Beware. eBay scams are getting REAL good

CIVITAS

Got this email today.

This is an actual item we have on eBay right now!



However, despite what the links say, here is the HTML for the link to the items:

<b>CANADA. Bank of Montreal. 1842 Halfpenny Token. EF</b> (<a href="http://cgi.ebay.com/ws/eBayISAPI.dll?MfcISAPICommand=ViewItem&co_partnerId=2&pUserId=
&siteid=0&pageType=&pa1=&i1=&bshowgif=&UsingSSL=&ru=&pp=&pa2=&errmsg=&runame=&ruparams=&ruproduct=&sid=&favoritenav=&migrateVisitor=&Item=
5875281930&aiu=rtqz{0ejggtuhknou0eqo0vy157985;497155854584&jsc=sig&jsv=1&jsem=rc{rcnBekxkvcuicnngtkgu0eqo" >8413987787</a&gt</font>
</td></tr><table cellspacing=0 cellpadding=0 border=0><tr>

Notice the Item# in the link is different from the actual item # of our auction. The links take you to one of those auctions with the script that reroutes you to a false login page. The only thing about this email that tips it off is the lack of our name at the top of the email as it says francois3650.

Already forwarded to spoof@ebay.com.

danglen

I have now taken the action to make sure that we do not reply to ANY eBay messages that are not listed within "My Messages" on "My eBay" page. Everyone in the shop is also instructed that if they are in eBay, and they click on any page and the "ID and Password" page comes up, to exit the browser and log into eBay again. What will they think of next?

MadMarty

I just hit reply and E-Mail the answer back to them.

CIVITAS

Well, my problem is that we usually have so much stuff on eBay, I never know what item it is they're asking about. So, I usually click the item link to bring up the auction so I know what they're asking about. That's what happened here. Guess I'll have to open up the page from My eBay now.... I notice now that francois3650 is the current high bidder on the auction, so I guess they must have some script that just sucks the info off the auction page and mails out this spam. What a pain.

MacCrimmon

Rescind their bid, and BLOCK 'em.

CIVITAS

Oops. that came out wrong. I didn't mean to imply that francois3650 was the scammer (although it's possible). I think the scammers have a program that just pulls all the info off an auction page to generate the phishing email to make them look that much more legitimate, which is why his ID ended up in the email rather than just a random username. I also think their program goofed and meant to pull our eBay ID instead. These scammers always seem to miss one small detail which gives them away (fortunately).

Conder101

First line tells me it's a fake.

eBay sent this message to francois3650

Then it says that your registered name is included to show that the message is real. But they DON'T show the registered name just an eBay ID. And Civitas says the francois3650 is the high bidder in the auction they refer to, but this message claims to be going TO francois3650 So unless Civitas IS francois3650, it is an obvious fake.

spinaker2000

<< <i>First line tells me it's a fake.

eBay sent this message to francois3650

Then it says that your registered name is included to show that the message is real. But they DON'T show the registered name just an eBay ID. And Civitas says the francois3650 is the high bidder in the auction they refer to, but this message claims to be going TO francois3650 So unless Civitas IS francois3650, it is an obvious fake. >>



"And the LORD spake, saying, first shalt thou take out the Holy Pin. Then, shalt thou count to three. No more, no less. Three shall be the number thou shalt count, and the number of the counting shall be three. Four shalt thou not count, neither count thou two, excepting that thou then proceed to three. Five is right out. Once the number three, being the third number, be reached, is counted, then lobbest thou thy Holy Hand Grenade of Antioch towards thy foe, who, being naughty in My sight, shall snuff it."

JZrarities

Still... VERY DECEPTIVE.

docday2003

<< <i>

<< <i>First line tells me it's a fake.

eBay sent this message to francois3650

Then it says that your registered name is included to show that the message is real. But they DON'T show the registered name just an eBay ID. And Civitas says the francois3650 is the high bidder in the auction they refer to, but this message claims to be going TO francois3650 So unless Civitas IS francois3650, it is an obvious fake. >>



"And the LORD spake, saying, first shalt thou take out the Holy Pin. Then, shalt thou count to three. No more, no less. Three shall be the number thou shalt count, and the number of the counting shall be three. Four shalt thou not count, neither count thou two, excepting that thou then proceed to three. Five is right out. Once the number three, being the third number, be reached, is counted, then lobbest thou thy Holy Hand Grenade of Antioch towards thy foe, who, being naughty in My sight, shall snuff it." >>

coinpictures

To do it justice, one must quote the entire scene verbatim:

[clop clop clop]

[whinny whinny]

GALAHAD: They're nervous, sire.

ARTHUR: Then we'd best leave them here and carry on on foot. Dis-mount!

TIM: Behold the cave of Caerbannog!



ARTHUR: Right! Keep me covered.

GALAHAD: What with?

ARTHUR: W-- just keep me covered.

TIM: Too late!

[dramatic chord]

ARTHUR: What?

TIM: There he is!

ARTHUR: Where?

TIM: There!

ARTHUR: What, behind the rabbit?

TIM: It is the rabbit.

ARTHUR: You silly sod!

TIM: What?

ARTHUR: You got us all worked up!

TIM: Well, that's no ordinary rabbit!

ARTHUR: Ohh.

TIM: That's the most foul, cruel, and bad-tempered rodent you ever set eyes on!

ROBIN: You tit! I soiled my armour I was so scared!

TIM: Look, that rabbit's got a vicious streak a mile wide! It's a killer!

GALAHAD: Get stuffed!

TIM: He'll do you up a treat, mate.

GALAHAD: Oh, yeah?

ROBIN: You mangy Scots git!

TIM: I'm warning you!

ROBIN: What's he do, nibble your bum?

