# Spam, or real e-card? **URL:** \ **Category:** Factual Questions\ **Created:** [June 13, 2004, 2:55pm UTC](https://boards.straightdope.com/t/spam-or-real-e-card/250119 "2004-06-13T14:55:38Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![Johnny\_L.A](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/johnny_l.a/32/1084_2.png) [@Johnny\_L.A](https://boards.straightdope.com/u/Johnny_L.A)\ **Post date:** [June 13, 2004, 2:55pm UTC](https://boards.straightdope.com/t/spam-or-real-e-card/250119/1 "2004-06-13T14:55:38Z")
I use spamblocker in my webmail. Messages will not be downloaded into my inbox unless the sender has received authorisation from me to send me e-mail by being added to my address book. I also have the virus blocker turned on. This is what it says: > [@](#): > > Virus Blocker works behind the scenes scanning your incoming email for viruses. If a message is infected, Virus Blocker takes one of three actions: > > \*\*Cleans Viruses from Attachments and Message Headers \*\* > Sometimes viruses attach themselves to email messages that others send you. Often Virus Blocker will be able to remove, or “clean”, a virus from an infected message and pass it on to your Inbox. A note will be inserted at the top of your message indicating that it was cleaned by Virus Blocker. > > \*\*Quarantines Messages that Can’t Be Cleaned \*\* > When you receive a legitimate message that can’t be cleaned, it’s moved to a special Quarantine folder on EarthLink’s email system… > > **Automatically Deletes Certain Messages** > Some viruses “breed” by sending copies of themselves via email. These messages are fakes; they have some nonsense in the message body, and an attachment containing the virus. They are tricky, because they appear to be sent by someone you know! Virus Blocker spots these messages right away, and deletes them before you ever see them… So I have the following message in my Suspect Email folder: > [@](#): > > Hi John! > has sent you an ecard from [TurnerClassicMovies.com](http://TurnerClassicMovies.com) To see it, just click on the link below > > [http://www.turnerclassicmovies.com/Ecard/View/0,,~21277,00.html](http://www.turnerclassicmovies.com/Ecard/View/0,,~21277,00.html) > > or simply copy and paste it in your browser address window. > > Thank you, > Your friends at [http://www.turnerclassicmovies.com](http://www.turnerclassicmovies.com) There is no indication that the message contains spam or a worm. Ordinarily, I’d delete the message immediately. But it’s reasonable that I would receive an e-card yesterday. Since e-cards are sent by a program on a website instead of from someone’s e-mail, the sender (who might be authorised to send me mail) wouldn’t know that the e-card is from an authorised sender; the “request authorisation” e-mail would go back to the card site and not the sender. The name is right; but that doesn’t mean anything. How often have you received spam with your name on it? Often. The date is right; since of any day of the year, yesterday would be the one when I’d expect to get an e-card. But the sender didn’t put a name in the “from” box. That’s suspicious, but he or she could have signed in the message. Should I follow the link? Or, to make this GQ instead of IMHO, what would the potential consequences be if this message is spam and not from someone I know? ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [June 13, 2004, 2:59pm UTC](https://boards.straightdope.com/t/spam-or-real-e-card/250119/2 "2004-06-13T14:59:49Z")
Here’s a quickie test – move your cursor over the link. Does the actual link shown in your browser window match the one under the cursor? If not, it is bogus, fersure – phishers use this to trick you into going to a non-ebay site that appears to be ebay in the link. ---
**Author:** ![Johnny\_L.A](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/johnny_l.a/32/1084_2.png) [@Johnny\_L.A](https://boards.straightdope.com/u/Johnny_L.A)\ **Post date:** [June 13, 2004, 3:01pm UTC](https://boards.straightdope.com/t/spam-or-real-e-card/250119/3 "2004-06-13T15:01:39Z")
First thing I checked. The link is the same as the text (except it has Ecard/View insted of the ellipsis). ---
**Author:** ![Mr.Blue\_Sky](https://avatars.discourse-cdn.com/v4/letter/m/d26b3c/32.png) [@Mr.Blue\_Sky](https://boards.straightdope.com/u/Mr.Blue_Sky)\ **Post date:** [June 13, 2004, 3:03pm UTC](https://boards.straightdope.com/t/spam-or-real-e-card/250119/4 "2004-06-13T15:03:11Z")
I clicked on it and got this: > [@](#): > > The page you are looking for is no longer here. Please use > your back button, or choose a link from the top navigation. ---
