A fairytale of eBay phishing

On the subject of phishing, which seems to be topical this morning, a friend has been subject to an attempted phishing attack via eBay (I've seen one of these before also - but not this bad) and the phisher is certainly relentless.

In a positive start to the case, eBay did alert him of the attempted attack early on - and very well. Sadly the attempted attacker won the bid for his item on the site.

Most of the e-mails below show some really bad spelling and grammar, and have been cut and pasted as is (with only identification details removed) - another sign of phishing!

E-mail Number 1 (genuinely from eBay):

Notice: Administrative Bid Cancellation

Hello (seller),

This email is to inform you that any recent bids placed by (phisher) may have been by an unauthorized third party. We are now in the process of restoring the account to its true owner.

If this person was the winning bidder for the transaction then the transaction in question should be considered null and void. You may relist the item and request a credit for the Final Value Fee. When a seller submits a final value fee credit request, unpaid Items are automatically identified by our system. Our system will then keep records of the credit requests that are received from sellers regarding transactions that were not completed.

You may file a "friendly" unpaid item dispute (UPI) remark in order to request the fees for your auction and this will not negatively affect this member's account. You can request a Final Value Fee credit through Unpaid Item Disputes by following the steps below:

1. Go to the eBay home page
2. Log in to your My eBay page
3. Under the "Related Links" box on the left side of the page, click the "Unpaid Item Disputes" link

For more information on how to request a credit, I encourage you to view our Frequently Asked Questions page below:

http://pages.ebay.com/help/policies/unpaid-item.html

Thank you for being an asset to the eBay trading community. We wish you continued success with your transactions on eBay.

Regards,

Customer Support (Trust and Safety Department)
eBay International AG

The next contact he heard was in response to the invoice that the (suspected) phisher received from eBay, from the phisher to him direct.

E-mail Number 2 (from the phisher):

Subject: Re: Your invoice for eBay purchases - item # (removed)

I am the winner of your item,And am sending this item to my Husband as
a Xmas Gift.Which is currently in Ibadan Nigeria for a project, I will be
paying you for this deal to be conclude very fast with my PAYPAL account and you will receive your payment confirmation immediately and also confirmation from eBay .I would havelove to send the item to Nigeria myself but i'm not presently in America. I scout for young players and i'm presently in South America, Brazil to be
precise.Please let me have the total cost of the item ,ROYAL MAIL which I found to be more secured and efficient. and i will offer you 30.00 GBP for the P&P with the
total cost of the item and arrange for the payment.Do get back to me as soon as possible.

Below the Delivery address :
NAME: (removed)
ADDRESS: (removed)
CITY: (removed)
STATE : (removed)
COUNTRY: Nigeria
ZIP-CODE (removed)
TEL : (removed)

Please note,my ebay account was tampered with that is what cause the cancellation of the Bid.Am sorry for that,But i will be paying for your item now,as i have contacted
ebay about it.

Best regards

Having been alerted to the attempted attack by eBay, as you can imagine the response takes this into account.

E-mail Number 3 (in response to the phisher):

Subject: Re: Your invoice for eBay purchases - item # (removed)

I was contacted by Ebay to say not to trust the bid and therefore have sent out a second chance offer. They haven't responded yet. I would be happy to send it to Nigeria for you as long as you pay by Paypal up front as you have stated below. You must also take full responsibility for the item once it has left the UK. I will send it using Royal Mail using their International Signed for service which provides tracking within the UK so I know it has at least left the UK. Once it goes in the plane and off to Nigeria I can not guarantee what will happen and will offer no refund if it doesn't arrive. Royal Mail state that this will take 5 days to get there and if you pay today I will post today to give it the best chance of getting there for you. I can't guarantee how the Christmas post will effect these time scales and it may not get there by Christmas - so you will need to accept that risk.

So with all the above in mind, £20 GBP P&P will suffice, plus the cost of the phone at £26 GBP as per your bid. So the total cost to be paid by Paypal is £46 GBP if you decide to continue.

