# Fraud Alert **URL:** \ **Category:** Factual Questions\ **Created:** [June 4, 2003, 9:31am UTC](https://boards.straightdope.com/t/fraud-alert/179546 "2003-06-04T09:31:44Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![SoulSearching](https://avatars.discourse-cdn.com/v4/letter/s/848f3c/32.png) [@SoulSearching](https://boards.straightdope.com/u/SoulSearching)\ **Post date:** [June 4, 2003, 9:31am UTC](https://boards.straightdope.com/t/fraud-alert/179546/1 "2003-06-04T09:31:44Z")
This is just a general alert to all of you who may be ebay members. We can usually spot a scam when it presents itself but I got one today that actually took a few seconds of thinking. You will receive an email from: [support@ebay.com](mailto:support@ebay.com) The return addy is indeed [support@ebay.com](mailto:support@ebay.com) IT SAIDS “[ebay.com](http://ebay.com)” not “[ebaysupport.com](http://ebaysupport.com)” Anyways the email is 100% authentic lookalike as an real ebay email would look. It says that the credit card on file was attempted to be charged but was declined, please update your card etc… it gives a long URL which has something like “cgi…ebay.com” etc but when you click the link it takes you to some obvious nonebay URL. The page also looks 100% authentic as an ebay LOGin page would. All of this looked so good, I’m not convinced it’s a scam. Will someone look into it? Recently we attempted to authorize payment from your credit card we have on file for you, but it was declined. For security purposes, our system automatically removes credit card information from an account when there is a problem or the card expires. Please resubmit the credit card, and provide us with new and complete information. To resubmit credit card information via our secure server, click the following link: [http://cgi3.ebay.com/aw-cgi/eBayISAPI.dll?SignIn](http://cgi3.ebay.com/aw-cgi/eBayISAPI.dll?SignIn) This is the quickest and easiest method of getting credit card information to us. Using the secure server will ensure that the credit card will be placed on account within 24 hours. Copyright 1995-2003 Ebay Inc. All Rights Reserved. Designated trademarks and brands are the property of their respective ---
**Author:** ![Joe\_Random](https://avatars.discourse-cdn.com/v4/letter/j/e8c25b/32.png) [@Joe\_Random](https://boards.straightdope.com/u/Joe_Random)\ **Post date:** [June 4, 2003, 9:45am UTC](https://boards.straightdope.com/t/fraud-alert/179546/2 "2003-06-04T09:45:44Z")
Looks legit to me. I clicked on the link and was taken to ebay’s sign-In page. The page I was taken to is identical (both in content and actual URL) to the sign-in page I get directly from [ebay.com](http://ebay.com). Also, the link you posted **is** a valid eBay URL. Anything of the form: [xxxxx.ebay.com](http://xxxxx.ebay.com) is an actual eBay URL. ---
**Author:** ![SoulSearching](https://avatars.discourse-cdn.com/v4/letter/s/848f3c/32.png) [@SoulSearching](https://boards.straightdope.com/u/SoulSearching)\ **Post date:** [June 4, 2003, 9:56am UTC](https://boards.straightdope.com/t/fraud-alert/179546/3 "2003-06-04T09:56:43Z")
I was right. It is a fraud attempt. A very very very good one. The link you clicked does take you to legit ebay signin site. But when I click that same link (from my email) it takes me to this link: [http://cgi3.ebay.com:aw-cgieBayISAPI.dllSignInRegisterEnterInfo&siteid=0co\_partnerid=2@e2io.iwebland.com/](http://cgi3.ebay.com:aw-cgieBayISAPI.dllSignInRegisterEnterInfo&siteid=0co_partnerid=2@e2io.iwebland.com/) And thus the signin sheet you go to will have the URL of this: [http://e2io.iwebland.com/](http://e2io.iwebland.com/) What I did was I type in random letters for username and password and it proceeded to the credit card update page. I did not fill out a single form, I just clicked submit and it brought me to the final page saying: Form Submission successful Thank you for updating your information. Back to Homepage I have already contacted ebay about this thing. I think I may have saved a lot of people heartache and money. 🙂 ---
**Author:** ![squigs](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@squigs](https://boards.straightdope.com/u/squigs)\ **Post date:** [June 4, 2003, 10:11am UTC](https://boards.straightdope.com/t/fraud-alert/179546/4 "2003-06-04T10:11:31Z")
Yep. It’s quite a popular trick. If you have a URL along the lines of [http://www.domain.com@www.fakedomain.com](http://www.domain.com@www.fakedomain.com), most browsers will effectively ignore everything between the http:// and the @. I think the latest version of ie will strip the information in the title bar. Try it yourself = [http://www.ebay.com@boards.straightdope.com](http://www.ebay.com@boards.straightdope.com). (The space bofore the @ is typically a username field. Most sites don’t use it) ---
