Slashdot Mirror


Profile of an eBay Scammer

prostoalex writes "FastCompany is running an article about Jay Nelson, whose primary income source for about 5 years included selling goods on eBay. Considering that he chose to skip the delivery, the profit margins were at an all time high. Under the names of biggerthanu, harddrives4sale, diamondsoft, yoshiinc and susancutey Nelson would collect five-digit PayPal payments from the buyers on eBay and Yahoo Auctions."

23 of 401 comments (clear)

  1. Re:Theft or no... by theNote · · Score: 5, Informative

    You obviously didn't bother to read the article.

    It goes in depth on how he rated himself with multiple screen names and used various other techniques like buying inexpensive items from others with fake mailing addresses.

    I love the image of the postal inspectors carrying guns. Reminds me of the accounting division of the FBI that walks into the accountants office strapped with a piece.

  2. Re:eBay has become unusable because of the scammer by ralico · · Score: 2, Informative

    After watching eBay auctions for a while, I notice that a lot of sellers just plain flat out refuse to ship outside the U.S. Some of them add comments that they do this because of credit card fraud.

    --

    SCO to Hell
  3. Not a good solution. by Anonymous Coward · · Score: 1, Informative

    Unfortunately, there are rather a lot of buyers on eBay who bid on high-dollar items, get the item, then dispute with their credit card company and end up paying $0 and getting a nice new laptop/digital camera/TV, not caring about what happens to the seller. Having eBay charge the seller for the item in such cases would mean that these types of buyers actually get paid to steal an item (since they'd get the item, then get their money back from VISA and then get the total given to them again from eBay, taken out of the seller's VISA).

    Incidentally, the only armor the sellers have in these types cases is their shipping receipt, but many small sellers (i.e. of items they personally used) don't keep such things, and even if they do keep them, they don't really verify contents, only that "something was shipped" and thus credit card companies often pay out anyway in the dispute.

  4. Re:eBay is a joke by Anonymous Coward · · Score: 3, Informative

    When I worked for an, um, "major online auction house" there was no call center, so there wouldn't be anyone to take your calls there at all. The resources just didn't exist in the company.

    Everything was done by email and like most "customer service" and "technical support" these days, they have to send you canned responses several times before you'll get special attention paid to your case. Employees were rated on the number of email responses they sent every hour, not on the level of service they provided, so unless someone's problem is desperately easy (and thus quick) or someone is very angry, you won't get a personalized answer because it can affect paychecks for them to take the time to discuss things in detail with you.

    Of interest: all contacts claiming to be official notice from customers' attorneys or official contacts from law enforcement personnel had to be instantly escalated and treated individually. Do with that tidbit what you will...

  5. Hardly the only eBay scam out there... by wahmuk · · Score: 5, Informative
    I just got an email last night, of the type where it appears to be from eBay (it's not) and it's asking for you to verify some information. The URL in the body appears to be a valid eBay address. And although the email appears to be plain text, it's actually HTML and the "valid eBay address" actually takes you to a non-eBay and non-secure IP address where you're presented with a poorly-worded form asking for name, address, passwords, PayPal username, password, credit card numbers, etc...

    All other links on the page go to the valid eBay "help" and "contacts" pages. It looks really official, except for the non-professional grammar.

    I wonder how many people fall for this type of scam every day?

    It wasn't even sent to the special email address that I use exclusively for my eBay account (my first clue, woohoo!).

    And yes, I've already reported it to eBay...

    Wot sez we demonstrate the SlashDot Effect(TM) for the thieving bastard?

    Here ya go:
    http://cgi1.ebay.com/aw-cgi/ebayISAPI.dll?UPdate



    --
    You can't take the sky from me!
    1. Re:Hardly the only eBay scam out there... by soloport · · Score: 2, Informative

      Here's some keys to the mistery code:

      The form goes to:
      "http :// ns.terraserver.nl/cgi-bin/web2mail.cgi"

      Then there's an e-mail reference in a hidden field:
      input type="hidden" name=".email_target" value="sorc3r3r@sorc3r3r.org"

      (Had to unescape() some JavaScript, then shove a bunch of junk though a function called v(). Embedded in the junk was more javascript, html and form fields that seemed to not be associated with any form -- until one reads the JavaScript.)

