10 replies to this topic

[Bencrest]

So, I know this is off topic, but there are loads of users here, and if I stop one person from losing their eBay account to a scammer, I'll be more than happy!

In the past 4 days, I have had 3 emails from 'Phishing' scammers, all of which look kinda like eBay emails. I'm the kind of person though that when I get an email, I forward it back to the people it is claimed to be from for verification, and all 3 of mine were fakes. People are going around eBay trying to steal identities, by sending out emails asking for account details - but they actually do appear to be from eBay, so I can see why people get fooled. I've included a picture of one of the scam emails, and I bet loads of peopl here have them.

Also, the picture is fairly grainy, as i JPEGged it, normally its crystal clear, and also it says at the top the location is on my desktop - thats because I use email where HTML is sent as an attachment, only plain text gets through, so I saved it to my desktop as 'unnamed' to examine it!

DON'T FORGET - NO reputable company will EVER ask you to send usernames / passwords or other sensitive information to them by email, so if they ask that, send the email to them via a customer services address on their website for verification!!!!

Heres the details :

TO : [your email address]
FROM : [av-confirm@ebay.com]
SUBJECT : TKO NOTICE : Please verify your account

And heres the content you see when you open the html [or just view the email if you can view html emails]

BarcrestBenito

Attached Files

•  ebayscam.jpg   83.1KB   245 downloads

[todd1970]

Thanks for the warning BB...i dont use e-bay myself but the missus is never off it..and she has a paypal account etc..Ill pass on the info to her

[Bencrest]

Quite funny really, eBay keep thanking me for reporting the emails the second they arrive, but they don't have a huge bloody warning on the home-page about them.

I guess it could scare some people!

I had to change my password after someone from Germany guessed it, and I started getting German emails from eBayers, apparently after I asked them questions about their items!!! [I can translate some german, and there is no way I asked about software or parallel ports on scanners!]

BarcrestBenito

[Bencrest]

I just had an email from eBay, the latest email I forwarded to them is also a 'Phishing' email, so I'll bung it on here!

eBay have also told me that if anyone receives one of these, or a similar email that they think is suspicious [from eBay only!!], please can they FORWARD the email, in its entirety [NOT as an attachment, just forward the email using a 'Forward' button], to

spoof@ebay.co.uk

If anyone from here abuses that address and I get in the crap, I'll come round and get ya

This was quite a scary email - the reason I say that is the scammers are now preying on people that are aware of the fraud going on [either that or I got it as a coincidence!]

Anyway, the poor spelling was what made me realise it was fake

TO : [your email address]
FROM : ebay customer support <aw-confirm@ebay.com>
SUBJECT : Security Test

And the content is shown as the picture below!

BarcrestBenito

Attached Files

•  ebayscam2.jpg   82.58KB   110 downloads

[duplu]

Jesus, the english on the last e-mail was worse than some of the TXT speak we see on these forums.

It would be interesting to see some of the e-mail headers as they'll reveal the real source and often even the IP address or hostname of the sender's PC.

[dave1de]

I had one exactly like that first one.

I've had a few, but I don't think these scammers ever fool anybody.

[ady]

I had one exactly like that first one.

I've had a few, but I don't think these scammers ever fool anybody.

I disagree Dave, BB was right to post that I think....

OK so if you into a site like this you do know the way certain things on the net works....But there are many-a-housewife that cloud mentioned that use ebay, and some that don't even know how to turn the PC off (in case they miss a bargain.lol).....It only takes One to foward the info and there can be massive complications result for the punter.

You see the mail drop through the letter-box everyday..........these people invest money knowing that (i'm sure) if only 1% 'fell for it' not only would there cost's be covered but they will show a profit.

Same goes for the premium call cost's, it would be over in a day for the lot of them if they lost out.....But they don't--no matter how often a warning is put out.

[Bencrest]

Thought I'd bump this back up, seeing as how I've just had 3 of these damn emails earlier in the space of about a minute

14:09 16th Mar 2005 FROM:service@paypal.com [SPAM] Notification of Limited Account Access 7.7 Kb
14:08 16th Mar 2005 FROM:service@paypal.com [SPAM] Notification of Limited Account Access 7.7 Kb
14:08 16th Mar 2005 FROM:service@paypal.com [SPAM] Notification of Limited Account Access 7.7 Kb

Anyway, the picture shows you a very simple check you can use to see it any email [be them from eBay/Paypal or any other company] are scams :

You'll notice that the 'status bar' at the bottom of Firefox shows, if you hover over the supposed eBay link, the actual site you are being directed to

DON'T go to the site, it does infact place a trojan, JS/Stealus.gen on your system, so that even if you click on it for fun, and don't intend to enter any details, it will send details of passwords e.t.c. to the gits responsible

Anyway, heres a GIF showing the email [with broken picture link!], and while it doesn't show the cursor [not sure why, normally comes up with Ctrl+PrintScrn] - thats the link at the bottom.

I've deleted the end of the link. Suffice to say it doesn't point to where you expect

Attached Files

•  scamola.gif   48.78KB   49 downloads

[westy20040]

It may be worth noting that when both ebay & paypal sent you email they always start your emails with

Dear <your full name> (e.g. Fred Flintstone)

and not

Dear Paypal (or Ebay) valued member

They usually tell you this in the reply email when you forward a spoof email to them.

HTH
Rob

[jaybee]

we get 10 a day at work!
If you hover over the link, and look at the ie status bar at the bottom, the 2 will not match.

I click on the anyway and write rubbish usernames and passwords in, and it goes straight to the next stage!!

[Bencrest]

Notice my post above, the one I was sent will install a trojan as soon as the link is clicked [I ran it on my little test PC, which I intentionally fill with virii ], it installs JS/Stealus.gen ... apparently a trojan which sends entered strings from websites to another PC.

Make sure you have damn good AV software [I have Corporate McAfee, not brilliant but picked it up ]