Thanks.

Now this is where it gets interesting, with the first attempted scam e-mail to my friend. The part in the brackets below that is now represented as (phisher) is exactly the same username as the purchaser had on their eBay account, which has since been nuked.

E-mail Number 4 (first attempted spoof):

TKO NOTICE: eBay Listing(s) Restored Successfully.

Dear eBay Community Member,

This message was originated from the eBay and PayPal team. We apologize for the cancellation of your eBay Item, it was an Error 908 on the eBay Data Base. The eBay & PayPal Team has both agreed to erase the cancellation of the item from the eBay Data Base both. We have confirmed that (phisher) is the truly owner of the account, so we urge you to complete the transaction with him/her so as to receive your funds inside your PayPal account.

We have been informed by PayPal Authority that the money will not get into your account until they have confirmed the shipment of the item. You can now go ahead and proceed with the shipment of the item so as to receive the funds in your account.

Thank you for using eBay and we look forward to many more successful transactions!

Sincerely,

Scott Shipman
Counsel -- Global Privacy Practices
eBay & PayPal Inc

And given that PayPal is an eBay company, anyone with half a brain would have spotted something up!

Two hours later, the next scam comes through.

E-mail Number 5 (Scam attempt #2):

Respond To eBay Item.

Dear (seller),

We are contacting you about the following item: # (removed)

The buyer "(phisher)" has made payment for your item and the item is yet to be posted to the given address in Nigeria .We will like to know if you have posted the item so that your account can be credited immediately you forward the tracking number to us .Note that you have committed yourself that you are going to send the item out.

Please respond by Dec-14-2007 so eBay knows whether you have agreed.
Respond to this notice or your account will be block.

Please note: You and the buyer will still be able to leave feedback for each other regarding this transaction.

Thank you for your patience and cooperation in this matter. Please don't hesitate to contact us directly through this email if you have further queries or require assistance.

Regards,

Customer Support (Trust and Safety Department)
eBay International AG.

So the e-mails are starting to get relentless and frequent, as the phisher tried to bully / scare him into sending the item with Christmas only 11 days hence. And the first threat of supposedly losing his eBay account - "your account will be block" [sic].

The next e-mail received (hope you're keeping up here) was another direct contact from the phisher. And just minutes later.

E-mail Number 6 (from the phisher direct):

From: Service@PayPal.co.uk <(phisher's supposed e-mail address)> Subject: payment has been made for your item...

Hello,
Am very happy to inform you that your payment has been made , and i hope they have contact you concerning the confirmation for the payment via paypal, because i just receive an e-mail confirmation from pay pal and they mail me that your payment has successfully deducted from my account, and i hope they should have contact you with the payment confirmation by now.. and i want you to check your Inbox or Bulk for the confirmation I want the shipment via ROYAL MAILS .And immediately you receive the payment confirmation i want you to notify me.

Below the Delivery address.

Delivery address :
NAME: (removed)
ADDRESS: (removed)
CITY: (removed)
STATE : (removed)
COUNTRY: Nigeria
ZIP-CODE (removed)
TEL : (removed)

It's great transacting biz with you

The phisher seems top have taken a break for a couple of days, before coming back to try to get the details of his eBay account.

E-mail Number 7 (Third attempted scam):

Respond To eBay Item.

Dear Valued Customer,

During our regularly schedule account maintenance and verification of the accounts, we have detected a slight error in your current information linked to PayPal Account. This might be due to either following reasons:
- Submitting invalid information during the initial sign up process,Also inability to accurately verify your selected option of payment due an internal error within our processors.we apologize for the mixed up that occur on our system that cause the cancellation of your item on our list.Due to this error,We know you could have ready to relist the item since we did not inform you about the issue.So we apologize for this and if you have re-listed your item you can now end the auction now and ship it to the buyer address since the buyer have already made the payment for your item.We have already contacted PayPal about this issue and with all our investigation,We were inform that your Buyer has made the payment for your item,and they have deducted your money from your Buyer Account, and is ready to be credit into your Account,Once we confirmed the shipment tracking number and we confirmed that the item has been posted for delivery abroad,your money will be credited into your account immediately.

