NWA-PCUG Newsletter Article, August 2006
eBay Warns of Phishing and Identity Theft
By Ira Wilsker,
APCUG Director; Columnist, The Examiner, Beaumont, TX; Radio & TV Show Host

(click to email author)


http://www.ebay.com/ebay_toolbar (that is "ebay underscore toolbar")
EMAIL: spoof@ebay.com

I received the following real email in HTML format, complete with authentic eBay graphics, typo errors, and links to eBay:

"From: member@ebay.com
Sent: Friday, July 14, 2006 11:05 AM
To: iwilsker@*******
Subject: Message from eBay Member

Your registered name is included to show this message originated from eBay. Learn more
Question about Item -- Respond Now. eBay sent this message on behalf of an eBay member via My Messages. Responses sent using email will go to the eBay member directly and will include your email address. Click the Respond Now button below to send your response via My Messages (your email address will not be included).
Question from eBay Member: ***** Item: (4644336***)
This message was sent while the listing was active. ***** is a potential buyer.

Hello, how much it is buy it now price? please let me know if you accept PayPal or Money Orders for payment. Thanks. Regards Respond to this question in My Messages. Respond Now.

Item Details Item number: 4644336*** End date: July-24-06 21:06:59 PDT View item description: Thank you for using eBay Marketplace Safety Tip Always remember to complete your transactions on eBay - it's the safer way to trade. Is this message an offer to buy your item directly through email without winning the item on eBay? If so, please help make the eBay marketplace safer by reporting it to us. These external transactions may be unsafe and are against eBay policy. Learn more about trading safely "

The problem is that I am not currently selling anything on eBay. I even noticed that the real item listed was an expensive item, and did not have me as the seller. Being a nice guy, I clicked on the link in the email, and am greeted by a genuine appearing eBay login page, asking for my username and password, so I login. eBay replies that it needs to verify my identity, so it asks me for my email address and PayPal password, as well as the credit card number, security code, and PIN number associated with that credit card. Once I have verified my information, I am taken back to an eBay page where I type a reply that the sender has made a mistake, and that the item listed is not mine. What gives?

The email above is one that I actually received. The graphics on the webpage displayed were genuine, and the webpage appeared perfect. I have established eBay and PayPal accounts, which are periodically used. The problem was that if I had logged in utilizing the link in the email, I would really have been connected to a spoof site, in this particular case, in Czechoslovakia, rather than the real eBay site. If I had fallen for this trick, some crook would have bid on eBay merchandise with my username and password, with delivery to some unknown destination, without an intent to pay for it. The crook may have also posted high value items for sale under my eBay ID, taking advantage of my high reliability rating on eBay, and never delivered the goods sold, instead absconding with the proceeds. Since my PayPal account would also have been compromised, any accounts connected to my PayPal would be likely be drained of assets. Since I also had to post my credit card information, it would likely have been used to purchase other merchandise, with the bill coming to me. My credit card information would also probably have been posted for sale and then resold, so others could take advantage of it prior to my canceling the account, which may be a month until I find out about it, or until my card is charged to the max.

Both the email above and the scenario are real, and eBay and many of its members have become innocent victims of this identity theft "Phishing" scam. The crime has become so common, and the amount of losses so severe, that eBay is actively fighting this illicit practice, investigating the scammers, getting the forged websites shut down, and taking other actions as appropriate. Since the preponderance of thieves are overseas, actual criminal prosecutions are scarce, and recovery of property stolen and money purloined is almost non-existent. eBay has recently requested that anyone receiving such an email, or some variation of it, forward the email immediately, including all headers, to spoof@ebay.com. Another common variation of this scam is the "I paid for it, now when will you be shipping it? Reply by clicking this eBay sign-in link" (I have also received several of those). eBay wants all of these, and it will likely respond within minutes that the email is fraudulent.

eBay has created several websites to inform its members of these scams. They have also created an Internet Explorer toolbar to help protect its members by authenticating any apparent eBay link, or displaying the information that it is not an official eBay or PayPal website. I strongly recommend that all eBay users review the online tutorials at pages.ebay.com/education/spooftutorial. There are five sequential sections in the tutorial, covering "What is a Spoof Email", "How to Spot a Spoof Email", "How to Spot a Fake Website", "What to do about Spoofs", and "Protecting Your Account." This graphically rich spoof tutorial could be used as a basis for a safety presentation presented by computer user groups, civic and religious associations, fraternal organizations, senior citizen events, and other meetings. With the millions of eBay users, and the countless millions of the spoof "Phishing" emails being sent on a daily basis, this spoof tutorial should be widely disseminated.

Sadly, some small percentage of recipients, estimated to be between one and four percent of those who receive such emails, fall for the scam. For those who may have been victimized, eBay has created another website "Securing Your Account and Reporting Account Theft" at pages.ebay.com/help/confidence/isgw-account-theft-reporting.html. At this site, seven tips, along with explanatory content, are displayed. The seven tips, summarized, are:

    1. Change the password on your personal email account
    2. Request a new eBay password.
    3. Change the Secret Question and Answer on your eBay account
    4. Verify your personal contact information registered on your eBay account and change anything that isn't correct.
    5. Search for any active bids or listings that may be unauthorized by reviewing your My eBay page
    6. Take steps to protect your identity.
    7. Educate yourself on how to recognize and report spoof email and Web sites impersonating eBay.

To help protect eBay and PayPal users, eBay has created a free toolbar that can be downloaded and utilized by almost all eBay users. In addition to one-click access to many eBay and PayPal functions, it contains an "Account Guard" which provides some protection from fake websites. The toolbar can be downloaded (free) from http://www.ebay.com/ebay_toolbar.

In addition to the toolbar from eBay, there are other protective measures that can be taken. Some internet security utilities, such as TrendMicro's PC-Cillin Internet Security Suite, contain both an anti-phishing toolbar that discloses most spoofed web addresses, and an internet filter that blocks suspect websites, and displays a message if it is a know scam. The new version of Internet Explorer 7 (currently in beta) has an integral anti-phishing utility. Recent versions of Firefox will display the real, rather than spoofed, URL in the address bar. McAfee has it's (currently free for Firefox) "SiteAdvisor" that warns users about suspicious sites.

Identity theft and phishing are big in terms of the millions of victims, and the billions of dollars that are scammed. Education, awareness, and prevention are among the best tools available to protect us from these possibly catastrophic events and losses.

Click here to return to top