Arbor Networks: Security to the Core

Back in November 2005, Bruce Schneier wrote about a Western Union-related fraud. This week, I was exposed to some of the techniques used by eBay sub-geniuses and their use of Western Union. I deal primarily in buying and selling rare and hard-to-find comics on eBay, which doesn’t see much fraud activity, and as a result I’ve been pretty insulated.

In the editorial piece of the June 2006 edition of ;Login:, Rik Farrow refers to an eWeek article and points out the absurdity of statements made by a Microsoft Program Manager who is quoted as calling users stupid because they fall victim to phishing and rampant fraud. I agree with Rik; many of my friends and family won’t ever be able to thwart every attempt to defraud them.

As I stated above, my experience with eBay fraud was non-existent until last Friday when I listed an auction for a used Sony PSP. About an hour after listing the item, the auction ended with a “Buy It Now” purchase from a user whose status was listed as “No longer a registered user”. Odd, since eBay states that unregistered users can’t buy or sell anything.

The unregistered buyer sent me a rambling message about wanting me to end the already-ended auction and informing me that they’d like me to ship the PSP to Nigeria. They might have better luck if they asked me to disarm a bomb.

Based upon what I’ve read, only the person listed as the shipper (i.e. the person or organization that paid for the shipping) can communicate with UPS, Fed/Ex, etc. when filing an insurance claim. This applies to shipping through a third-party included MBE, Fed/Ex Kinko’s and the Paypal shipping interface.

I wrote back to the unregistered buyer and explained that it would be a cold day in Death Valley, CA, before I sold to an unregistered user, let alone shipped using their Fed/Ex account. Four days and an e-mail exchange with eBay Customer Support later, I hadn’t heard back from the original buyer, but I did receive a refund for the cost of the original auction listing. I re-listed the item yesterday and within 10 minutes began exchanging some messages with a “potential” buyer. I thought I’d share my experience:

(Fraudster wannabe)
Hello,
How many of this item do you have for sale?What is the present condition of this item.What is the exact weight and size of it.Your last selling price for it
Thanks

(Me)

Hi , I admit I’m puzzled by your question. I’m selling one Sony PSP portable (otherwise the auction would have listed this). The exact size and weight of a Sony PSP is probably best obtained from Sony’s website where you’ll find a product datasheet.

Finally, with regard to your question about the last selling price, I don’t understand this question either. Auctions go to the highest bidder on eBay.

(Fraudster wannabe, 5 minutes later)

Thanks for the mail, I will like to buy the item from you and am ready to pay the amount of $300 for the item and i will handle the shipping with my fedex account.
If you are okay with my offer kindly end the Auction for me and email me back with your full name and address because i will be making payment through Western Union online money order which will be posted to your home directly.
Thanks
Pls do not hide your email address

(Me)
Listen to me very carefully, you are operating outside the acceptable rules of eBay and I think it will be fun to report you directly to eBay!

You are clearly not a native English speaker and I sincerely doubt you are in the United States.

Further, no one pays $300 for an item listed for $175. Further yet, did you see Western Union listed as an acceptable form of payment? I don’t think so.

Learn to read. Do not bid on my auction. Do not pass go, do not collect $200. Find a tall building and jump off the top of it.

This entry was posted on Tuesday, July 18th, 2006 at 12:19 pm and is filed under Other, Social Engineering, Spam. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.