Options
Warning on Clever Ebay phishing scam

I received this email today:
From: "eBay Member: ronnieboy" <ronnieboy_hu6849net@members.ebay.com>
Reply-To: ronnieboy_hu6849net@members.ebay.com
To: frank@frankcoins.com
Subject: Re: Other: ronnieboy sent a message about 1904 Liberty $20 Gold NGC MS64 #110692675598
Hello Frankcoins
I have been on your auction : http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=110692675598
1904 Liberty $20 Gold NGC MS64
and I want to bid on your and something is wrong because when i try to find out how much is the shipping United Kingdom it shows 2899$ which is the starting price.
Please e-mail me back with the shipping costs .
Thanks !
The first thing I did was clink on the Link to look at my auction, and the Ebay login screen appeared. But the Link actually goes to http://www.rogatica.net/album/themes/engines/phptemplate/awut/
which is a fake ebay login site.
I almost fell for it since it referenced my ebay name, a valid item and item number that I currently have for sale.
It raised my suspicion that they formatted the dollar amount as 2899$ instead of $2899, otherwise I most likely would have been victimized.
From: "eBay Member: ronnieboy" <ronnieboy_hu6849net@members.ebay.com>
Reply-To: ronnieboy_hu6849net@members.ebay.com
To: frank@frankcoins.com
Subject: Re: Other: ronnieboy sent a message about 1904 Liberty $20 Gold NGC MS64 #110692675598
Hello Frankcoins
I have been on your auction : http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=110692675598
1904 Liberty $20 Gold NGC MS64
and I want to bid on your and something is wrong because when i try to find out how much is the shipping United Kingdom it shows 2899$ which is the starting price.
Please e-mail me back with the shipping costs .
Thanks !
The first thing I did was clink on the Link to look at my auction, and the Ebay login screen appeared. But the Link actually goes to http://www.rogatica.net/album/themes/engines/phptemplate/awut/
which is a fake ebay login site.
I almost fell for it since it referenced my ebay name, a valid item and item number that I currently have for sale.
It raised my suspicion that they formatted the dollar amount as 2899$ instead of $2899, otherwise I most likely would have been victimized.
Frank Provasek - PCGS Authorized Dealer, Life Member ANA, Member TNA. www.frankcoins.com
0
Comments
Looks like somebody took the idea and refined it.
I'm familiar with those phish scams that ask to verify bank account or credit card numbers, but the example posted here is new one to me.
they send an e-mail that contains a link to a site they set up to look like an eBay login page.
look up eBay phishing scams and you'll learn more about what they are trying to do.
reputation of the victim.
Or they can change your buy it now price from $1000 to $100 and then have an associate buy it. Or place
a low starting bid on something then end the auction early with sale to the current bidder.
Many large volume sellers would not likely notice it.
No Way Out: Stimulus and Money Printing Are the Only Path Left
<< <i>Ok, that I understand - thanks! >>
Never log in to any account of any type from an official looking email. Always loging from the account's website. A lot of credit card and bank accounts are compromised this same way with some very official looking phishing emails.
No Way Out: Stimulus and Money Printing Are the Only Path Left
They should never put a sign in link in their official messages, they should tell you to sign into your account to do whatever they want. By not doing it that way they're training people to use links in emails and some victims don't look to see where the links direct them to.
Keep on guard!
Thank you for letting others know about the scam!!!
for everyone else out there, never, never, never ever use a link in an e-mail.
<< <i>i thought it was general knowledge NOT to use a link contained in an e-mail??? shame on you Frank, you'd have had noone to blame but yourself.
for everyone else out there, never, never, never ever use a link in an e-mail. >>
Well, really, if an email comes from eBay, or a member of eBay, it will show up in your eBay inbox. So, if I ever get a questionable email (which is very rare), then I always check my eBay inbox for verification.
<< <i>I received this email today:
From: "eBay Member: ronnieboy" <ronnieboy_hu6849net@members.ebay.com>
Reply-To: ronnieboy_hu6849net@members.ebay.com
To: frank@frankcoins.com
Subject: Re: Other: ronnieboy sent a message about 1904 Liberty $20 Gold NGC MS64 #110692675598
Hello Frankcoins
I have been on your auction : http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=110692675598
1904 Liberty $20 Gold NGC MS64
and I want to bid on your and something is wrong because when i try to find out how much is the shipping United Kingdom it shows 2899$ which is the starting price.
Please e-mail me back with the shipping costs .
Thanks !
