For those unaware, spoofed emails can be very convincing and taken for legitimate without you knowing it was spoofed. Spoofed addresses can be made identical to official MG addresses on the surface.

We are using DMARC signed emails. Most emails servers will not deliver spoofed MG emails. Or at least send them to SPAM.

Another thing I strongly advise anyone who received a phishing email from MG, is to check if your email address has been exposed in a data leak.
-- toptier

There was no leak. It's like @pibou said: someone just registered new accounts with username "SystemAlertX" and tried to automate the sending of phishing mails with the MG messenger. We have a limitation of 3 messages per user/hour. This is not to upsell unicorn accounts but to prevent the spammers from spamming to all users. Those of you who got the phishing mail are lucky winners, so to speak.

I do what is reasonable to fight scammers, but at some point security becomes a prison. Nobody wants to fill out a CAPTCHA for every message they want to send, and I think it would be quite excessive to require users to provide IDs or phone numbers just so they can use a modular planner...