NWA-PCUG Newsletter Article, September 2004
How to Recognize a Fake eBay Message
by Robert Simanski
From July/August, 2004 Capital PC User Group Monitor
rsimanski@yourpubpro.com
(click to email author)


If you receive the following message that appears to come from eBay, or anything similar, do not respond to the message. The message is a fake and offers a good opportunity to show how to spot a fake message.

If you receive a message like this, do not click on any of the bogus links shown in the message! Just place your cursor over them where I’ve suggested it. The message begins as follows:

Dear eBay User.

During our regular update and verification of the accounts, we couldn’t verify your current information. Either your information has changed or it is incomplete.

Please update and verify your information by signing in your account below:

If the account information is not updated to current information within 5 days then, your access to bid or buy on eBay will be restricted. go to this link below:

http://www.ebay.com/acounts/memb/avncenter/?dll87443%2213

The misspelling of “accounts”in the first link was a dead giveaway that the message might be bogus. If you place your cursor over the hypertext link, and your e-mail software has a status bar at the bottom of the main window, you will see that the link actually goes to the home page of the following site instead:

http://ebay-customer-validate.info/

This site has nothing at all to do with eBay. Note that “info”is what is called a top-level domain, just like “com,”“net,”and “org.”A “WhoIs”search showed that “ebay-customer- validate.info”is a domain created on May 10, 2004, by Mike Lynn, who apparently lives in Spring, Texas. He is listed as the administrative contact.

The billing contact for this domain is another domain — namely gandi.net. This is highly unusual. The organization that owns this domain is GANDI sarl, which is apparently located in Paris, France — no street address.

Please note that I did not go to the site myself. However, based on what I have read, I would expect that it would ask me to enter certain sensitive information, such as my credit card number.

FYI, the real eBay domain is owned by the following: eBay, Inc. (EBAY-DOM)
2005 E. Hamilton Ave., Ste. 350
2125 Hamilton Ave
San Jose, CA 95125

The bogus message continues:

***Please Do Not Reply To This EMail As You Will Not Receive A Response*** Thank you
Accounts Managent

As outlined in our User Agreement, eBay will periodically send you information about site changes and enhancements. Visit our Privacy Policy and User Agreement if you have any questions.

If you place your cursor over the User Agreement hyperlink, you will see the following: http://r.aol.com\cgi\redir-complex/?url=http://pages.ebay.com/help/community/ping-user.html?ssPage-Name=ADME:X:EOA:US.24

As you can see, it starts out at aol.com, then redirects your browser to a page on the real eBay Web site. This is another giveaway that the message is false. If the message were legitimate, there would be no need for this type of redirection.

The correct address for eBay’s User Agreement page (which you can try if you want) is as follows:

http://pages.ebay.com/help/policies/user-agreement.html

If the message were really from eBay, this is what you would see, both in the text of the message and in the status bar.

As a general rule, always place your cursor over a hypertext link and check the status bar before clicking on the link. If the information in the status bar is not identical to the text in the link, never click on the link.

Better yet, never click on a link at all unless you trust both the message and the sender, even if the text of the link and the information in the status bar match. Always enter the link manually in your browser’s address window.

This scam artist was even clever enough to attempt to include eBay’s copyright notice at the end of the message:

Copyright 2002 eBay Inc. All Rights Reserved.

Designated trademarks and brands are the property of their respective owners. eBay and the eBay logo are trademarks of eBay Inc

However, he got it wrong. This is the copyright notice on eBay’s home and user agreement pages:

Copyright © 1995-2004 eBay Inc. All Rights Reserved. Designated trademarks and brands are the property of their respective owners.

I hope you find this tutorial helpful.You can apply the ideas shown here to any message that looks suspicious, not just ones that appear to come from eBay.

Copyright © 2004 Robert E. Simanski

Bob Simanski is the owner of Business Pro Services, Sterling, Virginia. His company offers computer support and publishing services. You can contact Bob at 703-404-8665 or rsimanski@yourpubpro.com or visit his Web site at http://www.businessproservices.com.

Click here to return to top



==================================================================