Anatomy of an eBay Scam

27th December 2005

There are lots of fraudulent eBay auctions out there. One common target is pre-release mobile phones, especially where large quantities of phones are being offered at steep discounts. There are several tell-tale signs:

• The items are not available anywhere in the retail channel yet.
• The seller is asking you to contact them through an email address published on the auction.
• The same pictures are used in several other auctions.
• Large numbers of the item are on offer.
• The location of the seller does not match the location of the goods.
• The seller has no track record in selling the item (for example, teddy bear merchants will not suddenly start selling large quantities of gaming consoles).

Here' one particular example where the seller was selling a pre-release mobile phone and soliciting direct email contact. newgeneration_phones@yahoo.com is the scammer.

From: eBay Buyer
To: newgeneration_phones@yahoo.com
Subject : Re: Auction 8356402619 

I'm very keen to get hold of those phones! How much are they to buy now?

From :  Phones '05-'06 <newgeneration_phones@yahoo.com>
Subject :       Re: Auction 8356402619
Received: from [64.34.161.110] by web35307.mail.mud.yahoo.com via HTTP;
Return-Path: newgeneration_phones@yahoo.com

Sorry for the delay...i have too many customers, please accept my appologise for this.Thank you for your understanding...
Please let me know exactly your order and i will give you the price for all you want to buy
Thank you and please reply quick
Keep in touch !!!

Note: the mail was sent from a compromised proxy at 64.34.161.110. Research shows that this IP is also used for "phishing" attacks on eBay accounts.

From: eBay Buyer
To: newgeneration_phones@yahoo.com
Subject : Re: Auction 8356402619 

I'm really after Nokia N92s, about 20 of them?

Note: the Nokia N92 is not available until mid-2006 so it is impossible that the seller has any.

From :  Phones '05-'06 <newgeneration_phones@yahoo.com>
Subject :       Re: Auction 8356402619
Received: from [64.34.161.110] by web35302.mail.mud.yahoo.com via HTTP

ok .. i will give you all this 20 units Nokia N92 for 1910,00 euros with shipping and delivery included in the price.
let me know if we will make a deal ?

Note: that's probably around 1/10th of the actual value of these handsets when they come to market. The price is clearly too good to be true.

From: eBay Buyer
To: newgeneration_phones@yahoo.com
Subject : Re: Auction 8356402619 

Sounds good, let's do it.

From :  Phones '05-'06 <newgeneration_phones@yahoo.com>
Subject :       Re: Auction 8356402619
Received: from [67.19.123.2] by web35311.mail.mud.yahoo.com via HTTP;

Ok Mr XXXXXX , give me a reply with your full info's : name, address, city, country, zip code to know where i need to send you the package.
please reply quick

Note: proxy changed to 67.19.123.2, another hacked PC.

From: eBay Buyer
To: newgeneration_phones@yahoo.com
Subject : Re: Auction 8356402619 

[Address deleted]

Do you take PayPal, a cheque or what exactly?

Thanks

From :  Phones '05-'06 <newgeneration_phones@yahoo.com>
Subject :       For payment i propose you a 100% safe deal for you ..
Received: from [67.19.123.2] by web35305.mail.mud.yahoo.com via HTTP;

l will ship via UPS but you can choose other mail carrier .lt
usually takes 48 hours till the package arrives to your door. l will
cover the shipping and insurance costs.I send all my packages
having written on them "display unit, no comercial value" or as a gift
so you
don't have to pay any additional taxes. (VAT included)
l'm a serious seller with more than 2 years of experience in
this field.
l'm a fair trader with a good feedback on ebay which is the
proof that l have closed a lot of sucessful deals.
During this period l learned that the best deals are closed when the
risk involved is minimum.
You will arrange payment through western union( www.westernunion.com ).
  I have something safe  for you because I want you to be sure that
you will  receive the product and  I hope we will colaborate in future
too
because I want to develop this  bussines as soon as possible.
Look what I can do for you:
-you will make the transfer to my location but not to my name(you will
use your best friends name for example as receiver's name)so you can be
sure that i will not pick up the money untill you get the product.So
you make a deposit at western union and you will
give me the transfer's details(SENDER NAME,RECEIVER NAME,MTCN) so i can
check that the deposit was made .
After i verify I will send you the product imediately and email you the
tracking number from UPS.
-only after you will receive the product and check it, if it  is ok you will
have to change the reciver`s name of the transfer to my name so i can collect my
money.So untill you
will have the product in your hands the money will be deposited  on
your best friend's name at western union agent.
   I think it is better to not inform western union that you will change
the receivers name in a few days because it is  possible
they to ask you to pay the fees twice also when you go to an western
union office to make the transfer,please don't tell there the reason for you
send the money because here in this country I must pay somes aditional taxes
when I recive the founds(you know busines with electronic...),Please say
you send the money to your friends or to your partener.
My old buyers of course make the transfer at western union direct to my
name which is easier and i will be happy if you can trust in me but
because it is our
first deal i proposed you this very safe and efficient method so you can
only deposit the money first and after you get the product to allowed
me to cash it.
Western Union company have offices in every bank, postal
office, big store or airport from your town.
Probably this payment method it is not very familiar to you but l have used it  for many
times and  each of my customers being satisfied and l have to admit that
it  is most efficient process to  go through.
In case you'll change your mind after receiving the
package and want to cancel the order you'll ship it back and retreive
the money from western union. Also in case the delivery does not arrive
on time please email me and I'll contact the mail carrier.
is it ok?in this way you will be sure that i won`t have the money until you will
recive the phones and change the reciver`s name.
Please give me a reply if you accept the deal in this way .
Thank you and let me know

