Win a trip to the Ice Hotel in Lapland
Privacy is dead. Long live privacy
We don't really care about our privacy
FOREIGN criminals are stealing the credentials of British users of the internet auction site eBay to perpetrate large-scale fraud.
An investigation has identified one German-based fraudster who hijacked more than 30 accounts and used them to fleece UK car buyers.
It comes as increasing numbers of eBay users report concerns about trading on the site.
Figures from the government-funded Consumer Direct advice line show that calls expressing concern about eBay transactions are averaging 22 a day.
The auction site — which has 20m registered British users, equivalent to one third of the population — admitted last week that it was being forced to spend millions to combat fraud.
Conmen are targeting eBay users by acquiring their user names and passwords to pose as ordinary sellers with an unblemished trading reputation.
This undermines the basic security principle of the site, which relies on customers being able to gauge the reliability of a seller by looking at a history of their previous transactions.
Last week The Sunday Times tracked a prolific conman as he tried to sell more than 30 cars, in each case posing as a vehicle owner making a private sale.
The conman has duped several buyers into sending him thousands of pounds, according to a source who has had access to one of his e-mail accounts.
“There’s one payment this morning [October 12] for £6,000,” said the source. “Another of his purchasers is threatening to go to the police unless he returns the cash.”
North Yorkshire police confirmed that they are investigating a complaint against the man, who uses a series of aliases and has claimed to be a Croatian living in Germany.
Earlier this month the conman posted an advert on the auction site for a year-old black Audi A4.
The car, in good condition, was supposedly being offered for a quick sale at a “buy it now” price which was almost half the market value. A number of eBay members inquired about the car and each was instructed to contact the seller on an e-mail address.
When an undercover reporter offered to buy the car, he received a reply from a man calling himself Alex Lock, from Norfolk.
The man claimed he was in Germany for urgent surgery and needed to sell his car quickly to pay for the operation.
There was “nothing to worry about”, he said, because the cash would be deposited in an eBay payment protection account and could not be released until the car had been delivered.
For extra reassurance, he arranged for the eBay Motors section to contact the reporter by e-mail to vouch for the security of eBay payment protection.
The eBay e-mail and a subsequent billing invoice looked genuine, but they were sophisticated fakes. There is no such thing as eBay payment protection.
Further checks established that the same man was selling dozens of other cars at the same time and none of them existed. In each case he had stolen the identity of a real eBay user.
One of those users was Richard Tywang, a sports centre manager from Grassington, North Yorkshire. He had unwittingly surrendered his details when he responded to an e-mail purporting to be from eBay.
“It said that someone using the work computer had won an auction for a handbag,” said Tywang. “To find out who it was I had to log into the page using my password.”
Once the conman had the details he took control of the account, changed the e-mail address and used it to advertise a car for sale. Tywang was alerted to the sale by a would-be buyer who tracked him down because of his unusual surname.
Peter Jackson, owner of a limousine service in Manchester, received a call from a man interested in buying a cut-price BMW. He says he tried to alert eBay but it took three days before the car advert was blocked. “[eBay initially] replied saying that they couldn’t do anything because it wasn’t our e-mail address,” he said.
Meanwhile, the conman was proving elusive. One of his e-mail accounts proved to be registered to a Jonathon Cole who runs a cabinet-making business in Eldridge, Iowa. Cole checked his bank statement and found his card was being used by someone else.
Somehow Cole’s details had found their way across the Atlantic to Berlin. An identifying code on one of the conman’s e-mails led back to a computer in an apartment block on Hagenstrasse, in the former East Berlin. A bank account used to collect the money from British buyers was linked to a prefabricated apartment in north Berlin. The car seller was nowhere to be found at either address.
When The Sunday Times tracked down “Alex Lock” on the telephone, he claimed in heavily accented English that he was a genuine seller from Norfolk. “I’ve heard about these scams on eBay . . . If I were in your shoes I would be thinking the same,” he said.
This weekend eBay said it had investigated and contacted all the registered users of the site. It had also restored the settings of the accounts to the position before the conman had tampered with them.
This weekend eBay issued a statement saying that it worked “tirelessly” to prevent and detect fraud. It said all the conman’s suspicious transactions had been spotted and taken off the site before the end of the “auction”.
However, according to the source who had access to “Lock’s” e-mails, this was too late to save the victims from handing over their money.