We apologize for any inconvenience this may cause and appreciate your prompt attention in helping us maintain the integrity of the entire eBay System.


Below the Delivery Address :

NAME: (removed)
ADDRESS: (removed)
CITY: (removed)
STATE : (removed)
COUNTRY: Nigeria
ZIP-CODE (removed)
TEL : (removed)

Please note: You and the buyer will still be able to leave feedback for each other regarding this transaction.

Thank you for your patience and cooperation in this matter. Please don't hesitate to contact us directly through this email if you have further queries or require assistance.

Regards,

Customer Support (Trust and Safety Department)
eBay International AG.

By now this is starting to tire out me reading them, let alone the phisher. They are relentless though, and there's still plenty more to come.

Two days later they're at it again - this time all PayPal branded:

E-mail Number 8 (Fourth attempted scam):

Subject: SHIPMENT REMINDER....

(PayPal banner)

Dear Valued Customer,

We are Contacting you Concerning the Transaction Between you and your Buyer,We hereby notify you that your Buyer has made the Payment for your item and is already updated in our Data-Base Also ready to be Credited in your Account,But we are waiting for you to Send us the Shipment proof i.e the shipment Tracking number to verify the shipment or you Scan us the shipment Receipt to be sure that the item has been posted Abroad for Delivery in Nigeria before We Transfer the fund into your Account.Once you send Us this information Requested from you,We shall Credit your money into your Account immediately. We apologize for any inconvenience this may cause and appreciate your prompt attention in helping us maintain the integrity of the entire eBay System.

Below the Delivery address :

NAME: (removed)
ADDRESS: (removed)
CITY: (removed)
STATE : (removed)
COUNTRY: Nigeria
ZIP-CODE (removed)
TEL : (removed)

Thank you for using PayPal!
The PayPal Team
-------------------------------------------------------------------------------------------------------------------
PROTECT YOUR PASSWORD

NEVER give your password to anyone, including PayPal employees. Protect yourself against fraudulent websites by opening a new web browser ( e.g. Internet Explorer or Netscape) and typing in the PayPal URL every time you log in to your account.


-------------------------------------------------------------------------------------------------------------------


Please do not reply to this email. This mailbox is not monitored and you will not receive a response. For assistance, log in to your PayPal account and click the Help link located in the top right corner of any PayPal page.
PayPal Email ID: shipments-acess

PayPal, an eBay company
Copyright © 1999-2007 PayPal. All rights reserved.

And liking the security warning at the bottom of the e-mail, which is rather ironic.

The ninth e-mail (bear with me, we're nearly there) threatens closure of his PayPal account within 24 hours if he doesn't send it immediately - and also threatens removing his ability to sell on eBay unless he dispatches the item.

E-mail Number 9 (Fifth attempted scam):

Subject: WHY DELAY SHIPMENT....

(PayPal banner)

Dear Valued Customer,
We are Contacting you Concerning the transaction between you and your Buyer.By now you should have got the item shipped to the delivery address in Nigeria given to you by your Buyer and send us the shipment proof ( i.e) the Shipment tracking number or you Scan us the shipment receipt in Order to credit your Money into your Account.Since the order has been Approved and We have Confirmed that the Money have successfully been paid and Deducted for the item,And also ready to be Credited into your Account.But We don't know why you keep on Delaying the item to be shipped .You can now get the item shipped within 24hours or your PayPal Account will be close Down.Since you decide not to ship the item after the payment Has been made for the item.
NOTE;
If your account information is not updated within 2 working days, your ability to sell or bid on eBay will still be allowed. We encourage you to Get the item shipped to the address Given in Nigeria,so that your account can be credited immediately you forward the shipping information to us.
We apologize for any inconvenience this may cause and appreciate your prompt attention in helping us maintain the integrity of the entire eBay System.

