I usually think of myself as a pretty web-savvy person who takes care to protect online information and my online presence. Today, however, I fell for a pretty bad and embarrassing web trick.
Over my first cup of coffee, I opened an email from an acquaintance. Here is a part of it:

Clicking on the button to view the message took me to the tagged.com website, where I was told to create a profile to see my friend’s photos. At this point, the site looked very much like flickr.com (which I used to post the photo; ironic, isn’t it?), so I didn’t think there was much risk. It asked for my yahoo mail address, which I did put in because it said it could look to see who among my friends also had accounts. As I got to more and more screens asking for more and more information, I finally bailed out before finishing. As I usually do on sites such as this, I made minor "mistakes" on my birthdate. I stopped short of entering a mailing address or phone number.
Imagine my surprise when I started getting emails immediately for a failed address and an out-of-office autoreply. Tagged had hijacked my yahoo contact list and, without my giving permission, started sending emails to everyone in my list. I don’t know how many went out; they aren’t in my yahoo mail "sent" box. I presume these went to everyone. If so, that’s highly embarassing.
I found the spot for cancelling my account even though I didn’t finish creating it. That appeared to work and there was a box for giving feedback. I blasted them there and also tried to send feedback through another account on their "contact" page, but that bounced back quickly with a note it was sent to an address (inquiry@tagged.com) that is not monitored.
I have found contact information for them separately. This is from Business Week:
Company Overview
Tagged, Inc. operates as a social-networking site for teens. The company’s social networking site includes profiles, fluid widget embedding, integrated video, and chat; and helps users to keep in touch with their friends and make new ones. It has a strategic partnership with Razz, Inc. Tagged, Inc. was founded in 2004 and is based in San Francisco, California.
110 Pacific Avenue
San Francisco, CA 94111
United StatesFounded in 2004
Phone: 415-956-1377
www.tagged.com
They don’t appear to answer this phone number at this hour (7 am Pacific) on a Saturday. I will keep after them. I am going to push as hard as I can for them to identify how many of my contacts they spammed and get them to send apologies on my behalf. [I know, that's a Quixotic effort, but a guy has to try.] At the very least, I’m also going to do my best to make sure people know what a despicable operation Tagged.com is. My personal experience speaks for itself.
Don’t create a profile on Tagged.com unless you want your email contacts hijacked. I am still running my various antivirus, antispyware and antimalware software to see if they left a "present" behind that will do further harm. I’ll post an update in comments if I find anthing disturbing of that type.
Note to Tagged.com legal counsel: a statement can’t be libel if it is the truth, so bite me.
To everyone in my email contacts who got something from Tagged: I apologize profusely.





46 Comments
Spotlight
Support this site!
Subscribe to the newsletter
Advertise on Firedoglake
Send
us your tips
Make us your homepage
About The Seminal
Advanced search
LOL
I got Tagged.
Oh man I jumped through hoops to see your pictures and ended up nowhere.
NOW I see your diary!
Recommended. Thanks for the alert, Jim. I hate these internet abusers! BTW, there’s been a definite decrease in my weird e-mails received since I canceled my DIGG account.
My kids are still begging for a facebook account. I know it’s an important thingy for teens but it’s just so squiggly and stuff like this happens. ick.
Also, on another sort of related topic, I’ve gotten an email that looked so legitimate it almost got me, but because it pertained to a credit card account, I immediately put my brakes on and stopped to think about it.
It said I hadn’t “renewed” or “refreshed” my online access through an email they claimed they sent earlier and they just need a bit more information. This just didn’t make sense because if I had access before they had this information, why would they need more now? It also included a link to click through.
I called customer service for my card and they said they would never include a link. They would direct me to log into my account from their website. They also warned me that there are a ton of scams going on right now.
I guess the lesson I would like to pass along is slow down and only call the number you already have in order to contact customer service (which I did but was tempted to react to the email and also a phone message I got).
