Gmail: scammers use possible security flaw to forge blue seal of Google email

Gmail has an important protection feature that displays a blue seal next to secure email account addresses, but as discovered by cybersecurity expert Chris Plummer, scammers found a way to bypass verification and inserting the “check” symbol in your fraudulent messages.

Plummer disclosed the case on his Twitter after having his complaint ignored by Google. The expert identified a malicious sender pretending to be the UPS logistics company, but a possible bug in the verification system caused the address to be perceived as legitimate by Gmail. See the screenshot below:

Introduced last month, Gmail’s blue badges for verified accounts allow Gmail users to more easily recognize messages from legitimate companies, ensuring they are protected from malware and criminals.

For this, companies must undergo a verification step using systems such as BIMI (Brand Indicators for Message Identification), VMC (Verified Mark Certificate) and DMARC (Domain-based Message Authentication, Reporting, and Conformance), that guarantee the legitimacy of messages sent to clients.

Google, which at first denied Plummer’s complaint and defended that the service was “working as it should”, now acknowledges that this is a problem in the verification systembut has yet to provide details on what the source of the crash is.

The “blue badges” have become a key symbol on any web service. Especially due to its use on social networks, this element is seen by users as a way of attesting to the security and legitimacy of a personality or company on the internet. Failing this, people could be exposed to serious threats.