Urgent;I've had a phishing email re my donation to gofundme

I've had Bitcoin emails too and never had anything spammy to that email address before.

Re. the HaveIbeenpwned site - being a suspicious type the first thing I did was check this site itself was legit - a quick google suggests it is (you're looking for reviews from reliable sources like TechRadar).

Turns out (at least according to that site) that I haven't been - which slightly surprises me, because I was caught in both the Mumsnet hack and the TalkTalk hack.

This is a very awkward situation - I agree with Vicxy's take on this, that there's a possibility of human intervention at the GFM end of things. If so it is, as Andhow says, absolutely scandalous. Let's be quite clear about what the accusation would be (and I'm not saying this is true, libel lawyers, just that there's something hinky going on with people receiving phishing emails, and this is one possible explanation of how it could have been done). This would mean (if true - I may just be suffering an attack of tinfoil-hat-itis) that a site which handles the financial details of millions of people has an employee prepared to leak details (not necessarily the financial details, but certainly the personal details) of people using that site for political reasons.

However, sadly it's going to be next to impossible to get anyone to investigate. GFM clearly have a vested interest in covering this up, up to and including pulling the fundraiser altogether if it gets too embarrassing for them. (There's an absolute shit-ton of bad reviews online from people complaining about their lousy customer service). I don't think the fraud action line listed above will be interested either, as even if true there appears to be no intent to defraud people of money. The information commissioner might be interested, but as far as I can see there's no smoking gun here, merely a load of circumstantial evidence possibly suggestive of an insider leaking email and ID details (and possibly cross links to other social media IDs where people have shared on twitter or facebook).

I've finally had reply from gfm overnight. I think pp who say they've been investigating things may be right. They assure me I've been removed from their mailing by lists so we'll see.

Is it just me that's outraged at this? It sounds like an employee in a private firm has been trying to unlawfully obtain personal data in order to intimidate people because of their political views

I have been PWNed once so I have changed my password.

Jack got all the false names pulled by tweeting re supposed fraud. Is there anything we can tweet to raise awareness of this and make it more difficult to ignore? Even those like me who aren't directly affected at the mo but it feels like it's only a matter of time...

If it is an employee and they get caught, I am sure its against the law to do that. Fairly sure they will get a large fine, and gofundme will too. Wondering if gofundme might try to cover it up to avoid the negative publicity :/

That's been my fear all along, that GFM have a TRA working for them. Hopefully they weren't able to grab enough info to do too much harm since people realized the emails didn't look right quickly.

OK techy friend reckons that a member of staff at gofundme has basically gone rogue. He could not explain how an email address that I only use for twitter had been used though. And I had a keylogger on my computer also, that my antivirus programs missed but he has removed it now.

He says that if it was a member of staff, that could be why its taking them so long to reply as they are investigating. He also says be prepared for them to remove this campaign as it seems to be causing a lot of trouble and they will be pissed off. So not good news. I hope they leave it up, there is no reason to bow to the pressure and I hope that if they do remove it, they have even more pressure from women who donated or support the idea of it.

Vicxy
Thanks thats really useful. Gofundme didnt show up but one I already new about from last year did. Will change password now

God mine showed up on 3. Off to change my passwords!

Its maybe nothing. Its very concerning to me though.

While we are on about online security

haveibeenpwned.com/

Is a good site to check. My main email address showed up on 6 databases from sites that have been hacked that I was not informed of

Also some welcome to myanime list.

Very worrying that Gofundme have not made an immediate response to this! I keep checking JJ's twitter feed to see if they've said anything to her yet.

Iv had bit coin ones too. Should i be worried? Not great with IT stuff

I didn't send it to GFM no. I didn't think properly tbh. I immediately thought it was TRAs so reported to actionfraud

But, it was impossible for the one sent to me to be from gofundme as I did not use that email address when donating. The only thing I have ever used that email address for is twitter. Maybe I should have reported it to twitter on second thought, as its extremely unlikely that it was random and its got to be a breach at their end surely. Twitter handle does not match the email address.

Seems they are upping their game.

I actually have a techy friend coming round later to check my computer and laptop, thats how paranoid I am now. Kind of wish I had kept the email address that it came from (the gmail one, not the gofundme one that it pretended to be from now

Also since having the fake gofundme email..I have had 3 from random 'bitcoin' companies also and one offering me pictures of naked men with an attachment on it. I have never had any spam sent to that email address before today.

Yes they seem to jump when Jack says how high.

I do think it's a bit crap that Gofundme haven't moved faster on this.

I think gfm should know and send out warning emails out to everyone who has donated.

Have you reported it to GFM as well as ActionFraud?

Oh, and the one I got looked like it came from the zen desk thing thats mentioned at the start of this thread, but it was not. It was from a gmail email address so they masked their real one. Now thinking the zendesk is gofundmes real one, but some emails are just appearing to be from the real one.

Fairly sure this is dodgy. I had an email apparently from gofundme sent to an email address that I did not use to donate with. Asking for government issued photo ID. That email address though is the one thats attached to my twitter account. I feel that transactivists are trying their luck here. I reported the email to actionfraud then deleted it. Then ran 3 different virus checks as I was paranoid they had put a keylogger in it or something. Scary shit mind.

AFAIK it is dubious as far as data protection goes. They are not allowed to process random personal information without good reason.

Cheers for that info Barracker I'm sure that even gathering that extra info could be in breach of Data Protection, why do they need to know about a persons social media involvement in a campaign in order to process a donation? Short answer is that they don't so they should not be collecting that information.
Who the fuck do these people think they are?

I have had a few to and fro individual conversations emails with gofundme in the last few days asking general questions and the email address is a zendesk one.

My opinion is that the 'phishing emails' have actually been sent in an official capacity. But that they possibly have overstepped, and the blocking is very very strange.