I have my own domain (lets call it MyDomain.com), and my email account is set up such that all mails sent to @MyDomain.com will end up in the same mailbox.
So, think of a word, put it in front of @MyDomain.com, send me an email, and I will get it.
When I sign up for SomeService.com, the email address I will give them is ‘someservice@MyDomain.com’.
This means that if I get a spam email sent 'To' someservice@MyDomain.com, I can identify 'someservice' as having compromised my email address...Or so I thought.
When catching a company (a pharmacy from whom I'd bought earplugs), as far as I was concerned, red-handed, I sought them out, and got the following response:
I am one of the webmasters of the [SomeService] commerce portal. We take user data security very seriously as our business depends on this.
We have been PCI certified by 2 independent agencies who routinely scan our systems for security flaws.
Emails can leak out at multiple levels including the users computer or in transit due to network sniffers that are increasing being employed by professional spammers.
We not only keep our systems behind a firewall but also encrypt user data to ensure privacy even from our own staff.
I reiterate this is not something we condone and we will do an internal investigation to ensure our systems are clean. Kind Regards [administrator]
What do you folks make of this? Some questions I'm asking are
- What is PCI certification and can I take this seriously/is is credible?
- Is the 'email-leaking' and 'network sniffer' claims credible?
And any thoughts in general. Let's just say I'm learning.