Thanks Jim. You are a good sport to share this experience to help the rest of us.
Jim,
Thanks. This is so timely. I just received a Tagged e-mail this morning and was trying to decide what to do with it. I’ve been resisting all of these “social networks” because of the crazy stealing of identities, etc. that goes on. A close call!
Thanks, dosido. I’ve gotten some of those ‘account’ e-mails, too. I just use “block sender”. Oh, on the phone calls from odd area codes that you have no ordinary contact with: Don’t answer or you might have a huge bill to pay. Some come from Puerto Rico or other Carribean places and there is no limit to charges. That’s apparently another scam.
I got one Jim and hoped you wouldn’t be offended that I deleted rather than accept your tag.
Thanks for the heads up.
My Google Email address has been hacked and I get Spam messages with my own Email address.
Fuckers.
Google ain’t doing shit about it either, which pisses me off even more.
I got one from you Jim, and fell for it about half way, then bailed. Especially tacky and annoying was the fact that it said words to the effect, “If you don’t click, Jim will think you weren’t interested in his pictures.” So they threw in a guilt trip for the skeptics. I was envisioning a cute horsey or something. So far, nobody has told me they got grabbed, so maybe I backed out soon enough. More coffee is required for these early Saturday sneak emails….
T
I got this on my work account and it was from one of my bosses relatives. I emailed her and asked if she meant to send it to us. She said no that they had somehow sent this spam to every email address she had. Sounds exactly like what happend to you. To me it was quite obviously spam one because there was no personal message attached, two because we got the message three times.
Thanks for warning people. I didn’t even know about it my instincts kicked in and knew it was spam.
Be careful with giving access to your contact lists.
I doubt that bustednickles gmail has been hacked. How did you determine the spam originated from google – spoofing a return address is fairly easy and I’d say likely.
Heh. How schmart I am. I just got a similar email from a friend. I had gotten a tagged-thingy once before and remembered it asked for my bday, and declined at that point. Sure enough, same thing. I replied to the sender (who I know) and told her that I don’t respond to messages that require personal information. She sent me a confused response, which I didn’t understand, but now that I read your diary, I now know what she was saying, that her entire email contact list had been hijacked.
JUST SAY NO.
How nasty. Just in case you’re not running it, the local nerd shop that is presently building my new computer highly recommends Avast! as an antivirus program. It’s available either as a free download, or as a paid-for “professional” version that you can program to run automatically. Avast found 2 trojan horses and 1 worm on my machine that Symantec had missed 2 days before. Suffice it to say I’m running Avast now instead of Symantec. You can check it out here if you’re interested.
I also regularly get phishing e-mail trying to elicit information about my e-Bay and/or PayPal accounts. Both e-Bay and PayPal ask that phishing e-mails be forwarded to spoof@ebay.com or spoof@paypal.com.
I got a “You’ve Been Tagged” e-mail, but the person it allegedly came from was so highly unlikely to have sent me pictures I checked with the alleged sender. Surprise! (not) it wasn’t from her.
A friend -PDA associate/activist-sent me an email inviting me to join his ‘friends on tagged’ 2 weeks ago; since I have always been suspcious of ’social networking’ sites, I did a search on ‘tagged’ and saw the negatives associated with it.
Emailed my friend back and he had emailed out a ‘mea culpa’ to those he addressed the invitation too; turns out it was never sent on by tagged.com.
All these things appeal to the lazy and just make it real easy for others to invade what little privacy -if any- we have left.
Yes. Another friend of mine got hacked through Google. When he spoke to them, they essentially said,”Hey, it’s a free service. If you don’t like it, don’t use it.”
heh,heh,heh, Marion; now try and remove all the registry entries and program hooks Symantec has stored on your machine.
