posted
I haven't used Ebay or Paypal in probably four or five months. A month ago I received an email saying my ebay account had been suspended. Upon emailing Ebay, they said that my account wasn't suspended, and that I must've been "phished" by someone.
I didn't give the phisher any information so no worries from me.
Last week I got an email from ebay about a dispute with another ebayer. Apparently I'd listed something and hadn't sent it to someone after they bought it. I don't know what that is about, and I haven't heard anything back from ebay about it, so I'm not worrying.
Today I received an email from Paypal to confirm a purchase of a Dell laptop. I was hesitant to sign into Paypal from the email link, because if they didn't already have my password, I didn't want to give it to them.
But at this point, what the heck do I do?
Posts: 21898 | Registered: Nov 2004
| IP: Logged |
posted
It's happening to a lot of people. Contact Ebay, from their homepage - do not click on anything in any email and tell them what is going on. I was like you, with an inactive account, and it's now been cancelled.
Posts: 14428 | Registered: Aug 2001
| IP: Logged |
posted
Those emails all sound like phishing expeditions. I get all of them, and I don't have an ebay account. Or a PayPal account. (They don't work in Sri Lanka. )
If you want to check anything, don't follow any links in those emails. Instead, go directly to the ebay site, log in the same way you always do, and see if there's anything there. But DO NOT use any of the links from the emails.
Posts: 8355 | Registered: Apr 2003
| IP: Logged |
posted
Well I don't remember clicking anything in the ebay email, but the paypal email was from "service@paypal.com" and there was a "cancel this transaction" link that I DID click, that in hindsight I perhaps shouldn't have...
I should add that I did go to ebay and paypal separately, ebay said they don't know what it is, and on my paypal account, there's no indication of a transaction.
Posts: 21898 | Registered: Nov 2004
| IP: Logged |
quote:I should add that I did go to ebay and paypal separately, ebay said they don't know what it is, and on my paypal account, there's no indication of a transaction.
Which confirms that it was phishing, not authentic. Posts: 8355 | Registered: Apr 2003
| IP: Logged |
posted
Just because the display name sez "service@paypal" doesn't mean that it really is from them. Both EBay and Paypal use your real name, not just your email address or your registered user name, when sending you legitimate mail. And looking at saved legitimate messages I have from each, they all have my FULL real name, and EBay also includes my user name.
Posts: 4515 | Registered: Jul 2004
| IP: Logged |
posted
When I clicked the link in the fake email it led me back to the paypal site and asked for information which I did not give, figuring it was either some sort of mirror site or something, or that it was somehow being tracked.
I gave them nothing, but opened up Paypal in a separate window and logged in. I emailed Paypal and reported the incident and got a litany of things I should do, assuming I'd given out information. Is my paypal credit card the only thing I should be worried about?
I'm not really even worried about that. The card only has a $500 limit, specifically for situations such as this, and there's only like $100 of room on it, so nothing anyone who stole it would try to buy would go through anyway.
As for you thinking that the link took you to the real ebay site because it looked like ebay - No.
They can also forge the URL in the address bar.
This is why it's so important that you go to ebay.com or paypal.com or bankabc.com from an address that you either type in yourself, get from a search engine, or you have bookmarked, or from some other source that you trust as authentic.
They most likely took you to their own site, complete with graphics and everything else, copied from the legitimate site, to make it look like you were on the authentic site.
You weren't. You were on their site where, if you had signed in, you would have given them your sign in details.
Since you didn't sign in, you're fine, other than confirming to them that the email addy they spammed you at is an authentic in-use email addy, so you might experience an increase in spam as they sell your email addy to others since it's confirmed as valid.
If you had signed in, you would need to cancel accounts associated with that sign in and report what happened to the authentic website.
Posts: 8355 | Registered: Apr 2003
| IP: Logged |
posted
Well, if you can forge all those then your best bet would be to log in and change your passwords.
Posts: 3389 | Registered: Apr 2004
| IP: Logged |
posted
I'm fairly certain that any and all emails that ebay will send you appear as messages on your user account page on their website. Log in normally, and check your messages. That is one very easy way to determine whether these are genuine.
Posts: 2437 | Registered: Apr 2005
| IP: Logged |
posted
"check on the mailing address and make sure that those emails came from ebay.com or paypal.com ONLY"
Doesn't work, ya can't check. Microsoft made it fairly easy to spoof addresses by hiding redirects underneath text, even the text that can be read in the "Source"code provided by using View. As quidscribis says: go directly to the eBay [or Paypal] site, log in the same way you always do, and see if there's anything there. But DO NOT use any of the links from the emails.
Besides being misdirected to fake sites, clicking on email links is an easy way to load a keystroke logger or zombie program into your computer. After which, anything typed into your computer is open to scrutiny by the malware's originator.
"Both EBay and Paypal...looking at saved legitimate messages...have my FULL real name, and EBay also includes my user name."
Which means nothing. Anyone who is willing to buy a business license (or is willing to illegally use someone else's business license) can also buy such information from data-mining outfits for ~$50. And almost anybody else can get that information for ~$50 by providing data-mining outfits with a legitimate social security number, a phone number, an address, etc.
Professional phishers and pharmers often purchase or trade lists containing up to tens-of-thousands of names with such personal information. And purchase price is usually pennies per name.
"The card only has a $500 limit, specifically for situations such as this"
If you are using a credit card or a checking account to replenish the Paypal account, it doesn't have a limit. Paypal will bill your bank/etc for charges that exceed what is currently in your Paypal account.
