Warning on Clever Ebay phishing scam

Frankcoins · May 29, 2011 5:58AM

I received this email today:

From: "eBay Member: ronnieboy" <ronnieboy_hu6849net@members.ebay.com>
Reply-To: ronnieboy_hu6849net@members.ebay.com
To: frank@frankcoins.com
Subject: Re: Other: ronnieboy sent a message about 1904 Liberty $20 Gold NGC MS64 #110692675598

Hello Frankcoins

I have been on your auction : http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=110692675598

1904 Liberty $20 Gold NGC MS64
and I want to bid on your and something is wrong because when i try to find out how much is the shipping United Kingdom it shows 2899$ which is the starting price.
Please e-mail me back with the shipping costs .

Thanks !

The first thing I did was clink on the Link to look at my auction, and the Ebay login screen appeared. But the Link actually goes to http://www.rogatica.net/album/themes/engines/phptemplate/awut/
which is a fake ebay login site.

I almost fell for it since it referenced my ebay name, a valid item and item number that I currently have for sale.

It raised my suspicion that they formatted the dollar amount as 2899$ instead of $2899, otherwise I most likely would have been victimized.

kaz · May 29, 2011 6:00AM

Wow! Good thing you had your guard up.

notwilight · May 29, 2011 6:02AM

I got it yesterday, however, I got 6 copies of the same email so I knew it was a scam and didn't look at it. My shipping amount was supposedly $400. Often I will investigate these just as you have to warn others. good job. --Jerry

Frankcoins · May 29, 2011 6:12AM

I have received the $400 emails, but it didn't reference a valid item I was selling and those went to http://krulalubovi.com.ua/plugins/banner_menu/languages/

Looks like somebody took the idea and refined it.

Walkerguy21D · May 29, 2011 6:22AM

Just curious what were they attempting to do, and how might have you been victimized?
I'm familiar with those phish scams that ask to verify bank account or credit card numbers, but the example posted here is new one to me.

MsMorrisine · May 29, 2011 6:25AM

once the login and password are obtained, they can hijack the account and potentially the associated paypal account if both the passwords are the same and they can figure out the e-mail address.

Walkerguy21D · May 29, 2011 6:39AM

They can get to your login and password info by replying to an email? That sounds pretty scary.

MsMorrisine · May 29, 2011 6:47AM

no.

they send an e-mail that contains a link to a site they set up to look like an eBay login page.

look up eBay phishing scams and you'll learn more about what they are trying to do.

Walkerguy21D · May 29, 2011 6:55AM

Ok, that I understand - thanks!

Frankcoins · May 29, 2011 6:57AM

Once they have your ebay password, they can list fakes or simply stolen photos of expensive coins, redirect the money to themselves, ruining the
reputation of the victim.

Or they can change your buy it now price from $1000 to $100 and then have an associate buy it. Or place
a low starting bid on something then end the auction early with sale to the current bidder.

Many large volume sellers would not likely notice it.

coinhunters · May 29, 2011 7:17AM

Thankfully, I no longer sell on EBAY.

Wingsrule · May 29, 2011 7:37AM

Just another reason to 'verify' the message is legit by logging into ebay from their home page, not any kind of link. If I get an ebay-related email that does not come through ebay, it gets ignored (other than a pending deal).

derryb · May 29, 2011 8:16AM

Scammer doesn't need or really want the associated paypal account login info. He/she can use the hijacked ebay account to sell bogus goods and have the funds sent to any paypal account, including a valid one that he/she has full control over. If ebay were smart they would only allow proceeds of the sale to go to the one and only paypal account associated with the ebay account. A bit harder for scammer to get your ebay and paypal account login info. To make it tougher paypal should not allow bank accounts to be changed once a paypal account is created. This way a paypal account hijacker could only send his proceeds to YOUR bank account. A change in bank account info should require a new paypal account after the first one is closed.

derryb · May 29, 2011 8:19AM

<< Ok, that I understand - thanks! >>

Never log in to any account of any type from an official looking email. Always loging from the account's website. A lot of credit card and bank accounts are compromised this same way with some very official looking phishing emails.

GrumpyEd · May 29, 2011 8:31AM

Ebay and paypal also send emails with links to sign in.
They should never put a sign in link in their official messages, they should tell you to sign into your account to do whatever they want. By not doing it that way they're training people to use links in emails and some victims don't look to see where the links direct them to.

Keep on guard!

