Ebay identity theft

[tagryn]

So, someone broke into my ebay account and posted 30 auctions under my name. This happened while I was on the bus home, so didn't notice all the auction notices until an hour into them. I was able to cancel all but 3 of them, but those 3 were paid with Pay It Now, to a PayPal account presumably of the identity theft-er.

I contacted EBay, they've removed all the auctions and flagged them as invalid, and refunded to me most of the fees associated with posting them (which added up to over $100). Since the auctions were flagged as invalid, I don't think I can receive negative feedback for them. I don't know what's going to happen to the three folks who paid for those items, they'll probably have to pursue compensation via PayPal or ebay, unfortunately.

I've changed the passwords to all of my email accounts, PayPal, and ebay (of course), just in case. I hope this is all the bad that comes from this, but since I'm not exactly sure how they hacked my account - as far as I remember, I didn't visit any spoof sites, and SpyBot and virus scans both came up empty - I'm going to be worried for a while about more identity theft. Cleaned out all my cookies and cache, just to be safe.

Comments

[jilara.livejournal.com]

Good thing you caught them fairly early! You haven't replied to any supposed queries from other ebay members, via the supposed contact interface, have you? I've been getting a few of these lately, and they look very legit, but the links don't go where you think. What's fascinating is that they often ask about merchandise they supposedly bought but haven't received.

A friend made the mistake of "updating her information" a couple years ago, and they not only highjacked her account, but emptied her PayPal account, because she had the same password for both (dumb mistakes people make). Put her off ebay, I can tell you.

I got a second-chance offer on a high-ticket item, once. It looked legit, but I contacted the seller via the listing, not via the second-chance, and it turned out to be a hacker that would have swiped my money. Came out of Germany, according to ebay fraud. These guys are everywhere...

[tagryn]

With all the false flag 'query from prospective buyers/hey, where's my stuff?' emails going around, to tell the truth, I originally assumed all the "Congradulations, your auction has been posted!" emails were spoofs. Then I logged onto my account, and found the auctions actually *were* listed under me. An "oh, crap" moment.

In fairness, I had gotten sloppy with my passwords, and (a) hadn't changed some for many years and (b) continued to used fairly easy-to-crack ones, because they were easy to remember. One of those things: don't have a problem = assume there is no problem.

I am going to be concerned for a little while yet, since I've attracted someone's unwelcome attention. The malevolent in question went so far as to set up a hotmail account which included my ebay ID in it, making it look more legit. Time will tell whether the "Eye of Sauron" has moved on or not. If I get another "incident" relatively soon, I'm going to have to assume there's more than just a lucky password crack in play here.