The fraud was only possible, eBay said, because buyers were willing to enter into deals outside the site.
It added that preventing users from disclosing personal information was an “ongoing challenge”.
Industry sectors news at a glance. Interactive heatmap, video and podcast
The inside track on current trends in the charity, not for profit and social enterprise sectors
Read our exclusive 100 Years of Fleming and Bond interactive timeline, packed with original Times articles and reviews
Everything the Business Traveller needs to know to make a better trip
Shortcuts to help you find sections and articles
05/2005
£13,500
08/2008
£109,950
2005 / 55
£59,500
Great car insurance deals online
£Excellent+ executive benefits
Torres and Partners
London
£49,229 - £62,035 pro rata
Charity Commission
London/Liverpool/Taunton
Alstom Power
Europe
Six Figure
Rolls Royce
Midlands/Europe
From £89,950
Special Offers now available
At the new sophisticated
Encore Las Vegas Resort!
Cruise the Islands of Hawaii - Pride of America
List your property with two leading travel websites
Great travel insurance deals online
Contact our advertising team for advertising and sponsorship in Times Online, The Times and The Sunday Times, or place your advertisement.
Times Online Services: Dating | Jobs | Property Search | Used Cars | Holidays | Births, Marriages, Deaths
News International associated websites: Globrix | Property Finder | Milkround
Copyright 2008 Times Newspapers Ltd.
This service is provided on Times Newspapers' standard Terms and Conditions. Please read our Privacy Policy.To inquire about a licence to reproduce material from Times Online, The Times or The Sunday Times, click here.This website is published by a member of the News International Group. News International Limited, 1 Virginia St, London E98 1XY, is the holding company for the News International group and is registered in England No 81701. VAT number GB 243 8054 69.
Phishing has taken a new turn. Last week I got an email from an old friend saying that he had got into trouble, his hotel in the UK (he is from NZ) had been burgled, his money, passport etc. stolen. He sounded distressed and needed money quickly, because he needed to buy tickets,etc
The true story was that the REAL friend had had one of those emails saying 'your email account at X is about to expire, please log on here and retrieve your account.
The problem then was that once he did that,the scammers had full control of his email, and his history of correspondence with his friends.
this is a particularly clever scam, as the scammers can really assume the personality of the victim, because they have access to his emails! Ebay needs to wake up, like the other posters say they arent taking internet fraud seriously enough. If they persist with this policy eventually their reputation will suffer, and they will be forced anyway to do better.
they need to improve.
John Sparks, London, UK
Having just reclaimed my ebay and hotmail accounts after 5 days I think the security procedures need addressing, especially as the hijacker/s bid for hundreds of items unchecked! I have lots of data in my inboxes, but nowhere to report it too. Apparently no crime has been commited!!!!!!! I've ended up filing a report with the FBI!
Frustrated identity theft victim
sofia cox, milton keynes, bucks
The only trouble with Ebay is that it's virtually impossible to contact them.
The only method is the on site form which doesn't have an option for anything actually useful like: "Help I'm being ripped off" "someone is selling something illegal" or "why won't you respond to my attempts to contact you"
Thalia, London,
A perfect example of why you should have different usernames and unique passwords for every online service you use.
People fall for phishing attempts, and since many use the same passwords over, and over...I can see how it's easy to phish an ebay account...
Security needs to be on the end user's part as well as on the part of the online businesses.
Ex-pat, Vegas,
When you complete a transaction on ebay, wait for the transaction won email, this has the seller name and address + postcode and usually a telephone number. User www.192.com and search for the surname against the poscode, this shows that the seller is on the electroral roll which is a good indication, then use the full address and check on 118500.com against surname and postcode, see if they have a landline, again a good indication, if a mobile has been given, phone the landline and check if you have doubts. I've have negative feedback from seller because they won't give me their details, even though they have mine! but to me that means something a bit fishy - stolen goods etc. Also on advanced search page, the is the option to exchange contact details , so on a winning bid enter the auction number and ebay name of the seller and you should get an email with their details. None of it is full proof, but it all helps build a better picture. Also check the value of items previously sold.
Adam Jarvvis, UK, UK
Ebay and Paypal (owned by ebay) could do a lot more to reduced their fraudulent use.