RobertS · May 29, 2011 8:39AM

I received a similar email about a year ago, I fell for the link and logged into the account, not looking at the URL. Right after trying to log in it will re-direct you to the real ebay log in, 30 seconds latter I realized what had happened, went to ebay, changed my password and all has been good. Fortunately the scammers did not have a boot to log in and change the password of the user as soon as they get the ebay log in credentials. Needless to say I had a little fun afterwards by logging to their link and using creative username and password combinations... I thik I reported the link to ebay and it was taken offline in less than 24 hours.

Thank you for letting others know about the scam!!!

keets · May 29, 2011 8:44AM

i thought it was general knowledge NOT to use a link contained in an e-mail??? shame on you Frank, you'd have had noone to blame but yourself.

for everyone else out there, never, never, never ever use a link in an e-mail.

Rampage · May 29, 2011 9:08AM

<< i thought it was general knowledge NOT to use a link contained in an e-mail??? shame on you Frank, you'd have had noone to blame but yourself.

for everyone else out there, never, never, never ever use a link in an e-mail. >>

Well, really, if an email comes from eBay, or a member of eBay, it will show up in your eBay inbox. So, if I ever get a questionable email (which is very rare), then I always check my eBay inbox for verification.

BAJJERFAN · May 29, 2011 9:14AM

<< I received this email today:

From: "eBay Member: ronnieboy" <ronnieboy_hu6849net@members.ebay.com>
Reply-To: ronnieboy_hu6849net@members.ebay.com
To: frank@frankcoins.com
Subject: Re: Other: ronnieboy sent a message about 1904 Liberty $20 Gold NGC MS64 #110692675598

Hello Frankcoins

I have been on your auction : http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=110692675598

1904 Liberty $20 Gold NGC MS64
and I want to bid on your and something is wrong because when i try to find out how much is the shipping United Kingdom it shows 2899$ which is the starting price.
Please e-mail me back with the shipping costs .

Thanks !

The first thing I did was clink on the Link to look at my auction, and the Ebay login screen appeared. But the Link actually goes to http://www.rogatica.net/album/themes/engines/phptemplate/awut/
which is a fake ebay login site.

I almost fell for it since it referenced my ebay name, a valid item and item number that I currently have for sale.

It raised my suspicion that they formatted the dollar amount as 2899$ instead of $2899, otherwise I most likely would have been victimized. >>

nfm

Bobbo50 · May 29, 2011 9:33AM

<< i thought it was general knowledge NOT to use a link contained in an e-mail??? shame on you Frank, you'd have had noone to blame but yourself.
for everyone else out there, never, never, never ever use a link in an e-mail. >>

SamByrd · May 29, 2011 11:25AM

good looking out Frank.

OPA · May 29, 2011 11:32AM

<< Ebay and paypal also send emails with links to sign in.
They should never put a sign in link in their official messages, they should tell you to sign into your account to do whatever they want. By not doing it that way they're training people to use links in emails and some victims don't look to see where the links direct them to.

Keep on guard! >>

Really?

Frankcoins · May 29, 2011 11:58AM

<< i thought it was general knowledge NOT to use a link contained in an e-mail??? shame on you Frank, you'd have had noone to blame but yourself.

for everyone else out there, never, never, never ever use a link in an e-mail. >>

Why does eBay encourage this by sending end of auction notices with SIXTEEN links?

-----------------------------------------------------------------
eBay sent this message to Frank Provasek (frankcoins).
Your registered name is included to show this message originated from eBay.
Learn more at http://pages.ebay.com/help/confidence/name-userid-emails.html
-----------------------------------------------------------------

-----------------------------------------------------------------
Congratulations, your item sold!
-----------------------------------------------------------------

Dear frankcoins,
You did it! Your item sold. You agreed to ship this item to the buyer
within 2 business day(s) after receiving cleared payment. Once your buyer
pays for the item, promptly ship the item and follow the guidelines below
to ensure buyer satisfaction.

Print a shipping label
http://rover.ebay.com/rover/0/e12011.m354.l1337/7?euid=e3d665ed888d47d1a7b70dcc64a85eb7&loc=http://payments.ebay.com/ws/eBayISAPI.dll?PrintPostage&transactionid=0&itemid=190536279951&ssPageName=ADME:L:EOISSA:US:1337. Avoid a trip to the post office, print and pay for your label at home. Printing shipping labels on eBay also offers you reduced pricing on some shipping services, and when you print shipping labels on eBay, your tracking information is uploaded automatically.

