MainSleaze

Sprint Nextel is mailing an email address that was closed in 2008, and after its timeout period was re-enabled in 2010 as a spamtrap. The ESP is Acxiom Digital. This looks like spam, but it isn’t. This is why.

The email below is a transactional email sent by Sprint Nextel to a customer whose bank account it was debiting. 🙁 Yeah, that’s right. Sprint sent a private email with sensitive private information to an email address that has not been live for over three years and bounced these same notices for a period of over twelve consecutive months during that period. This email isn’t spam — transactional emails are not bulk and therefore cannot be spam. But the violation of privacy and security is worse than any spam I’ve ever seen. Just how many other sensitive, private transactional emails of this type were sent by Sprint to spamtraps or to the wrong email address?

The notice was actually sent yesterday. I held on to it and debated blogging about it for a day. If this involved a smaller company or one that I had reliable connections with, I probably would have talked with them directly. But Sprint is huge and Acxiom Digital is huge. Also, if this happened once, it almost certainly is happening more than once. :/ Sprint needs to reconfirm email addresses for its customers *NOW*. And Acxiom Digital should halt these mailings until it does so to protect the users.

Sending IP: 209.11.164.5

Spam Sample:

Actual Headers:

Received: from mh.nextel.m0.net (mh.nextel.m0.net [209.11.164.5])
        by <xxx> (Postfix) with ESMTP id <xxx>
        for <xxx>; Tue,  1 Nov 2011 23:xx:xx -0500 (CDT)
DomainKey-Signature: <xxx>
DKIM-Signature: v=1; <xxx>
Received: from [192.168.<xxx>.<xxx>] ([192.168.<xxx>.<xxx>:<xxx>] helo=<xxx>)
        by <xxx> (envelope-from <xxx>)
        (ecelerity 3.3.1.44388 r(<xxx>)) with ESMTP
        id <xxx>; Tue, 01 Nov 2011 21:xx:xx -0700
Date: Tue, 1 Nov 2011 21:xx:xx -0700 (PDT)
From: Sprint AutoPay <noreply@sprint.delivery.net>
Reply-to: noreply@sprint.delivery.net
To: <xxx>
Message-ID: <xxx>
Subject: Sprint Payment Info for XXXXX<xxx>
Errors-to: noreply@sprint.delivery.net
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="---=<xxx>"
X-eid: <xxx>
X-pid: <xxx>
List-Unsubscribe: <mailto:noreply@sprint.delivery.net?subject=unsubscribe<xxx>>

Readable Email:

From: Sprint AutoPay <noreply@sprint.delivery.net>
To: <spamtrap>
Subject: Sprint Payment Info for XXXXX<xxx>
Reply-to: noreply@sprint.delivery.net

Please do not respond to this email.
Replies to this message are routed to an unmonitored mailbox.

>>To see images, view the email online at the link below.
http://sprint.r.delivery.net/r?<xxx>

*********************************************************************

Direct debit transaction confirmation

*********************************************************************

This email confirms a direct debit payment was submitted to Sprint from your bank account. We initiated this transaction on your behalf.

To ensure we met your expectations, please review the information we collected during a recent phone conversation:

Account number: <xxx>
Contact phone number: <xxx>
Date of debit transaction: Within 1-3 days of: November 01, 2011
Amount of debit transaction: <xxx>
Authorization date: November 01, 2011

This letter is not a payment receipt. If your payment is returned to us because of insufficient funds, your payment will be reversed and corresponding fees may be assessed.

If you have questions, click the links below to email or chat with a Care specialist or call *2 from your phone.

>>Email
http://sprint.r.delivery.net/r?<xxx>

>>Chat
http://sprint.r.delivery.net/r?<xxx>

Thank you for choosing Sprint!

<removed>

*********************************************************************

To contact Sprint Nextel, write to: Office of Privacy — Legal Department, Sprint Nextel, P.O. Box 4600, Reston, VA 20195.

>>View the Sprint Privacy Policy.
http://sprint.r.delivery.net/r?<xxx>

(C) 2011 Sprint. All rights reserved

<xxx>