This is the crux of the scam. The seller wants a Western Union transfer to a false name (note how they tell you NOT to tell Western Union that you are doing this). You then supply the scammer with all the details including the transaction number. Armed with this, the scammer then creates a fake ID and collects the money at a Western Union office. Of course, the goods will never turn up and the transaction is untraceable.

The scammer also makes reference to their good feedback on eBay.. but of course, they've just hacked into someone else's account. This response is a copy-and-paste job used by the scammers quite often.

From: eBay Buyer
To: newgeneration_phones@yahoo.com
Subject : Re: For payment i propose you a 100% safe deal for you ..

That sounds OK, there's a Western Union office not far from here. Sounds foolproof too. What are the details?

From :  Phones '05-'06 <newgeneration_phones@yahoo.com>
Subject :       RE: For payment i propose you a 100% safe deal for you ..
Received: from [67.19.123.2] by web35306.mail.mud.yahoo.com via HTTP;

Sorry for the delay...i have too many customers, please accept my appologise for this.Thank you for your understanding...
Look here my full info's to make the payment :
first name : George
last name : Harison
adress: Via Stelvio # 30
city : Milano
country: Italy
zip code : 20100
Let me know after the payment is made .
I will wait your reply.
Thank you

Note: it's an obviously fake name. The address is a cyber-cafe but it's most likely picked at random anyway.

From: eBay Buyer
To: newgeneration_phones@yahoo.com
Subject : Re: For payment i propose you a 100% safe deal for you ..

I can only transfer £500 by Western Union from their website, so I'll have to visit the agent.

From :  Phones '05-'06 <newgeneration_phones@yahoo.com>
Subject :       RE: For payment i propose you a 100% safe deal for you ..
Received: from [67.19.123.2] by web35307.mail.mud.yahoo.com via HTTP;

Ok Mr XXXXXXXXXXXX , 

Contact me when everything is done.
Thank you and keep in touch .
I will wait your reply .

The scammer is getting excited now and follows up..

From :  Phones '05-'06 <newgeneration_phones@yahoo.com>
Subject :       RE: For payment i propose you a 100% safe deal for you ..
Received: from [67.19.123.2] by web35314.mail.mud.yahoo.com via HTTP;

Hi XXXXXXX ,

Please let me know if you made the payment ?
Let me know if we still have a deal or not ?
I will wait your reply.
Thank you

From: eBay Buyer
To: newgeneration_phones@yahoo.com
Subject : Re: Auction 8356402619 

Sorry for the delay, the agent closed early on Saturday but it's done now.

As you suggested, I made the transfer in the name of a friend, [deleted]

From :  Phones '05-'06 <newgeneration_phones@yahoo.com>
Subject :       RE: For payment i propose you a 100% safe deal for you ..
Received: from [67.19.123.2] by web35313.mail.mud.yahoo.com via HTTP;

Ok Mr Xxxxxxxxxxx ,

So , if the payment is amde, please give me a reply with all this :
1- Sender Full Info's
2- Receiver Full Info's
3- Money transfer COntrol Number
4- Total Amount Sent
I will wait your reply with all this.

Thank you.

Of course, we don't have a control number, so a plausible looking 10 digit number was used.

From :  Phones '05-'06 <newgeneration_phones@yahoo.com>
Subject :       RE: For payment i propose you a 100% safe deal for you ..
Received: from [68.178.160.77] by web35312.mail.mud.yahoo.com via HTTP;

Ok Mr Xxxxxx ,

i will call to western union and i will ask them if the payment was made ..
If all it's ok, i will send you a message and i will announce you when you need to receive the package.
Thank you

Scammer has switched proxies to 68.178.160.77 which will be another hacked PC.

From :  Phones '05-'06 <newgeneration_phones@yahoo.com>
Subject :       RE: For payment i propose you a 100% safe deal for you ..
Received: from [67.19.123.2] by web35302.mail.mud.yahoo.com via HTTP;

Hi Mr Xxxxxxxxx , why you like to play games ?
I'm a bussines man and i don't like when someone ... nevermind .

The penny drop as the scammer realises that they have been taken for a ride. However, they'll be running several different scams at the same time and it's quite likely that many others will succeed. Take care.