Ebay users beware

[Dionysian Beast]

I received this email two days ago:


"Dear Ebay user,

We regret to inform you that your home phone number had an error on
Ebay Inc. databases.

We use your phone number for your identification purpose only.
If the requested information is not provided to us then we will regret to
inform you that your account will be suspended from our database until
required information is provided.
* Invalid User Information - Our records show that there are some discrepancies
with the information that you registered with on our service. Due to this
violation your account will be suspended indefinitely from the site until valid
information can be provided.*

Due to the suspension of this account, please be advised you are prohibited from
using eBay in any way. This includes the registering of a new account.

Please note that this suspension does not relieve you of your agreed-upon
obligation to pay any fees you may owe to eBay.


To provide us with your phone number, just click the link below and
Please complete this form.

http://signin.ebay.com/aw-cgi/eBayISAPI.dll?SignIn


Regards,
Ian
eBay SafeHarbor
Investigations Team
______________________________
Your Personal Trading Community (tm)

eBay Update team
http://www.eBay.com"



It had gone to my junk mailbox, which I found a bit odd, but I still clicked on the link to fill out the form. When I got to the part where they were asking for credit card information, I got rather suspecious, and then I suddenly took a look at the address bar, and noticed that the URL was some IP.com, instead of ebay.com. I was quite suspecious at this point, so I emailed ebay. This is the email I received from them:


"Hello,

Thank you for contacting eBay's Trust and Safety Department about email
solicitations that are falsely made to appear to have come from eBay.
These emails, commonly referred to as "spoof" messages, are sent in an
attempt to collect sensitive personal information from recipients who
reply to the message or click on a link to a Web page requesting this
information.

The email you reported did not originate from, nor is it endorsed by,
eBay. We are very concerned about this problem and are working
diligently to address the situation. We are currently investigating the
source of this email to take further action. You may rest assured that
your account standing has not changed and that your listings have not
been affected.

We advise you to be very cautious of email messages that ask you to
submit information such as your credit card number or your email
password. eBay will never ask you for sensitive personal information
such as passwords, bank account or credit card numbers, Personal
Identification Numbers (PINs), or Social Security numbers in an email
itself. If you ever need to provide information to eBay please open a
new Web browser, type www.ebay.com, and click on the "site map" link
located at the top of the page to access the eBay page you need.

If you have any doubt about whether an email message is from eBay,
please forward it immediately to spoof@ebay.com and do not respond to it
or click on any of the links in the email message. Please do not change
the subject line or forward the email as an attachment.

If you entered personal information such as your password, social
security number or credit card numbers into a Web site based on a
request from a spoofed email, you need to take immediate action to
protect your identity. We have developed an eBay Help page with valuable
information regarding the steps you should take to protect yourself.

To get to the "Protecting Your Identity" Help page from the eBay site,
please click on the "help" link located at the top of most eBay pages
and select the following topics when the "eBay Help Center" window
appears:

Safe Trading > If Something Goes Wrong > Identity Theft

We encourage you to review additional information about protecting your
identity found in the eBay Help system. Please click on the "help" link
located at the top of most eBay pages and select the following topics
when the "eBay Help Center" window appears:

Safe Trading > If Something Goes Wrong& > Account Theft > Account
Protection

Once again, thank you for alerting us to the spoof email you received.
Your vigilance helps us ensure that eBay remains a safe and vibrant
online marketplace.


Regards,

Ian
eBay SafeHarbor
Investigations Team
______________________________
eBay
Your Personal Trading Community (tm)

*******************************************

Important: eBay will not ask you for sensitive personal information
(such as your password, credit card and bank account numbers, Social
Security numbers, etc.) in an email. Learn more account protection tips
at:

http://www.pages.ebay.com/help/account_protection.html
_____________________________________________

For our latest announcements, please check:

http://www2.ebay.com/aw/announce.shtml
_____________________________________________

In order to better serve you, we'd like to occasionally
request feedback on our service. If you would rather
not participate, please click on the link below and send
us an email with the word "REMOVE" in the subject line.
If that does not work, please send an email to the
email address below. Your request will be processed
within 5 days.

mailto:cssremove@ebay.com

*******************************************"

 

[Sinful Minx]

oh lovely.
Thanks for letting us know!

 

[BoobsNBrains]

I get these from Paypal.com all the time, too...only it's not an "L" in Paypal, it's a "1."

 

[Lust Engine]

Old phishing news already.

Anyone that asks for that kind of sensitive info is still trawling for people who don't know better.

 

[SkyBluAngelEyes]

I got the same exact email about 2 weeks ago.

I deleted it. I think I went to the Ebay site and logged onto my information and thought if they really needed my numbers so badly, they can drop my account and I'd open up a new one.

I also get the one from paypal.

I'm very suspicious when it comes to anyone asking for my credit card number.

 

[Lust Engine]

I got the same exact email about 2 weeks ago.

I deleted it. I think I went to the Ebay site and logged onto my information and thought if they really needed my numbers so badly, they can drop my account and I'd open up a new one.

I also get the one from paypal.

I'm very suspicious when it comes to anyone asking for my credit card number.