**Author:** ![tirial](https://avatars.discourse-cdn.com/v4/letter/t/ac91a4/32.png) [@tirial](https://boards.straightdope.com/u/tirial)\ **Post date:** [June 4, 2003, 10:14am UTC](https://boards.straightdope.com/t/fraud-alert/179546/5 "2003-06-04T10:14:54Z")
It’s not just ebay that’s affected by this scam. On a slight hijack, a friend and I both got something similar claiming to be from “paysecurity” at paypal. It asks you to confirm your credit card number and details in a form in the email for security reasons. We looked through the source for it before replying. The catch was that although all the email addresses supplied appeared to go to paypal, the cgi script it activated didn’t. It seems to go to the same domain as your ebay scam letter above. We’ve contacted paypal about this and were told they were taking action. Has anyone else received one of these, or anything similar? ---
**Author:** ![Colophon](https://avatars.discourse-cdn.com/v4/letter/c/f05b48/32.png) [@Colophon](https://boards.straightdope.com/u/Colophon)\ **Post date:** [June 4, 2003, 10:38am UTC](https://boards.straightdope.com/t/fraud-alert/179546/6 "2003-06-04T10:38:42Z")
Yep, any URL containing an @ symbol is a fake. Anyway, thanks for that link… for a laugh, I’ve filled in the “Update card details” form with a variety of suitable messages aimed at the scammer, and submitted them several times: Card number: what a pathetic attempt at a scam Billing address: do you expect people to fall for this? etc etc etc 🙂 Well, it gave me a moment’s diversion anyway… ---
**Author:** ![SoulSearching](https://avatars.discourse-cdn.com/v4/letter/s/848f3c/32.png) [@SoulSearching](https://boards.straightdope.com/u/SoulSearching)\ **Post date:** [June 4, 2003, 10:44am UTC](https://boards.straightdope.com/t/fraud-alert/179546/7 "2003-06-04T10:44:42Z")
> [@](#): > > \*Originally posted by r\_k \* > \*\*Yep, any URL containing an @ symbol is a fake. > > Anyway, thanks for that link… for a laugh, I’ve filled in the “Update card details” form with a variety of suitable messages aimed at the scammer, and submitted them several times: > > Card number: what a pathetic attempt at a scam > > Billing address: do you expect people to fall for this? > > etc etc etc 🙂 > > Well, it gave me a moment’s diversion anyway… \*\* Haha I did the same thing. Card Number: FBI is comming Address: Prison ---
**Author:** ![Keeve](https://avatars.discourse-cdn.com/v4/letter/k/f07891/32.png) [@Keeve](https://boards.straightdope.com/u/Keeve)\ **Post date:** [June 4, 2003, 12:33pm UTC](https://boards.straightdope.com/t/fraud-alert/179546/8 "2003-06-04T12:33:29Z")
Forget this business about the “@” symbol. The text you see might have **nothing** in common with where the link takes you! Guess what happens if you click here: [http://www.yahoo.com](http://www.google.com) This is because the text shown is not necessarily the address that you go to. If you have your “status bar” showing, then it might show you that this link really goes to Google, but very often people just click without looking at the status bar, or (especially in email) the status bar isn’t showing. Whenever I’m suspicious, I try to do a right-click and then check out the Properties of the link. ---
**Author:** ![Colophon](https://avatars.discourse-cdn.com/v4/letter/c/f05b48/32.png) [@Colophon](https://boards.straightdope.com/u/Colophon)\ **Post date:** [June 4, 2003, 12:57pm UTC](https://boards.straightdope.com/t/fraud-alert/179546/9 "2003-06-04T12:57:07Z")
There was, of course, the famous case of [paypaI.com](http://paypaI.com) (that’s a capital i, not a lower-case L, but they look near identical in the IE font), which fooled a lot of people before it was shut down. See [http://news.zdnet.co.uk/story/0,,t269-s2080344,00.html](http://news.zdnet.co.uk/story/0,,t269-s2080344,00.html) “International” URLs using foreign characters, could provide a wealth of new scam opportunities. [This page](http://www.dnso.org/dnso/notes/International-Domain-Names-EP.pdf) (PDF file) highlights the problem: > [@](#): > > If the usage of mixed letters from various alphabets is allowed - and the IETF works on Unicode characters cannot exclude it - then, there will be no more any unambiguous printed URL. The mixed similarly appearance while different code points will create a terrible confusion to consumers, and may kill any hope for safe electronic commerce For instance, I would be able to set up a site called [www.hοtmail.com](http://www.xn--htmail-i0e.com) (where the o in hotmail is actually a Greek omicron, ο ). Can you spot the difference? ---
