SCAM WARNING TO ALL EBAY USERS!!

or "A Story About How You Can Learn From My Mistake"

	Background
	The (Almost Unnoticed) Beginning of the Scam
	Who's Vulnerable? Everyone
	The Day it All Broke Loose
	The First Clue
	Changing Your eBay eMail Address ... and What You'll See in Return
	Checking Everything Else
	Tracking and Tracing
	The One That Slipped Through
	Part Two -- or How the Never-Ending Story Continues (and Why Am I Suddenly Writing in German?)
	How International Can This GET?
	eBay's Response
	Morals, Lessons and Take-Aways

Background

After a bit of soul searching, I have decided to use this page to share my recent experience on eBay. It is my hope that by sharing my experience, someone else might be spared all of the aggravation.

I assure you that I’m not a novice at eBay, computers or the Internet. I am even considered to be somewhat of a “techno-geek” (Web and Graphics Designer, Network Administration, software management/development, etc.). I have been a member of the eBay community since 1999. eBay has brought much joy and, yet, introduced a few bad experiences, as well. (Three to be exact, in all of my transactions.) I have met some of the kindest people through eBay -- people I never would have met without the Internet.

Now, however -- I have been force-fed a CONSIDERABLE AMOUNT of enlightening skepticism. Unfortunately, I'm going to have to hold on to that from now on. It's mine and it will stay mine.

I, like everyone else, have read about the scams circulating that target people using eBay, PayPal, and other highly-trafficked sites. I've read about the unfortunate stalkings that have occurred, the identity thefts. My feelings of sorrow ALWAYS went out to the victims of these crimes of fraud. It's stealing innocence and honesty. That's a horrible thing -- to take something from someone, blindly, never knowing or caring exactly HOW you are affecting them. In fact, these thieves never know ANYTHING about the victims, their lives, what they are going through on a human level -- ANYTHING. All that they care about are intimidation and their own concept of a get-rich-quick scheme ... at ANYONE else's expense.

In my opinion, it takes a hollow, empty person to blindly affect Internet Fraud on the unknowing and the unwilling. On those who are living and leading a straight and honest life. Those who are intent on adhering to "the rules," remaining mindful and concerned about fellow humans -- and their feelings and opinions.

eBay was originally created as a community of individuals who liked to provide a marketplace for those who were searching and those who were selling unique items. As of late, the innocence of the mission is beginning to tarnish -- at no fault of eBay's. It's the fault of those who make a living abusing for their own profit, at the cost of anything.

To my surprise, in spite of my computer and Internet savvy -- I was caught in a scam. If *I* can be caught, anyone can. Fortunately, however, I'm not an idiot. So far, I have managed to entirely thwart the illegal activities of the person who was intent on defrauding me. Read on.

   >>> top

The (Almost Unnoticed) Beginning of the Scam

On January 21, 2003, I was the receiver of a FRAUDULENT eMail that appeared to be from eBay (I am including the Internet Header info included below) stating "Your account has been inactive for a substantial period of time. Due to our scheduled maintenance we are reviewing the accounts. If you want to continue using our system please go to the URL below to confirm: (please use it exactly as is including all trailing fullstops)." A link was provided to complete the confirmation. (The link is no longer active -- they have been shut down by their ISP. Thanks go to another fellow eBay'er who knew about my situation. This quick thinking likely saved someone else from falling victim.)

I have taken off of work for a few weeks, and am remaining at home caring for a very ill relative who just had major surgery. The surgery was January 15. The eMail was January 21. I normally live with my computer attached as an appendage, but the care for my relative had made it so that I had not logged on to the computer/Internet in days. When I did, it was only to make sure I had no important messages.

I found a message "from eBay," (which of course, ultimately proved to be not from eBay at all).

So, I scowled and growled at the annoying/offending message, somewhat cursed eBay’s name and said, “What are they talking about? I haven’t been ‘inactive!’ It's only been a few months!!” Blah blah blah.

Upon clicking on the link, I was taken to a page that APPEARED to be eBay -- included eBay Logos, links, search, etc. So, I completed the form, and hit the "continue" (submit) button. I did not notice that the link had redirected me to a fraudulent site. I was exhausted and worried -- my life was upside down due to my family member's illness.

   >>> top

Everyone is Vulnerable

What I’m trying to say is that you don’t have to be stupid, an idiot, gullible, foolish, or ignorant to ‘fall for’ and reply to these messages -– and or to follow its directive in confirming the the requested information. It can simply be that someone is highly distracted by life’s events. (In my case, I supplied only eBay UserID and password -- no credit card info, but even that little bit of information was enough to cause a HUGE problem).

