points 5 days ago (1 children)

What is the real url?

[–] dan00@lemm.ee 4 points 5 days ago (2 children)

All the urls seems going to proton.me… thats why I’m confused. Should i check something specific?

[–] kungen@feddit.nu 15 points 5 days ago* (last edited 5 days ago) (2 children)

It could also be some IDN tricks. Most browsers translate mixed scripts into punycode nowadays, but it can be easy to get tricked. Just go to their official site if you're unsure.

For example: www.prοtοn.me/ looks like a normal link... but the O's have been replaced with the Greek letter omicron.

[–] shortwavesurfer@lemmy.zip 10 points 5 days ago

Interesting. I am blind and therefore use the TalkBack screen reader and it does not say the O's because they are not in English. It reads that as PRTN.

[–] mstrk@lemmy.world 2 points 5 days ago

this is really insightful, thanks!

[–] potentiallynotfelix@lemmy.fish 6 points 5 days ago

if it's actually proton.me that's an official url.

[–] Lemjukes@lemm.ee 1 points 5 days ago

Are you using the iOS mail client with a proton email account?