ebay security loophole

RFW

mikewill34 wrote: »

Yes they were genuine, and I did not (never would) reply to them.


I have dealt with institutions in which emails are considered legally binding, so any fraudulent use of emails is harmfull.


No; They do not (tested by a some of us today). it might have been a requirement in the past.

How do you know these were genuine Ebay emails, especially if you never replied to them?
On the emails you would have been given the user id, have you checked any other activity and details of where the account is registered?

mikewill34

RFW wrote: »

How do you know these were genuine Ebay emails, especially if you never replied to them?
On the emails you would have been given the user id, have you checked any other activity and details of where the account is registered?

Yes the emails are genuine.

Through the series of emails I have reveived, I now have in my posession the ebay user id, address and phone number.

When I enter this in the ebay forgotten password screens It all validates and I get a link to reset the password, this works up to a point, but fails to reset the password because the email address was not verified.

So I am close to gaining control of the fake account, but just can't overcome the "not verified" :mad:

sequence

I only got the phone verification when I tried to buy a buy it now.
Have you emailed ebay about this ?

mikewill34

sequence wrote: »

I only got the phone verification when I tried to buy a buy it now.
Have you emailed ebay about this ?

Yes; I have raised several incidents (by phone and resolution centre), none of which have resulted in deletion of the offending account.

lijaloo

The OP is correct. I've just set up a new ebay account using a second email address. No confirmation needed. Have just received the welcome to ebay message saying a can browse, bid and buy. To sell I need to enter my address and phone number.
Started selling by putting in a non-existent flat number in a local block of flats. No confirmation required or asked for.

mikewill34

lijaloo wrote: »

The OP is correct. I've just set up a new ebay account using a second email address. No confirmation needed. Have just received the welcome to ebay message saying a can browse, bid and buy. To sell I need to enter my address and phone number.
Started selling by putting in a non-existent flat number in a local block of flats. No confirmation required or asked for.

Many thanks for testing this.
This loophole must be shut down as soon as possible by ebay.

mikewill34

Heard through from ebay regarding the fraudulent account and they inferred that hotmail.com accounts were ISP accounts which are "recycled" after not being used for some time.

1. I have owned the account since at least 2003
2. As far as I know hotmail is not an ISP

The person drafting the reply seemed to be quoting a standard set of text with names changed as appropriate.

Seems very lax to me...

RFW

Have you talked to Hotmail about it? Not saying it isn't Ebay's fault but Hotmail aren't renowned for their security.

mikewill34

RFW wrote: »

Have you talked to Hotmail about it? Not saying it isn't Ebay's fault but Hotmail aren't renowned for their security.

Nothing wrong with my hotmail account, I simply want the fraudulent ebay account which is linked to it killed off.

zerog

I don't see how this is a security threat to the OP. If anything, it's a security threat to the owner of that ebay account, as the OP can see all his activity

If the owner is a scammer, then hypothetically this could affect the OP's reputation (now that we know it's a hotmail address), if the scammer bought from a seller who knows the OP by email... Also, the OP would be unable to open a genuine ebay account with that email address.

I don't know what the OP said to ebay, but the simple thing to do would be to tell them that an account was opened with an incorrect email address.