[rz2k]

I’ve surprisingly found that I have started to have to use mydomain.com with Fastmail. Sometimes banks used for a business account, or accounts at b2b companies don’t treat fastmail.com as a large email provider, and otherwise try to associate me with other fastmail customers as though we are colleagues at Fastmail.

[Normal_gaussian]

This is genuinely hilarious. Are you able to elaborate? Which banks? Which B2B? There is probably a shared product stack here that is making some hilariously poor decisions.

[rz2k]

I couldn’t figure out why US Bank business card applications using a sole proprietorship EIN kept disappearing into a black hole or being denied. Eventually after a few phone calls they complained about the email address.

The other was ferguson.com, so that I could order specialized furnace parts and larger diameter plumbing fittings than I could order from Home Depot. I don’t remember the details, but I think the Ferguson business application kept trying to autofill an address for me. It probably would have required a confirmation from the person who had been turned into the administrator of “fastmail” before I could have been added to their organization and been able to make purchases using their account.

It might not be a problem at larger suppliers like Grainger or Digikey, but it does suggest a vulnerability if you set up a corporate account at a small supplier using a fastmail address. Their backend could assume that anyone able to receive emails on “your” fastmail.com domain is at least authorized by your IT department to use email. If they assume your IT department has an email retention policy, then they might default to treating it like your problem if one of your employees makes an unauthorized purchase.

[cam_l]

Not only that, I used to use [e-mail] for setting up aliases to interact with different businesses. On more than a few occasions I had some very confusing back and forth until realising the issue, when they asked which department I was from.

When they saw their own business name in the email address they just straight up assume I am part of their company. No wonder phishing works.