- Provide shipping and tracking information
http://rover.ebay.com/rover/0/e12011.m354.l1663/7?euid=e3d665ed888d47d1a7b70dcc64a85eb7&loc=http://payments.ebay.com/ws/eBayISAPI.dll?AddTrackingNumber2&flow=myebay&LineID=190536279951_0&ssPageName=ADME:L:EOISSA:US:1663. When you upload tracking information to eBay, we'll send it to your buyer and let them know the item is on its way. This will save you time, and may result in fewer questions from buyers and higher detailed seller ratings.

- Mark your item as shipped in My eBay
http://rover.ebay.com/rover/0/e12011.m354.l1662/7?euid=e3d665ed888d47d1a7b70dcc64a85eb7&loc=http://my.ebay.com/ws/eBayISAPI.dll?MyEbayBeta&CurrentPage=MyeBayNextSold&ssPageName=ADME:L:EOISSA:US:1662.

Do this, and we'll let your buyer know the item is on its way. This will save you time, and may result in fewer questions from buyers and higher detailed seller ratings.

You should always leave feedback
http://rover.ebay.com/rover/0/e12011.m354.l1332/7?euid=e3d665ed888d47d1a7b70dcc64a85eb7&loc=http://feedback.ebay.com/ws/eBayISAPI.dll?LeaveFeedback2&show_as=sold&ssPageName=ADME:L:EOISSA:US:1332 for your buyer to encourage them to buy from you again.

=================================================================
Provide shipping information
http://rover.ebay.com/rover/0/e12011.m44.l1121/7?euid=e3d665ed888d47d1a7b70dcc64a85eb7&loc=http://my.ebay.com/ws/eBayISAPI.dll?MyeBay&CurrentPage=MyeBaySold&ssPageName=ADME:L:EOISSA:US:1121
=================================================================

Item name: One Ounce .999 pure Silver Universaro Round
http://rover.ebay.com/rover/0/e12011.m43.l1123/7?euid=e3d665ed888d47d1a7b70dcc64a85eb7&loc=http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=190536279951&ssPageName=ADME:L:EOISSA:US:1123
Sale price: $41.69
Quantity sold: 1
Sale date: May-25-11 16:19:03 PDT
Buyer: xxxxxxx

xxxxxxxx (mailto: xxxxxxxx@yahoo.com) contact:

http://contact.ebay.com/ws/eBayISAPI.dll?ReturnUserEmail&requested=xxxxxxxx&redirect=0&iid=190536279951
Buyer's shipping address:
xxxxxxxxxxxxx
xxxx Dr
xxxxxx United States

Your eBay item sold! One Ounce .999 pure Silver Universaro Round
(190536279951)

-----------------------------------------------------------------
Select your email preferences
-----------------------------------------------------------------

Want to reduce your inbox email volume? Receive this email as a daily
digest http://my.ebay.com/ws/eBayISAPI.dll?DigestEmail&emailType=12011.

For other email digest options, go to Notification Preferences
http://my.ebay.com/ws/eBayISAPI.dll?MyEbayBeta&CurrentPage=MyeBayNextNotificationPreferences in My eBay.

Don't want to receive this email? Unsubscribe from this email
http://my.ebay.com/ws/eBayISAPI.dll?EmailUnsubscribe&emailType=12011.

-----------------------------------------------------------------
Email reference id: [#e3d665ed888d47d1a7b70dcc64a85eb7#]
-----------------------------------------------------------------

Please don't remove this number. eBay customer support may ask you for this
number, if you should need assistance.
-----------------------------------------------------------------
-----------------------------------------------------------------
Learn how you can protect yourself from spoof (fake) emails at:
http://pages.ebay.com/education/spooftutorial/index.html.

eBay sent this email to you at frank@frankcoins.com about your account
registered on http://www.ebay.com.

eBay sends these emails based on the preferences you set for your account.
To unsubscribe from this email, change your communication preferences at

http://my.ebay.com/ws/eBayISAPI.dll?MyEbayBeta&CurrentPage=MyeBayNextNotificationPreferences.

Please note that it may take up to 10 days to process your request.
Visit our Privacy Policy at http://pages.ebay.com/help/policies/privacy-policy.html

and User Agreement at http://pages.ebay.com/help/policies/user-agreement.html if you have any questions.

Bobbo50 · May 29, 2011 1:32PM

Frank, maybe your problem is you can't tell a phishing letter from an eBay generated EOA letter.
I could have my grandson explain it to you if you'd like.

EurekaGold · May 29, 2011 2:20PM

Sell your computer, Frank.... It's too dangerous for you, or perhaps vice versa.