The first thing I did was clink on the Link to look at my auction, and the Ebay login screen appeared. But the Link actually goes to http://www.rogatica.net/album/themes/engines/phptemplate/awut/
which is a fake ebay login site.
I almost fell for it since it referenced my ebay name, a valid item and item number that I currently have for sale.
It raised my suspicion that they formatted the dollar amount as 2899$ instead of $2899, otherwise I most likely would have been victimized. >>
nfm
<< <i>i thought it was general knowledge NOT to use a link contained in an e-mail??? shame on you Frank, you'd have had noone to blame but yourself.
for everyone else out there, never, never, never ever use a link in an e-mail. >>
<< <i>Ebay and paypal also send emails with links to sign in.
They should never put a sign in link in their official messages, they should tell you to sign into your account to do whatever they want. By not doing it that way they're training people to use links in emails and some victims don't look to see where the links direct them to.
Keep on guard! >>
Really?
<< <i>i thought it was general knowledge NOT to use a link contained in an e-mail??? shame on you Frank, you'd have had noone to blame but yourself.
for everyone else out there, never, never, never ever use a link in an e-mail. >>
Why does eBay encourage this by sending end of auction notices with SIXTEEN links?
-----------------------------------------------------------------
eBay sent this message to Frank Provasek (frankcoins).
Your registered name is included to show this message originated from eBay.
Learn more at http://pages.ebay.com/help/confidence/name-userid-emails.html
-----------------------------------------------------------------
-----------------------------------------------------------------
Congratulations, your item sold!
-----------------------------------------------------------------
Dear frankcoins,
You did it! Your item sold. You agreed to ship this item to the buyer
within 2 business day(s) after receiving cleared payment. Once your buyer
pays for the item, promptly ship the item and follow the guidelines below
to ensure buyer satisfaction.
Print a shipping label
http://rover.ebay.com/rover/0/e12011.m354.l1337/7?euid=e3d665ed888d47d1a7b70dcc64a85eb7&loc=http://payments.ebay.com/ws/eBayISAPI.dll?PrintPostage&transactionid=0&itemid=190536279951&ssPageName=ADME:L:EOISSA:US:1337. Avoid a trip to the post office, print and pay for your label at home. Printing shipping labels on eBay also offers you reduced pricing on some shipping services, and when you print shipping labels on eBay, your tracking information is uploaded automatically.
- Provide shipping and tracking information
http://rover.ebay.com/rover/0/e12011.m354.l1663/7?euid=e3d665ed888d47d1a7b70dcc64a85eb7&loc=http://payments.ebay.com/ws/eBayISAPI.dll?AddTrackingNumber2&flow=myebay&LineID=190536279951_0&ssPageName=ADME:L:EOISSA:US:1663. When you upload tracking information to eBay, we'll send it to your buyer and let them know the item is on its way. This will save you time, and may result in fewer questions from buyers and higher detailed seller ratings.
- Mark your item as shipped in My eBay
http://rover.ebay.com/rover/0/e12011.m354.l1662/7?euid=e3d665ed888d47d1a7b70dcc64a85eb7&loc=http://my.ebay.com/ws/eBayISAPI.dll?MyEbayBeta&CurrentPage=MyeBayNextSold&ssPageName=ADME:L:EOISSA:US:1662.
Do this, and we'll let your buyer know the item is on its way. This will save you time, and may result in fewer questions from buyers and higher detailed seller ratings.
You should always leave feedback
http://rover.ebay.com/rover/0/e12011.m354.l1332/7?euid=e3d665ed888d47d1a7b70dcc64a85eb7&loc=http://feedback.ebay.com/ws/eBayISAPI.dll?LeaveFeedback2&show_as=sold&ssPageName=ADME:L:EOISSA:US:1332 for your buyer to encourage them to buy from you again.
=================================================================
Provide shipping information
http://rover.ebay.com/rover/0/e12011.m44.l1121/7?euid=e3d665ed888d47d1a7b70dcc64a85eb7&loc=http://my.ebay.com/ws/eBayISAPI.dll?MyeBay&CurrentPage=MyeBaySold&ssPageName=ADME:L:EOISSA:US:1121
=================================================================
Item name: One Ounce .999 pure Silver Universaro Round
http://rover.ebay.com/rover/0/e12011.m43.l1123/7?euid=e3d665ed888d47d1a7b70dcc64a85eb7&loc=http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=190536279951&ssPageName=ADME:L:EOISSA:US:1123
Sale price: $41.69
Quantity sold: 1
Sale date: May-25-11 16:19:03 PDT
Buyer: xxxxxxx
xxxxxxxx (mailto: xxxxxxxx@yahoo.com) contact:
http://contact.ebay.com/ws/eBayISAPI.dll?ReturnUserEmail&requested=xxxxxxxx&redirect=0&iid=190536279951
Buyer's shipping address:
xxxxxxxxxxxxx
xxxx Dr
xxxxxx United States
Your eBay item sold! One Ounce .999 pure Silver Universaro Round
(190536279951)
-----------------------------------------------------------------
Select your email preferences
-----------------------------------------------------------------
Want to reduce your inbox email volume? Receive this email as a daily
digest http://my.ebay.com/ws/eBayISAPI.dll?DigestEmail&emailType=12011.
