Spam Message Sent Using Maps Services

[BrianEdwards]

I've seen a comment or two about the Maps email tool being used inappropriately, but I wanted to create a separate topic. Recently I received an email via Maps requesting I watch and share a trailer for a movie (I won't even hint at the title here to avoid giving the spammer success). I know that others have likewise received other spam or phishing emails via the Maps functionality.

Is anyone aware of what safeguards are in place to avoid people being able to spam leaders (en masse) via the Maps? It could be identical emails sent anonymously one-at-a-time, some people may go that route. I'm also wondering if there's a way for bad actors to anonymously leverage the Maps to send bulk messages to leaders, or if the interface truly restricts them from doing anything other than one-by-one. The email I received may have been individually sent, in which case maybe it's the price we pay for trying to allow all to come unto Christ.

[russellhltn]

I assume you're talking about "Ward Directory and Map".

Are you able to identify the culprit? If so, I'd have bishop call support. They should be able to block that member's access.

[BrianEdwards]

The email has a SENDER titled "Anonymous", whereas usually the Maps emails I get have a valid SENDER email (whether that person is logged into a church account or just provides their email, I don't know). Here's the first lines of the email in question:

MESSAGE FOR: my name
PRIMARY CONTACT AT: my unit (unit number)
SENDER: Anonymous
FROM SITE: https://maps.churchofjesuschrist.org/wards/unit number

I assume the email was sent via the "Find a Church" icon at the main website, which takes you to https://maps.churchofjesuschrist.org. From there, I expect the person selected my unit, and selected "Send a Message" under my name. There's a toggle in that message box that allows a person to indicate if they want to be contacted regarding their email. If a person selects to include their email, the Church puts up at statement about safeguarding that person's contact info. But in the email I received, there's nothing identifying the sender, and nothing indicating a way to let the Church know I feel the email is inappropriate (and it definitely was an inappropriate way to use this tool).

[russellhltn]

I'd call support. Perhaps they need to remove the option to be anonymous. They might also have some tools to ban that IP from using the tool.

[TLoken]

I received a different spam message through the map services. Would be great to be able to block this so they don't scam a leader. Here is a part of the message.

"My name is Mrs. Susan McClary. I am 76 years old and a British citizen. I am currently hospitalized in a private hospital here in Abidjan, the capital city of Cote d'Ivoire as a result of cancer. I was diagnosed with cancer about 4 years ago. Now, it is clear that I’m approaching the last-days of my life because my doctor told me that I would not last for the next 3 Months.

I have some funds inherited from my late husband, the sum of US$ 3,800,000 which he deposited with a bank in Abidjan. I am looking for an honest and God fearing person that can use these funds for charity work and 15% out of the total funds will be for your compensation for doing this work. Please let me know if you are able to do this work so that I will give you more detail on how it could be done."

Anyone aware of a way to block this person?

[munaish]

It's possible they didn't use the maps service at all, but copied and pasted the data to make it look like they did. What does the header data look like?

However, it stands to reason that the maps service could be used in this way, and the ability for this to happen might be a concern.

If we used a centralized messaging service, that would solve the problem (and many others). As it is, I think your only option is to mark it as spam, warn your ward/stake members, and move on. Probably the main concern with a centralized service is that people might be concerned that people wouldn't use it. I don't personally think that's very true (less involved people might check the site less often). If they're using the directory, they would effectively be using the hypothetical centralized messaging service, too (and see any notifications that exist). Plus, you could have it send notifications to email to remind people if they have messages, if you really wanted to (and that would still solve the problem posed, since you would know who sent the message).

There's a vague possibility you might be able to catch the culprit, but I wouldn't count on it (let alone count on a reliable way of doing so).

You could try to compare IP addresses with known ones, but IP addresses change and are reshuffled (because static IPA addresses pretty much don't exist anymore); so, you might end up blaming the wrong person (or even if you do get it right, there might be multiple people who use that computer). Plus, they probably used a VPN anyway, and you'd have to be pretty obsessive to do that (to go through and compare the IP addresses [where they didn't use a VPN]).

[munaish]

Okay. So I was a bit confused. I thought they were getting this from the ward directory maps service (which apparently wasn't the case). It's about the meetinghouse locator. So, are you saying people can send local leaders messages when they're not signed in? How are they being anonymous? It sounds like this messaging service is intended for people who are not members of The Church of Jesus Christ of Latter-day Saints, too. Is that correct? If that's the case, they could just make another account if you blocked them (or if they don't have to make an account, I don't know how you would block them).

[munaish]

So, it's possibly just a spambot that emailed you, rather than an actual person. Yes, actual people could in theory make, run, and own spambots, but a spambot might be owned by a larger organization, rather than a single individual. I would consider an organization owning it considerably more likely, considering the costs and technical learning curve involved.

[russellhltn]

It's about the meetinghouse locator. So, are you saying people can send local leaders messages when they're not signed in?

Yes. The idea is probably to allow it to work for non-members as well.

Marking it as spam is not a good idea as it's likely to block future emails from the church.

[BrianEdwards]

So, are you saying people can send local leaders messages when they're not signed in?

A bit more involved than even that. I just did a couple of tests, sending an email to my local unit via the "Send a Message" functionality in the meetinghouse locator. I was signed into my church account at the time. When you click "Send a Message", the message box that opens has a toggle whether you are willing to be contacted.

If I do not select that toggle, then even if I am logged into my church account, no identifying information is send with the email - it is received as coming from "Anonymous".

And even if I am logged onto my church account and select that toggle, I can provide whatever name, email, and phone number I want -- it can be complete garbage unrelated to anything in my church account. The email is received with the SENDER identified as the name and email I provided, and the PHONE is whatever I entered.

All to say, the current implementation seems intentionally designed to allow leaders to be contacted in this fashion, and for those sending the message to be able to fully determine whatever type of contact information they wish to provide.