# Six-Year Study of Emails Sent to Unverified Addresses

Alexander Joukov, Nikolai Joukov

► To cite this version:

Alexander Joukov, Nikolai Joukov. Six-Year Study of Emails Sent to Unverified Addresses. 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.337-345, 10.1007/978-3-031-38530-8_27. hal-05462100

HAL Id: hal-05462100

https://inria.hal.science/hal-05462100v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Six-Year Study of Emails Sent to Unverified Addresses

Alexander Joukov<fnref n="1" />,<fnref n="2" /> and Nikolai Joukov<fnref n="1" />(✉)

**Abstract.** In addition to a username and password, more and more websites are requiring an email address during account creation. But often, users are granted full access before email verification, allowing them to create accounts using others' email addresses. As a result, emails sent to such users will instead end up in the true owners' inboxes. These emails can contain private data ranging from personally identifiable information to banking details and social security numbers. Additionally, the true owner can reset the password and access the account directly. But regardless of potential malicious action, both the user and the true owner face negative consequences.

In this paper, we enumerate the prevalence of this shortcoming by manually analyzing account accessibility before email verification on leading United States websites—72% of them failed to restrict potentially harmful actions. Then, we used our rare opportunity to use a short, dictionaryword Gmail address to analyze unverified emails over the course of six years. We categorize the exposed private data and reveal user risks. We aim to bring attention to the dangers of this security flaw and call for the development of new privacy policies.

**Keywords:** Authentication · Authorization · Security · Web Applications · Email

## 1 Introduction

One of the authors was part of a select few individuals to create and own an “OG” (slang term for “original gangster”) email address, which are short, desirable, dictionary word email addresses (e.g., “dog@gmail.com”). Unknown individuals regularly use the address when creating accounts without access to it. For example, years ago, one such individual used the address to create an account with a leading mobile phone producer and the company never verified the customer’s email address. When they ended up selling the phone without attaching the login credentials, the new owner could not gain access to it. Unable to reset the password, he or she resold the phone, starting a multi-year sequence of reselling events with each user purchasing the device, failing to log in, and finally selling it. Since the phone displays the email address in clear text, these buyers from all around the world sent reset links, harassing emails, social media attacks, and endless hacking attacks in hopes of gaining access to the email and the phone. This email address has been registered on many other websites too, some of which are highly

<footnote n="1">¹ modelizeIT Inc., 25 Health Sciences Dr., Stony Brook, NY 11790, USA</footnote>

<footnote n="2">² Ward Melville High School, 380 Old Town Road, East Setauket, NY 11733, USA</footnote>
confidential. Krebs on Security, one of the most influential security bloggers, has also reported a similar story [1].

## 2 Overview

Today, most web applications use user accounts. To enable automated password resets and to harvest client contact information for communication, most web applications also require the user's email address.

Although this is a great way to protect users with compromised credentials from malicious attacks, it creates a security threat of its own if improperly implemented. If the user inputs a false email address and it passes unverified, the true owner (TO) of the email address can view the emails or even reset the credentials using the email address and steal the account. It can be compared to revealing login credentials to a single random individual. Moreover, websites often send an email after sign-up (e.g., “Thank you for signing up!”). This not only informs the TO that an account was created under their email address, but also where, thus providing a potential reset-and-log-in target.

Additionally, the user may need to view website-sent emails but will not have the ability to do so. In extreme cases, such users have attempted to take over TOs' email accounts [2].

Although it may seem clear that we should only input email addresses we have access to, some still do so. We suspect this is for a few reasons: by mistake, to reduce spam, and to create aliases for sign-up bonuses [3], which are usually discounts for first-time users. In such instances, we suspect that users may be inclined to enter word/name addresses as opposed to random characters. It is estimated that there exist over one million English words and hundreds of thousands of first and last names, with comparable numbers in every other language. As a result, there exist many possible predictable email addresses to be targeted [4]. Simple permutations of such addresses (johndoe123@gmail.com, doejohn@gmail.com) are also likely to be targeted.

