I get about 10 fake order confirmations a week. This can't be that hard to detect, right?

It’s always the order confirmations

Wow, that is scary. Can I assume these are phishing emails? My point: They get you to "confirm" the fake order and harvest some personal information. I worry most about my parents. There is no way, at their advanced age, that they can distinguish between real and phishing emails. The Internet has gone to crap, again. Sigh.

I haven't invested a lot of time in them. They -always- have a PDF attached. It appears to be an invoice but never has my personal details, other than email address.

The subject is always either 'Order Confirmation' or 'Payment Confirmation.'

They always have a number at the bottom of email or the PDF to call for support/order cancellation. My best guess is that they want people call in rightly claiming they didn't make an order, then the phishing begins?

I've pasted one below, sans PDF. This one is a phone, but it seems to often be an antivirus subscription .

Notice it always comes from a personal name that doesn't even match the email address, not some fake company. That's why I don't understand why Gmail isn't blocking these!

--

From: Mark Kiehn <[email protected]> Subject: Payment Confirmation

Need Help? (815) X (570) X (9159) Congrats on getting your new device! We trust you're enjoying your purchase and exploring all its amazing features.

Invoice ID: INV//#<8 digit number>

Product: OnePlus 10T Ref: #<8 digit number> Purchase Date: AUGUST 15, 2024 Total Amount: $397.24 Return Policy If you're not satisfied with your device, you can get a full refund within 48 hours of purchase. For assistance or to start a return, contact our support team.

Need Help? (815) X (570) X (9159)

There’s a big uptick in one particular type of spam email for me. These ones have a huge amount of nonsense “words” at the end of it, which appear to be random strings of letters of random length. Their purpose seems to be to trick the spam filters that have no idea how to classify “witwicshmniss” as spam or not spam.

To be clear, I assume that modern, sophisticated spam operations are "leading the league" in LLM usage. It must be much harder to stop spam when each email can be individualized by an LLM. And let's be real: LLMs are already very, very good at producing text that sounds believable. I, myself, have been fooled many times already by recent spam, that is so much more believable than two year ago.

If GMail is getting worse, I can imagine that other, smaller mail services are getting much worse. The best explanation that I have read about why Google (and other major providers) are so good at spam filtering: They can observe a huge portion of the world's email, so they have the best training sets.

It is interesting that we never hear from GMail folks on HN. You see all kinds of Googlers pop-up into discussions with interesting insights about how the sausage is made. However, I cannot recall anyone from GMail appearing on HN to share some interesting behind-the-scenes stories.

SpamAssassin seems to work for me.

> The problem with building a bear-safe trashcan is that "There is considerable overlap between the intelligence of the smartest bears and the dumbest tourists"

Google can't create a good spam filter, because enough users actually want to receive spam.

A machine can't distinguish between male enhancement pill spam and a newsletter recommending alex jones' supplements.

Or between "join our MLM today" and emails from recruiters.

Or between sales people sending cold emails and social engineering.

Google should ban both, but if they did, there'd be a huge outrage from idiots that actually want to receive content that's basically indistinguishable.

When pre-Musk Twitter tried to reduce the wave of fake news, they actually had to explicitly whitelist republican accounts because

> Most fake news on Twitter is spread by […] Republican, middle-aged White women residing in three conservative states, Arizona, Florida, and Texas