      Talk about elaborate...

      Have fun!

    2. Re:Hardly the only eBay scam out there... by Permission+Denied · · Score: 3, Informative
      This paragraph is crap for the lameness filter (apparently, you have to insert crap at the beginning, not end, of your post if you want to post a program listing or command-line session). Skip to the next paragraph. This paragraph is crap for the lameness filter (apparently, you have to insert crap at the beginning, not end, of your post if you want to post a program listing or command-line session). Skip to the next paragraph. This paragraph is crap for the lameness filter (apparently, you have to insert crap at the beginning, not end, of your post if you want to post a program listing or command-line session). Skip to the next paragraph. This paragraph is crap for the lameness filter (apparently, you have to insert crap at the beginning, not end, of your post if you want to post a program listing or command-line session). Skip to the next paragraph.

      You generally have to provide a real phone number or something identifiable to get a recognized SSL cert, so this is always worth a try:

      kalashnikov% openssl s_client -showcerts -connect sorc3r3r.org:443
      CONNECTED(00000003)
      depth=0 /C=US/ST=CA/L=Mt Shasta/O=Finest Planet/OU=Service/CN=www.finestplanet.com
      verify error:num=20:unable to get local issuer certificate
      verify return:1
      depth=0 /C=US/ST=CA/L=Mt Shasta/O=Finest Planet/OU=Service/CN=www.finestplanet.com
      verify error:num=27:certificate not trusted
      verify return:1
      depth=0 /C=US/ST=CA/L=Mt Shasta/O=Finest Planet/OU=Service/CN=www.finestplanet.com
      verify error:num=21:unable to verify the first certificate
      verify return:1
      ---
      Certificate chain
      0 s:/C=US/ST=CA/L=Mt Shasta/O=Finest Planet/OU=Service/CN=www.finestplanet.com
      i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
      -----BEGIN CERTIFICATE-----
      [snipped for lameness filter]
      -----END CERTIFICATE-----
      ---
      Server certificate
      subject=/C=US/ST=CA/L=Mt Shasta/O=Finest Planet/OU=Service/CN=www.finestplanet.com
      issuer= /C=US/O=Equifax/OU=Equifax Secure Certificate Authority
      ---
      No client certificate CA names sent
      ---
      SSL handshake has read 1317 bytes and written 320 bytes
      ---
      New, TLSv1/SSLv3, Cipher is EDH-RSA-DES-CBC3-SHA
      Server public key is 1024 bit
      SSL-Session:
      Protocol : TLSv1
      Cipher : EDH-RSA-DES-CBC3-SHA
      Session-ID: AE5A02407FE137D27EDEA6C315B87DC83C4E9D137D3C09E2DB 1D3A7B3698CF4C
      Session-ID-ctx:
      Master-Key: C0701DD1BA02110163248E2CD8B9016099002A0FD597317BB3 A3C83C872F1A2250A9CC1736C6B1846EAFDDD534285867
      &n bsp; Key-Arg : None
      Start Time: 1061096037
      Timeout : 300 (sec)
      Verify return code: 21 (unable to verify the first certificate)
      ---
      HEAD / HTTP/1.0

      HTTP/1.1 302 Found
      Date: Sun, 17 Aug 2003 04:52:03 GMT
      Server: Apache/1.3.20 Sun Cobalt (Unix) mod_ssl/2.8.4 OpenSSL/0.9.6b PHP/4.0.6 mod_auth_pam_external/0.1 FrontPage/4.0.4.3 mod_perl/1.25
      Location: https://www.finestplanet.com/
      Connection: close
      Content-Type: text/html; charset=iso-8859-1

      closed
      kalashnikov%

      You got this:

      lake% host 216.98.146.249 249.146.98.216.IN-ADDR.ARPA domain name pointer 4t146249.aspadmin.net

      See this:

      kalashnikov% host www.finestplanet.com www.finestplanet.com has address 216.98.146.249

      This is the same Cobalt machine you noted (perhaps a web farm). Looks like a mom-and-pop dialup ISP. Most likely some innocent third-party seeing as how this looks like a legit business. If it's not legit, you could contact Equifax to get real contact information. They have a number of contact numbers and email addresses on their page, so someone should contact them and point them to this thread because they'll be seeing lots of strange stuff in their logs.

