# How do these ebay scammers send mail from ebay.com? **URL:** \ **Category:** Factual Questions\ **Created:** [October 29, 2004, 4:01pm UTC](https://boards.straightdope.com/t/how-do-these-ebay-scammers-send-mail-from-ebay-com/271867 "2004-10-29T16:01:21Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![KidCharlemagne](https://avatars.discourse-cdn.com/v4/letter/k/ed8c4c/32.png) [@KidCharlemagne](https://boards.straightdope.com/u/KidCharlemagne)\ **Post date:** [October 29, 2004, 4:01pm UTC](https://boards.straightdope.com/t/how-do-these-ebay-scammers-send-mail-from-ebay-com/271867/1 "2004-10-29T16:01:21Z")
I got an email that I believe is a scam that came from: [aw-confirm@ebay.com](mailto:aw-confirm@ebay.com) How can a scammer send something from this address? ---
**Author:** ![Selkie](https://avatars.discourse-cdn.com/v4/letter/s/bbce88/32.png) [@Selkie](https://boards.straightdope.com/u/Selkie)\ **Post date:** [October 29, 2004, 4:06pm UTC](https://boards.straightdope.com/t/how-do-these-ebay-scammers-send-mail-from-ebay-com/271867/2 "2004-10-29T16:06:45Z")
> [@KidCharlemagne](#): > > I got an email that I believe is a scam that came from: [aw-confirm@ebay.com](mailto:aw-confirm@ebay.com) > > How can a scammer send something from this address? They can’t. If you use the “Reveal Full Headers” function on your browser, you should see that it’s actually coming from elsewhere, and only appears to be coming from [aw-confirm@ebay.com](mailto:aw-confirm@ebay.com). ---
**Author:** ![Early\_Out](https://avatars.discourse-cdn.com/v4/letter/e/6f9a4e/32.png) [@Early\_Out](https://boards.straightdope.com/u/Early_Out)\ **Post date:** [October 29, 2004, 4:07pm UTC](https://boards.straightdope.com/t/how-do-these-ebay-scammers-send-mail-from-ebay-com/271867/3 "2004-10-29T16:07:01Z")
It’s very easy to do, but I don’t think anyone is going to pop in here and give step-by-step instructions about how to spoof an email address. ---
**Author:** ![SpaceDog](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/spacedog/32/9932_2.png) [@SpaceDog](https://boards.straightdope.com/u/SpaceDog)\ **Post date:** [October 29, 2004, 4:08pm UTC](https://boards.straightdope.com/t/how-do-these-ebay-scammers-send-mail-from-ebay-com/271867/4 "2004-10-29T16:08:27Z")
Faking the From: line on an e-mail is trival. Since most mail programs trust the from line you’ll see whatever is put there. You can establish the real route the message took and, therefore, it’s origin from examining the full headers (under View/Options from a message window in Outlook). Although these can be faked to be malicious or misbehaving mail gateways. SD ---
**Author:** ![Severian](https://avatars.discourse-cdn.com/v4/letter/s/49beb7/32.png) [@Severian](https://boards.straightdope.com/u/Severian)\ **Post date:** [October 29, 2004, 4:09pm UTC](https://boards.straightdope.com/t/how-do-these-ebay-scammers-send-mail-from-ebay-com/271867/5 "2004-10-29T16:09:27Z")
SMTP, or Simple Mail Transport Protocol, the protocol used to send e-mail on the Internet, was formalized in a far more trusting era. It relies on the sender to properly identify themselves. I could send you a message from [Bill.Gates@microsoft.com](mailto:Bill.Gates@microsoft.com) if I wanted to. Well, I could if I knew your e-mail address. If you look in the header of the message you’ll see that the message didn’t really come from [ebay.com](http://ebay.com). ---
**Author:** ![Severian](https://avatars.discourse-cdn.com/v4/letter/s/49beb7/32.png) [@Severian](https://boards.straightdope.com/u/Severian)\ **Post date:** [October 29, 2004, 4:11pm UTC](https://boards.straightdope.com/t/how-do-these-ebay-scammers-send-mail-from-ebay-com/271867/6 "2004-10-29T16:11:43Z")
> [@Severian](#): > > SMTP, or Simple Mail Transport Protocol, the protocol used to send e-mail on the Internet, was formalized in a far more trusting era. It relies on the sender to properly identify themselves. I could send you a message from [Bill.Gates@microsoft.com](mailto:Bill.Gates@microsoft.com) if I wanted to. Well, I could if I knew your e-mail address. > > If you look in the header of the message you’ll see that the message didn’t really come from [ebay.com](http://ebay.com). Whoops. Simple Mail _Transfer_ Protocol. ---
**Author:** ![Q.E.D](https://avatars.discourse-cdn.com/v4/letter/q/51bf81/32.png) [@Q.E.D](https://boards.straightdope.com/u/Q.E.D)\ **Post date:** [October 29, 2004, 4:12pm UTC](https://boards.straightdope.com/t/how-do-these-ebay-scammers-send-mail-from-ebay-com/271867/7 "2004-10-29T16:12:23Z")
Look at the actual message header. Chances are the scammer simply spoofed the FROM field, which is very easy to do. However, the actual originating email server address will still be embedded in the header, as follows: > [@](#): > > Return-Path: \<[Spoofed\_Address@ebay.com](mailto:Spoofed_Address@ebay.com)\> > Received: from **mail.scammer\_server.net ([xxx.xxx.xxx.xxx])** > by [cortelyou.mail.atl.earthlink.net](http://cortelyou.mail.atl.earthlink.net) (EarthLink SMTP Server) with ESMTP id 1cnxkW3Rt3Nl3py0 > for \<[me@peoplepc.com](mailto:me@peoplepc.com)\>; Fri, 29 Oct 2004 10:02:38 -0400 (EDT) > Received: from WFC (Spoofed\_server.com [216.165.154.127] (may be forged)) > by **mail.scammer\_server.net** (8.12.10/8.12.2) with SMTP id i9TE2Zhi027382 > for \<[me@peoplepc.com](mailto:me@peoplepc.com)\>; Fri, 29 Oct 2004 09:02:36 -0500 (CDT) > Message-ID: \<003801c4bdbf$f1d248f0$d32bfea9@WFC\> If the bolded parts aren’t from an eBay server, then it’s a scam. ---
**Author:** ![KidCharlemagne](https://avatars.discourse-cdn.com/v4/letter/k/ed8c4c/32.png) [@KidCharlemagne](https://boards.straightdope.com/u/KidCharlemagne)\ **Post date:** [October 29, 2004, 4:28pm UTC](https://boards.straightdope.com/t/how-do-these-ebay-scammers-send-mail-from-ebay-com/271867/8 "2004-10-29T16:28:29Z")
Ok, that’s all I wanted to know. I wasn’t looking for insructions. What you all explain is indeed the case with my email. Thanks. ---
**Author:** ![friggae](https://avatars.discourse-cdn.com/v4/letter/f/45deac/32.png) [@friggae](https://boards.straightdope.com/u/friggae)\ **Post date:** [October 29, 2004, 9:18pm UTC](https://boards.straightdope.com/t/how-do-these-ebay-scammers-send-mail-from-ebay-com/271867/9 "2004-10-29T21:18:52Z")
You can forward the message to [spoof@ebay.com](mailto:spoof@ebay.com) so they can investigate the scammer. [http://pages.ebay.com/help/confidence/isgw-account-theft-spoof.html](http://pages.ebay.com/help/confidence/isgw-account-theft-spoof.html)