The TO can face consequences, too. If their email address is taken by a different user, the TO may not be able to use their own email address to create an account. Even if resetting the account is possible, that email address may be permanently restricted from receiving additional sign-up bonuses.

## 3 Study on Unverified Emails

The present paper consists of two investigations. In the first, we determined which kinds of private data **could** be intercepted or lost through unverified emails in a larger sample size. In the second, we determined which kinds of private data **actually** appear in such emails. Evaluated together, these investigations show which types of websites we would expect the most unverified emails from (assuming equal unverified email proportions across website categories), which websites should actually be associated with unverified emails, and how often and which types of data may be compromised.
## 3.1 Categorization and Related Concerns

In both investigations, each website was only placed in one category. These categories group similar web applications and generalize other websites not included in this list. A breach of a user account through an incorrect email submission will nullify and compromise authentication details in every web application due to password reset capabilities, regardless of the category. Additionally, personally identifiable information (PII) is revealed in emails of every category at least once. In this paper, we view PII as a broad category of information, and include names, addresses, and other similar information.

However, each website category also presents its own set of related concerns. There is no single unified website categorization list, though studies attempting to automate this process exist [6]. We used categorizations defined by Similarweb [5]. They are as follows:

**News** websites present information on new events or developments. They may store financial information for subscriptions.

**Ecommerce** websites are online stores. They may store financial information and shipment details. A TO can log in directly and purchase goods without the need to intercept data.

**Shipping** websites provide a portal for users to track shipments. They may store package locations and financial information.

**Price Comparison** websites provide product or travel reviews. They may store private messages and financial information.

**Telecommunications** websites include Internet Service Providers and Mobile Network Operators. They may store confidential identification numbers and financial and insurance information.

**Social Media** websites provide a platform for users to communicate. They may store messages and financial information (uncommon). The TO can also send messages to others under the user's name.

**Health** websites deal with healthcare and medicine. They may store financial, medical, and insurance information, messages, and confidential identification numbers.

**Finance** websites deal with large amounts of capital. They may store financial and insurance information, messages, and confidential identification numbers (e.g., tax IDs and SSNs).

**Government** websites may store confidential identification numbers and insurance and financial information.

**Streaming** websites stream video or audio to their users. They may store financial information and messages.

**Education** websites provide academic information. University websites are included. They may store financial information, messages, confidential identification numbers, and evaluations.

**Employment** websites provide a link between employers and potential employees. They may store messages and financial information.

**Game** websites provide online games. They may store financial information and messages.

**Dating** websites may store messages, sensitive images, and personal and financial information.
The **Individual** category encompasses emails sent directly from one individual to another. The intended recipient directed the sender to a false address. These emails may contain messages and attached files with varying risk levels.

**Email** websites provide an email address. They may store messages, financial information, and authentication information for other websites. If such an account is breached, associated web accounts may also be compromised through resetting as explained above.

**Miscellaneous** websites do not fit into any other category. These include, for example, online birthday card services. Note that miscellaneous websites' risks largely vary and such websites can include any risk category.

## 3.2 Web Applications and Associated Risks

In this investigation, we manually analyzed the top 100 most visited websites [7] to determine if each verifies user email addresses. Of the 100 analyzed websites, 75 could be studied for user email address verification, while the remaining 25 could not. 6 of these use system accounts constructed elsewhere and the remaining 19 could not be studied because accounts could not be created for them. The Government, Health, and Finance categories were combined into a High Priority category in this investigation because the groups are small individually and share similar risks and purposes. Not every category is present in the first investigation because they are not in the data set. We could not automate the account-making process using a script because many required human verification tasks (e.g., CAPTCHA [8]).

