This is Money have published a follow up story today revealing that five more eBay sellers scammed of sales proceeds have come forward. They have jointly lost a total of £70k in the eBay PayPal payment email address scam. Following publication of the story of Richard Crisp, the sellers contacted the This is Money directly.
Fraudsters hacked the sellers eBay accounts and set up fake PayPal addresses on listings and although each individual amount stolen was just a few pounds, over time as the sales rolled in it added up to tens of thousands stolen from these small businesses.
With these cases, the total stolen from the eBay sellers scammed and identified by This Is Money and those who have contacted us directly has now topped £400,000. This is Money reveal that one seller was advised to contact thousands of his previous customers requesting that they do a charge back through PayPal which led to customers accusing him of being the crook. However the chargebacks failed as he had provided tracking for the purchases.
Another seller revealed what is becoming a common theme of the crooks entering his account multiple times switching the eBay PayPal payment email address to the fraudulent one and then back to the genuine email address multiple times in an effort to avoid detection.
In encouraging news from PayPal’s side, one seller was informed by PayPal themselves that an email address similar to theirs was receiving funds from their eBay account. It looks as if PayPal are starting to try to take action even before the fraud is discovered by the seller. It appears that eBay are also attempting to take action from previous reports forcing password changes, refunding fees and unlinking PayPal accounts, although it’s not being made immediately clear to sellers that they themselves then need to amend the fraudulent eBay PayPal payment addresses back to their own and that their funds have been stolen.
We still don’t know how and when eBay accounts are being compromised, but eBay’s advice to sellers makes it pretty clear that two factor authentication is their recommended course of action to halt the fraud for the eBay sellers scammed and to prevent the fraud from taking place on your account. They have given the following statement:
“Millions of people use eBay safely every day and cases like this are extremely rare. We invest heavily in measures to protect our users from privacy and security threats, including investment in teams dedicated to safety, customer service and law enforcement liaison.
Fraudsters use very sophisticated methods to try and circumvent trusted website security and we continuously enhance and update our security infrastructure to tackle new fraud trends.
From enabling two-step verification, to regularly changing your password, we encourage all members to take precautions that will improve the level of security protection on their accounts.
We have reimbursed the fees of the sellers referenced by This is Money as a goodwill gesture.”
– eBay statement to This is Money
7 Responses
We reconcile our eBay sales record to Paypal so this absolutely blows my mind how this can happen. I don’t think the blame can be 100% thrown at eBay or Paypal in this matter as there are a hell of a lot of sellers out there especially on Amazon who click on links on fake emails willy-nilly. Just look on the forums ‘oh I keep getting orders for washing machines but I sell pens, I think Amazon is a bit glitchy as I’ve had 2000 orders today!, no, love you’ve clicked on a dodgy link and opened the door’. Doh! Sometimes, people shouldn’t be allowed on the internet, let alone sell on it.
I don’t feel Paypal’s assertion they have no culpability totally holds water.
You don’t have to be an expert in cyber security to conclude that people opening multiple paypal accounts using an email address ‘@gmajl.com’ instead of ‘@gmail.com’, for example, are clearly doing so for reasons of deception on some level.
@Roger Couple of good points there.
Were passwords phished or not? We get constant emails from fraudsters trying to get our eBay login details, they send out a zillion emails a day and maybe cherry pick the ones that are worth scamming, so it is possible. But like you I am begining to wonder if it is not somebody on the inside.
Paypal have no reall redress regards eBay’s cock-up and their failing to act quickly to prevent further fraud once they were notified.
However, regarding the email address is a good point.
How do scammers open a PP account or get an email address verified if that address does not exist, or they have no access to?
The relevant authorities should be looking into this, after all, what if the stolen funds are being used to fund terrorism?
I got affected by this scam….my case is not part of these statistics…This scam is a huge blow for small businesses, its hard enough spending time to clean up the mess but to spend further time to have it widely spoken about is the not ideal…I would imagine that this scan has happened to 100’s if not 1000’s of eBay sellers….but just remains unreported for the main reason outlined above. I have a feeling there are 1000’s of sellers who are CURRENTLY affected but haven’t it yet.
We have fallen foul to this scam, and got done for just over £2k as we managed to catch it fairly quickly. We are a big seller on eBay and are the market leaders in most of the categories we sell in so this could have been a lot worse.
From what I am hearing, lots of high volume sellers are being targeted, it begs the question how they are getting in to these accounts.
We are all very vigilant when it comes to phishing email so I think this is either compromise of our personal details or they have managed to gain access through third party API applications (which shouldn’t be possible).