As we all should.

 

[linuxgeek]

Yeah, these are right up the same alley as the guy who asks the bank patron to draw out thousands of dollars to verify one of the tellers is a thief.

When you get these types of emails, the best thing you can do is forward the message (with the header information), to the company they are trying to spoof. They have the resources to work with local Law Enforcement and the FBI. If your city or county/parish has a Economic Crimes or Computer Crimes division, they can follow up on the spoofed email also from the Identity Theft angle.

LE is doing a lot to crack down on identity theft rings. Every forwarded email they get points them to a source of the email and the responsible party for the web page/server being used to collect people's data.

 

[nitengale]

I get these things on a pretty regular basis. I just forward them off to the safeharbor folks.

 

[DevilishTexan]

Funny, "Ian" must be a popular name since they used the same salutation exactly.

 

[Morcheeba]

Funny, "Ian" must be a popular name since they used the same salutation exactly.

Interesting how you noticed that, too.

Maybe next week they'll alter their name to Esther.

 

[someplace]

I read last week that Citibank recently surpassed Ebay in the number of spoofs sent to their customers. You must really pay attention. I've had them where they wanted my passwords to different sites, not bank information as well. It's crazy.

 

[lobito]

i never provided a phone number to ebay, so I'd suspect it was fraud(ish) anyway. People should just pay attention, btu that's too hard for them to do.

 

[linuxgeek]

people are in general trusting on the internet. Hell, plenty people are too trusting in real life. It isn't until after they get burned that they get a clue.

 

[The Heretic]

Phishing is fairly well known. What some people don't know is that the smart phishers who setup these sites, set up the forms such that any info you enter is recorded regardless of whether you quit halfway through or cancel/etc. - so consider that any info you filled out in the form they now know, even if it was partial or you canceled, and take appropriate action.

 

[TexasFunGuy]

I got the spoof emails from Ebay and PayPal. At first I thought they may be real but I didn't click until I could be sure one way or the other. Once I knew they were fake I deleted and went about my merry business.

 

[Guru]

Phishing is fairly well known. What some people don't know is that the smart phishers who setup these sites, set up the forms such that any info you enter is recorded regardless of whether you quit halfway through or cancel/etc. - so consider that any info you filled out in the form they now know, even if it was partial or you canceled, and take appropriate action.

Do they use java script, sending the fields to the server as you fill out the form?

 

[Adrenaline]

I've never received any e-mail like that before so thanks for the warning.

 

[The Heretic]

Do they use java script, sending the fields to the server as you fill out the form?

I suppose so. They can also use VBScript/etc., with Gecko based browsers they could use XUL - whatever the method, people need to be aware that they can do that.

 

[Guru]

I suppose so. They can also use VBScript/etc., with Gecko based browsers they could use XUL - whatever the method, people need to be aware that they can do that.

I always use java script in web pages, because it's cross-browser compatible. I'd like to see the code, to dissect it.

 

[The Heretic]

I always use java script in web pages, because it's cross-browser compatible. I'd like to see the code, to dissect it.

I use JS too - but I always make sure that if the user has JS turned off or not present, then the page degrades gracefully. Also, there are different DOMs for different browsers, so a person has to be careful to write any DOM manipulation code to be cross-browser compatible.

I wrote some code that does just that and it took me a while to learn how to do it correctly, and it is still a hassle.

 

[Guru]

I use JS too - but I always make sure that if the user has JS turned off or not present, then the page degrades gracefully. Also, there are different DOMs for different browsers, so a person has to be careful to write any DOM manipulation code to be cross-browser compatible.

I wrote some code that does just that and it took me a while to learn how to do it correctly, and it is still a hassle.

Too bad Micro$oft and NutScrape had to go their own way with JS. We could have a compatible world today, where programmers could write once, run anywhere.

 

[The Heretic]

Too bad Micro$oft and NutScrape had to go their own way with JS. We could have a compatible world today, where programmers could write once, run anywhere.

I have worked for a number of companies that were on various standards comittees. It is always a political struggle, even when everybody means well and is mature about it. Then you've got companies like MS (and many many others) who view standards as a strategic weapon they can wield to beat down the competition with. With such companies the goal is not to produce better more productive software for the customer, it is to win market share.

Of course, business is about market share and beating out the competition, but some companies actually accomplish this by producing a better product rather than resorting to such tactics. MS could win by producing better products, they often do - but they can't resist also winning by other tactics which hurt consumers.

 

[Guru]

I have worked for a number of companies that were on various standards comittees. It is always a political struggle, even when everybody means well and is mature about it. Then you've got companies like MS (and many many others) who view standards as a strategic weapon they can wield to beat down the competition with. With such companies the goal is not to produce better more productive software for the customer, it is to win market share.

Of course, business is about market share and beating out the competition, but some companies actually accomplish this by producing a better product rather than resorting to such tactics. MS could win by producing better products, they often do - but they can't resist also winning by other tactics which hurt consumers.

Well said. Programmers tend to live in an idealistic world, where ever API is approved and vetted by the community at large. Too bad business and money enter into it, and fuck it up so that we have lawyers and patents and copyrights interfering with our art.