(See below for removal instructions)
There seems to be a plague of these nasty ShoppyBag emails at the moment. As far as I can tell, this phishing/malware scam only affects GMAIL account users.
You receive an email, purporting to be from a friend, asking you to click on this button in order to look at a photo they have sent you. All you have to do is click and the scammers have gained access to your Gmail account, stolen your contact list and sent invitations to all the Gmail accounts on that list, telling them that you have sent them a picture. The site claims that you have to fill out their application form and agree to their terms in order for them to send emails on your behalf but everyone who I have spoken to, who have unfortunately clicked on the link, have told me that simply clicking the link did all the damage. Many backed out without completing the account sign up form and without agreeing to anything. It was too late though. They had already gained access by using a special API code (supplied by Google) that gives access to third parties and websites to your Gmail accounts.
What makes this worse is that Google, who own Gmail, know that these despicable scammers are targeting Gmail accounts and seem to be doing nothing to stop them. Looking on the Gmail forum sites, users have been complaining for months now, with little or no reaction from Google.
If Google remain silent and do not stop ShoppyBag from hijacking Gmail accounts then it would seem that ShoppyBag have Google's tacit approval to steal Gmail user’s contact lists and send their phishing scams to everyone on that list.
One person who wrote into the Google forums said that his Gmail account contained all his business customers. After Shoppybag bombarded all of them with emails, he has lost their trust and it has ruined his “parnosa”.
How to remove ShoppyBag’s access to your Gmail account
The first thing to say is that these scammers have unfortunately already stolen your contact list. Some people on Question/Answers sites have suggested going into the ShoppyBag site and completing their form to close your account. People have informed me that people on the contact list still continue to receive the emails. Moreover, going into the site could be a security risk so I would not recommend this.
My advice is to do the following:
1. Send an email only to Gmail account holders on your Contact list...
a. Telling them to report all sent and future ShoppyBag emails to Google as "Phishing emails".
To do this, click on the blue down arrow, to the right of the Reply button and click the "Report Phishing" option.
b. Tell them NOT to click on the link.
c. Apologise to them for giving ShoppyBag their email address.
d. Include the link to this page, or better still, paste the contents of this page to those effected.
2. Log into Gmail and click on “Settings” in the top right hand corner of the page.
Click on the third TAB across labeled “Accounts and Import”.
Scroll down to the bottom to where it says “Change Account Settings”
Click on the link saying “Google Account Settings”
(Log in if it asks you)
Under Security settings, the third line down, click on the link labeled “Authorisng Applications and Sites”.
Click on “revoke access” next to ShoppyBag's Google contacts to remove their access to your account.
3. Go back to the “Google Accounts Setting” Page and click on the first link: “Changing your password”.
Change your password to something with a combination of letters and numbers.
4. Log back into Gmail with your new password and go to your Contacts list.
Search through all your Contacts, deleting all ShoppyBag emails.
That’s all you can do I’m afraid until Google decide to act.
*** UPDATE ***
I found this legal site which is collecting information in order to sue shoppybag with a class action lawsuit.
http://sites.google.com/site/stopcallscopy/shoppy-bag-lawsuit
*** UPDATE ***
I found this legal site which is collecting information in order to sue shoppybag with a class action lawsuit.
http://sites.google.com/site/stopcallscopy/shoppy-bag-lawsuit
