is there a new EBAY scam going around?

wizardPC · 02-28-2004, 12:24 AM

I've gotten 2 emails that appear to come from awconfirm@ebay.com, one with a title of "ebay Notification" and the other "eBay important account information"

I am suspicious because each email asks me to enter enough information to steal my ebay account. They claim that my information could not be verified "during our regular update and verification of accounts", then they ask me for my name, ebay ID & password, address, phone number, email address, etc.

If they couldnt verify my information for my account, then wouldnt they already have my ebayID and email address? All of this is put into a form inside the email, it's not a link to an Ebay site.

anybody heard of this being a scam? I'm not gonna do anything with it because if it is real, then they'll just delete my account (according to the email) and I dont use it that much.

wizardPC · 02-28-2004, 12:31 AM

wow, these guys are good.

I looked at the headers, and they say that they come from ebay.com, but if you lookup the IP addresses, the machines are in amsterdam and madrid.

anybody know where I can report a scam to ebay?

SinnerG · 02-28-2004, 12:45 AM

I've received dozens of these e-mails. Just foreward them to spoof@ebay.com . You may also get some from PayPal scammers.

Zip-Lock · 02-28-2004, 01:06 AM

It's called phishing http://www.antiphishing.org/

jnusaira · 02-29-2004, 03:38 PM

the paypal site does say the one way to know its a pay pal scam is that in the address line where it says lke Dear or something .... it will always be Dear FirstName LastName

kami333 · 02-29-2004, 04:53 PM

When is there not an eBay/PayPal scam going around?

Nico3k · 02-29-2004, 05:06 PM

i get the same thing eccept its paypal, asks you to put in all your personal information and it links to a website that looks like paypal.com, but its different.

some link to that fake site that steals your login and the other wants you to download some attachment. its quite interesting

Arby · 02-29-2004, 06:30 PM

They always use the address spoofing trick

like www.mp3car.com@www.arbytech.com

But they'll convert the real address to ascii and use like %25%43%63 so you can't see it. I get these stupid things all of the time.

bgoodman · 02-29-2004, 10:41 PM

i've never gotten one of those, and i've had both a paypal account and ebay account for over a year

hussein · 02-29-2004, 11:28 PM

yea, me too, over a year though. maybe its a good thing we arent on those lists. haha.

jnusaira · 03-04-2004, 08:40 AM

what ****es me off ... is i FINALLLLLY got tired of ALLLLL the spam ... so i was like . damn ... joes a genius .... he shall do this .. i'll make a new domain name ... and then use various identies to login with ... a month ago .... NOW .... to my avail!!! i am already gettign spammed off the one. ( i have a joseph@ and an online@ ...) ...

.... ah but now ... my NEWEST PLAN!!! its sheer genius .... i am going to get rid of the online at .. and just do @online.companyname.com ... then everything before that will be based off the siet in question .. sOOOOO then i may be able to figure out which loser site i go to got my name ....

Arby · 03-05-2004, 01:33 PM

I do the same thing, jnusaira. Any email @arbytech.com gets forwarded to my main account. Whenever I sign up for something, I use companyname @ arbytech.com so I know who's sending me spam.

MatrixPC · 03-05-2004, 02:42 PM

One more interesting trick is that they make it like sending from ebay(the trick is NOT from ebay). I got couple email which is a reply to "Question to seller". The body of the message is almost identical to typical ebay question to seller email respond.
At the end of the message there is regular link to "To view the item" the url is encoded to number and % sign which ip address. After decode the url and nslookup, it go to some dial-up/dsl/cable number from charter.com like xxx.xxx.xxx.xxx.something.charter.com. The page will be display is the ebay item number.html
When I first get the email, and found the link is weird so I go direct to ebay and login to see the the account activity for the pass 30 day (I thought that the accout could be hijack). Nothing happen. That is good.
A word of advice, do not click on anylink you get from email or any form, just go directly to the website and find out from there.