   >>> top

The Day It All Broke Loose

I truly never would have given it a second thought (in fact, I hadn’t), if January 27, 2003 hadn’t proven to be one of the most interesting eMail days I’ve ever had.

When I log on to my computer, a program -- SpamKiller -- starts that accesses all of my eMail accounts, checks for new messages, screens all received messages, and filters out any that are identified as SPAM. The rules of defining the SPAM can be created manually by the user and/or by subscribing to and checking for regular updates from the software seller (it used to be a private company; the software was sold to McAfee recently). The program additionally provides Symantec's Norton AntiVirus with the opportunity to scan the eMails for viruses -- before they are ever downloaded to your eMail client (your eMail box).

On January 27, 2003, my eBay password and ID were effectively "hijacked" for 39 minutes. The person(s) who stole the information were able to post ONE fraudulent auction -- THREE MINUTES BEFORE I CHANGED MY PASSWORD. They attempted to steal my identity and were responsible for my receiving over 3,000 spam emails. This onslaught of eMail was directed at my account in an attempt to keep me from noticing that I had received a note from eBay -- confirming that "I" had accessed my eBay account and that my eMail address had been changed.

THAT was the cause of the "39-minute delay" in changing my password. Because it took so long to download the messages (and I have a broadband connection), it prevented me from seeing the TWO messages that I received from eBay -- that informed me of a submission of a change of address.

   >>> top

The First Clue

The first clue that something was dramatically wrong were the two eMail messages that I received from "real" eBay:

   >>> top

Changing your eBay eMail Address and What You'll See in Return

When I discovered the above notification from eBay -- FINALLY! Something legitimate! -- I immediately logged on to eBay, accessed my account, and changed my password. A copy of the official confirmation that I received is below.

So see, WHEN SUBMITTING AN EMAIL CHANGE REQUEST TO eBAY, NOTIFICATIONS ARE SENT FROM eBAY. However, here's a note worthy of CAREFUL study:

• They send one -- an "alert" message -- to the "OLD" eMail address informing that someone at IP Address XXXX has changed your eMail (saying "Thank you for submitting your change of e-mail address request. Instructions on completing the change have been sent to your new email address. Once the process is completed, your eBay-related email will no longer be routed to this email address."); and
• Another eMail is sent directly to the "NEW" eMail address that was submitted; WITH THOSE VERY IMPORTANT "SPECIFIC INSTRUCTIONS."

In other words, I could be out shopping, not at home, not at my computer, doing nothing with my eBay account, and someone who happens to break into my account can submit a change, access the confirmation instructions, confirm/complete the change ... access my account and personal information and history ... and I would be none the wiser.

Additionally -- if *I* had not succeeded in confirming the eMail address change prior to the THIEF confirming the FRAUDULENT change, I would have been unable to access my own account.

But, you know, they DID care enough to actually DELETE my entire "ABOUT ME" page. What IDIOTS.
Fortunately, I maintain quadruple backups of my files.

By MY assessment, this should encourage eBay to implement some type of verification for account changes. Something should be done to more thoroughly protect the legitimate user. Receiving the instructional eMail at the "NEW" eMail doesn’t help much ... if you really aren’t the one initiating the change. And I seriously doubt that everyone remains logged on to their computers 24 hours a day to receive the "alert" messages.

   >>> top

Checking Everything Else

Then I proceeded to check my eBay account activity – including online activities with eBay connected credit cards, invoice activity, eBay fees, etc. Nothing. Then I logged on to my credit card's online secure site, to verify that it had not been compromised; logged on to my other online payment accounts, verified them, as well.

Strong moral here: amazingly enough, I had set up every account with different logons and passwords. I feel VERY fortunate -- using non-identical logins and passwords must have really frustrated the thief, eh?

I then changed my “password hint” on eBay, receiving this eMail confirmation:

   >>> top

Tracking and Tracing

Spending time on the most immediate problem -- having my eMail box inundated with 3,000+ SPAM eMails -- succeeded in distracting me from the offense that was later proven to be the biggest issue: the eBay issue. After thinking that I'd accomplished all I needed by changing my eBay eMail address, password, my password hint, verifying the security of my credit cards and other online payment accounts ... I proceeded to hunt down the offending eMail SPAMMER.

I had the IP address that had initiated the fraudulent eMail change request (200.142.239.xx). I had the IP addresses and eMail address (buried in) the Internet Headers of the FIRST eMail (the one where I clicked on the link and provided my personal login and password.)

So, I ran traces on them. All of them. I'm in the Eastern part of the US. Found one in Brazil. Sao Paolo. One in New Jersey. Closer. One in Baltimore. Closer.

