(no subject)

[which_chick]

OMG, best phishing attempt 3V4R!!!



This hit my inbox today:

Dear eBay Member:

Due to recent account takeovers and unauthorized listings, EBay is introducing a new account verification method. From time to time Randomly selected accounts (seller and/or buyer) Are subjected to an advanced verification process Based on our merchant accounts/bank relations and customer's credit card.

EBay may also request in an email message scanned/faxed copies of one or more photo ID's. Your account confirmation may go wrong if your credit card/bank account is expired Or if you have changed your credit card number Billing address etc. without notifying us about the change.

Subject of this verification process are also the accounts that have unpaid dues to eBay. Your account is not suspended But if in 48 hours after you receive this message your account is not confirmed We reserve the right to suspend your eBay registration.

If you received this notice and you are not the authorized account holder Please be aware that it is in violation of eBay policy to represent oneself as another eBay user.

Such action may also be in violation of local, national And/or international law. EBay is committed to assist law enforcement with any inquires related to attempts To misappropriate personal information with the intent to commit fraud or theft.

Information will be provided at the request of law enforcement agencies To ensure that perpetrators are prosecuted to the full extent of the law.

Note: If this is the second time you receive this notice it might be because you have made a mistake when you entered your details or that the account was not updated at all.


To confirm your identity with us click here:

http://www.ebaylive2005.com

We apologize in advance for any inconvenience this may cause you and we would like to thank you for your cooperation as we review this matter.


Respectfully,
Trust and Safety Department
eBay Inc.


Now, this is a criminal mind phishing for identity-theft materials. It is. How do I know?

1. eBay doesn't ask for personal information like that. Ever. They say so multiple places on their web site.

2. The link for "www.ebaylive2005.com" actually goes to http://www.co-op.or.kr/acounts/memb/avncenter/dll87443/.BayISAPI.dll/.... I'm pretty sure that eBay doesn't host its stuff on websites in Korea.

3. Whois information on the domain name ebaylive2005 lists the registrar as
Deborah Denen
665 North 57th Avenue
Omaha NE 68132

I imagine that Deborah Denen will be pretty surprised to realize that she registered a domain name on 6-20-2005 that's being used in a noteworthy phishing attempt. Probably she's too busy cleaning up the mess that's being made of her credit history at this very moment to appreciate the slickness of this phish, but that's not our problem.

Note, for the record, that the ACTUAL eBay domain name is registered to:

eBay, Inc.
2005 E. Hamilton Ave., Ste. 350
2125 Hamilton Ave
San Jose, CA 95125

4. The email does not follow standard capitalization rules. It looks like the author capitalized the first word in each phrase or something. Official communiques I've gotten from eBay have all been correctly punctuated and spelled.

Okay. So it's a phish. What makes it a GOOD phish?

It sounds plausible, at least at first. Citing recent account takeovers and unauthorized listings is a good way to start. Many people, particularly the exceedingly trusting, know that one's eBay account data can be stolen and consider this a pretty significant problem. The line about an email message scanned/faxed copies of one or more photo ID's should raise red flags all over the place, but you're given a set-up sop on this because it's a part of the new account verification method, see. If you're willing to buy into the "new account verification method", you're probably not smart enough to realize that a couple of minutes with Photoshop could put whatever numbers you wanted on a scanned image of an ID.

Big false step, at least to me, was the line Subject of this verification process are also the accounts that have unpaid dues to eBay. Dues to eBay? Whiskey Tango fucking Foxtrot on that one, baybee. Dues to eBay? News to me. Greedy fucking criminals, aren't they?

They've also wrapped themselves in eBay's disclaimers about laws and such. Sheep's clothing, oh yes.

You know, in the face of inbox overphishing, reading for meaning is a lot more important than most middle-schoolers probably think it is. I think perhaps the ability to tell phish from friend is one of the more USEFUL applications of reading for meaning that normal humans can do these days. They should teach this in school.

Comments

[not-your-real.livejournal.com]

I think "Whiskey Tango fucking Foxtrot" should be nominated for the Bree Hill award (made up this moment for text in which a euphemism or translation is clarified by an adjacent gloss).

[fooliv.livejournal.com]

Nah, a really good "phish", as you call it, is where the grifter is effectively indistinguishable from the sockpuppet company in question. I got one the other week which was note-perfect. Format and design lifted directly from eBay electronic stationary, the mask address was to eBay proper's proper address, no misspellings or non-primary-English-speakers' half-errors, no high weirdness or eccentricities. They were just asking for something that eBay should never be asking for. It's only when you roll over the link that you notice that it isn't going to eBay, but rather some anonymous URL...

[which-chick.livejournal.com]

I think the particular appeal for this one was that it wanted scans of photo ID. That's so damn funny.

[ksleet.livejournal.com]

Actually, that part is slightly plausible. I misplaced my PayPal account for several years once and, when I wanted to use it again, discovered that I no longer had the password, lived at the same home address, or had access to the same email address or telephone number (and for whatever reason one is not allowed to just kill such a zombie account and start a new one; these things attach to your credit card like leeches and just won't let go.) In order to regain access I eventually had to fax PayPal photocopies of various identification documents.

Now of course the only real solution to phishing scams is to, you know, prosecute the offenders, but that's apparently hard or something.