Scam email from [email protected]. How do they do that?

Hello.

I acquired an e-mail from [[email protected]](mailto:[email protected]) saying:

Pricey consumer,
You are attempting to reset the password linked together with your Binance account.

|| || |System: Safari 16.6.1 (Mac OS X) IP Location: Bucharest Romania IP: 178.132.108.236|

and so forth and so on and so on

I am from England.

A short time later a youngish male with a southern English accent referred to as 'Ryan' rang from a Personal Number saying he was from Binance help and that my account had been hacked. He referred me to the email. Now the email is certainly from [[email protected]](mailto:[email protected]) (I seen the uncooked source of the e-mail to verify) so I made a decision to go together with it but not give something away. His rationalization of how I used to be hacked was not very convincing particularly as I might see I still had access to the account and the stability was still the identical. He stated he was compiling a report for Binance and to move it on to other exchanges I had accounts with. He asked me if I had different accounts. I used to be very doubtful about telling him this so stated I might if he rang me again in half an hour.

I only have one different account on a special change so went there and altered password, eliminated previous units and secured it as a lot because it was potential to do.

He rang back. I advised him the identify of the Trade. He left with a quantity for the Report he was passing on to the opposite Trade. 30 minutes later I get a name from a lady with a London accent, once more on a Personal Quantity. She says she is from the opposite Trade and asks me for the quantity. I'm now 100% positive it's a scam so inform her I'll contact the Trade immediately and close the call.

I'm a bit rattled. The scammers had my identify, e-mail handle and telephone quantity! I assumed I used to be pretty savvy to these things but the reality the email *is* from a server inside the binance.com area had me fooled. I did not assume it was attainable to try this.

So, massive query: How can a scammer probably ship an e mail from [[email protected]](mailto:[email protected]) ??

And here's a part of the source of the email to show I'm not going mad:

ARC-Authentication-Results: i=1; mx.google.com;

dkim=cross [[email protected]](mailto:[email protected]) header.s=gxhqvjfn7nxg45wwesxakydswcc4dbhb header.b=MwlDvzaH;

dkim=cross [[email protected]](mailto:[email protected]) header.s=ihchhvubuqgjsxyuhssfvqohv7z3u4hn header.b=UFDqYrmY;

spf=cross (google.com: area of [0102019aeadca385-cd44d6a7-a0e5-4c3c-b15e-5b758a55c132-000000@aws.ses.binance.com](mailto:0102019aeadca385-cd44d6a7-a0e5-4c3c-b15e-5b758a55c132-000000@aws.ses.binance.com) designates 76.223.149.163 as permitted sender) smtp.mailfrom=[0102019aeadca385-cd44d6a7-a0e5-4c3c-b15e-5b758a55c132-000000@aws.ses.binance.com](mailto:0102019aeadca385-cd44d6a7-a0e5-4c3c-b15e-5b758a55c132-000000@aws.ses.binance.com);

dmarc=cross (p=NONE sp=NONE dis=NONE) header.from=ses.binance.com

Return-Path: [0102019aeadca385-cd44d6a7-a0e5-4c3c-b15e-5b758a55c132-000000@aws.ses.binance.com](mailto:0102019aeadca385-cd44d6a7-a0e5-4c3c-b15e-5b758a55c132-000000@aws.ses.binance.com)

Acquired: from c149-163.smtp-out.eu-west-1.amazonses.com (c149-163.smtp-out.eu-west-1.amazonses.com. [76.223.149.163])

by mx.google.com with ESMTPS id 5b1f17b1804b1-47930ca6365si13442465e9.74.2025.12.04.11.35.20

for [[email protected]](mailto:[email protected])

(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);

Thu, 04 Dec 2025 11:35:20 -0800 (PST)

Any input can be appreciated (aside from any calling me a fool. I do know that already).