These traces provided me with names, phone numbers, eMail addresses and street addresses –- a m o n g   o t h e r   t h i n g s .

Brazil. Just South and East of Sao Paolo. This tracing program I use is a really cool program –- it helps you to track down whoever is bugging you. And this idiot was DEFINITELY bugging me by sending 3,000+ eMail messages.

I then spent an incredible amount of time online with my ISP so that I could alert THEM that their servers were being bombed and sucking up a huge amount of bandwidth. They were able to look at the Internet Headers (as I was) and determined that I had indeed already pulled all of the pertinent information from the files. They directed me to send “abuse” notifications to the Brazilian NIC organization, the one that oversees all Network Protocols in Brazil (and I also included as cc’s, two individuals from the company that had routed the Spam (200.142.239.xx).

My ISP, Comcast, was extraordinarily helpful -- and very concerned. They are following up with me in a few days to find out if I had any success in resolving the issue directly with the IP holder.

I have since received this response from the IP holder:

I have not heard back from them again, yet neither have I received anymore SPAM relay messages.

   >>> top

The One That Slipped Through

When I participate in any auction on eBay, I utilize a program called "Sold!" created and distributed by Timbercreek Software. Fabulous auction management software.

So, I had this software running in the background of my system. Eventually -- very late in the night on January 27, 2003 -- I clicked on the icon in my task manager. It prompted me with something I'd never seen before. It wanted me to validate and key in a number shown on a GIF image before it would update the auctions I had in the program.

After keying in the number represented by the GIF, I watched the program. It scans my auctions -- both ones that I am watching for purposes of bidding, and then it scans my eBay ID's to see if I've posted any auctions. If I have, it adds them to the program so I can watch how the bidding progresses during the course of the auction.

Imagine my surprise (okay ... unbridled, uncontrolled, flaming fury and annoyance at this point) to find that I have posted the following:

Oh yeah, right. Right. Uh huh and You Betcha. Only a bank wire transfer to "my" account. Euros as payment. Oh, I think that I might have forgotten to mention that -- according to the auction posting -- "I" had apparently relocated, and apparently now lived in Riga, Latvia. And "I" am such a good person, "I" am selling this with a Buy-It-Now option of $2,700 Euros, even tho' I live in the US. Oh forgot. Since "I" now live in Latvia, maybe "I" can accept and use Euros. Then again, maybe not.

Editor's Note:

• "I" (with quotation marks) indicates the idiot who stole my ID.
• I, I, or I (bold, red, or just-plain-I) indicates ME. As in, THE REAL ME.

I have been selling things on eBay for a very long time. My reputation has always been a point of pride. I treat my customers well, I am always willing to accommodate specific needs and requests.

Suddenly, due to this fraud, "I" had into someone who has a narrow list of requirements that the bidder must fit into before they can bid. "I" am now disagreeable, untrusting and untrustworthy person. Now, "I" require payment within three business days AND will not accept credit cards, but hey the "lucky" winner of the auction gets to submit payment via a really (NOT!) inexpensive bank wire transfer! Fortunately, when I found the auction, no one had yet bid -- despite the phenomenal bargain. Oh, wait. I forgot. "I" -- no wait NOW that's a REAL I, not an "I" with quotes! --  I  have "no-negatives-PERFECT" feedback. Of course the poor bidder would trust "me."

Can you tell I'm getting angrier here???

   >>> top

Teil zwei -- oder, wie die nie Endgeschichte fortfuhr

     (Translation: Part Two -- or How the Never Ending Story Continues)

So, you are no doubt wondering how and why I switched to German. Hopefully, it's not been entirely boring so far, but HERE'S where it gets REALLY interesting.

No one had bid on the ONE posted auction before I found it. I'm thinking that the S-I-M-P-L-E thing (hadn't I learned by now?) would be to   a) log on to eBay, b) cancel the auction. So, I skip on over to eBay, and log in. I bring up the auction, try to cancel it.

It tells me that I had to go to the site where "I" (we're back to that!) originally entered the auction to be able to modify or cancel the posting. Huh? WHAT? I follow the link, and I end up at ... eBay Germany!!! OH GRAND!

So now, I get to have MORE fun. See, I hadn't gone through enough, so I guess it was okay.

Naw, truly the thrill of the hunt had my adrenaline going by now.

Seeking as the auction text was actually in ENGLISH, I have no doubt that this person did this to throw roadblocks in my way. Sorry, buddy, you messed with the wrong person on this one.