Table 1 summarizes the categories, frequencies, and risks. Assuming Ecommerce websites save financial information more frequently than websites of other categories, and given that only 4 of 16 verify email addresses, we see considerable potential for theft. In addition, High Priority websites all store government documents or other data with comparable confidentiality. Since only 2 of 7 analyzed High Priority websites verify email addresses, this category presents a serious risk too.

Overall, only 21 of the 75 (28%) websites verified email addresses.

## Collected Emails and Exposed Information

In the second investigation, we used an “OG” address owned by one of the authors to collect emails from unverified accounts over a span of six years (June 2016 to February 2023). We expect that short email IDs like these are more likely to be inputted by non-TOs and, as such, serve as a quicker way to collect an abundance of emails to study. Initially, more than one thousand emails were collected. We excluded many because they were regular spam or because of a language barrier, leaving 943 emails for analysis. For each email, we determined the sender’s web application type, the type of content of the email, and whether personally identifiable information (PII) was exposed. This section distinguishes theoretical unverified email counts as presented in the US website analysis from unverified email counts in practice. It is important to note how certain categories are seen more or less often compared to the previous section.

**Data sorted by Application Category.** In Table 2, we removed 184 insignificant emails, 59 of which contained PII. These contained some private information but little that could be targeted. 369 of the 759 (49%) remaining unverified emails contain personally identifiable information.
<table><caption>**Table 1.** Fraction of websites requiring email verification by category and the types of data that are typically stored in each.</caption><thead><tr><th>Site Category</th><th>Verification</th><th>Financial</th><th>Messages</th><th>ID Numbers</th><th>Medical</th><th>Package</th></tr></thead><tbody><tr><td>News</td><td>5 of 17</td><td>X</td><td></td><td></td><td></td><td></td></tr><tr><td>Ecommerce</td><td>4 of 16</td><td>X</td><td></td><td></td><td></td><td>X</td></tr><tr><td>Price Comparison</td><td>2 of 9</td><td>X</td><td>X</td><td></td><td></td><td></td></tr><tr><td>Social Media</td><td>4 of 8</td><td>X</td><td>X</td><td></td><td></td><td></td></tr><tr><td>High Priority</td><td>2 of 7</td><td>X</td><td>X</td><td>X</td><td>X</td><td></td></tr><tr><td>Streaming</td><td>0 of 6</td><td>X</td><td>X</td><td></td><td></td><td></td></tr><tr><td>Education</td><td>1 of 5</td><td>X</td><td>X</td><td>X</td><td></td><td></td></tr><tr><td>Employment</td><td>1 of 4</td><td>X</td><td>X</td><td></td><td></td><td></td></tr><tr><td>Miscellaneous</td><td>2 of 3</td><td>X</td><td>X</td><td>X</td><td>X</td><td>X</td></tr><tr><td>Shipping</td><td>0 of 0</td><td>X</td><td></td><td></td><td></td><td>X</td></tr><tr><td>Game</td><td>0 of 0</td><td>X</td><td>X</td><td></td><td></td><td></td></tr><tr><td>Dating</td><td>0 of 0</td><td>X</td><td>X</td><td></td><td></td><td></td></tr><tr><td>Individual</td><td>0 of 0</td><td>X</td><td>X</td><td>X</td><td>X</td><td>X</td></tr><tr><td>Telecommunications</td><td>0 of 0</td><td>X</td><td>X</td><td>X</td><td></td><td></td></tr><tr><td>Email</td><td>NA of 6</td><td>X</td><td>X</td><td>X</td><td>X</td><td>X</td></tr></tbody></table>

We can see that Ecommerce websites send the most unverified emails, followed by Social Media websites. Together, these two sources sent nearly half of all collected unverified emails. Ecommerce sent a total of 198 emails containing personally identifiable information (54% of the total excluding insignificant emails), which in part can be attributed to the mobile phone provider described earlier. Ecommerce websites—despite often containing critical financial information—are more frequently abused in this domain than other types of websites. Such websites are eager to enroll new users and are likely willing to eliminate barriers like email verification at the expense of preventing unsafe behavior.

