The dots do matter: how to scam a Gmail user
* The below is copied verbatim from a deeper branch of the thread, but may clarify some things for others as well. *Those are three different addresses. On some systems they may be three different accounts. On others they may be one account.
On some systems, anything ending in '@example.com' may be a single account.It may be that defined address to account mappings exist on a domain and all other addresses map to a default account. It's common enough the hosting industry supports it and it has a name - a catchall email account.Nobody sending mail to any of those addresses needs to know how many addresses map to the account associated with the address to which they are sending. It's an address, not an identifier. I would argue you don't have a reason nor a right to know the address to account mappings in my systems.What a sender should reasonably expect is that someone who can receive mail delivered to a particular address is in charge of the email account to which that address maps. Sending a verification email to someone expecting to receive it is the way to validate the recipient is the intended recipient. That's it.If I give you my phone number, do you need to know what other phone numbers will ring that phone or how many phones I answer in order to call me? Do I need to disclose all the possible places I might receive a package if I want one delivered to a single place? No.Email addresses are addresses. That's all they are. Stop pretending they are something else, and this will become much clearer for you.