OT: Even old pros get hacked

[Aussie Mark]

I'm not sure what happened, since I'm very careful about clicking on the scam emails from fake ebay sites etc, but at some stage while navigating ebay and being required to enter my password yet again (personally I think ebay causes users to become complacent by requiring you to log in every now and then, seemingly on a random basis) someone hacked my account, and because my Paypal and email accounts used the same password they had some fun with me on Friday night.

I woke up on Saturday morning to messages on my Blackberry saying I'd won an iPhone on eBay, and then my email password was rejected. I soon put 2 and 2 together and got 5, and a phone call to eBay, the Paypal, then my email provider sorted everything out within 2 hours. The interesting part was that the Vietnamese hacker used my Paypal to pay for the iPhone, but because there were no funds in my Paypal account he tried to add funds from my bank account, and because that takes 7 working days and the bank account I have attached to Paypal only had 23 bucks in it, they were screwed.

The morals to this story are (1) use different passwords for eBay and Paypal (2) don't keep money in your Paypal account (3) link your Paypal account to a separate bank account that doesn't have much cash in it.

 

[oli@bass]

Wow. That sucks!

Sorry to hear you were hacked, and glad you had no major damage!!

Good advice on the passwords and Paypal accounts...

 

[daangroen]

that sucks dude!

 

[glockaxis]

Wow, I had to go through something similar recently. I started getting correspondence in French about a phone I supposedly bought but someone else was writing back on my behalf in French!!!! (French Vietnamese????) I sent all that to Ebay and they cleared it up quick. I changed my password to everything and made them all different. What a bunch of losers. We'd have no problems in this world if everyone respected each other and their property. Thank goodness everything turned out alright for you.

 

[Big Poppa]

THere are so many bogus ebay spam that the only time i sign on is to bid

 

[roburado]

Hmmm...maybe, I need to get a new bank account and link that to my PayPal. That's a good idea.

 

[StevieStingray]

wow, that really sucks - sorry to hear that

and thanks for the tips

here's a couple of things i do to keep identity fraud to a minimum...

1) empty browser cache periodically [varies between browsers & OS's, but on Firefox on OS X: Tools > Clear private data

2) i keep a credit card that i use EXCLUSIVELY for internet purchases (and it's obviously the one linked to my paypal account). the catch is that it has a LOW maximum limit, and whenever i have to renew the thing, i keep reminding the credit card company that i want it FIXED at that limit and do not want automatic increases

worst case scenario, i'm out a few hundred $$$

if i need to purchase something expensive, i temporarily add that card to my PayPal account, then remove it once the transaction is complete

sounds like a pain in the neck, but i think it beats the alternative

 

[MacD]

I almost got burned by an ebay scam.

I was selling something, and someone messaged me with a question about my item. The question was something like "Hey I say another auction with the same pictures being used. Is this the same one?" Followed by a link to the auction (Or so they'd want you to believe)

So I click on the link and it brings me to the ebay log in field. I thought it was kind of weird that my info didn't auto populate. Atleast my user name.

So I put in my info, and log in. At that point I clued into why my username didn't come up. I looked at the address and it wasn't ebay's domain. It was similar to it, but there were a few things off.

At that point I went back to ebays actual website, changed my password, my paypal password, and my email password. Thankfully no one got into my account during those 3 minutes of having my password.

If you're already logged into ebay, you shouldn't have to re log in unless you go from ebay.com to .ca or .uk or whatever. And always make sure the website is www. ebay .com /blah blah blah.... (or .ca or whatnot) if there isn anything else between www and .com other than ebay, then you've made a wrong turn.

 

[ScottyBoy]

Hey Mark

Do you think this happened as a result of clicking on a link from an scam email you think you received from Paypal? This is the only way I can see this happening.

I only ask because my wife got an email asking her to login to Paypal to verify something. It was very convincing - even the URL looked "Paypalish" but it wasn't.

The advice I have given my wife is to never login to anything - either ebay paypal etc from a link in an email even if it looks like it has come from them. Always go straight to the site itself and login.

Good stuff you acted on it quick!

 

[timmy5strings]

This also happened to me and someone was actually selling from my account and had changed my address. I didn't notice until I got an email from Ebay saying they canceled the items after they found the fraud. I think I was duped into giving my password on one of THOSE fraud emails. Now I never click on a link without checking it first, by "right-clicking" with the mouse on the link and then clicking properties to see if the address looks funny or bogus. If its bogus, it usually has a numbered IP address or some strange website address. If the address is the same as what the link says, then chances are better its safe. You have to be very careful, I still get those spam emails.

