Another eBay identity scam

[Paddy]

Got this scam today:

Received: from sccrgxc01.xxxx.net ([IP])
          by sccrmxc11.xxxxx.net (sccrmxc11) with ESMTP
          id <20030820095654s1100a4iege>; Wed, 20 Aug 2003 09:56:54 +0000
Received: from mx5.sjc.ebay.com (mxpool03.ebay.com[66.135.197.9](misconfigured sender))
          by xxxxx.net (sccrgxc01) with ESMTP
          id <20030820095654e01006oo63e>; Wed, 20 Aug 2003 09:56:54 +0000
Received: from dragnet.sjc.ebay.com (dragnet.sjc.ebay.com [10.6.17.35])
        by mx5.sjc.ebay.com (8.12.3/8.12.3) with SMTP id h7K9uheq005842
        for <xxxx@xxxx.net>; Wed, 20 Aug 2003 02:56:43 -0700
Message-Id: <200308200956.h7K9uheq005842@mx5.sjc.ebay.com>
To: xxxx@xxxx.net
From: aw-confirm@ebay.com
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Subject: Change password.
Date: Wed, 20 Aug 2003 02:56:54 PDT

Forgot your password?

If you did not forget your password, please ignore this email.

To choose a new password, please go to the URL below:
(please use it exactly as is including all trailing fullstops)
http://cgi3.ebay.com/aw-cgi/pass/$1&#...4LhiXW2Ln5ifj0a

This request was made from:
        IP address:     81.79.85.197
        ISP host:       user-1477.wfd18.dsl.pol.co.uk

Thank you for using eBay!
http://www.ebay.com

---------------------------

Dead giveaways - the IP and ISP - IN THE UK! Hello? How DUMB do they think we are? eBay NEVER ever sends emails asking for your password or login ID or any other identification. Also - when you look at the header (I've edited it to remove my email addy and ISP info) the sender is misconfigured, and it sure ain't eBay!! I've forwarded this to spoof@ebay.com - which is what ebay asks one to do. (Note - Forward the email, don't copy and paste it or anything else). The page itself looks fairly convincing - but it ain't the page eBay uses for changing passwords.

[ljocampo]

Paddy:  Thanks for the alert.  I'd never fall for that one, but most people never have full headers enabled in their mail programs (including me).

[iGuy]

I clicked on your link Paddy and it leads to an official looking Webpage.  The page itself looks convincing.

Why does that link still work?  Shouldn't e-bay be stopping that?

Ryan

[Paddy]

Well, turns out that the email WAS from eBay, but I did NOT request a password change or forget my password, so one has to assume that someone typed their user ID incorrectly as eBay suggests. And the header info still looks weird to me, though....

Here's the email I got in reply from them this morning:

Hello,

Thank you for writing with your concern.

If you did not request this password change, you can safely ignore the
email you received. As long as you do not follow the steps outlined in
the email, your password will not be changed.

You may want to check with other members of your household to see if
they made the request. Remember, these requests are generated using the
"Forgot Your Password" feature. To request your password be sent to you,
please follow the steps below:

1. Click the "site map" link at the top of any eBay page.
2. From the Site Map page, click the "I forgot my password" link at the
top of the middle column.
3. Follow the instructions on the next page.

When you enter a User ID on the above page, an email is generated and
sent to the address associated with that User ID. Sometimes, the person
requesting a new password mistypes his or her User ID, resulting in the
email being sent to the wrong person. We've found that this is the most

common reason our members receive this email unexpectedly.

As a general rule, it is also a good idea to change your password every
30-60 days, and remember, the best passwords are those which use a
random combination of both numerals and letters. If you wish, you may
change your password here:

To change your password, please follow the steps below:

1. Click the "site map" link at the top of any eBay page.
2. From the Site Map page, click the "Change my password" link under the
"My eBay" heading near the middle of the center column.
3. Follow the instructions on the next page.

Thank you for your time.

Regards,

Holly Morecombe
eBay SafeHarbor
Investigations Team

[ljocampo]

Paddy:

I've had people try to open accounts at eBay using my email address and domain several times.  eBay is a priates den for sure.  Your proactive caution is right on the money, literally.