Question
This is the scariest ebaY related scam email I
ever saw. It looks very much like the real thing.
Beware! I have posted the headers and message of
both the scam email and the real ebaY change of
address email so you can see the difference.
Scam email and header:
<BLOCKQUOTE class="ip-ubbcode-quote"><font size="-1">quote:</font><HR>Status: U Return-Path:
<aw-confirm*ebay.com> Received: from
cassiopeia.email.starband.net ([148.78.247.122])
by skylark (EarthLink SMTP Server) with
ESMTP id 1aM3vx5Du3NZFjw0
for [my email account here]; Wed,
28 Jan 2004 20:10:22 -0800 (PST) Received: from
12.150.35.63 ([12.150.35.63])
(authenticated bits=0)
by cassiopeia.email.starband.net
(8.12.9/8.12.9) with ESMTP id i0T43H90031950
for [my email account here]; Wed,
28 Jan 2004 23:03:21 -0500 Message-Id:
<200401390403.i0T34H90031950*cassiopeia.email.s tarband.net>
Dear eBay user, Thank you for submitting your
change of e-mail address and password request.
Instructions on completing the change have been
sent to your new email address. Once the process
is completed, your eBay-related email will no
longer be routed to this email address. Change of
E-mail address request was made from: IP Address:
200.74.137.107ISP [note: not me of course]
Host: 200.74.137.107 Your Confirmation Code is:
ZX3U8 If you or anyone with authorized access to
your account did not make this change,please go
to:
http://pages.ebay.com/help/contact_inline/index.html
and complete the cancellation form. Thank you for
using eBay!
http://www.ebay.com/
<HR></BLOCKQUOTE>
When looking at the source code for this message,
it shows the following which takes you not to
ebaY, but to another website. [in this case a
phony page on trininet which has been pulled.
Fixed link below so it is not clickable.]
"ht<LI>p://pages.ebay.com.help.contact_inline.index.html&-#-1-;
&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#
&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#
&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#
&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#
&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#
&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#
&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#
&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#
&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#
&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;&-#-1-;*www.trininet.com/login.html
[note: I had to insert "-" between each
character for the above link to print on this
board.]
Here is what the real header and message from ebaY
looks like:
<BLOCKQUOTE class="ip-ubbcode-quote"><font size="-1">quote:</font><HR>Status: U Return-Path:
<aw-confirm*ebay.com> Received: from
mx45.sjc.ebay.com ([66.135.197.28])
by cockatoo (EarthLink SMTP Server) with
ESMTP id 1aMiNV2X3NZFkl0
for <myaccount*earthlink.net>; Thu, 29 Jan
2004 12:30:22 -0800 (PST) Received: from
rc-cgi304.smf.ebay.com (rc-cgi304.smf.ebay.com
[10.8.17.40])
by mx45.sjc.ebay.com (8.12.3/8.12.3) with
SMTP id i0TKTVi001903
for [my email account here]; Thu,
29 Jan 2004 12:29:31 -0800 Message-Id:
<200401292303.I0TKTVi001903*mx45.sjc.ebay.com&g t;
Dear [my ebay user ID],
Thank you for submitting your change of e-mail
address request. Instructions on completing the
change have been sent to your new email address.
Once the process is completed, your eBay-related
email will no longer be routed to this email
address.
Change of E-mail address request was made from: IP
Address: [my IP address here] ISP Host:
[My dial up and host here]
If you or anyone with authorized access to your
account did not make this change, please go to
http://pages.ebay.com/help/contact_inline/index.html
and submit an email to Customer Support.
Thank you for using eBay!
http://www.ebay.com:<HR></BLOCKQUOTE>
When you view the source for the real ebaY
message, the link is to
http://pages.ebay.com/help/contact_inline/index.html
I would suggest always viewing the source of any
emails that you even suspect might be a scam. Look
for links which take you to sites which are NOT
ebaY.
**** Ordinary riches can be stolen, real riches
cannot. In your soul are infinitely precious
things that cannot be taken from you. Oscar Wilde
(1854 - 1900)
[This message was edited by akauffman on FRI
January 30, 2004 at 11:07 AM.]
[This message was edited by akauffman on FRI January 30, 2004 at 11:09 AM.]
Answer
I asked a question about this exact email a few days ago. While I immediately forwarded it to spoof*ebay, I have not heard anything from them about it being legit or not.
Answer
I recieved almost the exact same one yesterday.
I immediately sent it off to spoof* and trust & safety. The response I received was it was not an official ebay email
I had also looked at the headers so I was confident it was fake.
The reason I was fast to check was that my husbands account had in fact been taken over last week, luckily it was caught within a short time of happening and all is straightened out now.
Even if you think it is real I would double check.
Karen