Frankcoins · May 29, 2011 3:07PM

<< Frank, maybe your problem is you can't tell a phishing letter from an eBay generated EOA letter.
I could have my grandson explain it to you if you'd like. >>

I am WARNING people about a phishing letter. The eBay end of auction letter was to show
how eBay encourages its users to rely on links.

Frankcoins · May 29, 2011 3:09PM

<< Sell your computer, Frank.... It's too dangerous for you, or perhaps vice versa. >>

I posted a warning for the benefit of others. I have been using computers since they
were paper TTY terminals hooked to to a mainframe with acoustic modems...like back in 1975.

Frankcoins · May 29, 2011 4:48PM

<< I got it yesterday, however, I got 6 copies of the same email so I knew it was a scam and didn't look at it. My shipping amount was supposedly $400. Often I will investigate these just as you have to warn others. good job. --Jerry >>

Looks like Ebay didn't appreciate me warning the members of the eBay Coin and Paper Money Discussion Board...
(of course, it matters not that I posted no user's contact information or email address)

Hello frankcoins,

We appreciate your participation in the eBay Community Forums. This email is to
notify you that we are revoking all privileges for posting in eBay Discussion
Boards, Chat Boards, and the Answer Center for a period of thirty (30) days, for posting
the following:

I wanted to warn everyone about a phishing email that seemed legit since it
used my name and details from an actual auction I am running:

Subject: Re: Other: ronnieboy
sent a message about 1904 Liberty $20 Gold NGC MS64
#110692675598

Hello Frankcoins

I
have been on your auction : <a href="http://cgi.ebay.
com/ws/eBayISAPI.dll?ViewItem&item=110692675598" target="
_blank" rel="nofollow">Link</a>

1904 Liberty $20
Gold NGC MS64
and I want to bid on your and something
is wrong because when i try to find out how much is the
shipping United Kingdom it shows 2899$ which is the starting
price.
Please e-mail me back with the shipping costs .

Thanks !

The first thing I did was
clink on the Link to look at my auction, and the Ebay
login screen appeared. But the Link actually goes to <a
href="http://www.rogatica.
net/album/themes/engines/phptemplate/awut/" target="
_blank" rel="nofollow">Link</a>
which is a fake
ebay login site.

I almost fell for it since
it referenced my ebay name, a valid item and item number
that I currently have for sale.

It raised my
suspicion that they formatted the dollar amount as 2899$
instead of $2899, otherwise I most likely would have been
victimized.

Your post was removed for the following reason:

Including another individual's contact information and/or email address in a
post. For clarification of this policy, please visit this page:
http://forums.ebay.com/db2/thread.jspa?threadID=410492039

During this sanction, you may continue to bid and list, and you will be able to
start posting again after 30 days. However, it is important that you do not
register and/or use an alternate User ID to post on or sign into any eBay
Discussion Board, Chat Board, or the Answer Center during this sanction. Doing
so is a violation of the terms of this sanction, the Board Usage Policy, and the
eBay User Agreement, and can lead to an indefinite sanction of your account(s)
and/or a suspension of your eBay account(s), which removes your buying and
selling privileges.

Once your board sanction is over, we respectfully request that your future board
activities comply with our guidelines

Thank you in advance for your cooperation in this important matter.

Again, we value your participation in the forums, and we appreciate your support.

Regards,
Azarel
eBay Moderation Team

itsnotjustme · May 29, 2011 8:37PM

THis would be termed "Spear Phishing", as it used information directly related to you and your activities to make the e-mail appear much more legitimate. As a good practice, always use your own bookmarks or type in the URL directly to reach sites vs. following links provided to you. If a spear phisher obtains enough information about you, they can develop very convincing e-mails or other targetted attacks.

Glad you caught this before they hacked your e-bay account.

itsnotjustme · May 29, 2011 8:43PM

There are more ways to get people's PayPal funds than sending to a bank account. Fund balances can be used to pay for items, as can the attached credit cards and bank accounts.

Scary when you think about it.

ebaytrader · May 29, 2011 9:57PM

FeePay is a cesspool.

