I received this today:

FPA NOTICE: Suspicious Activity -Section 9- [Email]philip.ohare@******.com[/Email]
Your bank has contacted us regarding some attempts of charges from your credit card via the eBay system. We have reasons to believe that you changed your registration information or that someone else has unauthorized access to your eBay account Due to recent activity, including possible unauthorized listings placed on your account, we will require a second confirmation of your identity with us in order to allow us to investigate this matter further. Your account is not suspended, but if in 48 hours after you receive this message your account is not confirmed we reserve the right to suspend your eBay registration. If you received this notice and you are not the authorized account holder, please be aware that it is in violation of eBay policy to represent oneself as another eBay user. Such action may also be in violation of local, national, and/or international law. eBay is committed to assist law enforcement with any inquires related to attempts to misappropriate personal information with the intent to commit fraud or theft. Information will be provided at the request of law enforcement agencies to ensure that perpetrators are prosecuted to the full extent of the law.

Per the User Agreement, Section 9, we may immediately issue a warning, temporarily suspend, indefinitely suspend or terminate your membership and refuse to provide our services to you if we believe that your actions may cause financial loss or legal liability for you, our users or us. We may also take these actions if we are unable to verify or authenticate any information you provide to us.
Due to the suspension of this account, please be advised you are prohibited from using eBay in any way. This includes the registering of a new account.

To confirm your identity with us click here:
https://signin.ebay.com/aw-cgi/eBayISAPI.dll?OneTimePayment&ssPageName=h:h:sin:US

After responding to the message, we ask that you allow at least 72 hours for the case to be investigated. Emailing us before that time will result in delays. We apologize in advance for any inconvenience this may cause you and we would like to thank you for your cooperation as we review this matter.

Respectfully,
Trust and Safety Department
eBay Inc.
http://www.ebay.com/

This message and any files or documents attached may contain classified information. It is intended only for the individual or entity named and others authorized to receive it. If you are not the intended recipient or authorized to receive it, you are hereby notified that any disclosure, copying, distribution or taking any action in reliance on the contents of this information is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately then delete it from your system. Please also note that transmission cannot be guaranteed to be secure or error-free.

I assumed it to be the normal spoof email but when I entered nonsense for the username and password it said the submitted info was not correct.

The header is:
Return-Path: <[email protected]>
Received: from aamta04-winn.ispmail.ntl.com ([81.103.221.35])
by mta06-winn.ispmail.ntl.com with ESMTP
id <20050610214729.KLAU6731.mta06-winn.ispmail.ntl.com@aamta04-winn.ispmail.ntl.com>
for <philip.ohare@******.com>; Fri, 10 Jun 2005 22:47:29 +0100
Received: from callaway.webserveronline.com ([64.34.171.17])
by aamta04-winn.ispmail.ntl.com with ESMTP
id <20050610214729.YHLA8825.aamta04-winn.ispmail.ntl.com@callaway.webserveronline.com>
for <philip.ohare@******.com>; Fri, 10 Jun 2005 22:47:29 +0100
Received: from scots by callaway.webserveronline.com with local (Exim 4.51)
id 1DgrLk-0005vF-6c
for [Email]philip.ohare@******.com;[/Email] Fri, 10 Jun 2005 16:47:36 -0500
To: [Email]philip.ohare@******.com[/Email]
Subject: FPA NOTICE: Suspicious Activity -Section 9- [Email]philip.ohare@*******.com[/Email]
From: <[email protected]>
Message-Id: <[email protected]>
Sender: <[email protected]>
Date: Fri, 10 Jun 2005 16:47:36 -0500
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - callaway.webserveronline.com
X-AntiAbuse: Original Domain - ntlworld.com
X-AntiAbuse: Originator/Caller UID/GID - [686 687] / [47 12]
X-AntiAbuse: Sender Address Domain - callaway.webserveronline.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Antivirus: AVG for E-mail 7.0.322 [267.6.6]
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="=======AVGMAIL-42AAE2C26057======="

Anyway it looks suspect to me but why would they send me to a genuine eBay login page?


Edited by Phil. (11/06/2005 12:03)