Comments on: due to some reasons the eBay policy automatically proclaims you to be the winner by default !

Question: due to some reasons the eBay policy automatically proclaims you to be the winner by default !

acro — Wed, 02 Jan 2008 14:25:43 -0800

After bidding on a high-end cell phone on ebay, at a seemingly reputable Ebay store, I soon received several emails, all purporting to be from the seller (but appearing very automated), telling me that I had won the item (still active at Ebay) and to contact them by email to purchase it. Ebay seems to hide the bidder information and email address, so how are they sending me mail, and why from so many different phishers?

Delivered-To: {redacted}
Received: by 10.65.54.20 with SMTP id g20cs328254qbk;
Tue, 1 Jan 2008 23:45:49 -0800 (PST)
Received: by 10.100.34.16 with SMTP id h16mr29644415anh.114.1199259949461;
Tue, 01 Jan 2008 23:45:49 -0800 (PST)
Return-Path:
Received: from higgins.propagation.net (higgins.propagation.net [66.221.160.21])
by mx.google.com with ESMTP id 45si18201819wri.25.2008.01.01.23.45.49;
Tue, 01 Jan 2008 23:45:49 -0800 (PST)
Received-SPF: pass (google.com: best guess record for domain of nobody@higgins.propagation.net designates 66.221.160.21 as permitted sender) client-ip=66.221.160.21;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of nobody@higgins.propagation.net designates 66.221.160.21 as permitted sender) smtp.mail=nobody@higgins.propagation.net
Received: from higgins.propagation.net (localhost [127.0.0.1])
by higgins.propagation.net (8.13.6/8.13.6) with ESMTP id m027Z3wn015982
for <>; Wed, 2 Jan 2008 01:45:49 -0600
Received: (from nobody@localhost)
by higgins.propagation.net (8.13.6/8.13.3/Submit) id m020eK6a021694;
Tue, 1 Jan 2008 18:40:20 -0600
Date: Tue, 1 Jan 2008 18:40:20 -0600
To: [redacted]
Subject: eBay Offer for Item ([redacted])
From: eBay
Reply-To: {redacted}@gmail.com
Message-ID: <1>
X-Mailer: PHP v4.4.2
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary = PHP-EMAIL477add7491cee

This is a MIME encoded message.
[encoded message redacted]
Dear Buyer,

I'm the seller of the item that you've recently bided through the eBay system - http://offer.ebay.com/ws/eBayISAPI.dll?ViewBids&item={redacted} and i`ve just been contacted by the eBay staff who informed me that due to some reasons the eBay policy automatically proclaims you to be the winner by default !
So if you are interested please tell me what is your best price for my item?And forward this email to {redacted}@gmail.com including this email.
You have oportunity to purchase my item if your offer is resonable for me !! I make this transaction only trought ebay !

Waiting for your answer!
Best regards!

By: smackfu

smackfu — Wed, 02 Jan 2008 14:44:18 -0800

There's a 'Contact Member' link on each user's profile page that lets you send email to someone without knowing their email address. Maybe they used that.

By: fvw

fvw — Wed, 02 Jan 2008 14:48:41 -0800

Are you using a recognisable username? Often a little creative googling is enough to link accounts across sites.

By: fvw

fvw — Wed, 02 Jan 2008 14:49:15 -0800

Where I wrote recognisable I meant distinctive, one that isn't used by lots of other people on other sites.

By: acro

acro — Wed, 02 Jan 2008 15:00:28 -0800

fvw, good suggestion, easily automated too.

By: pluckysparrow

pluckysparrow — Wed, 02 Jan 2008 15:21:09 -0800

I suspect you might be getting targeted by a 3rd party who has nothing to do with the transaction and is looking to take advantage of you. There's an increasing phenomenon of scammers contacting bidders on high dollar items and pretending to be the seller looking to do either a second chance or off-ebay transaction. You should contact the seller, using the "ask seller a question" feature so that your email is recorded in the ebay communication system. Ask the seller if they have sent you messages offering to do an off-ebay transaction. I'm willing to bet the seller has nothing to do with these emails.

I sold a high dollar item on ebay earlier this year and some similar scammer contacted all of my runner-up bidders through the "contact member" button, pretending to be me and claimed that the winning bidder had backed out and that I wanted to do a second chance offer. Fortunately, each of my runner up bidders contacted me to confirm this and I reported it to ebay. Had someone actually fell for this scam, they would have sent a large sum of money to the scammer and received nothing in exchange.

DO NOT send money to the person claiming to be the seller.

By: damn dirty ape

damn dirty ape — Wed, 02 Jan 2008 15:42:26 -0800

Ask them to verify their identity by using the built-in ebay messaging system.

Whos to say how they got your email address. For all you know some disgruntled ebay employee copied a database to his flash drive on his last day and sells mappings of username to email addresses to scammers to pay for his Caribbean vacation.

By: acro

acro — Wed, 02 Jan 2008 16:40:37 -0800

The strange thing is the number of these emails I recieved (5), all from different disposable gmail or hotmail addresses. I was thinking that there might be a bit of script kiddie software that automates the process (and that ebay should be defending against).

By: willpie

willpie — Wed, 02 Jan 2008 16:41:57 -0800

I don't have anything useful to add, except that the same thing happened to me. Oddly, though, the spam was consistently for a different phone than the one I had bid on. Even more oddly, I won the one I bid on, bought it, have it, and don't need another one, thanks.
I would not recommend replying to the emails; that just confirms to the spammers/phishers that they do indeed have your email address correctly (in case there was any doubt).
You might look around the ebay security center page for someone to forward it to. I kind of doubt there's much they can do about it, though.

By: acro

acro — Wed, 02 Jan 2008 16:50:54 -0800

@willpie I forwarded some of the messages to phishing@ebay.com (it wasn't listed anywhere, but seems like it might be a catchall address).