Longtime friend and colleague Stephen Cobb sends the following warning about an auction-related scam (“I” refers to Stephen throughout and names have been changed to avoid lawsuits):

* * *

In early April, I failed to win an auction for an $800/£420 item by just a few pounds. The item was listed by someone in South Gloucestershire, England. I think the listing itself was entirely legitimate. A few days later I was contacted via eBay e-mail, supposedly by the seller, saying:

“You expressed interest in Item number 6165275772 by bidding, however the auction has ended with another member as the high bidder. In compliance with eBay policy, the seller of that item is making this Second Chance Offer to you at your bid price of £415.00. The seller has issued this Second Chance Offer because the winning bidder was unable to complete the transaction.”

However, the name associated with this message, “Dave Alabaz,” did not seem to match the lister of the item (far722 - but those names are sometimes obscure). When I contacted Dave via his Yahoo e-mail address he asked for my mailing address. I felt this made him sound legit and gave it to him (it is not exactly a secret) along with an offer to pay him via PayPal. But he turned this down, telling me to follow instructions in the message that I would get from eBay.

I did then receive e-mail from aw-confirm@ebay.com stating, “You have agreed to purchase the following eBay item from far722 on Mar-29-05.” The message asked me to pay through Western Union. The seller gave me the name and street address of the Western Union recipient as Patsy Alabaz, in London, not South Gloucestershire.

Here is some of the e-mail:

“Currently, this seller has a US$ 20,000.00 deposit in an eBay managed purchase protection account. Transactions with this eBay seller are covered by purchase protection against fraud and description errors. For your safety, this account was locked today, for 30 days time. The seller is unable to withdraw any money from it, within this period.”

This sounded fishy and the source of the HTML message looked fishy. One disguised link led to a login at Yahoo e-mail! So I went to the eBay Q&A forum and described this stuff. Everyone there shouted SCAM!

Presumably this is perpetrated by someone watching the bidding for a high-end item, then hitting one or more “losers” with e-mail to their eBay bidding ID, correctly listing their losing bids and offering to sell them the exact same item. Quite enticing to a keen buyer, even though logic tells you that the scammer very definitely does not have the item - we are talking about serial-numbered items here - it went to the auction winner.

M. E. Kabay, PhD, CISSP-ISSMP, is Program Director of the Master of Science in Information Assurance program at Norwich University.