I dont know if this still applies (someone please correct me) but the last I heard is that it is still not possible to put a limit on the transactions made; this would limit the damage in the event your details were stolen.
There is nothing to stop someone using your Paypal details to buy a yacht, jumbo or submarine.
Why is this the case when it is so easily prevented? Because ebay & paypal make money on every transaction; to allow a limit may reduce their revenue; so to maximise their profits they will do nothing to protect their customers.
They stink and the DTI stinks for not forcing them to do more.
Jack Sprat, Bristol, UK
I've got good feedback and years of experience on eBay but was scammed nevertheless. It was a car, a pre-drive-by-wire Rover 825SD. I do like this model very much but after mine was shunted by a taxi (driver says I reversed into him!) I wanted something smarter. Car was described in glowing terms. Minor faults and scratches were mentioned (all part of the con) Unfortunately the car leaks like a sieve, floorpan is buckled by jacking in the wrong place, and car has been "clocked". I thought I was buying a car in really good condition with 100,000 less miles on it than my blue one (180K). A car that should have lasted at least five years of my retirement but it has a "tired" engine and to cap it all it has a "bent" MOT (ABS not working and bulb removed) The cheeky seller even sent rude emails saying "Ha Ha Ha" and "Loser". PayPal say that the vehicle IS as described! HPI won't disclose mileages to public! Why is the UK run 4 benefit of cheats? Data Protection Act helps cheats.
David Benyon, Bude, UK Cornwall
Just because you have a well paid job doesn't make you savvy. I run a mail order business and we have set our payment security so no one at the company sees card or account details. Everyday customers phone wanting to give all their details over unsecure phonelines to strangers. I have even had returns with customers names addresses and card details on covering letters. It is the same mentality that makes people think they can leave bags lying around unattended. Thirty years of being bombed by the IRA suceeded in removing bins from railway stations but not one ounce of awareness slipped into the collective public mentality fraud whether ebay or card fraud happens to someone else.
Neil Warner, Wantage, Oxon UK
Accounts also get hijacked. These accounts which have excellent feedback ratings are then used to sell non-existent items aswell as used to give fraudsters good feedback. I wouldn't trust paypal because they will only refund a certain amount and you can't conflict resolution with someone who has taken your money and run. So only use it if you are paying an amount that is covered by their poor policy. Paypal should act as a third party whereby payment is received by paypal and only on recorded receipt of the goods would the money be released to the seller.
I got scammed along with several other experienced ebay buyers and never again. Ebay simply do not have the necessary security or resources these days to stop the fraud.
Russ, Reading, UK
I found a January 2007 Galaxy in Classified Ads on ebay for £ 6094! (what a bargain!) Apparently it was in Marlborough. I offered to fetch the cash (just down the M4) and if I liked it, to buy it. The seller told me he was in Budapest, Hungary for 3 weeks and I should send the money to ebay there, he then would ship the vehicle to me (itâs crated up!) and once I had it on approval for 7 days if all was ok ebay would transfer the money to him. I didnât take up their kind offer, although I told them I had sent the money to ebay (who had told me that âtheirâ email wasnât genuine!)
Iâm still getting phone calls from Donald the seller, usually the number is withheld â sometimes they are calling from 001441625502 which would appear to be from Brazil! I see from the British Embassy in Brazilâs website and a Google search that phishing is an up and coming pastime in Brazil.
Iâve contacted South Wales Police, the police in Budapest and the British Embassy in Brazil.
arthur bletchly, Bridgend, Wales
Ebay could do MUCH more pro-actively with alerts SHOWING what the fraudsters are doing. They could also have a very easy interface for reporting suspicious activity, which they don't have. (every account should have a 'tick-box' asking for it to be checked over.Why not?) They actually make it easy for the fraudsters and hard for soon-to-be-ripped-off punters. It's simply not good enough with this size of community saying 'we've told you not to give out details' I know heavy-weight city people who've had their details conned.
Simon Addinsell, London, UK
eBay own PayPal and that has protection, I certainly wouldn' send a "wire" for cash and I never ask a customer to use one. I will only use PayPal precisely because of their dispute resolution.
Jay, Whittlesey, UK
What ebay need/needed long ago is a good escrow service for larger transactions. That people will be protected to a good degree. It would not be save either to onsist on cash when seeing car, because you may turn up and get battered and cash taken.
Patrick Swinmer, London, UK