Take care and double-check what you’re clicking on in the next few days when it comes to eBay related emails because a clever spoof email is doing the rounds.
It seeks to tempt you into providing your debit or credit card details to a dummy site by fooling you into thinking your eBay payment method card has expired. We’ve blurred user IDs and emails addresses in the image we display, needless to say.
A spoof email aims to trick people into giving up info by pretending to be from a reputable source. We’ve had numerous sellers alert us this evening to this clever email. You can find the image below.
This email looks especially plausible because it includes not just your eBay user ID but also your registered email. Eagle-eyed sellers have noticed that it is a spoof. We’ve seen no alerts from eBay on the matter.
We are forced to wonder if this sophisticated spoof is using information garnered by phishers and fraudsters from the hack eBay reported nearly a month ago, that happened earlier in the year.
Indeed, eBay has been very tight-lipped on what the result of that security breach might be. It has, however, asked all users to change their passwords.
But it isn’t beyond the bounds of possibility that the secure data stolen was User IDs and passwords which could be used in spoof/phishing emails. A change of password wouldn’t stop such information being so very useful for people who want to relieve you of your bank details via a spoof email.
Protect yourself by only relying on emails in your eBay My Messages account. If you need to update your card, they will tell you there.
Don’t click on any of the links you find in emails similar to one the we are showing below.
We’ll be asking eBay for clarification on this issue. Have no fear.
10 Responses
We found this email in our inbox this morning.
It’s worth noting that it also showed as being from “[email protected]”, which does look very legitimate.
However, also worth noting that they have used the old eBay logo so not that credible
I got that one yesterday and forwarded it to eBay. I actually get several similar each day – honestly, several each day – and I forward every single one. Must be said, most have crappy grammer, typos, etc, but a few are VERY good and I can see how people would easily fall for it.
Simple way to figure genuine eBay from phising is eBay will nearly always address you by your full name and not by your eBay ID, email, or “dear member”. PayPal have the same policy. Whilst there are a few exceptions they are rare and in those circumstances you will probably relate the message to something already going on with your account so you should know if it’s genuine. Nevertheless, still be careful.
But to be safe, and this applys to much more than just eBay or PayPal, NEVER click a link within an email unless you are 100% sure who the sender is and trust them. Also, never open uninvited attachments, photos, etc.
Furthermore, if you do click a link and it then asks you to “log in” – be suspicious!! Be very suspicious!!
If you do get something you are not sure about, forward it to eBay or PayPal. The emails for forwarding anything you think may be dodgy is:
[email protected]
and,
[email protected]
Don’t be shy, report anything you think may be dodgy. eBay appreciate the heads up and easily filter out peoples mistakes. Don’t worry about wasting their time. They don’t mind at all. Report anything that doesn’t seem right, it helps to make the community safer for everyone.
OK they can get thousands of eBay ID’d quite easily but how have they got the email addresses with the ID’s ?
It’s all pointing to that security breach I think ?
If people are concerned about these (and other) phishing emails, it really helps to have some password-filling software, such as Roboform, which I’ve used for years. (There’s a free version for up to 30 passwords but it’s very cheap anyway!)
When installed, it sits as an extra toolbar on your browser and remembers (securely!) all your passwords for all the sites you visit.
So if you click on a phishing site by mistake, it doesn’t pop up because it always checks the site address precisely for you, and so you know you’ve been redirected or whatever.
Highly recommended – it also generates strong random passwords, fills forms with all your name and address details (incredibly useful!), etc etc.
A great ‘failsafe’ tool – and free too. (Plus it spares my poor brain from having to remember all my new extra strong passwords!)
pleased to report that both hotmail and gmail spam filters are working, both have succesfully blocked this email from reaching our inbox (but its in the spam folders of both).
they can be as clever as they like
we get our paypal account suspended 20 times a day
bank accounts froze credit cards refused etc etc etc
we dont take a blind bit of notice of any email or message of this nature
so if ebay really do close or suspend our account it wont matter
lol
We had this email too. We get lots of similar emails but this one was different. It went to an email address that we use exclusively for correspondence with eBay and nothing else. This must have resulted from the hack. eBay need to tell us exactly what other information was taken.
Back in 2006 I fell for a PayPal spoof. It was also the only time I fell for one. It was very similar, sent directly to my PayPal email address (not my eBay address), and it indicated that my credit card had expired. It actually had just expired and I had been putting off adding the new expiration date so finally relented. About a minute later I remembered I didn’t verify the URL like I always do before clicking it. By then they’d already changed my password. Fortunately I had a second login id and password for the account and just took it back before they could do anything.
As I’ve said in the past here and was even hinted by Chris in a post years ago there was a security hole that let any unauthenticated user find the PayPal payment address for any listing. And that’s how they got me.