It took me about TEN minutes to navigate through the site, translate what I needed, and take it down, cancel the auction, erase the fraud ... and deny this idiot, jerk thief the chance of ripping anyone off while using my name. Oh, I'm sorry -- "It took me about TEN minutes to 'steuern Sie durch den Aufstellungsort, übersetzen Sie, was ich benötigte, und nehmen Sie es herunter, annullieren Sie die Auktion, löschen Sie den Betrug... und verweigern Sie diesen Idioten, Ruckdieb die Wahrscheinlichkeit von jedermann weg zerreißen beim Verwenden meines Namens.' "

Pretty cool, eh?

Want to know how this was done? How DID I translate this so quickly and navigate my way through a site when I no previous lessons in the German language?

Altavista Babel Fish Translation Service    Yup. As in Altavista -- the search engine. This very specialized site -- available free of charge -- allows you translate words, sentences ... or entire web pages.

As a matter of fact, you can even add Babel Fish to your own web site. Altavista makes the code available to anyone.

Well, I got MY immediate problem solved. But I realize that the really frustrating part about this step of my process is that not everyone would have known to -- or thought of -- accessing a site like Altavista's Babel Fish in order to put an end to a nightmare. Sure, I could have sent an eMail to eBay ... but how quickly would they have gotten the eMail, how soon would they have shut down the fraudulent auction, how quickly could they have responded if I found myself dealing with an irate winning bidder who had just lost their $2,000+ dollars on an illegal -- most likely unfilled -- auction? This was a "3-day auction." Time was not a luxury I could fall back on.

   >>> top

How International Can This GET?

So we're really becoming world travelers now, aren't we? Let's see ... I've got Brazil, Germany, a few Caribbean Islands ... and Latvia. And New Jersey and Maryland, but, hey, they're not "International" to me.

What else can happen? Anyone want to offer any guesses? Time's up. Sorry ... I'm tired and I'm punchy.

To add more fun to my life, at 3:31am, I receive an eMail from "eBay United Kingdom Customer Support." To quote a line from one of my favorite movies, "Oh, this just keeps getting better."

I'm including the Internet Headers here (personal info again omitted). Yup.

At this point, I gotta tell you, I'm beyond believing much of ANYTHING. I told you'd I'd acquired a heavy dose of skepticism.

I check all the message Internet Headers. Fine. I run traces on the IP's it passed through. Fine. Whatever. All of the links are legit.

It still prompted one seriously curious question to pop into my head: if they thought my eMail address had been changed ... how in the heck -- or WHY in the world -- did they send me this eMail message? To the same account that they were saying had been defrauded.

   >>> top

eBay's Response

Late in the evening, I did send a report to eBay reporting the original SPAM/SCAM eMail. To their credit, I also received a response -- approximately 30 hours after the report. Not too bad, really! I'm impressed!

Regardless, I'm entertaining the idea of calling them, because this has gotten WAY more complicated than any eMail can convey.

   >>> top

Morals, Lessons and Take-Aways

Some of the most important things that I want to emphasize are:

• When clicking on a provided URL/link – everything PRIOR to an “@” symbol is ignored. For example, in MY case, using the http://cgi3.ebay.com@64.176.128.170/eBayISAPI.dll?&... the http://cgi3.ebay.com@ was ignored, and I was redirected to a authentic looking fraudulent site that was actually identified by everything AFTER the @ symbol.
• All eBay genuine links will begin with http://cgi.ebay.com/ in the browser location bar. For more info on the URL's used on eBay web pages (International sites may differ), please visit the eBay Account Security Page.
• Passwords. Passwords. Passwords. Make sure that all of your logins and passwords at any online organization – Yahoo!, Microsoft, Amazon, PayPal, American Express, VISA/MC, eMail Accounts, and any-and-every-thing else – are DIFFERENT! While it’s obviously easier to have everything be the same … it makes it easier for the THIEF, as well. Don't enable them.
• Only change or confirm your personal eBay information by directly logging on to www.ebay.com and accessing the account info through that route.
• Check your eMail accounts as often as possible and be diligent about following up on suspicious activity or notes. Suspicious eMails should be forwarded to spam@ebay.com. Be sure to include the “Internet Header” info.
• For more information on how to protect your eBay password and your account, click here.

I feel beyond grateful that I wasn't hit harder with this scam and I think (hope!) that I've managed to get my hands around this. It has taken almost two solid days to do so ... but it could have been so much worse. Fortunately it has not yet cost me either financially or by "identity theft” –- which by all assessments appears to have been the defrauding motive.

I truly hope that this has helped or provides some insight to something someone else might be going through.

   >>> top

If you'd care to contact me to ask any questions -- or even to share a story or a suggestion -- you can reach me at: sam@samnjoe.com. Or, if you'd choose, visit my guestbook page. I truly would be interested in hearing how this information has helped, or if you'd care to add your insight to it.