eBay fraudsters?

I'm currently selling a couple of Xeon CPUs on ebay http://cgi.ebay.co.uk/ws/eBayISAPI.dll?ViewItem&category=14293&item=3454372531 and have been getting requests to sell early which I've declined.

But I received an email last night with promises of large amounts of cash for the item and any identical items.

It was from an eBay user, but it didn't seem right - he said he was in Hungary, wanted to go via Escrow, and the items had to be sent via DHL or FedEx immediatley. When I searched for this user on Ebay, hes located in the USA, has a huge positive feedback and had nothing to do with CPUs or IT equipment. Alarms bells were ringing, so I emailed via ebay to check it out and got a reponse from a weird Yahoo account confirming he'd contacted me.

The eBay guy has an eBay shop, and the name on the shop is NOT the guy who answered me. I'm beginning to think this guy in Eastern Europe is using his account (and has changed the contact email) in a bid to gain peoples trust into sending them items. Small valuable items, Eastern Europe, Escrow??? Seems dodgy to me. Anyone else or am I just being paranoid?

I'd like to get the details of the eBay guy to warn him, but I can't access his details as I'm not involved in a transaction. Do I leave it? I'd want to know if it was me. Maybe its all ok, but at the back of my mind theres something odd.

Greetings!

Report it to ebay immediately. My guess is that someone who spent a lot of time building a good reputation had his account attacked by someone else, and that the cracker is now using that account fraudulently. Escrow, and all of the other security measures, would be binding against the owner of the account, not the cracker.

eBay has had a lot of trouble with fraud email recently - part of a phishing scheme to get account data.

Report it. It is likely that the original account owner would thank you for it.

Personally, I'd be very leary... I'd report it to ebay. I've been getting huge amounts of those emails from people pretending to be ebay asking to fill out forms with all your personal information. 10 bucks says the real buyer stupidly filled one out and is now paying the price.

ya beat me to it Paul

Yeah, my gut feeling too. Consider it reported.

Greetings!

By the way, always send those email spoof to the fraud alert / spoof investigation address on ebay or whatever service you are looking at. Granted, there is not likely much they will be able to do, but even if they can nail one of the crackers, it would be worth it.

The guys not onto me, I could always mount a covert operation! Whos with me?!

It sounds like a scam to me. I bet that the 'buyer' fell for one of those fake ebay emails and gave his login credentials to the scammer. I reckon that the escrow service will turn out to be owned by the scammer too.

I'd contact ebay.

Tempting, but you are better off reporting it now. Even if he is not on to you, he may have lots of other deals pending with other sellers...

All reported. Here is a copy of the email I received from him:

Hello,

I am very interested in your product. I am ready to buy it right away. For the safety of the transaction I want to close it through an escrow service on my choice because the amount is bigger and escrow protects buyer and seller in the same time. I will pay all the escrow and shipping fees.

I am located in Hungary, Europe. For shipping I would like to use DHL, UPS or FedEx.

I might be interested in more then one item (if you have available).

Please let me know the price you are willing to close a deal right away!

Thank you
--------------------


Question from: [censored by me]
Title of item: PAIR of Intel P4 Xeon 3.06GHZ CPU's
Seller: philip.ohare
Starts: Jan-19-04 10:40:58 PST
Ends: Jan-26-04 10:40:58 PST
Price: Currently GBP 393.00
To view the item, go to: http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=3454372531

www.Manager-Escrow.com

Dubious to say the least;

whois manager-escrow.com reports;
Registrant:
Kiril Gantchev
217 N Park Blvd.
Streamwood, IL 60107
US

Registrar: NAMESDIRECT
Domain Name: MANAGER-ESCROW.COM
Created on: 11-JAN-04
Expires on: 11-JAN-05
Last Updated on: 12-JAN-04

Administrative, Technical Contact:
Gantchev, Kiril [email protected]
217 N Park Blvd.
Streamwood, IL 60107
US
630-855-3447

The person named above is probably some poor sucker, possibly a victim of a credit card scam. The surname matches to the address in anywho.com. It might be interesting to find out whether this Kiril person has any knowledge of this registration.

Furthermore, clicking on the Verisign identity check link on the site calls a php script at www.manager-escrow.com that returns a page purporting to be from https://digitalid.verisign.com. Right-clicking and checking the page info will confirm that the page is wrong - It is neither on Verisign's server or on a secure (https) server. The javascript link is purely to obscure this by placing false link information in the browser status bar.

It doesn't look good.

For kicks, suggest an escrow service of your own just to see what BS excuse he comes back with,

I think that's it right there. If you don't use his bogus escrow service, it doesn't work for him. If you suggest a real one you'll probably never hear from him again.

Wow, I knew they did this crap with real money objects like cars, I didn't think they'd bother with something this small (in comparison anyways). These guys must send thousands of emails a day just hoping for a hit, if they go this far down the value pole.

"Mail fraud". I bet postal inspectors wouldn't care yet since nothing happened...

Post the guy a couple of 486DX33's and see if he complains?

DX? I wouldn't waste a maths co-processor on him!

"Mail fraud". I bet postal inspectors wouldn't care"

Which is probably why he requires a non-postal courier, to avoid mail fraud charges if he's ever caught.

I suggested a different escrow and he replied with...

Hello There,

Then we have no deal.

Thank you

While it's tempting to email back a "Piss off you scamming bastard" message, it would be more useful to report all of the details to both ebay and the FBI's internet fraud center.

Postal inspectors dressed in UPS uniforms apparently made Nigerian scam arrests nearby a few weeks ago.

From eBay....

Hello,

Thank you for your report.

As you are probably aware, email solicitations for outside of eBay transactions are prohibited and are a violation of our user agreement. However, our initial review leads us to believe that you are correct and the email you received may actually be the result of an unauthorized account takeover. We are now in the process of verifying the actual sender and will restore the account to its true owner if necessary.

Hi,
My name is Kiril M. Gantchev... I am the person that you mentioned in your comment: the "poor sucker" who is a victum of credit card scam (I actually find it amusing, no hard feelings on my side). I found my name by googe-ing it, so I was hoping to shed some light on this:

I really didn't know that this site existed untill verisign contacted me and said that I have been using one of their logos illegaly on my web site... needless to say I was more surprised than a 5-year-old on Christmas morning.

BR
Kiril (Chris) Gantchev

Heh heh, always interesting to see "vanity surfers" popping up on forums after searching on their name. Out of interest how long did it take for you to discover the problem, how does it match up with the dates on these postings? I guess nobody else followed up the whois information?

Gareth

I think that this issue was discovered within the first month of the site being registerred... I hadn't noticed the small $8-$20 charges that were used for domain registration on my debit card. Verisign called me about the logos, then they told me to check with my bank, and then it all made sence: I had been scammed.

BTW: nobody but verisign followed up on my "whois" information... I didn't get any funky calls.

Chris