Fake ebay e-mail message

Why would someone send out a message like this to my ebay acct.?

"I’ve sent you the money for the item and I have not receive any item from you!

You are an asshole who tricked me and If you don’t Respond Now!!! and explain me what happen’ I will contact eBay to report you and I also go to the police!

I am waiting your Respond Now! You have to know I am not so stupid as you think "

Do they think I’ll send them some money? The grammar is terrible. Do you think its from Nigeria?

I do occasionaly sell things on ebay, but I have never sold anything to someone in the UK. The message is from a ebay uk user. Is it possible that this person’s ebay user ID was hijacked and he was not the one who sent it to me? The user ID seem legit. I’ve reported the message to ebay.

The entire e-mail is a trick. It is called a phishing scam. It is not sent through the ebay server; it has headers and images that merely resemble the ask seller a question e-mail. If you click respond now you’ll be taken to a false login page on a server that is not ebay where you will be prompted to enter your user:pass combo for either ebay or paypal, and a tracking cookie will be installed onto your web browser which will do I do not know what. Please report this e-mail to ebay using the appropriate methods listed on the ebay help page. The ebay ID is most certainly appropriated, and they are more than likely after your account info on ebay and/or paypal.

I know this because I had to do damage control on a friend’s PC after this happened. It would be safest to refrain from clicking links in e-mails from ebay or those that resemble ebay e-mails. I believe this is one of the reasons why the ebay message center was introduced. If the buyer or seller wants to contact you, it would be better for you to respond to them directly by using the regular reply button in your e-mail program than ebay’s respond now link.

Both Paypal and Ebay have a “spoof@” address to forward the message to. You will get an automated reply telling you that the message was not sent by them, but thanks for reporting it and they are doing their best to shut it down.

Then tomorrow you will get twice as many.

Musicat , have you experienced this directly? Meaning, are you saying that you received a sginificantly higher amount of phishing mail after reporting one? Do you have any reasons why you would correlate the 2 things?

im curious to know if we are looking at this correctly - is there anywhere in the email you received that asks you to sign into ebay? Unless you are being asked to sign into an account using your user name or give a CC number, I don’t understand how the angry user can use a reply message to scam you (inless the email is just fishing for active email addresses). A simple email back, which is what the email is apparently asking for , should not be enough to compromise your ebay account (note I am NOT advising this, I am just saying I don’t see how a reply email could cause your ebay userID/pw to be compromised). However, I have read of problems with stolen ebay accounts used for scams - the nice part with a stolen ebay account is that it generally has some positive feedback to lull the buyer into a false sense of security. I would check recent activity on your Ebay account - anything going on that wasn’t your doing?

I recently had my eBay account hijacked, but it was suspended and locked down before any damage could be done. What tipped them off was that it was apparently out of character for me to go from occasionally buying random things and almost never selling on eBay to selling 9 Prada handbags at once. I went through the various hoops to straighten things and ended up in a live chat with their customer service people. I asked what happens after you forward a spoof email to them, and I was told that they track the email as best they can and contact the appropriate authorities.

I suggested that they should in the future just dispatch ninjas to deal with it. Seems that that was the funniest thing the guy had heard all day. :smiley:

Perhaps that’s what they call the employees that track down the emails??? :smiley:

The e-mail urges you to ‘respond now’ and click the graphical link in the e-mail that says ‘respond now,’ not reply via e-mail. The link in the e-mail will take you to a site requesting your username and password. You are correct; replying via e-mail is perfectly safe.

I got a very legitimate looking email from monster.com yesterday that said I had to download the new Job Jeeker Tool in order to keep using monster. It even addressed me by my real name. But monster had never required me to download anything before. I browsed over to monster using my bookmark and searched the site for any sign of a Job Seeker Tool download. Nothing there. I contacted their fraud/abuse section. They verified that monster did not send the email, and advised me not to click on any links or log in using the link in the email. (I had not and did not, of course.) They asked me to send them the full header of the email, which I did. I was thanked, and told that they would use the full header information to try to shut the phisher down.

I think we’re all on guard against eBay and PayPal phishing scams. But it’s good to be on guard against any email that is out of the ordinary, even if the sender uses your proper name and it’s from a site you use frequently.