Which is why I provided the link to the Senate Cmte. for ‘Senator Dodd wants your input on healthcare. *G*
You did note that I said I’m having a new machine built?!! We’ve got a great little nerd shop in town, and not only do they custom build you a machine they pretty much refuse to put Vista on it unless you grovel and beg for it. Me, I don’t grovel or beg! I should be free, clear and clean in about 2 or 3 weeks. I was wondering why my current machine would suddenly slow down for no apparent reason… [multiple expletives deleted]
Actually I missed about having a new machine built but as long as you ‘run’ under Windows, you’ll be vulnerable to many things; check out Ubuntu.
Not sure what my observation about Google’s attitude toward it’s user’s security has to do with Dodd’s healthcare work, but ok, thanks for the link.
JimWhite, you don’t mention this directly — did you contact the acquaintance you got the original email from? Could very well be they didn’t send it/don’t know they’ve been hijacked?
This is scary. I work with alot of elderly people, and it is shocking how often they are targeted with phony charity requests and authentic looking documents, etc that ask for personal information. I know we are all kiddos….but look out for parents or neighbors who may be vulnerable. Stories are frequent enough that I am surprised that AARP is not more vocal. Thanks for the info
Ubuntu looks interesting, but given what I do I must use MS Word and a text exploder. Open Office, for instance, doesn’t support the use of a text exploder and when Ubuntu says
that means to me that it won’t work for me. Unless I’m misunderstanding something, which wouldn’t surprise me in the least!
What did your guys say is so bad about Vista?
There are days when it apparently pays to be a luddite. I felt “out of it” when so many people at the Lake were joining facebook; it eventually proved to be a smart move resisting the temptation…..at least for me. ymmv
And it will be a very cold day in hell when I pay for any product via teh tubes; makes life a bit more difficult at times…….but much *less* difficult in some respects.
P.S. I’m one of those elderly people to which the Rev refers…..just a lot more suspicious than most. *G*
I know it started out very buggy, and Microsoft has been working on patches and fixes, but there are still problems. Intel won’t support it, and that’s pretty much all I need to know.
I guess I’m “middling old,” and am on Facebook and haven’t had any problems at all because of it. Of course, I don’t go spreading my credit card and bank information all over it! I also buy stuff on line, but only from companies I trust. So far (knocking wood) I’ve had no problems. But,as you say, ymmv.
I get e-mails like that, and I don’t have an EBay account. Or one with PayPal, as convenient as it would be.
I also get mail claiming to be from banks and credit unions I’ve never had accounts with (and usually I’ve never heard of them).
Spam is everywhere, and if I don’t know who the sender is, or if I’ve never done business with them, I’ll delete it, with or without sending it to the spam filter. (I get spam sent to my work account, with my own work e-mail address on it!)
You and me both. I treasure my privacy, plus I’m a doofus when it comes to this intertoobz stuff, so I stay away from it. My only anxiety is that a close friend of mine is on the network. But at least he still has his e-mail. I just don’t go there. But it’s just me.
Even if you don’t have an e-Bay or Paypal account you should forward those phishing e-mails to spoof@ebay.com or spoof@paypal.com because they take that information and try to go after the spammers. I agree with you about spam — if I am not absolutely sure where an e-mail comes from I don’t open it and toss it into the spam bucket to be deleted.
Oh, I am SO coming to sit next to you on the “doofus wrt intertoobz” bench! *G*
Were you able to get a train ticket to attend the D-Day activities where Obama was? That was you, iirc.
If a company can’t/won’t provide a phone number so I can talk to a human being, I don’t buy their product. And, yeah, people keep telling me a human on the phone is just as likely to steal my information as losing it via the internet but I got this thing about customer service. Don’t provide it; a pox on whatever it is they’re trying to sell.
Well, I started buying from Lands’ End via phone and now on line, as well as some other companies. As I said, only companies I trust!