And in the worst case scenario, your bank/etc will go along with Paypal's request. eg You put $500 into your Paypal account using your checking account, and spend $400. So you'd think your maximum exposure for a theft would be $100. Doesn't work that way. Paypal will send up to $500 to the thief -- taking their cut from the transaction -- then charge your bank up to $400 plus transaction fee, with which your bank will comply. Once the transaction between Paypal and your bank is complete, your Paypal account is $0, which allows the thief to once again steal $500 from your Paypal account. And once again Paypal charges your bank, and the bank pays Paypal. Repeat until both your checking account and your overdraft protection is depleted. Leaving you owing money to the bank and to Paypal. Your bank (credit card issuer, etc) might protect your interests better as part of their policy, but Paypal makes a policy of aiding fraudsters up until Paypal can't get your bank to pay off those fraudulent charges, even if you had made repeated requests that Paypal cease making those payments. At which point, they will bill you directly, and refuse to close your account until you pay off the negative balance.
In that worst case scenario, you might (perhaps even should) be able to recover that money in a few months (or years), but that still leaves you without use of your own money for that time. And unless you make payment on that overcharge, still leaves you with an overdue credit balance (and a blackmark on your credit) for the entire time that Paypal and/or your bank refuse to admit that a fraud had been perpetrated.
The only truly safe way to use Paypal is to purchase yourself a gift card with cash, then use the gift card to open a Paypal account. And use a gift card, paid for with cash, each and every time you wish to replenish that account.
posted
If you get anything from Ebay or PayPal, it is smarter to go directly to the website. Do not hit the link from the e-mail. Trust me, I had the exact thing happen not two months ago.
If there are issues, you can find them by going to the webpage itself.
Posts: 1766 | Registered: Feb 2006
| IP: Logged |
posted
By the way, if you're still getting email from forged senders, get yourself a spam filter that does SPF/SenderID. It will change your life. Posts: 37449 | Registered: May 1999
| IP: Logged |
quote:Originally posted by Lyrhawn: I haven't used Ebay or Paypal in probably four or five months. A month ago I received an email saying my ebay account had been suspended. Upon emailing Ebay, they said that my account wasn't suspended, and that I must've been "phished" by someone.
I didn't give the phisher any information so no worries from me.
Last week I got an email from ebay about a dispute with another ebayer. Apparently I'd listed something and hadn't sent it to someone after they bought it. I don't know what that is about, and I haven't heard anything back from ebay about it, so I'm not worrying.
Today I received an email from Paypal to confirm a purchase of a Dell laptop. I was hesitant to sign into Paypal from the email link, because if they didn't already have my password, I didn't want to give it to them.
Don't click on the link -- just mouse over it, and look at the status bar at the bottom of your browser. This is what phishers do. The link you see on the webpage looks legit, so you click on it. But it really takes you to their site, where they continue to trick you into giving them information. Or download spyware onto your computer.
I've gotten both of the e-mails you describe. And a few other variants as well. Just mouse over the link and see if it's really going to the link it claims. If not, it's BS. Just delete it and put it out of your mind.
Posts: 12266 | Registered: Jul 2005
| IP: Logged |
quote:Originally posted by Lyrhawn: Well I don't remember clicking anything in the ebay email, but the paypal email was from "service@paypal.com" and there was a "cancel this transaction" link that I DID click, that in hindsight I perhaps shouldn't have...
Definitely you shouldn't have. Putting a fake return address on an e-mail is easy. Someone (who I will maim if I ever catch) has been using my domain (starways dot net) to send spam for the last couple of years. It's cute for them, because all of the bounces from accounts with spam protection or accounts that don't exist any more come to me. Periodically, someone who doesn't know better than to respond to spam will send me an angry e-mail telling me to take them off "my list". I write back explaining the situation, and tell them that if I'd been a real spammer, writing to me would only have informed me that their address is a live one. That's probably what you did when you clicked on that link.
Posts: 12266 | Registered: Jul 2005
| IP: Logged |
quote:Originally posted by Lyrhawn: When I clicked the link in the fake email it led me back to the paypal site and asked for information which I did not give, figuring it was either some sort of mirror site or something, or that it was somehow being tracked.
Are you sure it took you to the PayPal site? Or did it take you to a site that looked like it, but had an address like www.paypal.biz.com? That'll look like it's PayPal to the average person, but it's really just a subdomain at biz.com, and has no relation at all to PayPal.
quote:Originally posted by Lyrhawn: Am I probably fine?
You're completely fine, except that clicking on that link will probably increase the amount of spam you receive.
Posts: 12266 | Registered: Jul 2005
| IP: Logged |
posted
If it had been a real spammer, just clicking on the link increased the resale value of his victims' list, and told the spammer/buyer that the victim is sufficiently naive about computer trickery to be worth going after with more elaborate scams.
"Don't click on the link -- just mouse over it, and look at the status bar...and see if it's really going to the link it claims."
Even if the "same link" shows up on your status bar, it is quite possible to spoof the status bar into a lie that hides a redirect. Reading the status-bar protects one from only the clumsiest or laziest of attacks, which admittedly describes nearly all such attempts*. The problem is that the nearly can cost you unless you have really good anti-malware programs which are kept current, as well as practice other good computer security measures.
* Quite possibly purposefully so. A phisher would be stupid to attract the bite of a hacker shark when there are multitudes of more gullible fish in the sea.
Posts: 8501 | Registered: Jul 2001
| IP: Logged |
How would Paypal bill my bank for costs above my credit card limit? They don't have my banking information. All they have is my credit card number.
Posts: 21898 | Registered: Nov 2004
| IP: Logged |
Printer-friendly view of this topic
![[Smile]](smile.gif)
)![[Razz]](tongue.gif)
