Scary eBay phishing experience

Forums › Off topic › Scary eBay phishing experience

ictgeeknz

255 posts

Ultimate Geek

Trusted

#18485 12-Jan-2008 10:20

I was doing last minute bidding on an item on eBay yesterday morning around 10am, and (unfortunately) was outbid in the last few seconds. If I had won, the sale price would have been about NZ$200.

In my e-mail this morning (it arrived around 2am) was a Second Chance Offer* on the item, with the exact listing number and all.

Firstly, it looked suspicious as it was not the typical e-mail you would receive, if you send messages via the eBay system, which are in HTML (not plain text), and the message had not been Cc'd to my eBay message Inbox.

Secondly, and what is rather scary, is that it the offer had been sent to my Gmail e-mail address. Noting that I've registered on eBay with my Orcon e-mail address.

So, within 16 hours of the auction ending I had been targeted.

*i.e. an opportunity to buy the item if the winning bidder withdraws under certain circumstances

freitasm

BDFL - Memuneh
79250 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#104356 12-Jan-2008 11:27

How would they get your gmail address? Are you sure there's no automatic forward from your Orcon mailbox to your gmail account?

Note that a similar thing was discussed this week, on Trade Me. It was clarified that sellers with more than one item can offer the other items to bidders.

ictgeeknz

255 posts

Ultimate Geek

Trusted

#104366 12-Jan-2008 12:19

Not sure Mauricio. My Orcon e-mail is retrieved (and labelled as such) using Gmail - it is not fowarded. I'm surprised that the message didn't come in via my code230 e-mail which turns up in web search results.

ictgeeknz

255 posts

Ultimate Geek

Trusted

#104368 12-Jan-2008 12:24

Do a web search for 'donderou@aol.com' (the fake sender of the phishing message). Quite obviously it is not the first time...

ajobbins

5052 posts

Uber Geek

Trusted

#104379 12-Jan-2008 12:57

Unfortunately as long as the internet is internet there will be phishing attempts. They key is to be smart about it and know what you are looking for.

If you recieve any email that you are not sure is legitimate, delete it and go into your *bank/trade me/paypal/ebay/whatever* account through the sites known URL. Don't click on the links.

Also always make sure you are making payment via a traceable method. Western Union, for example, is like sending cash in the mail and should never be used to pay for internet purchases.

Always make sure you are running up to date and active virus and malware protection, and run a browser (Such as IE7 or FF2) that has inbuilt phishing filter support.

Phishers are (sometimes) smart, and use interesting ways to get your details. If you had traded with someone on eBay, and given them your @gmail address through eBays communication system (Do they have one?) and then that persons account was phished, the phisher may have gotten your address from there. Same goes if you had left your email address in a question on an auction.

paulchinnz

Circumspice
793 posts

Ultimate Geek

Trusted

Lifetime subscriber

#104410 12-Jan-2008 17:22

I had exactly the same thing happen but after I'd actually won the auction. Got emails to both my gmail and yahoo accounts (both have the same name in front of @gmail.com and @yahoo.com) even though the latter has never been listed with eBay. Guessing phisher simply uses your eBay username and goes to town with it using lots of webmail providers. Caveat emptor!