Robinhood users are being warned about a phishing campaign that combines Gmail’s “dot alias” handling with weaknesses in Robinhood’s account creation system. The result is emails that appear legitimate but are designed to trick users into visiting fake login pages.
Singapore Summit: Meet the largest APAC brokers you know (and those you still don't!).
Users reported on social media that they had received messages that looked like routine security alerts from Robinhood. The emails claimed that a login had occurred from an unrecognized device. They also included a button urging users to review the activity.
Phishing Uses Gmail Dot Alias Abuse
Cybersecurity expert Alex Eckelberry analyzed the scheme. He said there is no evidence of a breach of Robinhood’s systems. Instead, he pointed to abuse of Gmail’s handling of email addresses with dots and weaknesses in Robinhood’s account registration flow.
- FCA Reconsiders 7-Day IPO Research Delay Amid Concerns Over Costs and Market Risk
- CFI Posts $2.3 Trillion Q1 Volume as Client Activity and Deposits Rise
- IG Japan Confirms Potential Data Exposure of 163K Clients, but No ‘External Leak’
The attack starts with the creation of a fake Robinhood account. The attacker uses an email address that closely resembles the victim’s but removes dots. For example, john.doe@gmail.com is entered as johndoe@gmail.com. Robinhood treats these as different accounts. Gmail treats them as the same inbox.
As a result, system emails sent by Robinhood for the fake account are delivered to the real user’s inbox. These messages can include login alerts or account notifications and appear authentic because they originate from Robinhood’s infrastructure.
Eckelberry said attackers then exploit optional fields during account creation, such as the “device name” field. HTML code is inserted into these fields. Gmail processes this as formatting rather than plain text. This allows attackers to embed fake warning text and a malicious button inside a legitimate Robinhood email.
Emails Pass Checks, Content Manipulated Only
The emails pass standard authentication checks, including SPF, DKIM, and DMARC, because they are sent through Robinhood’s servers. Only the injected content is manipulated.
Clicking the button redirects users to a look-alike website designed to collect login credentials. Security experts say the site itself is harmless if only visited. The risk arises when users enter personal information.
Robinhood said its core systems and customer accounts were not breached. It also said no personal data or funds were affected. The company advised users to delete the emails and avoid clicking any links. It added that customers who interacted with the messages should contact support only through the official app or website.
