Scam email from [email protected]. How do they do that?

Hello.

I acquired an e mail from [[email protected]](mailto:[email protected]) saying:

Pricey consumer,
You are trying to reset the password linked together with your Binance account.

|| || |System: Safari 16.6.1 (Mac OS X) IP Location: Bucharest Romania IP: 178.132.108.236|

and so on and so on and so forth

I'm from England.

A short time later a youngish male with a southern English accent referred to as 'Ryan' rang from a Personal Number saying he was from Binance help and that my account had been hacked. He referred me to the e-mail. Now the e-mail is certainly from [[email protected]](mailto:[email protected]) (I seen the raw supply of the email to verify) so I made a decision to go together with it but not give anything away. His rationalization of how I was hacked was not very convincing especially as I might see I still had entry to the account and the stability was still the same. He stated he was compiling a report for Binance and to cross it on to other exchanges I had accounts with. He asked me if I had other accounts. I used to be very dubious about telling him this so stated I might if he rang me again in half an hour.

I solely have one different account on a unique change so went there and altered password, eliminated previous units and secured it as much because it was attainable to do.

He rang back. I informed him the identify of the Change. He left with a number for the Report he was passing on to the opposite Trade. 30 minutes later I get a call from a lady with a London accent, once more on a Personal Quantity. She says she is from the opposite Trade and asks me for the quantity. I am now 100% positive it's a rip-off so tell her I will contact the Change immediately and shut the call.

I am a bit rattled. The scammers had my identify, e mail tackle and telephone number! I assumed I was pretty savvy to these things but the reality the email *is* from a server inside the binance.com domain had me fooled. I did not assume it was attainable to try this.

So, huge question: How can a scammer probably ship an e mail from [[email protected]](mailto:[email protected]) ??

And here's part of the source of the e-mail to prove I'm not going mad:

ARC-Authentication-Outcomes: i=1; mx.google.com;

dkim=cross [[email protected]](mailto:[email protected]) header.s=gxhqvjfn7nxg45wwesxakydswcc4dbhb header.b=MwlDvzaH;

dkim=move [[email protected]](mailto:[email protected]) header.s=ihchhvubuqgjsxyuhssfvqohv7z3u4hn header.b=UFDqYrmY;

spf=cross (google.com: area of [0102019aeadca385-cd44d6a7-a0e5-4c3c-b15e-5b758a55c132-000000@aws.ses.binance.com](mailto:0102019aeadca385-cd44d6a7-a0e5-4c3c-b15e-5b758a55c132-000000@aws.ses.binance.com) designates 76.223.149.163 as permitted sender) smtp.mailfrom=[0102019aeadca385-cd44d6a7-a0e5-4c3c-b15e-5b758a55c132-000000@aws.ses.binance.com](mailto:0102019aeadca385-cd44d6a7-a0e5-4c3c-b15e-5b758a55c132-000000@aws.ses.binance.com);

dmarc=cross (p=NONE sp=NONE dis=NONE) header.from=ses.binance.com

Return-Path: [0102019aeadca385-cd44d6a7-a0e5-4c3c-b15e-5b758a55c132-000000@aws.ses.binance.com](mailto:0102019aeadca385-cd44d6a7-a0e5-4c3c-b15e-5b758a55c132-000000@aws.ses.binance.com)

Acquired: from c149-163.smtp-out.eu-west-1.amazonses.com (c149-163.smtp-out.eu-west-1.amazonses.com. [76.223.149.163])

by mx.google.com with ESMTPS id 5b1f17b1804b1-47930ca6365si13442465e9.74.2025.12.04.11.35.20

for [[email protected]](mailto:[email protected])

(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);

Thu, 04 Dec 2025 11:35:20 -0800 (PST)

Any enter can be appreciated (aside from any calling me a fool. I do know that already).