E-Bay Scam?

DawgPhan · Post by **DawgPhan** » Mon Feb 23, 2004 8:10:32 am

Well I got this email today...Looks like a scam to me...any information from you guys?...Has some links that take you to a billing information page where it asks for credit card information and checking account information...but it never asks for my ebay id and password...just thought that I would ask you guys since most of you probably use ebay and might have gotten the same email...I still think beware and I would/will not be entering my information into it...

Dear valued eBay member,

It has come to our attention that your eBay Billing Information records are out of date. That requires you to update the Billing Information If you could please take 5-10 minutes out of your online experience and update your billing records, you will not run into any future problems with eBay's online service.However, failure to update your records will result in account termination.
Please update your records in maximum 24 hours.

Once you have updated your account records, your eBay session will not be interrupted and will continue as normal. Failure to update will result in cancellation of service, Terms of Service (TOS) violations or future billing problems.

Please click here to update your billing records.

Thank you for your time!
Marry Kimmel,
eBay Billing Department team.

--------------------------------------------------------------------------------

Announcements | Register | SafeHarbor (Rules & Safety) | Feedback Forum | About eBay
Copyright © 1995-2003 eBay Inc. All Rights Reserved.
Designated trademarks and brands are the property of their respective owners.
Use of this Web site constitutes acceptance of the eBay User Agreement and Privacy Policy.

tssgery · Post by **tssgery** » Mon Feb 23, 2004 8:26:34 am

This is definately a scam.

I got the same email on Friday and contacted Ebay. Their response was:

Hello,

Thank you for contacting eBay's Trust and Safety Department about email
solicitations that are falsely made to appear to have come from eBay.
These emails, commonly referred to as "spoof" messages, are sent in an
attempt to collect sensitive personal information from recipients who
reply to the message or click on a link to a Web page requesting this
information.

The email you reported did not originate from, nor is it endorsed by,
eBay. We are very concerned about this problem and are working
diligently to address the situation. We have investigated the source of
this email and have taken appropriate action. You may rest assured that
your account standing has not changed and that your listings have not
been affected.

We advise you to be very cautious of email messages that ask you to
submit information such as your credit card number or your email
password. eBay will never ask you for sensitive personal information
such as passwords, bank account or credit card numbers, Personal
Identification Numbers (PINs), or Social Security numbers in an email
itself. If you ever need to provide information to eBay please open a
new Web browser, type www.ebay.com, and click on the "site map" link
located at the top the page to access the eBay page you need.

If you have any doubt about whether an email message is from eBay,
please forward it immediately to spoof@ebay.com and do not respond to it
or click on any of the links in the email message. Please do not change
the subject line or forward the email as an attachment.

If you entered personal information such as your password, social
security number or credit card numbers into a Website based on a request
from a spoofed email, you need to take immediate action to protect your
identity. We have developed an eBay Help page with valuable information
regarding the steps you should take to protect yourself.

To get to the "Protecting Your Identity" Help page from the eBay site,
please click on the "help" link located at the top of most eBay pages
and select the following topics when the "eBay Help Center" window
appears:

Safe Trading > If Something Goes Wrong > Identity Theft

We encourage you to review additional information about protecting your
identity found in the eBay Help system. Please click on the "help" link
located at the top of most eBay pages and select the following topics
when the "eBay Help Center" window appears:

Safe Trading > If Something Goes Wrong& > Account Theft > Account
Protection

Once again, thank you for alerting us to the spoof email you received.
Your vigilance helps us ensure that eBay remains a safe and vibrant
online marketplace.

Regards,

Ian
eBay SafeHarbor
Investigations Team

DawgPhan · Post by **DawgPhan** » Mon Feb 23, 2004 8:47:57 am

That is what I figured. I just thought that I would post here and give everyone a heads up. I wonder how they got my email address? I would think that you would have to be invlovled with me through a sale to have my email address....normally ebay sends the email between people unless you have actually engaged in a transaction..

qrnd · Post by **qrnd** » Mon Feb 23, 2004 10:13:18 am

They got your address the same way all other spam senders get your address. Through mass email address lists. They actually have no idea if you even have an eBay account, but a large percentage of internet users do, and a large percentage of them are taken by an email such as this. I have been receiving emails like the above for years now, including ones allegedly from PayPal. Be sure to always check the sender address, and who sent to address on these mails. Many times those blocks are filled in with garbage, letting you know to avoid the email.

myron · Post by **myron** » Mon Feb 23, 2004 11:44:32 am

there is an identical one for paypal as well...infact, paypal sent out a letter about 2 or 3 weeks ago about just such a scam...

x-omatic · Post by **x-omatic** » Mon Feb 23, 2004 12:45:36 pm

the main thing is that they do not address you by name but as "dear member"

Paypal and Ebay will always address you by name if they need any info from you. Many of these scams will even look like ebay or paypal when you click on the links they provide.

If you ever get them just log in to the site they claim to represent. If there is a need to update anything it will tell you when you log in.

Never click on the links. When you do that they then know you have an account.

n-boy · Post by **n-boy** » Mon Feb 23, 2004 5:41:53 pm

another note regarding this (and other scams)

everyone knows it's VERY easy to spoof an email address (such that i could send an email from "n-boy@ebay.com" or even "customerservice@paypal.com"). however, there's a relatively new vulnerability in internet explorer that allows not nice people to spoof web links - both in the email and also in the address bar of ie (the site can say www.ebay.com and look like ebay, but is really a fake site set up to scam passwords)

last i heard, ms hasn't patched it yet, so keep an eye out.

a good rule of thumb regarding this is, if you receive an email from ANYTHING with a web link, instead of just clicking the link, manually type in the address. that way you won't potentially get scammed.

something else that can help is using a different browser. i'd recommend mozilla firefox. it's gpl (free) and very full featured (native popup blocking, tabbed browsing, etc.). http://www.mozilla.org/products/firefox/

ZephyrWasHOT!! · Post by **ZephyrWasHOT!!** » Mon Feb 23, 2004 6:40:41 pm

Along with all the other excellent advice, please, anyone reading this, always keep in mind the following:

The BEST and MOST SECURE way to deal with ANY information over the internet is by visiting the ACTUAL website in whatever browser you use. It's not absolutely foolproof (nothing really is) but it's the BEST way to avoid nonsense scams.

Never, ever, EVER give ANY personal information via e-mail, EVER, to anyone, for any reason, regardless of who they are or claim to be. E-mail is about as secure as standing on the street corner and shouting, so no matter what you do, don't send ANY personal identifying information through e-mail....

Even if it's mom!

Don't click ANY links, don't even cut and paste, unless it's information you specifically and very recently (such as a password change) requested. If you have a question, go to www.ebay.com, or www.paypal.com, and go from there. Paypal, AOL, eBay, etc will NEVER, for ANY reason, ask for personal information via e-mail...they will ALWAYS refer you to their website directly.

Me? I like to screw with 'em and type in things like 'Name: F*** You!' and what not. Yes, I know that let's them know the e-mail address is a 'valid' one, but I can handle that.