Ecommerce and Dating websites appear more frequently than in the previous section. In the case of Ecommerce, we suspect that sign-up bonuses are the root.

In the case of Dating websites, which did not even make the top 100 US websites, we suspect that users are less inclined to associate their own email addresses with such websites. Thus, they turn to “burner” (temporary) addresses or addresses which they do not own [9].

**Data Sorted by Email Content Category.** As visible in Fig. 1, most unverified emails are of the category reset, verification, or advertising (53%). Reset emails request to reset the credentials of the TO to gain access to the email account. Verification emails notify the TO that the email has been used to sign up on a website, but they do not necessarily mean that the website prevented the account creation. Advertising emails
<table><caption>**Table 2.** Unverified email and personally identifiable information counts per category.</caption><thead><tr><td>Website Application Category</td><td>Unverified Email Count</td><td>PII Count</td></tr></thead><tbody><tr><td>Ecommerce</td><td>283</td><td>198</td></tr><tr><td>Social Media</td><td>90</td><td>20</td></tr><tr><td>Finance</td><td>55</td><td>25</td></tr><tr><td>Email</td><td>52</td><td>43</td></tr><tr><td>Telecommunications</td><td>48</td><td>7</td></tr><tr><td>Individual</td><td>43</td><td>6</td></tr><tr><td>Education</td><td>38</td><td>27</td></tr><tr><td>Dating</td><td>28</td><td>5</td></tr><tr><td>Games</td><td>25</td><td>3</td></tr><tr><td>Shipping</td><td>19</td><td>7</td></tr><tr><td>Employment</td><td>17</td><td>5</td></tr><tr><td>News</td><td>17</td><td>3</td></tr><tr><td>Streaming</td><td>15</td><td>2</td></tr><tr><td>Government</td><td>14</td><td>14</td></tr><tr><td>Health</td><td>12</td><td>5</td></tr><tr><td>Price Comparison</td><td>3</td><td>0</td></tr></tbody></table>

<figure><img src="image_3.png" /><figcaption>**Fig. 1.** Unverified emails in each content category.</figcaption></figure>

display website promotions; these should not be confused with spam, since they were deliberately subscribed to. Emails of these three categories tend to display little private information besides PII. Therefore, their proportionately large volume is positive.
However, every other category contains private data, and those categories still account for a large part of the emails. Credential emails display login credentials directly, which grants the TO the ability to log in to the account directly. Receipts contain purchase information and package contents. Package emails contain these too, but they also reveal the destination and time of arrival of packages—all the information needed to intercept them. Emails from the backup category request the recipient’s email account to act as a backup to their own email address in case they lose their password. This is especially dangerous because if the TO resets and accesses the user’s email address, then they can also access all the web accounts linked to that address through a similar resetting process. Confidential emails contain government documents, tax ID numbers, and other data of similar confidentiality. Sixteen such emails were found.

<figure><img src="image_4.png" /><figcaption>Fig. 2. Unverified email count by month.</figcaption></figure>

**Data Sorted by Date.** In Fig. 2, we see that the volume of unverified emails appears to fluctuate with time. We received an average of 12.2 emails each month.

## 3.3 Future Work

In the absence of internal Gmail algorithm knowledge, in our future work we are considering investigating this phenomenon by considering senders and filters as black boxes [10]. We note, for example, that it is difficult for spam filters to identify fraudulent emails [11] and in this case, we are studying legitimate emails requested by or generated as a byproduct of non-TO users.

## 4 Solutions

Public email providers have made changes in recent years to filter spam and fraudulent emails [12–15]. Although they attempt to send such emails to users’ spam folders, they skip over emails they believe the user deliberately subscribed to or requested. Emails
sent to unverified addresses are deliberately subscribed to, just not by the TO. Thus, such filtering policies are unable to target them.