**Author:** ![Johnny\_L.A](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/johnny_l.a/32/1084_2.png) [@Johnny\_L.A](https://boards.straightdope.com/u/Johnny_L.A)\ **Post date:** [June 4, 2003, 1:07pm UTC](https://boards.straightdope.com/t/fraud-alert/179546/10 "2003-06-04T13:07:49Z")
I received this e-mail in April: > [@](#): > > Dear valued ebay member [_username_] : > > It has come to our attention that your ebay Billing information’s > records are out of date. thats require update your billing information’s > If you could please take 5-10 minutes out of your online experience and update. > Your billing records you will not run into any future problems with the > problems with the online service. However, failure to update your records will result in > account termination. Please update your records by tomorrow. > > Once you have updated your account records your ebay session will not be > interrupted and will continue as normal. Failure to update will result in > cancellation of service, Terms of Service (TOS) violations or future billing > problems. > > Please click here to update your billing records. [_linked_] > > Thank you for your time. > Marry Kimmel > ebay Billing Dept team. Note the many problems. **It has come to our attention that your ebay Billing information’s records are out of date.** “The records belonging to the Billing information”? **thats require update your billing information’s** First word not capitalized. My billing informations _what?_ (Possessive.) **If you could please take 5-10 minutes out of your online experience and update.** Sentence fragment. (A comma would make it a sentence, but it would be an awkward one for an official e-mail.) **Once you have updated your account records your ebay session will not be interrupted and will continue as normal.** Poor syntax. **Marry Kimmel** _Marry?_ Why would I want to marry this Kimmel person? 😕 I did not click on any of the links, but right-clicked to find out what they were. Not eBay. eBay confirmed that this is spam and said they would “take appropriate action”. Since this was an obvious attempt at credit fraud, I filed an official complaint with the FBI. As for the OP, I received that e-mail but the bonehead couldn’t be bothered to get his HTML right. This is how it looks (trimmed): ```auto qjcs ohusilzk jiufhi
``` Hahahahahahaha! Oh, yeah. I’m going to believe _that_ came from eBay! ---
**Author:** ![Balthisar](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/balthisar/32/2825_2.png) [@Balthisar](https://boards.straightdope.com/u/Balthisar)\ **Post date:** [June 4, 2003, 3:35pm UTC](https://boards.straightdope.com/t/fraud-alert/179546/11 "2003-06-04T15:35:56Z")
Wow, Ebay ought do some .htaccess work or something – aside from trying to steal customer information, they’re stealing Ebay’s bandwidth by linking right to Ebay’s artwork! ---
**Author:** ![Urban\_Ranger](https://avatars.discourse-cdn.com/v4/letter/u/e9c0ed/32.png) [@Urban\_Ranger](https://boards.straightdope.com/u/Urban_Ranger)\ **Post date:** [June 4, 2003, 4:03pm UTC](https://boards.straightdope.com/t/fraud-alert/179546/12 "2003-06-04T16:03:05Z")
> [@](#): > > \*Originally posted by SoulSearching \* > The return addy is indeed [support@ebay.com](mailto:support@ebay.com) Return address can be forged as well. You need to check the full header to see where it came from. ---
**Author:** ![Janx](https://avatars.discourse-cdn.com/v4/letter/j/b9bd4f/32.png) [@Janx](https://boards.straightdope.com/u/Janx)\ **Post date:** [June 4, 2003, 5:36pm UTC](https://boards.straightdope.com/t/fraud-alert/179546/13 "2003-06-04T17:36:13Z")
Well! I went over there to include my creative attempt at a credit info up date and the page is 404. Saying it was cancelled for a violation of their TOS. 10 points guys! ---
**Author:** ![critter42](https://avatars.discourse-cdn.com/v4/letter/c/7ba0ec/32.png) [@critter42](https://boards.straightdope.com/u/critter42)\ **Post date:** [June 4, 2003, 5:36pm UTC](https://boards.straightdope.com/t/fraud-alert/179546/14 "2003-06-04T17:36:35Z")
> [@](#): > > \*Originally posted by r\_k \* > **Yep, any URL containing an @ symbol is a fake.** Incorrect. [http://xxx:yyy@www.somesite.com](http://xxx:yyy@www.somesite.com) is a valid format that can be used to access some password-protected addresses. However, this puts the username/password (the xxx:yyy part) in plaintext across the 'net…not good. There are other issues involved as well, but an @ in a URL does not _automatically_ make it fake - highly suspicious, yes, but not necessarily a scam - the important part is after the @ sign (as noted by other posters). Also, it looks like the scam site has been deleted - all you get now is “The page you were trying to access was not found or\*\* has been deleted for terms violation\*\*” (bolding mine) 🙂 😉 😃 - doggone quick work, I must say 🙂 critter42
Recently we attempted to authorize payment from your credit card we have on file for you, but it was declined.