      My opinion: this guy registered an IP pointing to this machine. This IP is irrelevant

  6. Re:What's really incredible... by UnknowingFool · · Score: 2, Informative

    In this case, even checking out the merchant's reputation would not have helped. He bought cheap things, sent the money, and had them delivered to a fake address. All this so he could boost the reputation. Then he would start scamming until the identity got suspsended. Then he would do it again with a new identity.

    --
    Well, there's spam egg sausage and spam, that's not got much spam in it.
  7. Ebay fraud protection is a joke. by technicka · · Score: 2, Informative

    oh yea.. ebay's doing a terrific job at stopping fraud. ha! Check out my web page I errected about fraud that happened to me. Did ebay seller protection help?.. no because I recieved an item,... no matter that it didn't work at was fraudulent and was in some sort of house fire!

    http://bubonick.teknikill.net/tivofraud/

    reply to this.

  8. Re:Theft or no... by Jhon · · Score: 5, Informative

    One of the interesting things I found about the article was the listing of some of his "usernames". I checked my ebay transactions a while back and found I had one with one of his accounts. I had received a broken proxim wireless modem. I mean broken -- it rattled, the case was cracked etc.

    I looked at his feedback and checked on some of his older positive feedback transactions and found that the pay-pal link was identical to the one I had purchased from. I sent a mail to THAT user saying basically "You are [BLANK] I know this because the paypal links on both user's auctions point to the same account. How about you either refund my money or send me a working item and I let this go".

    He said he was the BROTHER... blah. I think the idea of getting reported scared him enough that he sent out a WORKING modem.

    Moral of the story: If it's an item that's going to cost you more than what you can comfortably lose, check the old feedback for anything suspicious -- like identical paypal links, a lot of 1 or 0 feedback bidders (shills), and even how LONG the account has existed. One month? Two? A few years? The longer an account has been around with a decent amount of feedback are USUALLY good indicators.

  9. I did get scammed once... by useosx · · Score: 2, Informative

    I was selling a video card for a friend on eBay, and someone writes me from Spain, saying she's starting a computer shop in Amsterdam or something and needs parts. She was completely insane, but I just chalked it up to the language barrier. I cancelled the auction so I could send her the card immediately and waited for her to transfer money to my PayPal account. I wasn't really concerned because I figured since I got the money first, what did I have to lose?

    A lot, it turns out. So she finally transfers me the money, I transfer the money to my bank account, and I go right down to FedEx and send the card 2-day. When I get back home, I have an email from PayPal telling me that the person who sent me the money had their account hijacked and PayPal had taken the money back. This, I suppose, was fine. I couldn't argue because I had agreed to their terms. I was a little pissed because I wasn't the idiot who had their account hijacked, but such is life.

    So I immediately called FedEx and had them stop the shipment, but it was already over the Atlantic, so they couldn't stop it until it got to Spain. This caused me to have to pay for it to be shipped back, effectively doubling my shipping costs. Not cheap...this was 2-day to Spain.

    I was further irked by PayPal's bad programming. Instead of intercepting and canceling my bank transfer, they just deducted the money from my PayPal account, so now I was in the negative, and had to wait for the transfer to go through, and then transfer the money back. Annoying, but at least it was free.

    So what about PayPal's protection policy? Doesn't apply to international orders. Also, you have to ship to the person's registered address. Not sure I know how to even look that up.

    Oh, also, I checked the eBay ID of the person, and that was a hijacked account, too. The person sold a lot of "exotic" drinking glasses and had a high feedback rating. Obviously, not someone in the computer fraud business.

    Anyway, the point of my story was that you have to be careful even if you're the seller. Only ship to registered PayPal addresses and check what sort of stuff a person is selling on eBay. I recently saw someone selling a really cheap Powerbook, but all their previous items were dolls, or something. Definitely something fishy there.

  10. everyone bitching about how ebay/paypal/etc sucks by jbellis · · Score: 4, Informative

    is apparently missing the single biggest change ebay made to prevent people like this guy from building up positive feedback:

    they separated buying feedback from selling feedback. now to get +50 selling, you actually have to sell 50 items, not just buy a bunch of paperbacks and give a false address.

    of course you can still get positive feedback selling cheap items but it'll take you a few days now instead of a few hours.

    could ebay do more? probably. but at least they're not missing the obvious.