One solution would be to implement new filtering policies to target unverified emails. One issue with this approach, however, is that it may be difficult to distinguish between spam and unverified emails. In some scenarios, even we, human operators, had trouble differentiating the two. More importantly, still, is that TOs may prefer to know when their address was used. Thus, a website-side approach appears more reasonable.

To prevent account breaches and data interception caused by users inputting false email addresses, web applications often provide additional identification steps such as two-factor authentication, security questions, and more. Although these are invaluable, email verification is less costly to implement and almost entirely eliminates this vulnerability. Unfortunately, the small hassle on the part of the user may dissuade them from the service and reduce user traffic. We suspect website hosts may be opposed to implementing the security feature for this reason. Therefore, it may be necessary for privacy standards to enforce new related privacy policies.

## References

1. The Joys of Owning an 'OG' Email Account. https://krebsonsecurity.com/2020/09/the-joys-of-owning-an-og-email-account/. Accessed 9 June 2023

2. Meet the underground business of OG account takeover attacks. https://securityboulevard.com/2020/10/meet-the-underground-business-of-og-account-takeover-attacks/. Accessed 20 Mar 2023

3. Hölzer, R., Malin, B., Sweeney, L.: Email alias detection using social network analysis. In: The 3rd International Workshop on Link Discovery, LinkKDD, pp. 52–57 (2005). https://doi.org/10.1145/1134271.1134279

4. Frequently Asked Questions about Name Statistics. https://www.scb.se/en/findingstatistics/statistics-by-subject-area/population/general-statistics/namestatistics/produktrelaterat/more-information/frequently-asked-questions-aboutname-statistics/. Accessed 20 Mar 2023

5. SimilarWeb Categories. https://www.similarweb.com/category/. Accessed 20 Mar 2023

6. Bruni, R., Bianchi, G.: Website categorization: a formal approach and robustness analysis in the case of e-commerce detection. Expert Systems with Applications, vol. 142 (2020). https://doi.org/10.1016/j.eswa.2019.113001

7. Top 100 most visited websites (US and worldwide). https://ahrefs.com/blog/most-visited-websites/. Accessed 20 Mar 2023

8. Rahman, M.A., Anwar F., Azad, M.S.: A simple and effective technique for human verification with hand geometry. In: 2008 International Conference on Computer and Communication Engineering, ICCCE, pp. 1177–1180 (2008). https://doi.org/10.1109/ICCCE.2008.4580792

9. Hu, H., Peng, P., Wang, G.: Characterizing pixel tracking through the lens of disposable email services. In: 2019 IEEE Symposium on Security and Privacy, SP, pp. 365–379 (2019). https://doi.org/10.1109/SP.2019.00033

10. Joukov, N., Traeger, A., Iyer, R., Wright, C.P., Zadok, E.: Operating system profiling via latency analysis. In: 7th USENIX Symposium on Operating Systems Design and Implementation, OSDI, pp. 89–102 (2006). https://dl.acm.org/doi/abs/10.5555/1298455.129.8465

11. Airoldi, E., Malin, B., Sweeney, L.: Technologies to defeat fraudulent schemes related to email requests. In: AI Technologies for Homeland Security, AAAI Spring Symposium, pp. 133–135 (2005)
12. Help prevent spoofing and spam with SPF. https://support.google.com/a/answer/33786. Accessed 20 Mar 2023

13. Kitterman, S., Sender policy framework (SPF) for authorizing use of domains in email, version 1. RFC 7208 (2014). https://www.rfc-editor.org/info/rfc7208, https://doi.org/10.17487/RFC 7208

14. Crocker, D., Hansen, T., Kucherawy, M.: DomainKeysIdentified mail (DKIM) signatures. RFC 6376 (2011). https://www.rfc-editor.org/info/rfc6376, https://doi.org/10.17487/RFC 6376

15. Kucherawy, M., Zwicky, E.: Domain-based message authentication, reporting, and conformance (DMARC). RFC 7489 (2015). https://www.rfc-editor.org/info/rfc7489, https://doi.org/10.17487/RFC7489