It’s been my experience that I’ve had much more trouble with spam or phishing e-mails than with buying stuff. I’ve had people ask me, all hurt-like, why I didn’t respond to their e-mail. Turns out they changed e-mail accounts and didn’t have something REALLY obvious in the subject line and got dumped into spam and deleted. For me the key is a really specific subject line that I recognize as being “non-spam” and from someone I know. Spammers don’t have the creativity for that, usually.
DON’T EVER CLICK ON AN link in an E-MAIL THAT ARRIVES UNEXPECTEDLY IN YOUR INBOX. NEVER, NEVER, NEVER, no matter how “legitimate” it looks.
Yep. When in doubt, ALWAYS assume it’s spam or phishing or worse.
Thanks for the reminders….I just got Pay pal piece….Ialso have no connection with them….Thanks
Jim,
Thanks for the explanation. I had three Tagged emails when I checked my email a few minutes ago. I didn’t recognize the sender’s email, so just deleted them.
Tagged is very similar to what Reunion did a while back, harvesting people’s email address and then sending an offer. I guess the internet scum is trying to keep all of us mentally agile dodging spam, phishes, viruses, and worms.
I’ve been getting mail in my spam folder that says it’s from “me”. When I open them, there are warnings from my email provider that these are probably forged and are phish. Most of them are porn.
I don’t know how to stop them from sending out these disgusting emails in my name, short of changing my account which I am loathe to do
I did include her in the emails I sent out explaining that my contacts were hijacked. I haven’t heard back from her…
Thanks for all the great comments, folks. I think I’ll just scramble some of that egg on my face…
Sounds like Yaari all over again.
A Congress not owned by business could make this crap illegal. Our politicians won’t even make spam illegal because the Direct Marketing Association wants to reserve the right to spam responsibly.
Interesting. I got a “Tagged You!” email last night from an acquaintance who doesn’t like me much, so my antenna went up. The “tell” was that the email said I HAD to click “yes” or “no” if I did or did NOT want to view photos. Why would I click no if I did NOT want to view photos? I googled “Tagged You” and found info warning me to stay away. I then set the filter on my email software to automatically delete anything that came in with the subject “Tagged.”
let’s do a little experiment. i see these a lot, ‘we’re so-and-so bank’ and we need important information about your account for security purposes…’ and the email has all the bank of america or citicorp or mastercard logos. looks real legit.
before you click on their link, just float your cursor over that link, now look down at the lower left-hand corner of your browser. you’ll see the address you’re being directed to. it’s usually something like “myscam.ru” or 127.0.0.1/security. DON’T CLICK ON THAT LINK !!!
it will take you to a site that looks legit, a dead-on copy of bank of america / etc. it is a site run by i.d. thieves. i used to enjoy filling out their forms with bogus info (Name: R U Crazy Password: BiteM3….) and leaving a profane message, generally insulting their intelligence and their country (’You n****ians all suck dogs, don’t you?) but these days, ‘drive-by downloads’ can leave all types of nasty crud on your pc.
once you see the attempted scam, your email ought to have a ’spam’ button, so click THAT. your internet provider will start blocking their emails, and with any luck, pass their names on to the NSA.
Now I have a follow up email from these clowns and at the bottom is a place to click if I want to be removed (I never clicked yes or signed up, they are just giving me one more chance.) DO WE TRUST this company to really unsubscribe me.??
there is a great description of this social networking phenom. at
and it is from TWO years ago.
Would love to know how to get the word out and stop these lunatics.
I wonder where my link went?
Don’t know where the link went, am trying again–
it is
or maybe this will show up: http://www.istokpavlovic.com/b…..taggedcom/
Thanks for this head’s up. I am usually pretty paranoid, but all it takes is that one slip, the fingers are going and answering while the gut is beginning to send out uneasy messages. Too late. And pulled in by their using the name of a friend you trust. YUCK.
“Getting over” apparently has been the MO of those profit organizations we trusted as part of status quo living. Like the banks. We live in dangerous amoral times. Paranoia is a misdiagnosis perhaps. Savvy to distrust.