Picture this: you receive an email from your streaming service. The sender is legitimate, the branding is perfect, and it’s sitting right in your primary inbox. But there’s a catch - you never actually opened that account. A clever new phishing tactic is targeting Gmail users by exploiting a loophole in how Google handles punctuation in email addresses and slipping past traditional defenses. In this guide, we break down exactly how this attack flow works, and the essential checklist you need to follow to secure your digital footprint today.
If your email is johnsmith@gmail.com, you own all dotted versions of your address. For example, you will automatically receive emails sent to john.smith@gmail.com, j.o.h.n.smith@gmail.com, or any other dot variation. This behaviour is intended to reduce delivery issues when senders insert dots by mistake, but scammers can exploit it.
Scammers create fake accounts using email variations on popular service platforms. Since these platforms treat 'jane.smith@gmail.com' and 'janesmith@gmail.com' as different accounts, attackers can register one account under the dotted version while your actual email inbox receives all communications sent to either address.
The result is a convincing phishing email that appears to come from a legitimate company like your streaming service, but was triggered by an account the scammer created using a dot variant of your email address. To you, it looks completely real as it's genuinely from the company's servers; the cybercriminal is banking on you not noticing the difference in dots.
Using Jane Smith and Netflix as an example, the attacker signs up to a Netflix account using jane.smith@gmail.com. Once the account is created, they can force automated actions from Netflix by doing things like cancelling the credit card on the account which triggers an 'update your payment details' email. Because of Google's 'dots don't matter' approach, the legitimate Netflix automated emails generated on the account jane.smith@gmail.com are delivered to janesmith@gmail.com.
If Jane Smith doesn't notice the dot in the email 'to' field, it is only a few easy clicks to respond to a payment details update request, believing her streaming account is about to be frozen, delivering free Netflix to the scammer until whatever time in the future Jane notices she is paying two subscriptions.
Essentially, forewarned is forearmed, and knowing to pay attention to the exact format of the email 'to' field has become another mental security check for us all to add to our repertoire. And it just goes to show that while cybersecurity technology and security techniques are definitely must-haves, user education and awareness is increasingly important.
How to Protect Your Email and Accounts
Below is a summary of techniques - both technical and visual verification assessments - that form a protective arsenal in thwarting any phishing attack.
A password manager can help protect you by avoiding password reuse and by warning you if you’re about to enter your credentials on an unrecognised or fraudulent website, reducing the risk of this type of attack.
Popular options include:
Not all methods of 2FA are equal. Here's the hierarchy in terms of security:
Hardware security keys (gold standard)
Instead of relying on SMS-based 2FA, consider using a hardware security key, like Google's Titan Key or a YubiKey by Yubico. These are physical devices ensure that your second-factor authentication is bound to an object that hackers cannot steal digitally. They work with Gmail, Australian banks, and most online services. The devices look like small USB flash drives or key fobs, and instead of typing in a 6-digit text code for 2FA, you plug this physical key into your computer or tap it against your phone to achieve a cryptographic signature.
Passkeys (high security)
Passkeys are resistant to phishing attacks and don't rely on SMS or email-based verification. When you use a passkey, you are establishing a digital handshake between your physical device (like your phone or laptop) and the website you want to log into using an advanced form of math called public-key cryptography.
Authenticator apps (medium security)
If you can't use hardware keys yet, use an authenticator app instead of SMS:
SMS authentication (better than no 2FA, but lower security)
SMS 2FA relies on vulnerable telecommunications networks, which can be intercepted through SIM swap attacks where scammers trick your Australian mobile provider into transferring your number to their device. This is a real threat in Australia.
Keep recovery options current and ensure you have at least one additional trusted device or factor. Add:
* Recovery options can be crucial on many accounts when using secure forms of login like 2FA. If you lose the device that stores your passkey or your 2FA codes, you need another way to authenticate yourself to re-gain access to the account. If you don't have a recovery method set up, there is no way for the account provider to prove that you aren't in fact the hacker trying to gain access to an account!
Regularly check your Google account's recent activity for any unfamiliar devices or logins. You can do this in the Security section of your Google Account settings (myaccount.google.com). Look for:
Attackers don't always need to log in if they can get persistent access through third-party apps, email forwarding, or delegated permissions (especially on social media apps). Review who and/or what has access to your account and remove anything you don't recognise. Pay special attention to apps that can:
This is a free program that adds stricter security checks. It's recommended if you're a high-risk target (journalist, activist, public figure, business owner, or concerned user) to install threat detection software.
Always install the latest patches and updates on your computer, phone, and browser. Many session theft incidents begin with outdated software or malicious browser extensions.
AI-assisted phishing enables attackers to produce large volumes of well-written messages quickly, often tailored to specific roles or organisations. This is making phishing attacks harder to detect, and making all the techniques above increasingly vital. Scammers can test variations rapidly and adjust language to bypass controls and user suspicion. Increasingly, these messages are combined with other techniques such as address manipulation, compromised infrastructure, or credential-harvesting sites to form coordinated campaigns.
Staff should understand how to recognise common phishing patterns, handle credentials safely, verify unusual requests, and report suspicious activity quickly. Reinforcement through regular training helps maintain these behaviours over time.
The CyberHeroes program is designed to provide foundational cybersecurity awareness for all staff, not only IT professionals. Delivered by IT Basecamp, it focuses on practical behaviours and reinforcement through short, regular training to help keep security awareness current and front-of-mind.
If you are already using CyberHeroes, consider confirming that staff have completed the Fundamentals module and that new starters are enrolled as part of onboarding. If you are not currently enrolled in our CyberHeroes Concierge Service, IT Basecamp can provide an overview of the program, delivery options, and a recommended rollout approach for your organisation.
As cyber threats continue to combine sophisticated techniques with persuasive content, an informed workforce remains a practical and cost-effective risk reduction measure. Organisations that reinforce awareness and reporting processes are better positioned to identify and contain email-based threats early.
Contact IT Basecamp for a company security audit to assess your business's risk today.
The best defence is layered protection: