Warning to all: Most sophisticated eBay scam yet?

Manorcourtman · March 18, 2007 9:07AM

So I had an coin auction end this afternoon. About 15 minutes after it was over I get this email:

---------------------------------------------------------------------------------
Question from munch_2
munch_2( 1128)
Positive feedback: 99.9%
Member since: Oct-15-02
Location: MI, United States
Registered on: www.ebay.com

Item: 1899 PCGS MS65 "V" Nickel, GEM Cartwheel Luster NR (160094965179)
This message was sent after the listing closed.

Look at what this guy what is saying about you :
http://members.ebay.com/aboutme/my2sonsandme
Respond to this question
------------------------------------------------------------------------------

Immediately I am skeptical. I cut and paste the members link and go to eBay. The eBay member (my2sonsandme) is a registered eBay member that looks legit. BUT, when you click on his about me page it asks for your eBay name and password. The About Me symbol on the eBay page links you to a Yahoo members page that is phishing for your log-in info.

Pretty sophisticated phishing attempt if you ask me. I do not know if the ebay member who emailed me after the auction was closed is aware of his account being used nor do I know if the guy with his about me page is aware of the false link? What say you guys? BTW they were both reported.

Zoins · March 18, 2007 9:12AM

You may also be interested in reporting phishing sites to the Anti-Phishing Working Group. eBay is a member as are many banks who are also victims of phishers. The APWG serves as a clearing house of phishing related activity. Some phishing site lists get disseminated to some web browsers for extra protection outside of any action individual websites may take. The following is what I see in my browser when I go to one link used by eBay scammers. I'm not sure where Firefox gets their list of phishing sites but I wouldn't be surprised if it was from the APWG.

BiddlesBank · March 18, 2007 9:16AM

.
I got two paypal phishing emails today. A record. Usually only once a month or so.

Does anyone ever try to track down these cyber thieve's?

Zoins · March 18, 2007 9:19AM

<< I got two paypal phishing emails today. A record. Usually only once a month or so.

Does anyone ever try to track down these cyber thieve's? >>

I've met FBI agents that attend Anti-Phishing Working Group meetings. After the working meetings, usually everyone heads out for some drinks at a local pub. At one of these pub gatherings, a FBI agent was like (my paraphrasing) "(with all the money being made,) do you ever feel you're on the wrong side"? HAHA!

One of the difficult things about getting to the actual people behind the phishing sites is that many are run by foreign organized crime syndicates. It's a lot easier to shut down sites as they come up.

OPA · March 18, 2007 9:21AM

This is not a phishing website...the idiot "bookmarked" his ebay sign-in page & emailed it to you....what an idiot...

Manorcourtman · March 18, 2007 9:31AM

<< This is not a phishing website...the idiot "bookmarked" his ebay sign-in page & emailed it to you....what an idiot... >>

When you try to enter a fake id/pw and hit enter it directs you off eBay.

Russ · March 18, 2007 9:31AM

<< Some phishing site lists get disseminated to some web browsers for extra protection outside of any action individual websites may take. >>

Won't work in this case. This phish uses a legit eBay URL. The about me page is just coded like a login page with script pointing to another server.

<< This is not a phishing website...the idiot "bookmarked" his ebay sign-in page & emailed it to you....what an idiot... >>

It's not a sign in page, just coded to look like one.

Russ, NCNE

Zoins · March 18, 2007 9:33AM

<< 

<< Some phishing site lists get disseminated to some web browsers for extra protection outside of any action individual websites may take. >>

Won't work in this case. This phish uses a legit eBay URL. The about me page is just coded like a login page with script pointing to another server.

<< This is not a phishing website...the idiot "bookmarked" his ebay sign-in page & emailed it to you....what an idiot... >>

It's not a sign in page, just coded to look like one.

Russ, NCNE >>

Hmm. Pretty ingenious. I wonder if the browser can flag specific URLs instead of just domains. If so, it could still work but I'm not sure if it works that way.

Barry · March 18, 2007 9:34AM

Same thing we discussed last week:
Dangerous phishing Ebay message

barbershopper · March 18, 2007 9:40AM

I just tried his url and it took me to an "ebay page" wanting me to sign in.
I have auto fill for my name and PW and never need to sign in.
I then opened another window, went to my ebay me page w/o having to sign in.
Clicked on "community" and searched for his user name.
Again, I was asked to sign in.
Got out of there as quick as I could.
Gotta be something phishy about the whole thing.
JT

Manorcourtman · March 18, 2007 9:44AM

Ok, computer genius people......are these 2 eBayers involved or are they just bystanders???

Russ · March 18, 2007 9:47AM

The About Me page is likely a hijacked account.

Russ, NCNE

Zoins · March 18, 2007 9:47AM

<< I just tried his url and it took me to an "ebay page" wanting me to sign in.
I have auto fill for my name and PW and never need to sign in.
I then opened another window, went to my ebay me page w/o having to sign in.
Clicked on "community" and searched for his user name.
Again, I was asked to sign in.
Got out of there as quick as I could.
Gotta be something phishy about the whole thing.
JT >>

I'm not sure how your auto fill works but if it submitted the info on your behalf, I hope you immediately changed your password after the experiment.