TIM: He's got huge, sharp-- eh-- he can leap about-- look at the bones!

ARTHUR: Go on, Bors. Chop his head off!

BORS: Right! Silly little bleeder. One rabbit stew comin' right up!

TIM: Look!

[squeak]

BORS: Aaaugh!



[dramatic chord]

[clunk]

ARTHUR: Jesus Christ!

TIM: I warned you!

ROBIN: I done it again!

TIM: I warned you, but did you listen to me? Oh, no, you knew it all, didn't you? Oh, it's just a harmless little bunny, isn't it? Well, it's always the same. I always tell them--

ARTHUR: Oh, shut up!

TIM: Do they listen to me?

ARTHUR: Right!

TIM: Oh, no...

KNIGHTS: Charge!

[squeak squeak squeak]



KNIGHTS: Aaaaugh!, Aaaugh!, etc.

ARTHUR: Run away! Run away!

KNIGHTS: Run away! Run away!...

TIM: Ha ha ha ha! Ha haw haw! Ha! Ha ha!

ARTHUR: Right. How many did we lose?



LAUNCELOT: Gawain.

GALAHAD: Ector.

ARTHUR: And Bors. That's five.

GALAHAD: Three, sir.

ARTHUR: Three. Three. And we'd better not risk another frontal assault. That rabbit's dynamite.

ROBIN: Would it help to confuse it if we run away more?

ARTHUR: Oh, shut up and go and change your armour.

GALAHAD: Let us taunt it! It may become so cross that it will make a mistake.

ARTHUR: Like what?

GALAHAD: Well... ooh.

LAUNCELOT: Have we got bows?

ARTHUR: No.

LAUNCELOT: We have the Holy Hand Grenade.

ARTHUR: Yes, of course! The Holy Hand Grenade of Antioch! 'Tis one of the sacred relics Brother Maynard carries with him. Brother Maynard! Bring up the Holy Hand Grenade!

MONKS: [chanting] Pie Iesu domine, dona eis requiem.



Pie Iesu domine, dona eis requiem. Pie Iesu domine, dona eis requiem. Pie Iesu domine, dona eis requiem.

ARTHUR: How does it, um-- how does it work?

LAUNCELOT: I know not, my liege.

ARTHUR: Consult the Book of Armaments!

BROTHER MAYNARD: Armaments, chapter two, verses nine to twenty-one.

SECOND BROTHER: And Saint Attila raised the hand grenade up on high, saying, 'O Lord, bless this Thy hand grenade that, with it, Thou mayest blow Thine enemies to tiny bits in Thy mercy.'



And the Lord did grin, and the people did feast upon the lambs and sloths and carp and anchovies and orangutans and breakfast cereals and fruit bats and large chu--

MAYNARD: Skip a bit, Brother.

SECOND BROTHER: And the Lord spake, saying, 'First shalt thou take out the Holy Pin. Then, shalt thou count to three. No more. No less. Three shalt be the number thou shalt count, and the number of the counting shall be three. Four shalt thou not count, nor either count thou two, excepting that thou then proceed to three. Five is right out. Once the number three, being the third number, be reached, then, lobbest thou thy Holy Hand Grenade of Antioch towards thy foe, who, being naughty in My sight, shall snuff it.'

MAYNARD: Amen.

KNIGHTS: Amen.

ARTHUR: Right!



One!... Two!... Five!

GALAHAD: Three, sir!

ARTHUR: Three!

[angels sing]

[boom]

Aethelred

<< <i>

<< <i>First line tells me it's a fake.

eBay sent this message to francois3650

Then it says that your registered name is included to show that the message is real. But they DON'T show the registered name just an eBay ID. And Civitas says the francois3650 is the high bidder in the auction they refer to, but this message claims to be going TO francois3650 So unless Civitas IS francois3650, it is an obvious fake. >>



"And the LORD spake, saying, first shalt thou take out the Holy Pin. Then, shalt thou count to three. No more, no less. Three shall be the number thou shalt count, and the number of the counting shall be three. Four shalt thou not count, neither count thou two, excepting that thou then proceed to three. Five is right out. Once the number three, being the third number, be reached, is counted, then lobbest thou thy Holy Hand Grenade of Antioch towards thy foe, who, being naughty in My sight, shall snuff it." >>




Who are you who is so wise in the ways of science?

1jester

Their English also sucks, and is indicative of a non-native English speaker.

CIVITAS

Well, because of the type of merchandise we carry, we certainly get plenty of genuine messages from people whose English sucks.

CIVITAS

Many of those people whose English sucks are native English speakers too!

ajaan

<< <i>we certainly get plenty of genuine messages from people whose English sucks. >>



Hey! I resemble that remark.

SYRACUSIAN

The only thing about this email that tips it off is the lack of our name at the top of the email as it says francois3650.




Suppose that the scammer has done a legitimate purchase from you (and other sellers) in the past, and therefore knows the real names of his intended victims from the invoices that he has already received and maybe even paid. Instead of sending hundreds of emails like this one, he chooses a few select ones with the recipients' real names, and maybe even manages to have the two different item numbers look alike,say only one or two out of the 10 digits is different. How hard does this become to detect, can you imagine?


The only way out is to do what danglen does, even I receive one of these emails every other week, although I only average 7-8 listings per month.It's this, or an invitation to join the power seller program, the urls of which are originating from the Czech republic or Romania.

ajaan

<< <i>the urls of which are originating from the Czech republic or Romania. >>


Pretty soon eBay probably will be outsourcing to these places.

WWW

Speaking of Internet scams getting better and better. Beware of the latest one involving Voice over I.P. (VoIP). It's very slick.

New VoIP Phishing Scams