For other email digest options, go to Notification Preferences
http://my.ebay.com/ws/eBayISAPI.dll?MyEbayBeta&CurrentPage=MyeBayNextNotificationPreferences in My eBay.
Don't want to receive this email? Unsubscribe from this email
http://my.ebay.com/ws/eBayISAPI.dll?EmailUnsubscribe&emailType=12011.
-----------------------------------------------------------------
Email reference id: [#e3d665ed888d47d1a7b70dcc64a85eb7#]
-----------------------------------------------------------------
Please don't remove this number. eBay customer support may ask you for this
number, if you should need assistance.
-----------------------------------------------------------------
-----------------------------------------------------------------
Learn how you can protect yourself from spoof (fake) emails at:
http://pages.ebay.com/education/spooftutorial/index.html.
eBay sent this email to you at frank@frankcoins.com about your account
registered on http://www.ebay.com.
eBay sends these emails based on the preferences you set for your account.
To unsubscribe from this email, change your communication preferences at
http://my.ebay.com/ws/eBayISAPI.dll?MyEbayBeta&CurrentPage=MyeBayNextNotificationPreferences.
Please note that it may take up to 10 days to process your request.
Visit our Privacy Policy at http://pages.ebay.com/help/policies/privacy-policy.html
and User Agreement at http://pages.ebay.com/help/policies/user-agreement.html if you have any questions.
I could have my grandson explain it to you if you'd like.
<< <i>Frank, maybe your problem is you can't tell a phishing letter from an eBay generated EOA letter.
I could have my grandson explain it to you if you'd like. >>
I am WARNING people about a phishing letter. The eBay end of auction letter was to show
how eBay encourages its users to rely on links.
<< <i>Sell your computer, Frank.... It's too dangerous for you, or perhaps vice versa. >>
I posted a warning for the benefit of others. I have been using computers since they
were paper TTY terminals hooked to to a mainframe with acoustic modems...like back in 1975.
<< <i>I got it yesterday, however, I got 6 copies of the same email so I knew it was a scam and didn't look at it. My shipping amount was supposedly $400. Often I will investigate these just as you have to warn others. good job. --Jerry >>
Looks like Ebay didn't appreciate me warning the members of the eBay Coin and Paper Money Discussion Board...
(of course, it matters not that I posted no user's contact information or email address)
Hello frankcoins,
We appreciate your participation in the eBay Community Forums. This email is to
notify you that we are revoking all privileges for posting in eBay Discussion
Boards, Chat Boards, and the Answer Center for a period of thirty (30) days, for posting
the following:
I wanted to warn everyone about a phishing email that seemed legit since it
used my name and details from an actual auction I am running:
Subject: Re: Other: ronnieboy
sent a message about 1904 Liberty $20 Gold NGC MS64
#110692675598
Hello Frankcoins
I
have been on your auction : <a href="http://cgi.ebay.
com/ws/eBayISAPI.dll?ViewItem&item=110692675598" target="
_blank" rel="nofollow">Link</a>
1904 Liberty $20
Gold NGC MS64
and I want to bid on your and something
is wrong because when i try to find out how much is the
shipping United Kingdom it shows 2899$ which is the starting
price.
Please e-mail me back with the shipping costs .
Thanks !
The first thing I did was
clink on the Link to look at my auction, and the Ebay
login screen appeared. But the Link actually goes to <a
href="http://www.rogatica.
net/album/themes/engines/phptemplate/awut/" target="
_blank" rel="nofollow">Link</a>
which is a fake
ebay login site.
I almost fell for it since
it referenced my ebay name, a valid item and item number
that I currently have for sale.
It raised my
suspicion that they formatted the dollar amount as 2899$
instead of $2899, otherwise I most likely would have been
victimized.