Coinlearner · March 18, 2007 10:12AM

Thanks. Just changed my password. I was remembering it to

Oh well, I'll change it every month just to play it safe.

Russ · March 18, 2007 1:02PM

This needs to stay near the top. Some forum members are falling for it.

Russ, NCNE

Fjord · March 18, 2007 1:05PM

<< This needs to stay near the top. Some forum members are falling for it.

Russ, NCNE >>

I fell for it. Changed my password immediately and notified ebay. Will check my account daily for anything odd.

OPA · March 18, 2007 1:26PM

<< 

<< This needs to stay near the top. Some forum members are falling for it.

Russ, NCNE >>

I fell for it. Changed my password immediately and notified ebay. Will check my account daily for anything odd. >>

Has me fooled. Sure looks like a legit URL. Signed on using phony user i.d & password .. once it accepted the info, I knew it is a scam.

seatedcollector · March 18, 2007 5:32PM

these phishing scams are avoidable in one simple way

DO NOT ANSWER ANY EMAIL FROM EBAY OR PAYPAL THAT ASKS FOR A PASSWORD >>>>>>> PERIOD.

Fjord · March 18, 2007 5:42PM

<< these phishing scams are avoidable in one simple way

DO NOT ANSWER ANY EMAIL FROM EBAY OR PAYPAL THAT ASKS FOR A PASSWORD >>>>>>> PERIOD. >>

Good advice, but it would not have worked in this case. The phishing lure is a real "about me" page on ebay. The password request is not in the email.

incidentally, the "aboutme" page has gone blooey. Looks like ebay heard our cries.

I just changed my ebay password again, can't hurt.

gyocomgd · March 18, 2007 5:42PM

<< these phishing scams are avoidable in one simple way

DO NOT ANSWER ANY EMAIL FROM EBAY OR PAYPAL THAT ASKS FOR A PASSWORD >>>>>>> PERIOD. >>

It isn't expressed simply as e-mail. It comes in the form of a "question from buyer" at ebay itself. That's what makes it deceptive.
I've received 10 of these in the last 3 days. I forward the e-mail end to spoof@ebay.com and got an automated response. I have no idea if they're trying very hard to stop the thieves.

Cladiator · March 18, 2007 8:10PM

Manorcourtman,

I got the exact same email when I had auctions closing on Sunday as well. Led me to the same eBay user too.

Manorcourtman · March 18, 2007 8:42PM

I don't understand why eBay lets anyone other than the buyers send emails to sellers after an auction is completed. It sure took eBay long enough to pull the scammers link. I emailed eBay within 5 mins. of getting it. I can only imagine how many people got sucked into it. BTW I rec'd no official response back from eBay acknowledging they even rec'd my complaint. No safeharbour email, nada.

Cladiator · March 18, 2007 8:47PM

The interesting thing about this one is it went both to my personal email address associated with my eBay account AND my "My eBay" page. eBay has always said that messages that appear in "My eBay" are legit. Sure didn't look legit to me.

ebaytrader · March 18, 2007 10:36PM

As a protection, we use Compter Associates E-Trust Firewall. Why? The firewall prevents us from sending our eBay login info to any site other than eBay.com. Ingenious. E-Trust was highly recommended to us by people that need security in a big way and I highly recommend it to others. Their security suite is second to none and runs much better and smoother than Norton.

Barry · March 18, 2007 11:01PM

Seems to me all Ebay needs to do to nip this one in the bud is prohibit scripts on the MyEbay page, just like they prohibit html in various places.

pharmer · March 19, 2007 3:11AM

I'm not sure what is sophisticated about it. Not being computer savvy like you folks, I can't understand the nuances of the coding stuff, but it seems that responding to "look at what this guy is saying about you" from a complete stranger is the polar opposite of sophisticated

Proofquarter · March 19, 2007 8:59AM

Am I the only one using the Pay Pal security key? One time charge of $5. and you can also use it to log in to Ebay. Changes the number everytime you log in.

ARCO · March 19, 2007 9:11AM

This is the same phishing scam that got me on Sunday. You get an Ebay message within Ebay, that asks some question. You go to the link, which looks like an Ebay link and are then prompted to enter in a login and password (another common Ebay request). However, the link is fraudulent.

Forum Scam thread.

Tyler

Russ · March 19, 2007 9:21AM

<< However, the link is fraudulent. >>

The link is not fraudulent. It is, in fact, a legitimate eBay URL. That's why normal safety precautions such as software or browsers and plugins that detect bogus links will not work. It is important that those who use those types of methods thinking they are safe realize this.

The page itself is fraudulent.

Russ, NCNE

Proofquarter · March 19, 2007 9:31AM

Security key gives someone less then 30 seconds to log in to your account before the password is changed if you give it to a fraud site.

Warning to all: Most sophisticated eBay scam yet?

Comments

Leave a Comment