Invite Systems are an Open Relay
Every time I think I've seen it all from spammers, they do something that surprises me. The ingenuity of bad actors is an interesting thing. I always wonder what sort of world we'd live in if their efforts were focused on good.
What sucks the most is when they abuse something that's intended to bring people together. Case in point, an invite system. It exists to allow somebody the chance to get the rest of their team using a product or service.
Invites wouldn't work if they said "You've been invited to platform" with no additional context. Typically the email states the name of the organization you're being invited to. "You've been invited to your organization name here".
Where does that organization name come from? The user of course! And what happens if the user has ill intentions? They set the organization name to something like "Text 1-800-555-1212 for a good time", or something even sketchier than that.
Generally speaking, these emails come through transactionally and from a generic email on the platform. If your system doesn't meter the number of invites, you have yourself a certified spam cannon! May as well set up an SMTP server without authentication, better known as an open mail relay.
There's a few ways you can approach limits. Have a cap on the total number of pending invites? The spammer may delete pending invites to keep moving. Daily limits on total invites sent? Maybe they'll be okay with stretching their campaign over days?
Probably not, most spammers are in the business of going as hard and fast as possible before they get caught. Occasionally somebody will fly below the radar, but I think that's more of a bug than a feature.
Sane limits as to not get in the way of legitimate users tends to get you pretty far. Monitoring if/when somebody hits the limits is good too. Spammers usually won't write in to let you know they hit some limit.
I say usually because there are some special folks out there that will come knocking.
:wq
Like this drivel? There's a whole RSS feed of it, or subscribe via email.