Your post was removed for the following reason:
Including another individual's contact information and/or email address in a
post. For clarification of this policy, please visit this page:
http://forums.ebay.com/db2/thread.jspa?threadID=410492039
During this sanction, you may continue to bid and list, and you will be able to
start posting again after 30 days. However, it is important that you do not
register and/or use an alternate User ID to post on or sign into any eBay
Discussion Board, Chat Board, or the Answer Center during this sanction. Doing
so is a violation of the terms of this sanction, the Board Usage Policy, and the
eBay User Agreement, and can lead to an indefinite sanction of your account(s)
and/or a suspension of your eBay account(s), which removes your buying and
selling privileges.
Once your board sanction is over, we respectfully request that your future board
activities comply with our guidelines
Thank you in advance for your cooperation in this important matter.
Again, we value your participation in the forums, and we appreciate your support.
Regards,
Azarel
eBay Moderation Team
Glad you caught this before they hacked your e-bay account.
Scary when you think about it.
<< <i>
<< <i>I got it yesterday, however, I got 6 copies of the same email so I knew it was a scam and didn't look at it. My shipping amount was supposedly $400. Often I will investigate these just as you have to warn others. good job. --Jerry >>
Looks like Ebay didn't appreciate me warning the members of the eBay Coin and Paper Money Discussion Board...
(of course, it matters not that I posted no user's contact information or email address)
Hello frankcoins,
We appreciate your participation in the eBay Community Forums. This email is to
notify you that we are revoking all privileges for posting in eBay Discussion
Boards, Chat Boards, and the Answer Center for a period of thirty (30) days, for posting
the following:
I wanted to warn everyone about a phishing email that seemed legit since it
used my name and details from an actual auction I am running:
Subject: Re: Other: ronnieboy
sent a message about 1904 Liberty $20 Gold NGC MS64
#110692675598
Hello Frankcoins
I
have been on your auction : com/ws/eBayISAPI.dll?ViewItem&item=110692675598" target="
_blank" rel="nofollow">Link
1904 Liberty $20
Gold NGC MS64
and I want to bid on your and something
is wrong because when i try to find out how much is the
shipping United Kingdom it shows 2899$ which is the starting
price.
Please e-mail me back with the shipping costs .
Thanks !
The first thing I did was
clink on the Link to look at my auction, and the Ebay
login screen appeared. But the Link actually goes to <a
href="http://www.rogatica.
net/album/themes/engines/phptemplate/awut/" target="
_blank" rel="nofollow">Link
which is a fake
ebay login site.
I almost fell for it since
it referenced my ebay name, a valid item and item number
that I currently have for sale.
It raised my
suspicion that they formatted the dollar amount as 2899$
instead of $2899, otherwise I most likely would have been
victimized.
Your post was removed for the following reason:
Including another individual's contact information and/or email address in a
post. For clarification of this policy, please visit this page:
http://forums.ebay.com/db2/thread.jspa?threadID=410492039
During this sanction, you may continue to bid and list, and you will be able to
start posting again after 30 days. However, it is important that you do not
register and/or use an alternate User ID to post on or sign into any eBay
Discussion Board, Chat Board, or the Answer Center during this sanction. Doing
so is a violation of the terms of this sanction, the Board Usage Policy, and the
eBay User Agreement, and can lead to an indefinite sanction of your account(s)
and/or a suspension of your eBay account(s), which removes your buying and
selling privileges.
Once your board sanction is over, we respectfully request that your future board
activities comply with our guidelines
Thank you in advance for your cooperation in this important matter.
Again, we value your participation in the forums, and we appreciate your support.
Regards,
Azarel
eBay Moderation Team >>
Of course when you are buying thats a whole other matter.
That's incredible. I, too, am glad I stopped selling on that cesspool of fakes and scammers they call Ebay.
P.S. Frank, you can quote me on this in your reply to Ebay.
Hey there is an idea, maybe i can begin a case study!!! Tittle would be;
The Inner Working's of a collectors mind...
<< <i>THis would be termed "Spear Phishing", as it used information directly related to you and your activities to make the e-mail appear much more legitimate. As a good practice, always use your own bookmarks or type in the URL directly to reach sites vs. following links provided to you. If a spear phisher obtains enough information about you, they can develop very convincing e-mails or other targetted attacks.
Glad you caught this before they hacked your e-bay account. >>
What's odd is, that I am almost always logged into eBay, so a genuine eBay link would have worked without needing to log in.
But for some reason, the past few weeks (apparently thinking it INCREASES security) I have been asked to log in to eBay every few
hours even though I have the "keep me logged in" box checked. So this log on request in the phish seemed MORE NORMAL.