to ANYONE selling or buying a vehicle on ebay...

[slade]

...when you make the listing, make sure its a private listing so that the identities of the bidders are kept private.

i bid on a bike on ebay a couple weeks ago and recieved 8 second chance offers for the item. i did again last night and recieved this e-mail this morning:

BA Ca <[email protected]> to me More options 8:44 am (49 minutes ago)
You expressed interest on my item. I'm the owner of that item on which you've recently bided on through the eBay system. However the auction has ended with another member as the high bidder which is no longer interested or the reserve price was not meet. In compliance with eBay policy I'm giving you the chance to buy the item at your last bid price. If you accept this offer the eBay policy automatically proclaims you winner by default. The transaction will go strictly according to eBay's rules and policy and will be supervised by eBay Trust & Safety Department. Just contact me if you are still interested.
Regards

god, how stupid are scammers? not only is he incapable of writing a coherent e-mail, but he sends it as a form letter, and doesnt even mention what the "item" is. he doesnt even say "vehicle". and on top of that, he just put in 4 letters for his name when he registered for gmail.

ive seen a few companies selling vehicles on ebay and they all have private auctions, usually citing this reason (false second chance offers). so if you list a vehicle on ebay, make it a private auction, and if youre looking to buy on ebay... buy locally, and dont fall for any of these stupid scams.

oh, and watch out for craigslist too. i just ran into a scammer there. he would answer every question i had except for what his address was, what his phone number was, and when i could stop by to look at the bike. and the name from his e-mail wasnt listed in the town he claimed to be from.

[personman]

Theres a post in paintball talk about how someone got a similar message when they were outbid for an xmag.. so this goes for anyone using ebay, not just ebay motors.

[slade]

Theres a post in paintball talk about how someone got a similar message when they were outbid for an xmag.. so this goes for anyone using ebay, not just ebay motors.

true, and ive known of it for quite a while, but ive bid on quite a few ebay items before and never recieved a scam message. i just bid on two ebay motors items and recieved over 10 scam e-mails. it makes sense i suppose, theres quite a bit of money in vehicles, not all that much in used paintball gear (especially because of the ion)

[SCpoloRicker]

Only respond to eBay emails. Motors, along with all the other divisions, does a decent job and they should be notifiying you of second chance offers. They will also never ask you for account information.

/my client, actually

[Hexis]

How exactly do you check if a message is "From" ebay? The From address in email is so easily forged, it's easier to get wrong than right.

[SCpoloRicker]

How exactly do you check if a message is "From" ebay? The From address in email is so easily forged, it's easier to get wrong than right.

I'm not entirely sure about the tech side of things, but all the emails I develop for them have standardized header, footer, mailer daemon, IP, routing, etc to make sure that the email is easy to identify as "official".

I can try and find out more if you'd like.

[Hexis]

I'm not entirely sure about the tech side of things, but all the emails I develop for them have standardized header, footer, mailer daemon, IP, routing, etc to make sure that the email is easy to identify as "official".

I can try and find out more if you'd like.

I know how to check for myself, but I'm an infosec professional. I'm wondering if ebay has a nice how-to-spot a fake messge guide. The only realy way to tell is to check who (which smtp client) sent the message, in the headers. The problem is that doing so takes a bit of SMTP understanding. I think somone mentioned that messages ebay actually sends end up in your account somewhere (not an ebay user myself, so I'm no help there). Perhaps that is a good method for folks to use to verify the authenticity of a message.

[ProX9]

on your gmail account if they use [email protected] it checks to see if its actually an ebay email address, so if it isnt it will mark it as a phishing email.

[robnix]

I know how to check for myself, but I'm an infosec professional. I'm wondering if ebay has a nice how-to-spot a fake messge guide. The only realy way to tell is to check who (which smtp client) sent the message, in the headers. The problem is that doing so takes a bit of SMTP understanding. I think somone mentioned that messages ebay actually sends end up in your account somewhere (not an ebay user myself, so I'm no help there). Perhaps that is a good method for folks to use to verify the authenticity of a message.

http://pages.ebay.com/education/spooftutorial/

Headers are a pretty lousy way to catch spammers, they can be spoofed, or have no information in them.

[Hexis]

There is one header that can not be spoofed, and it's the only one that matters. The recieved by that is added by the local MTA is fully important and fully un-spoofable (because it's added locally). It's where you start any real investigation into the source of a message.

[slade]

How exactly do you check if a message is "From" ebay? The From address in email is so easily forged, it's easier to get wrong than right.

first of all, ebay has a "my messages" page, which essentially displays any message that ebay sends to your e-mail. if its there, its authentic. at least, until someone figures out how to hack "my messages"...

also, in the header of an ebay e-mail it will say your first name, or the name you registered with on ebay. it will say it is including your "registered name" to show that the message is authentic. all the phishing messages ive recieved have said my account name (slade2867) where ebay would put my first name.

[robnix]

There is one header that can not be spoofed, and it's the only one that matters. The recieved by that is added by the local MTA is fully important and fully un-spoofable (because it's added locally). It's where you start any real investigation into the source of a message.

Yes, the "Received:" line, which we both could have noted here for the OP in the first place.

[Tunaman]

ALWAYS go to "My Ebay" and check "My Messages". If it isn't in there it didnt come from Ebay.

[robnix]

ALWAYS go to "My Ebay" and check "My Messages". If it isn't in there it didnt come from Ebay.

I was selling a laptop with a buy it now. I got three buy it now's that were scams, all of them contacted me via ebay, so the messages were there. They'd buy one or two cheap items to get past the 0 feedback limit, and then come after a high priced item.

[Recon by Fire]

If you were selling the message came from mebers wanting buy outside the auction, those were not scams (well, maybe not) but users violating the ebay rules.

I've been using ebay since 1998 (100% feedback) and never been scammed. I'm real careful in what I buy and very explicit in what I sell. Just pay attention to teh latest scams and be careful, amke sure to ask questions and you will do ok.

I've never bought a vehicle off of ebay, but I have tried! Attempted to by my wife's convertible from a dealer in San Antonio but ended up outbid. Foiled!