Just wanted to share a scam that was tried on me yesterday. In the afternoon my computer was bombarded with just under 400 emails. Lots were multiples of the same. All were for American places. I started deleting these individually so as to ensure I didn't lose any legitimate ones in the process. In amongst them all was an ebay notification confirming a purchase of an expensive watch from an American seller and a delivery to an American address. This was done using my Visa card. I got onto the bank and stopped the card and after a mammoth effort managed to get to speak with someone from ebay who investigated and has stopped my account and flagged the fraud so the money should be repaid to the bank. Loads of agro and changing of passwords etc plus the inconvenience of not having a debit card for a while. So, if you get a similar attack, please look carefully at the emails. I assume they try to sneak the sale through hidden in the spurious ones. Be careful.
- Thread starter Mikes
- Start date
gaz1
Member
- Messages
- 19,208
- Location
- westyorkshire
as i see it a company with your details has been data hacked
to have both credit card details and bank account card this would say so and email address
or have you used somewhere where you recently inputed those details into
ebay reference is by a credit card bought
ebay should have flagged it if you already have an account with them
if you use the rear code on your cc then its something simple somewhere you have used it or have inputed those details
that rear code is hard to get unless you hand your card over to pay for or youve inputed those details
to have both credit card details and bank account card this would say so and email address
or have you used somewhere where you recently inputed those details into
ebay reference is by a credit card bought
ebay should have flagged it if you already have an account with them
if you use the rear code on your cc then its something simple somewhere you have used it or have inputed those details
that rear code is hard to get unless you hand your card over to pay for or youve inputed those details
lazybones51
Member
- Messages
- 379
- Location
- Northamptonshire, UK
The fact you received the emails suggests it was your own eBay account that was compromised, and the seller used your saved payment method to complete the purchases.
I'm guessing you were either phished, or use the same login credentials across various platforms of which one has been compromised.
It does highlight the importance of having 2FA enabled to help combat these sorts of attacks, as they would never have been able to login to your account without a valid one time code.
I'm guessing you were either phished, or use the same login credentials across various platforms of which one has been compromised.
It does highlight the importance of having 2FA enabled to help combat these sorts of attacks, as they would never have been able to login to your account without a valid one time code.
Morrisman
Member
- Messages
- 8,300
- Location
- Staffordshire, England
Easiest way into your accounts is by someone emailing you about a purchase, for example, and you hit the link to get to ‘eBay’ and you log in, as asked….. and you’ve just given your details to a stranger who makes good emails.
I always open ebay separately, never follow an email link, for any reason. Same with PayPal. Farcebook etc.
I always open ebay separately, never follow an email link, for any reason. Same with PayPal. Farcebook etc.
Genuine question - being a bit of a luddite when it comes to phishng scams involving fake websites.... I have auto password completion for sites - would the fraudulent site be recognised as Ebay by the password manager? (I presume the domain must match or something?)
ajlelectronics
Forum Supporter
- Messages
- 9,793
- Location
- Gloucester, England
You are quite right. The login will not be offered for a site other than the one which matches its creation.
I'm Mr. Cautious with computers and always err on the side of safety. I don't use the same login for more than one site. I think it's most likely that they got in via Google as I found two extensions on there when I looked. Trouble is identifying if they are friendly or not. Both removed now anyway. Again, worth checking your browser to see if there are anything on it that you haven't added. Yes, two stage logins seem to be the best way going forward. Worth the inconvenience hopefully.
I will add that I thought that when using a credit or debit card for an internet purchase, they could only deliver to the address where the card is registered. This apparently is no longer the case and ebay and Amazon will accept orders sent to a third party address.
gaz1
Member
- Messages
- 19,208
- Location
- westyorkshire
even on ebay or amazon external side of it they still need that 3 or 4 pin number underneath otherwise that card wont go through
its this point you need to consider how theyve got that number
restaurant petrol station or pub or wherever you have used that card by hand over of it
as goes for net based its down to the user
fake website and youve put all of the details down ( hijacked website or clicked a phishing link )
or an account somewhere has been hacked and have gotten your details (a company as silly as amazon prime ) everything email address cc number and the pin code needed
its not always a hacked pc or phone it all depends on how you access and where you have bought
if I suspected it was my pc then id stop using it do a format and reinstall everything phone it would be a factory reinstall
you can back stuff up but keep that files off line
Morrisman
Member
- Messages
- 8,300
- Location
- Staffordshire, England
Generally I’ve found they don’t recognise the fake site, or even a link to the genuine site. I’m guessing the ‘url’ that it matches must be slightly different to any url a link gives.
rcx132
Philip
- Messages
- 2,929
- Location
- London, UK
Browser plug ins are a big risk. Encryption is between browser and server. Your browser sees everything in plain text.