I know it’s juvenile but I found this phrase with the unintended smiley hilarious.

Uh huh. Yeah, right. Unless you are using an email client that offers you only straight text messages and not HTML email messages it’s very easy to do.

How easy is it to scam folks via email? Which link below is accurate?

  1. Go to The Straight Dope home page.
  2. Go to The Straight Dope home page.
  3. Go to The Straight Dope home page.

Real easy, eh? The above examples are so basic and so easy to spot. However, so many people fall for it because they can only see what is in front of them and not the code underneath. They never bother to look at the browser/email status bar that shows the actual link under the visual email.

You can find more tricks here —> http://www.contentverification.com/obfuscation-attacks/index.html

Well, it would help you more to never reply at all, report the e-mail and mark it as spam, because if you do reply, you’re getting 10 of these tomorrow, and god knows how many the next day. Clicking on the link is just more dangerous. If you’re using an HTML message you can stop your example links from showing up in the status bar, or even better, label them as the advertised site and not the dummy one.

I buy and sell on eBay occasionally and have received a few of these emails and always ignore them.
Recently, however, I started getting these emails at my work email address, which is in no way connected with my eBay account.
Would someone be eblasting every email address they have just in hopes that someone is an eBay user and would fall for it?
Are eBay users that numerous?

I have had the same thing happen to me; an email from ebay to an account not associated with ebay, i scratched my head for about 10 seconds over that one, until i read the email itself. Consider how cheap it is to send spam - how many people who get spam for viagra actually buy it? Some people must or no one would send viagra spam. If one out of 100,000 spam phish emails yield a valid ebay account or other sensitive info, I would say it is probably worth it to the spammer

I’ve been getting emails about password changes to my PayPal account which look really legit. Thing is, I never have nor likely ever will have a PayPal account. The only thing that really jumped out at me to make it different than a usual “your password has been updated, please click here to confirm” email was the fact that there was no trademark or registered sign next to the PayPal logo. I even went to the PayPal website via google, and the email was very hard to distinguish from webpages on that site. Even the links in the email went to sites with the word PayPal in it… something like security.paypal.com or something.

I can see how people can fall for it. I even considered whether someone had started an account using my email address, but I haven’t noticed any unusual activity otherwise on any of my bank/credit statements, or even for that email address other than these damn PayPal emails.

No, I was just being cynical; I don’t think that reporting problems to a legitimate site like paypal or ebay will trigger more of the same tomorrow. This differs from trying to unsubscribe to email lists.

But it seems that in spite of the claims of those companies to be actively pursuing the miscreants, more new ones pop up tomorrow, whether you report them or not. It looks like a losing battle.

I get about a dozen obviously bogus phishes a day. I report one or two, especially if they are new or devilishly clever. Then I get more the next day.

FYI, y’all: if mousing over the links doesn’t show a legitimate URL, it is a bogus email. (That is, if the ACTUAL URL doesn’t match the TEXT URL, it is an attempt to deceive.) The crooks go out of their way to make their URL look OK, but the mere presence of “ebay.com” in the string is NOT a guarantee of legimitacy. You need to understand how URLs are constructed, and if that is beyond what you want to learn, I will just say that if the URL begins with 4 groups of digits separated by periods, it probably is bogus.

Thanks for the clarification.

One thing to keep in mind is an increase in phishing emails (in general not just to one recipient) can mean that advances are being made in other areas to fix the larger problem. The phishers then need to send out higher volumes to maintain their “revenue” so to speak.

The problem is that no one can stop them from sending mail. Things can be done to keep them from being delivered but its difficult because of the wide variety of email clients and ISPs that are out there.

I get the phishing e-mails from eBay and PayPal fairly frequently (my wife has done a lot of business with both).

The one’s I’ve been getting lately are fairly clever. It appears to come to me from PayPal, and confirms my purchase of some item (usually an expensive watch, for some reason). At the bottom is a link “to dispute the claim”. Obviously, clicking the link would take me to a page that would require me to give my account information.

I don’t trust anything anymore.

To be fair, that’s pretty much what eBay tells you to do. Not trust anything, that is. They pretty much want you to close any email you get from them, open a browser, go to eBay or Paypal, and THEN log in to see what’s up. They actively discourage clicking links in emails.