**Author:** ![Johnny\_L.A](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/johnny_l.a/32/1084_2.png) [@Johnny\_L.A](https://boards.straightdope.com/u/Johnny_L.A)\ **Post date:** [June 13, 2004, 3:13pm UTC](https://boards.straightdope.com/t/spam-or-real-e-card/250119/5 "2004-06-13T15:13:26Z")
> [@](#): > > I clicked on it and got this: That was brave. Either that, or you trust your virus protection more than I trust mine! So the mystery is, if not solved, at least moot. I’ll just delete the message. Thanks! ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [June 13, 2004, 3:15pm UTC](https://boards.straightdope.com/t/spam-or-real-e-card/250119/6 "2004-06-13T15:15:25Z")
While you are correct in being suspicious, a lot of legitimate sites let users send e-cards like this. Since the link was clearly from a legitimate site (it’s a company with a fairly high profile, after all, and the URL is not phonied up in any way), there was no reason to believe this was anything other than an e-card sent to you from a friend. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [June 13, 2004, 3:24pm UTC](https://boards.straightdope.com/t/spam-or-real-e-card/250119/7 "2004-06-13T15:24:20Z")
> [@RealityChuck](#): > > Since the link was clearly from a legitimate site… How can you tell this? It is a fact that the FROM address in email headers cannot be relied upon to be genuine. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [June 13, 2004, 3:29pm UTC](https://boards.straightdope.com/t/spam-or-real-e-card/250119/8 "2004-06-13T15:29:57Z")
Sorry, **RealityChuck,** I didn’t think much before quoting you & replying. You were referring to the LINK in the email as being legitimate, not the sender, right? So, nevermind. 🙂 **Johnny L. A.** , it looks more and more like the mail is OK, but you are right to be suspicious. It may save your ass one day. ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [June 13, 2004, 3:38pm UTC](https://boards.straightdope.com/t/spam-or-real-e-card/250119/9 "2004-06-13T15:38:43Z")
Exactly. You can’t trust the sender, but the link **has** to be accurate, or it goes nowhere. There are ways of disguising links – using IP addresses, including an “@” sign, creating an HTML link that goes to one site but not the right one, and even putting the number in octal. If there’s evidence that something like this is being used, then be very wary. But if the link is not faked in any way, then it can be trusted. ---
**Author:** ![Colophon](https://avatars.discourse-cdn.com/v4/letter/c/f05b48/32.png) [@Colophon](https://boards.straightdope.com/u/Colophon)\ **Post date:** [June 13, 2004, 3:50pm UTC](https://boards.straightdope.com/t/spam-or-real-e-card/250119/10 "2004-06-13T15:50:52Z")
> [@Mr. Blue Sky](#): > > I clicked on it and got this: That’s because the link above has the ellipsis instead of the proper link. ---
**Author:** ![Colophon](https://avatars.discourse-cdn.com/v4/letter/c/f05b48/32.png) [@Colophon](https://boards.straightdope.com/u/Colophon)\ **Post date:** [June 13, 2004, 3:51pm UTC](https://boards.straightdope.com/t/spam-or-real-e-card/250119/11 "2004-06-13T15:51:59Z")
Oops, ignore that :smack: ---
**Author:** ![gum](https://avatars.discourse-cdn.com/v4/letter/g/bbe5ce/32.png) [@gum](https://boards.straightdope.com/u/gum)\ **Post date:** [June 13, 2004, 5:20pm UTC](https://boards.straightdope.com/t/spam-or-real-e-card/250119/12 "2004-06-13T17:20:17Z")
:o :o :o :o :o I send the card. :o I send the card. I’m so embarrased. I don’t know _why_ my name wasn’t on it. I filled in my name and email address. Nor do I know why you can’t see the card anymore. I’m so sorry for the inconvenience **Johnny L.A.**. And all that on your birthday. I’ll go sit in a corner with my ass-hat on, okay? Forgive me? ---
**Author:** ![Johnny\_L.A](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/johnny_l.a/32/1084_2.png) [@Johnny\_L.A](https://boards.straightdope.com/u/Johnny_L.A)\ **Post date:** [June 13, 2004, 5:54pm UTC](https://boards.straightdope.com/t/spam-or-real-e-card/250119/13 "2004-06-13T17:54:08Z")
**gum** : No worries! Thanks for the thought! 🙂 ---
**Author:** ![BrotherCadfael](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@BrotherCadfael](https://boards.straightdope.com/u/BrotherCadfael)\ **Post date:** [June 14, 2004, 12:08am UTC](https://boards.straightdope.com/t/spam-or-real-e-card/250119/14 "2004-06-14T00:08:52Z")
I never open e-cards. Too damned risky. Plus, I have seen e-cards that were as hard to get rid of as a virus! ---
**Author:** ![gum](https://avatars.discourse-cdn.com/v4/letter/g/bbe5ce/32.png) [@gum](https://boards.straightdope.com/u/gum)\ **Post date:** [June 14, 2004, 4:53am UTC](https://boards.straightdope.com/t/spam-or-real-e-card/250119/15 "2004-06-14T04:53:17Z")
I’m very relieved, Thanks, **Johnny L.A.** Really, **BrotherCadfael**? Thanks for the tip. To reassure **Johnny L.A.** , I ran a virus check just yesterday. I’m clean. 🙂 ---
**Author:** ![shijinn](https://avatars.discourse-cdn.com/v4/letter/s/cc9497/32.png) [@shijinn](https://boards.straightdope.com/u/shijinn)\ **Post date:** [June 16, 2004, 7:04pm UTC](https://boards.straightdope.com/t/spam-or-real-e-card/250119/16 "2004-06-16T19:04:13Z")
it can be both. some companies will use the addresses for spamming.