Shipping information:
(removed)
Nigeria,
(removed)
Confirmed.

Regards,

Customer Support (Trust and Safety Department)
Account Review Department
Thank you for using PayPal!
The PayPal Team

At this stage my friend is feeling naturally under siege, and believes that this is the last of the mails:

"Talk about being hounded. Basically their objective was to trick me into the thinking the money was there and to send the phone to them. Thankfully my basic principles of not sending something until it has been paid for, paid off in this instance - phew ! Caused me loads of hassle too.

Buggers."

But little did he know, there's more yet to come! Two days later (surely his eBay and PayPal accounts are supposed to have been suspended by now aren't they), another one comes through.

E-mail Number 10 (Sixth attempted scam):

Subject: CONGRATULATION .....

(PayPal banner)


Dear Value Customer,


We are sorry for any in-conveniency this may have cause you.Now that we have Confirmed that the Payment has been made for your item,You can now Shipped the item to the Address given to you by your Buyer. eBay and PayPal will be responsible for any loss that occur during the shipment.And if you have shipped the item already kindly scan us the shipment receipt to verify the shipment and also credit your fund into your account immediately.we are rectifying all errors on our system,please bear with us. ( PayPal is reliable) The payment has been successfully made but due to security reason we have to receive the shipment tracking number before the next 24hour for the processing of your order.This a new measure we are taking to protect both our sellers and buyers against fraudulent customers. Send tracking number to us or email us through this mail shipments-acess
**PLEASE NOTE**
Once shipment has been verified and the tracking number sent to us, You will receive a " CONFIRMATION EMAIL" from PayPal® informing you that the Money has been credited.Note: eBay and PayPal will be responsible for the item loss or damage once we receive the tracking number


Thank you for using PayPal!
The PayPal Team

Copyright © 1999-2007 PayPal. All rights reserved.


PayPal, an eBay company
Copyright © 1999-2007 PayPal. All rights reserved.
PayPal (Europe) Ltd. is authorized and regulated by the Financial Services Authority in the United State as an electronic money institution.
PayPal FSA Register Number: 226056

(JPEG signature)
PayPal

I was particularly amused by "we are rectifying all errors on our system,please bear with us. ( PayPal is reliable)" [sic].

By the time the last e-mail is sent (well, the last so far anyway) you really would have thought that the phisher would get the point ... he's not going to send the item or hand over any PayPal details!

E-mail Number 11 (Seventh attempted scam):

Subject: WHY DELAY SHIPMENT..

Dear Valued Customer,
We are Contacting you Concerning the transaction between you and your Buyer.By now you should have got the item shipped to the delivery address in Nigeria given to you by your Buyer and send us the shipment proof ( i.e) the Shipment tracking number or you Scan us the shipment receipt in Order to credit your Money into your Account.Since the order has been Approved and We have Confirmed that the Money have successfully been paid and Deducted for the item,And also ready to be Credited into your Account.But We don't know why you keep on Delaying the item to be shipped .You can now get the item shipped within 24hours or your PayPal Account will be close Down.Since you decide not to ship the item after the payment Has been made for the item.
NOTE;
If your account information is not updated within 2 working days, your ability to sell or bid on eBay will still be allowed. We encourage you to Get the item shipped to the address Given in Nigeria,so that your account can be credited immediately you forward the shipping information to us.
We apologize for any inconvenience this may cause and appreciate your prompt attention in helping us maintain the integrity of the entire eBay System.

Shipping information:
(removed)
Nigeria,
(removed)

Confirmed.

Regards,

Customer Support (Trust and Safety Department)
Account Review Department
Thank you for using PayPal!
The PayPal Team

I think it's safe to assume that there's not going to be a phone winging its way to Nigeria from this seller this Christmas, nor is he in danger of losing his account from either eBay or PayPal!