 

[Aussie Mark]

Hey Mark

Do you think this happened as a result of clicking on a link from an scam email you think you received from Paypal? This is the only way I can see this happening.

No, I never click on links in emails, so that's not how it happened. I have heard of scammers embedding links into photos they use in eBay listings, so when you click on the photo you are asked to log in. This is what I think happened, because the number of times ebay requires you to "re" log in is ridiculous (eg. when you want to sell an item, search completed auctions, etc) and can make you complacent. I usually check the URL in the address bar, but must have missed it this time.

 

[ScottyBoy]

wow! Thanks for the info. Scary!

... I have heard of scammers embedding links into photos they use in eBay listings, so when you click on the photo you are asked to log in. This is what I think happened, because the number of times ebay requires you to "re" log in is ridiculous (eg. when you want to sell an item, search completed auctions, etc) and can make you complacent.

 

[jamesattard]

i had a similar incident - read more about it on my blog

 

[Colin]

Mark, that's terrible news. I'm glad they didn't succeed...

 

[oli@bass]

I have heard of scammers embedding links into photos they use in eBay listings, so when you click on the photo you are asked to log in.

Wow! Thanks for the info! I never check for the URL when I surf within ebay

 

[muthafunk]

damit! they have hackers in Vietman already

We're doomed!

 

[TNT]

Thanks to everyone soooo much for the info here!! I probably deserve to be "hacked" more than anyone because I generally trust people, and I'm not that sharp about these things. So far its been fine, but I know if I don't "get with it" I'm going to get bit!! Thanks again guys!!

 

[Nitrix]

"Buy It Now" scam from hackers

I was selling an item (two actually) back in March, and I put a "Buy It Now" price on the auction. Never again!

Both items were "bought". One by a "soldier in Iraq" requesting that I ship it to Nigeria (?!?!). Both items were bought by users who had been registered about 5 minutes and then sent "Paypal requests" to pay for the item with the Ebay auction ID in the subject of the email. That is NASTY because it looks pretty damn legit. I cut the embedded URL's from the Opera browser that I use to read email into a Firefox browser and Firefox actually recognized it as a potential scam (IP address instead of a domain name in one of them). They of course wanted me to confirm my personal information. BTW, I copied from one browser in case it was to trying to key log, or be mailcious via some violation of browser security. The firefox session was running in a separate OS on the same machine. Yes, I am anal.


Dutifully, I report it as fraud to Ebay and relist the items. ZAP! Both items sold right away. One by a "soldier in Iraq" requesting that I ship it to Nigeria......

I was now being targeted by this scumbag. Anything I listed with Buy It Now was being bought immediately. Ebay recommended that I re-register, but I don't want to change my username on Ebay. I have had it for 8 years and this really helps me sell as a reputable auction vendor. It also Pi$%es me off that the victim has to change. I know it is reality, but I hate it.

I waited months before I sold again, and it appears to be OK now.

I just wanted to inform others of the "Buy It Now" scam. Be very aware of the scammers quoting your auction ID as it is easy enough to do and looks very legit that way. They even had the PayPal logo in the email.

 

[StevieStingray]

requesting that I ship it to Nigeria (?!?!)

any time you see "Nigeria", run away!!!

i *almost* got burned once selling an item through eBay, and the winner asked to have it shipped to Nigeria, and paid with an "advance money order" or some such BS. I received an email from "US Postal Services" explaining a money order is waiting for me, and they will release it once they receive the item - as if they're acting as a broker "to keep everyone safe"

seemed suspicious, so i called the US Postal Services, and they said there's no such thing. After rereading the email, I noticed a bunch a spelling/grammar errors that would just not appear on a gov't doc. And the bottom of the email had a footer "Sign up with xyz now for free ringtones" or something. Um, I don't thing the USPS uses some free email service for their correspondence

However, the scammers did a VERY good job making it all look legit, and if I wasn't skeptical by nature, I would have been burned

 

[muthafunk]

Not long time ago I got a message at Myspace from some so called "model" who went to South Africa for a photosession for some glamour magazine. Everything was settled, expensive hotel was booked and stuff, but after the photosession organizers ran away and she was stuck in S.Africa with no money and no retunr ticket and asking to help her out...

I always try not only to mark such emails as "SPAM" but also to fill in "Report Abuse" forms immediately. Too many people are falling for similar tricks and I'm just curious how stupid they should be to send money abroad.