I just got an email from eBay SafeHarbor asking me to confirm my username and password.
It looks legit, with the logo, the links seem to go to its site, etc. – but I’ve been hearing about a scam to get people’s ebay passwords, so I’m a little chary.
So – should I answer or ignore?
Don’t touch it with a bargepole.
“View source” on the mail and see where the form response actually goes: that email might be drawing all the graphics from eBay and pulling down the images from the eBay site, but the form almost certainly gets sent to a crook.
(If you don’t know how to do this, feel free to mail it to me and I’ll have a look.)
No. Those are never legit. Foward it to spoof@ebay.com with full headers.
I have no idea how I managed to say the same thing in different ways twice in the same sentence. Substitute “linking to eBay” for one of them.
Does it ask you to mail the details (in which case it’s 99.9999% likely to be dodgy), or to enter them at a webpage?
In either case, could you post the email address/the webpage address that it’s asking you to use?
I wouldn’t give them any information. Checkthis out. It clearly states e-bay will never ask you for that kind of information in an e-mail. Probably a scam.
Contact ebay my friend. That’s my gut feeling. Indeed, when it comes to the internet, you can never be too cautious.
Recently, I bought a lovely restored Mustang via ebay from a very reputable car dealership in Miami, Florida.
I wired over all the money, including shipping costs to bring the car via the Panama Canal down here to my home in Australia.
I had to sign various Bill of Sale documents, and I was asked to forward over some proof of identity and proof of address data. So I sent some jpegs of utility bills etc. I was asked if I could send a copy of my Drivers License. I said “no way”. But the Miami firm was really insistent - they really wanted a copy of my Drivers License.
Eventually I explained the deal to them… “You’ve got my money… it’s already in your bank account. I’ve sent you jpegs of every imaginable proof of identity you could ask for. What do you TRULY need my Australian Drivers License for, really? There is absolutely NO WAY on God’s earth that I am going to send a jpeg photograph of either my Drivers License or my Passport photo out into the great unknown that is the internet. This is NOT negotiable - sorry.”
And eventually they saw my point… sending a Primary proof of ID like a Drivers License or a Passport just leaves yourself so incredibly wide open to something VERY BAD happening to your bank account etc.
So… I repeat… you can never be too cautious regarding the web. Contact ebay - send them an email explaining your concerns.
Big time scam. I got the same thing a few weeks ago. It does look legit but it’s not. There’s a couple of threads over in GQ about what to do.
Thanks, everyone! jjimm – thanks for the offer; you correctly discern my lack of techno-savvy. I’ll put “SDMB - twickster” in the message line. (BTW – how’s your compost pile? Did my suggestion that you add shredded newspapers work out for you?)
SimpleDreamer – who or what is spoof, and why should I forward this to him, her, or it?
Ashkicker – expired link.
Edward – D’oh! I should have checked GQ, I always skip the computer threads there, so forget that’s the right forum.
I really love how Dopers rally 'round and offer help without, well, making fun of me. 
Fighting ignorance, not mocking it, eh?
If you go to the “Community” section in the discussion boards at Ebay they have a thread saying what to do if you think you’ve gotten a fraudulant email. That is the email addy they say to send it to. I just sent one a couple days ago to that email address. They investigate the possibly fraudulant emails forwarded to that address.
I meant to add that it was specifically in the Bidders board I found that email, if you need to go check it out. 
Thanks, SimpleDreamer – you can understand that since today is “Be Suspicious of Email Intstructions” Day, I’d want a little additional clarification. 
Not a problem. If I’d been thinking clearly (hadn’t had enough caffine yet) I’d have told ya all that origionally. They’re getting really good with these fraud emails though. The one I got was a scam wanting me to enter to “win” a car… just needed to varify my ID and password. :rolleyes:
OK, twickster, here’s what I’ve found out:
The email originates from a dialup of Chungwha Telecom ISP in Taipei, Taiwan.
Every image and link in the mail is bona fide. Except, as I thought, the form submit button - when you hit the “submit” button, it will send your username and password to a cgi script at a site called “cgi.wish.net”. Goodness knows what happens to them then - whatever, it can’t be good!
(P.S. I did indeed add newspaper to my compost heap, and eventually used most of the heap to make the basis of a rock garden. Great advice. Thanks!)
Missed a bit:
When you submit the mail, it uses that cgi site to email your details to usersandusers@yahoo.com, whoever the hell they are… I suggest you report that email address to Yahoo abuse too.
Excellent – the Doper Team kicks ass, as usual.
SD – I forwarded it to spoof, and got a quick reply from the fraud team at ebay, who recommended I change my password. Not a bad idea – except now I’ll have to remember a third password (I’ve got my five-letter usual, my longer-than-five letter usual, and now… sigh.)
jjimm – thanks! (and ain’t compost grand?)
Again, thanks everyone!
Mama Tiger has gotten several of these sorts of things. Don’t be surprised if more show up down the road.
There’s these fake emails from eBay and from Paypal. Neither of them will ever ask you for this info in an email, so you can either do as I now do (after having reported the first couple), which is delete them unread, or you can continue to report them if you want. My suspicion is that the people doing them keep moving around enough that submitting them to the folks at eBay or Paypal ultimately doesn’t do a lot of good. I do warn my less techno-savvy friends about them, however.
Papa Tiger got one the other day asking for all his Citibank online account information. We don’t HAVE a Citibank online account. He immediately got on the phone with them, and they said, oh yes, it’s phony, just delete it, we’ve got too many of 'em to deal with now as it is. So some folks don’t even want the phony emails any more, either.