<< 

<< I got it yesterday, however, I got 6 copies of the same email so I knew it was a scam and didn't look at it. My shipping amount was supposedly $400. Often I will investigate these just as you have to warn others. good job. --Jerry >>

Looks like Ebay didn't appreciate me warning the members of the eBay Coin and Paper Money Discussion Board...
(of course, it matters not that I posted no user's contact information or email address)

Hello frankcoins,

We appreciate your participation in the eBay Community Forums. This email is to
notify you that we are revoking all privileges for posting in eBay Discussion
Boards, Chat Boards, and the Answer Center for a period of thirty (30) days, for posting
the following:

I wanted to warn everyone about a phishing email that seemed legit since it
used my name and details from an actual auction I am running:

Subject: Re: Other: ronnieboy
sent a message about 1904 Liberty $20 Gold NGC MS64
#110692675598

Hello Frankcoins

I
have been on your auction : com/ws/eBayISAPI.dll?ViewItem&item=110692675598" target="
_blank" rel="nofollow">Link

1904 Liberty $20
Gold NGC MS64
and I want to bid on your and something
is wrong because when i try to find out how much is the
shipping United Kingdom it shows 2899$ which is the starting
price.
Please e-mail me back with the shipping costs .

Thanks !

The first thing I did was
clink on the Link to look at my auction, and the Ebay
login screen appeared. But the Link actually goes to <a
href="http://www.rogatica.
net/album/themes/engines/phptemplate/awut/" target="
_blank" rel="nofollow">Link
which is a fake
ebay login site.

I almost fell for it since
it referenced my ebay name, a valid item and item number
that I currently have for sale.

It raised my
suspicion that they formatted the dollar amount as 2899$
instead of $2899, otherwise I most likely would have been
victimized.

Your post was removed for the following reason:

Including another individual's contact information and/or email address in a
post. For clarification of this policy, please visit this page:
http://forums.ebay.com/db2/thread.jspa?threadID=410492039

During this sanction, you may continue to bid and list, and you will be able to
start posting again after 30 days. However, it is important that you do not
register and/or use an alternate User ID to post on or sign into any eBay
Discussion Board, Chat Board, or the Answer Center during this sanction. Doing
so is a violation of the terms of this sanction, the Board Usage Policy, and the
eBay User Agreement, and can lead to an indefinite sanction of your account(s)
and/or a suspension of your eBay account(s), which removes your buying and
selling privileges.

Once your board sanction is over, we respectfully request that your future board
activities comply with our guidelines

Thank you in advance for your cooperation in this important matter.

Again, we value your participation in the forums, and we appreciate your support.

Regards,
Azarel
eBay Moderation Team >>

REALGATOR · May 29, 2011 10:10PM

I only accept bids from the US. I havent had any issues since. Certainly not a total fix but it helps. Unless you sell foreign coins you will not receive many bids outside the US anyway.

Of course when you are buying thats a whole other matter.

Walkerguy21D · May 29, 2011 10:13PM

Incredible - Ebay penalizes a long time user in good standing, for warning others about someone who is merely using the info in their website to launch electronic piracy attacks! I can see their rules for protecting against libelous claims, but in this case they can quickly check it out and see for themselves.....another example of getting punished for doing a good deed, IMO.

Barry · May 29, 2011 10:42PM

Looks like Ebay didn't appreciate me warning the members of the eBay Coin and Paper Money Discussion Board... (of course, it matters not that I posted no user's contact information or email address)

That's incredible. I, too, am glad I stopped selling on that cesspool of fakes and scammers they call Ebay.

P.S. Frank, you can quote me on this in your reply to Ebay.

RobertS · May 30, 2011 12:20AM

Hey frank, ignore the people that are beyond help. I am sure many more than the people that have posted are thankful for your warning!!! Based to some of the replies to this thread and others I am starting to believe that something is seriously wrong with the inner workings of some peoples brain. Just seem unreal on how they read something and when they reply they butcher it into something else, I hope this is not contagious.

Hey there is an idea, maybe i can begin a case study!!! Tittle would be;

The Inner Working's of a collectors mind...

Frankcoins · May 30, 2011 1:10AM

<< THis would be termed "Spear Phishing", as it used information directly related to you and your activities to make the e-mail appear much more legitimate. As a good practice, always use your own bookmarks or type in the URL directly to reach sites vs. following links provided to you. If a spear phisher obtains enough information about you, they can develop very convincing e-mails or other targetted attacks.

Glad you caught this before they hacked your e-bay account. >>

What's odd is, that I am almost always logged into eBay, so a genuine eBay link would have worked without needing to log in.

But for some reason, the past few weeks (apparently thinking it INCREASES security) I have been asked to log in to eBay every few
hours even though I have the "keep me logged in" box checked. So this log on request in the phish seemed MORE NORMAL.

Warning on Clever Ebay phishing scam

Comments

Leave a Comment