ebay security loophole

sequence

How do you know it was definitely purchased on ebay if you don't have the password to the ebay account (Or do you ?) ?

mikewill34

sequence wrote: »

How do you know it was definitely purchased on ebay if you don't have the password to the ebay account (Or do you ?) ?

I have the emails, which ebay automatically sends out :-

1. when the account was created
2. when an item is won
3. when the scammer messaged the seller

the_lunatic_is_in_my_head

mikewill34 wrote: »

I don't give a hoot about the fake ebay account or the person setting it up.
But I strongly object to my email address being associated with anything fraudulent, thus tarnishing it's reputation.

I don't think an email address holds much of a reputation to be honest.

I'm sure eBay require the email address to be verified by sending an email with a confirmation link?

Maybe they had access to your email account?

mikewill34

sequence wrote: »

How do you know it was definitely purchased on ebay if you don't have the password to the ebay account (Or do you ?) ?

If I had the password I would have deleted the account

mikewill34

the_lunatic_is_in_my_head wrote: »

I don't think an email address holds much of a reputation to be honest.

But it is still linked to me.

the_lunatic_is_in_my_head wrote: »

I'm sure eBay require the email address to be verified by sending an email with a confirmation link?

Have you tried to create an ebay account lately, I did today and email verification is NOT required.

the_lunatic_is_in_my_head wrote: »

Maybe they had access to your email account?

Definately not, want to take up my experiment, send me an email address of yours (by PM) that is not connecetd to an ebay account and I will be able to create an account linked to it without any verification...

sequence

So, I tested, and yes you can open an account without a valid email address. The only verification required is via phone.

mikewill34

sequence wrote: »

So, I tested, and yes you can open an account without a valid email address. The only verification required is via phone.

I was not asked to verify by phone when I created an account today ???

mikewill34

sequence wrote: »

So, I tested, and yes you can open an account without a valid email address. The only verification required is via phone.

Just successfully placed a bid on an item, still no verification required.

RFW

mikewill34 wrote: »

. Suddenly on 4th May I received an email from ebay welcoming one of my email accounts to ebay. A few minutes later this account had bid on a mobile phone unlock at USD159.99. This was followed by an email from paypal, in this the shipping address was in Missouri (USA).

I immediately reported this fraudulant use of my email address to ebay and just for good measure changed the passord on the affected email account.

On the 10th May I recieved an emails requesting the above transaction be cancelled, but as a gesture of good faith requested a partial refund of USD90 (thus the seller had USD 69.99 for doing nothing). Sounds too good to be true!

It probably is a scam as I have searched for the address and I can see that at least two fake companies are registered to it.

I have raised several issues with ebay customer support, but sofar they have not been able to free my email address. :mad:

I have now registered new ebay accounts as placeholders to protect my other email accounts against fraudulant use. I would suggest others do the same.

Were these emails genuine Ebay emails? Sounds like they were phishing scams.

The second advice to register new Ebay accounts for every email address is a little over the top. If someone registers an Ebay account in one of my email addresses I can't think of anything harmful to me they can do with that.

Also Ebay do ask for email addresses to be verified when registering an account.

mikewill34

RFW wrote: »

Were these emails genuine Ebay emails? Sounds like they were phishing scams.

Yes they were genuine, and I did not (never would) reply to them.

RFW wrote: »

The second advice to register new Ebay accounts for every email address is a little over the top. If someone registers an Ebay account in one of my email addresses I can't think of anything harmful to me they can do with that.

I have dealt with institutions in which emails are considered legally binding, so any fraudulent use of my email address is harmful to me.

RFW wrote: »

Also Ebay do ask for email addresses to be verified when registering an account.

No; They do not (tested by a some of us today). it might have been a requirement in the past.