  11. Ebay Scammers by draed · · Score: 5, Informative

    I got scammed out of $1,500 on ebay a couple months ago... I researched a bit on what my options where and filed complaints to paypal and ebay. Paypal found the seller guilty and was able to get me back a total of *50* dollars out of the $1,500.

    It's amazing how difficult it is to get anything done about online fraud.

    Anyways, in doing research, here is a very helpful site I found : http://members.ebay.com/aboutme/!turk

    and don't ever order from these companies :
    http://www.factory101.com/
    http://www.my1stop2gaming.com/
    http://www.masonavenue.com/

    1. Re:Ebay Scammers by warrensomebody · · Score: 2, Informative
      I too got scammed on eBay back in 2001 -- for an iBook that I was buying for my parents. I was out $1250, and PayPal claimed that there was nothing they could do about it. I wasn't eligible for their maximum $200 compensation.

      But... I got a letter from the FBI just last week saying that they caught the guy, and that he had pleaded guilty. (This is only the second response I've gotten from them, the first being an email a few months after it happened. They're amazingly uncommunicative.) Now I've got a "victim's impact statement" to fill out. We'll see what happens.

      Warren

  12. Re:ebay is full of scammers, $5 at a time by rwsorden · · Score: 2, Informative

    Did you file a complaint with eBay? I've had two bad experiences (less than $15 in each case) with sellers in the past and, after trying to work it out with them personally, I ended up filing complaints with eBay in both cases and soon thereafter (within 2-3 weeks) I either recieved the item or was refunded my money by the seller. eBay was very prompt in replying to my e-mails, but you really need to have your ducks in a row (copies of all prior e-mails, scans of physical correspondence, receipts, credit card bills, etc.) to make the dispute resolution go smoothly.

  13. we're all screwed ;D by gt25500 · · Score: 2, Informative

    Good read. It's a bit scary, ANYONE can pull a scam like this. I thought I'd check to see if his feedback was still up... indeed it is, feedback
    Notice he has 2 1/2 pages of good feedback spanning over a few months... Then he goes in for the "Attack" all at once... ALL the bad feedback comes in a two day period. Those bidders thought they had a real seller I'd assume... There's no real way to protect yourself sadly ;[

    --
    _________ Help me get a PSP!
  14. Re:ebay is full of scammers, $5 at a time by Punk+Walrus · · Score: 3, Informative
    Yeah! I have been fished for that on eBay, but never bit. For me it was always something to do with rare rock memorabilia and stuff (why? dunno...). I read about some guy who does this to get the maximum amount of money he can for multiple items. Here's how it goes:
    1. Say you have 10 "rare posters" of Bob Dylan (or at least claim you do) at some concert in the 1970s. Put one for auction.
    2. Top bid a few minutes before end is $100. Record all bids, get e-mails for all bids.
    3. Have a buddy sniper bid on it for $1200, auction ends.
    4. Wait one week. You know the most someone will pay for the posters by their high bids. Send e-mail to all bids, stating the top bidder backed out, and how mad you are, because you're a regular working Joe, etc, etc... To the first guy say, "I'll sell it to you for $90, $10 lower than your high bid, because I know this is outside eBay and all..." Hope he bites. The second highest bidder, do the same thing, with $10 off his bid, and so on down the line.
    5. Now you can send them the posters, send them misrepresented crap, or send them nothing. The official eBay policy won't cover what goes on outside their realm.
    6. You and your sniper buddy leave positive feedback for each other. Repeat.

    Nice scam, mostly illegal, but again, if you nickel and dime a ton of people who are too embarrassed, too lazy, or just won't bother to complain, you'll get rich slowly (or not, I have no idea if this works for a long-term plan). This especially works for low-end items where you guess your clientele are not too bright or have enough resources or perseverance to complain, like emo/punk clothing, "Spring Break" videos, "How to Get Di$$$$counted $$$$oftware!" promotions, and so on.

    I have heard, though, to never piss off Beanie Baby collectors... they can be mean and tenacious.

  15. Re:Capitalism v. Free Market by whorfin · · Score: 3, Informative

    http://www.m-w.com says that the term goes back to 1877, but the first appearance in print of the word capitalism was in the novel The Newcomes, by William Makepeace Thackeray, 1854.

