eBay car scam???

The general manner in which frauds are perpetrated interests me and, without giving away any secrets, there appear to be two major ways this fraud can be performed.

Firstly beware if the seller makes the offer MINUTES after the auction ends (where as a normal second chance offer takes place a week or so after an auction ends).

Check that the details in the offer fit in with the seller's profile. That is, if the seller claims to be based in the USA and asks you to pay money to an account in the UK it's probably a scam.

Don't go outside the ebay set up to make payment. Make your payment by Paypal to the ebayer's ebay account. If they insist on you making payment outside the ebay system, don't do it.

Scammers will always look for ways to exploit a new system or one that people aren't familiar with, so that they can persuade the victim to do things that are insecure and risky. Don't use systems with which you are unfamiliar.

Thanks for letting us know, adguitrars1952.
What name and email address did the scammer use?
It would also be helpful if you let us know the address that the fake Ebay mails came from.
Thanks.

The same scammer contacted me today offering a second chance for an eBay auction that was thousands of dollars. I was able to spot many things that alerted me to the scam, so I forwarded the full email including headers to [email protected], and they promptly replied confirming that it is a scam.

I played dumb and engaged the scammer to try and trick him into revealing his IP address to me. I asked all kinds of questions about the item and provided a link to a picture hosted on my server. I also tried to get him to send me a PayPal invoice so that I could alert PayPal. He wouldn't click the link or send me an invoice, so I sent him another email with a link to the picture embedded so that it will load automatically when he opens it. It worked, I was able to get the following information which I have reported to eBay and the Canadian Anti-Fraud Center:

IP: 81.182.110.210

Date/Time: 12/Jun/2013:19:47:31 -0400

Browser: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0

Country: Hungary

ISP: Magyar Telekom plc.

Org: T-Online ADSL clients (dynamic address pool)

BTW, did anyone notice that scamwarners.com registration and login pages don't use HTTPS/SSL encryption? That means your password is transmitted over the Internet in plain text for the NSA to snoop on. If you manually change the address to start with https://, you get an error. Very incompetent.

Welcome to Scamwarners rdelaplante did the scammer use the same email address with you or a new one?

Bryon

Welcome to Scamwarners rdelaplante did the scammer use the same email address with you or a new one?

Bryon

The "second chance offer" email had the following in the headers:

From: eBay <[email protected]>
Reply-To: [email protected]

Our entire discussion happened on the gmail address. His response to each of my replies was basically the same, ignoring anything and everything I said:

I accept $xxxx. If you wish to proceed further please send me your:
FULL NAME and THE SHIPPING ADDRESS.
I am looking forward to hear from you.
Best Regards!

I suspect he crafts an email address that seems believable for each potential victim. For example, this one gives me the impression that he is a 60 year old engineer, or one born in 1960. That would make sense for what the auction was.

An nslookup on ebay.sky56.info reveals that it was registered about six weeks ago, and has been flagged for spam/abuse by the root name servers:

Name Server:NS1.SUSPENDED-FOR.SPAM-AND-ABUSE.COM
Name Server:NS2.SUSPENDED-FOR.SPAM-AND-ABUSE.COM

^^^Scammers typically and most all of the times use scripts. They send out mass mailings. If they get a reply then they send out the next script and so on. That is why he never answered any questions. If he had to type the response himself you would clearly see he is not a native American writer.

Keep your transactions within Ebay. All communication should be going through Ebay. Payment should be made in your Ebay account and not some outside account.

ETA: Removed my comments about selling.

From the address used - eBay <[email protected]> - it's not hard to see the outline of how this 'second chance' scam operates that is being operated by a gang of professional overseas scammers.

They run an auction which is really nothing more than an exercise to harvest targets/victims. Any time a new system is devised it gives scammers an opportunity to step in and try to take advantage of it.

The purpose appears to be to lure the victim in to going outside the Ebay system which would provide some level of protection to the buyer. Because this 'second chance' feature is relatively new, if the scammer gives instructions what to do in a confident manner it's all too easy to go along with it without understanding the risks.

Same return address just hit me up for a 2nd chance offer:

You&#39;ve been given a second chance to
buy 2005 ASV RC-100 Skid Steer Loader 100 H.P. Heat & A/C GREAT
TRACKS Forestry pack, which you placed a bid on for $ 17,500.00 on May
29, 2013 . To purchase this item, reply to this email or just
contact the seller at: [email protected]

Of course, it is interesting in that I had bid on that item, so somehow, he figured my ebay ID and
worked around the bid shielding. (Perhaps he/she was the seller and the whole auction was a scam?)