    I thought the Communist Manifesto may have preceeded that, so I quickly scanned it, and there are several references to Capital, and Capitalists, but no "Capitalism"

    This site backs that up, showing what appears to be entries from the OED (which is a paid site, so no linky) for it and a few more 'isms'

    BTW, here is an interesting article on Capitalism. I doubt that it will change the minds of any true believers, but I'd encourage all to read it.

    Wait a minute, who am I kidding? This is /.

    --
    Laugh while you can, monkey-boy!
  16. Re: hard drives bought on Pricewatch by King_TJ · · Score: 2, Informative

    One scam I've noticed on the real low-priced vendors selling IDE hard drives via Pricewatch is selling either OEM drives, intended only for use as part of a name-brand PC, or selling the drives received as RMA replacements from defective drives.

    Many people don't realize it, but whenever you send off a hard drive that's under warranty for RMA replacement, your replacement drive you get back is only warrantied for the remainder of the warranty the original unit had. Some vendors will sell these replacements as new stock, yet their factory warranty may only be 4 or 5 months long!

    They also try selling the drives originally destined for OEM system builds as though they're normal drives for end-users. I got burned on a Western Digital 100GB 8MB cache drive like this not long ago. It worked for a few months and started developing bad sectors. I figured "No problem. I'll RMA it to Western Digital." When I keyed in the drive's serial number, it rejected it as an OEM drive I couldn't directly exchange. (I would have to go through the OEM vendor who sold me my system, it said.)

  17. And what about /. ? by twoallbeefpatties · · Score: 2, Informative

    Isn't this the purpose of the eBay rating systems, etc.?

    Well, Slashdot's system gives good ratings to the majority of the people with something interesting to say. And you can just set your system up to block off most of the AC's. But then there's the few devoted trolls who sign up for 12 different accounts, jack them up to excellent karma, and then go posting goatsex links on every post they can until someone cuts them off. It doesn't happen often, but...

    ...Oh yeah, please mod this up so that I get away with posting my rant on homosexual nazi liberals in the next post.

    --
    Libertarians somehow believe that private businesses should be stronger than governments but weaker than individuals.
  18. Re:How NOT to get scammed by loco_0wnz · · Score: 2, Informative

    Have any of you that can't get ahold of eBay to get something done tried calling the number listed on their domain registration? 408 376 7400 is listed as Accounts Payable.

  19. Re:Take some responsibility! by Anonymous Coward · · Score: 1, Informative

    So what is Paypal supposed to do?

    How about act responsibly?

    The problem with paypal is that they screw legitimate people - freezing the funds of innocent people for no reason...

    So why didn't they do anything about this jerk?

  20. We have our man by Permission+Denied · · Score: 2, Informative
    Another (slightly devious) possibility: send a specially-crafted email to sorc3r3r@sorc3r3r.org. The email is HTML and contains an image link to some web server you own.

    More fun: google for sorc3r3r. First few links are for someone who registered with a number of dating services in New Zealand. Next you have some IRC activity in Romanian. Then you have some caches of rooted web pages, and sorc3r3r gets a shoutout along with a bunch of other Romanian nicknames (mafiotu (mafia man), dulcica (sweet girl), beculetz (light bulb)).

    The most interesting link:

    here

    This is google's cache of a Romanian web server's stats page. Note that sorc3r3r.org accessed this page, but the DNS entry was a different IP at the time (traceroutes to Australia or New Zealand). This ties together the sorc3r3r.org domain name with New Zealand and Romanian, so it corroborates the rest of the links.

    So we have our man. A lonely Romanian in New Zealand who I'm guessing runs Windows XP and plays Counter-Strike. He's also interested in script kiddie games on IRC, so the spammer email trick may just work if you're clever with the subject line (to trigger a preview). (Look up some Romanian greetings, that should do the trick :).

    For the curious: yes, I'm Romanian (that's how I can read the IRC logs and whatnot). And no, we aren't all little script kiddies, although that's what it looks like if you're ever on IRC (so I have no sympathy for this guy - when I tell fellow network security guys about my origins, the first thing that pops into their heads is the IRC nonsense).

    Have fun. Don't steal. Keep off IRC.