Welcome to Scamwarners crhea.

The most likely explanation is that this type of fraud is based on a 'mock' auction to harvest potential target details. The point being that they want to get their buyer to purchase the goods outside the Ebay system.

Scam: Got same thing on a tractor I was bidding on. I had already spoken to the owner on the phone and he gave me his email. Total ebay scam by [email protected] . The major question is how did he know I was bidding on the item and how did he/she/them get my true email unless they had somehow gained access to ebay data.

This question has come up several times. We have seen quite a few of these scams lately in which the scammers have details of the bidders, and to my knowledge nobody has gotten an explanation from eBay as to how this is happening .

I would encourage EVERYONE who has dealt with this scenario (fake offer from scammer after bidding on a real auction, where scammer somehow has your info) to report this to eBAY and demand an explanation. The two most likely explanations are that there is a security problem that the scammers are exploiting, or that the scammers have an inside source (e.g. an eBay employee with this access.) Neither should be considered acceptable.

I have used eBay many times in the past myself, but personally I won't use it now, nor would I recommend it, in the absence of an explanation (and action taken to correct this repeated problem.) I would be too concerned about how much of my information could be compromised.

I feel the same as Dotti and I wouldn't have anything to do with these 'second chance' offers at all.

The main feature of the scam is that the seller then wants to go on to conduct the transaction outside Ebay, which is utterly fatal (not literally).

If you can't see a vehicle, don't buy it. The best bargains on the internet are scams. The scammers can afford to undercut all the honest traders and there are too many sophisticated scammers with every tool in the scamming trade at their disposal to steal your money.

I've never used Ebay and never would after what I know now. Scammers are doing to ad sites what they've done to romance and dating sites. It's a big problem and, if there were an easy answer they'd apply it but an awful lot of people are finding out the hard way.

It makes us more popular, but that doesn't make us happy.

I made 2 Best Offers on a camera and didn't end up winning either of them yesterday (over $2,200). Today I just got an email coming from eBay <[email protected]> with a reply to [email protected] offering a second chance to buy the item.

What made me suspicious was that the Contact Seller links brought up a compose window to email the guy directly at the GMail address which is something I'd never seen before, but I had never gotten a second chance offer before either.

I decided to google his email address and found this forum, turns out it's a good thing I did!

I'm really curious as to how they got my EBay username AND email address, as the email is being sent to [my EBay address] <my email address>.

I've emailed him to ask him if he can come down to a lower price, let's see what happens.

Welcome to Scamwarners althanis.

It'll be interesting to see if his script has changed from the one he uses here.

http://www.network54.com/Forum/207593/thread/1371313451/Second+Chance+Offer+Scam+on+ebay

Intriguingly this is a script used in connection with another form of scam in which the subsequent mail suggests that the buyer pays money to a money 'mule account' in the UK. For reasons I cannot explain it appears that they have 'money mule' accounts in the UK on a scale they don't have elsewhere.

The mail is quite wacky even to someone in the UK but it's clearly designed for the UK to whom the 'b' reference isn't just an offensive reference to a sexual act. Clearly if they offer you a UK bank account they're mindlessly following a template instruction without any brain input. Putting complexity their way may cause them to blow a fuse.

Your information is interesting as it connects up quite a widespread scam attack on ad sites that might not be considered to have any connection if we didn't see them using the exact same script.

So just to update: I went ahead and emailed the guy playing along with it. I gave him a fake name and address. He said:

Hi there,
How are you? I've registered the transaction with ebay and you must have received an order confirmation. Please check your junk or spam folder because sometimes their messages may end in there and look for an email named: ''order confirmation'' . Please read it carefully, because all the info you need is in there. Let me know at your earliest convenience.
Thank you!

And then another EBay-like looking message comes in looking like this:



and



GB94 BARC 2053 0460 0988 92
BARCGB22
I.D.D Inc. Financial Center
Barclays Bank PLC
126 Station Rd, Middlesex, HA8 7RY, UK
20 Canada Square, London E14 5AH, UK
Bank Account Noted. (BW)

And: Confirm the Bank Transfer with a scanned copy of the receipt/statement from your bank. You can reply directly to this email with the receipt from your bank or by fax at : 917-503-9746.

I emailed him to ask if I could use Paypal instead, let's see what he says.