cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Phishing scam messagefrom buyer

Got this weird message through eBay messages about an expensive item,

 

New message from: jazzsimmons23 (7)

Hey, ɪ ᴀᴍ ᴛʀʏɪɴɢ ᴛᴏ ᴘᴀʏ ᴛʜɪɪꜱ ʙᴜᴛ ᴜɴꜰᴏʀᴛᴜɴᴀᴛᴇʟʏ ɪ ꜰᴏᴜɴᴅ ᴀɴ ᴇʀʀᴏʀ ᴡʜᴇɴɴ ꜰɪɴᴀʟɪᴢɪɴɢ ᴛʜᴇ ᴘᴀʏᴍᴇɴᴛ. ʜᴇᴇ ᴛᴇʟʟꜱ ᴍᴇ ᴛʜᴇʀᴇ ᴡᴀꜱ ᴀ ᴘʀᴏʙʟᴇᴍ ᴡɪᴛʜ ᴛʜɪꜱ ꜱᴇʟʟᴇʀ ᴀɴᴅ ʜᴇ ꜱʜᴏᴡꜱ ᴍᴇ ꜱɪᴍɪʟᴀʀ ɪᴛᴇᴍꜱ,

ɪ ᴄᴏɴᴛᴀᴄᴛᴇᴅ ᴇʙᴀʏ ᴀɴᴅ ᴛʜᴇʏ ᴛᴏʟᴅ ᴍᴇ ᴛʜᴀᴛ ʏᴏᴜ ʜᴀᴠᴇ ᴅɪꜱᴀʙʟᴇᴅ ᴛʜᴇ ꜱᴀʟᴇ ᴛᴏ ᴜꜱᴇʀꜱ ᴡɪᴛʜᴏᴜᴛ ʀᴇᴄᴇɴᴛ ᴘᴜʀᴄʜᴀꜱᴇꜱ ꜰᴏʀ ᴛʜɪꜱ ɪᴛᴇᴍ, ɪɴ ᴏʀᴅᴇʀ ᴛᴏ ᴍᴀᴋᴇ ʏᴏᴜʀ ᴘᴜʀᴄʜᴀꜱᴇ ʏᴏᴜʀ ꜱᴇʟʟᴇʀ ɴᴇᴇᴅꜱ ᴛᴏ ᴀᴄᴛɪᴠᴀᴛᴇᴇ ᴛʜɪꜱ ᴏᴘᴛɪᴏɴ, ᴛʜᴇʏ ꜱᴇɴᴛ ᴍᴇ ᴛʜɪꜱ ʟɪɪɴᴋ ɪɴ ᴡʜɪᴄʜ ᴛʜᴇʏ ᴛᴇʟʟ ᴍᴇ ᴛᴏ ꜰᴏʀᴡᴀʀᴅ ɪᴛ ᴛᴏ ʏᴏᴜ.

http://listing-buy-it-now.center/ebay

ɪɪꜰ ʏᴏᴜ ᴍᴀɴᴀɢᴇ ᴛᴏ ᴀᴄᴛɪᴠᴀᴛᴇ ᴛʜɪꜱ ᴏᴘᴛɪᴏɴ ᴡɪᴛʜᴏᴜᴛ ᴀ ᴅᴏᴜʙᴛ ᴀɴᴅ ɪ ᴛʀʏ ᴀɢᴀɪɴɴ, ɪ ʜᴏᴘᴇ ᴛᴏ ʜᴀᴠᴇᴇ ᴀ Qᴜɪᴄᴋ ʀᴇꜱᴘᴏɴꜱᴇ,,

ʙᴇꜱᴛ ʀᴇɢᴀʀᴅꜱ,

`𝐉𝐚𝐳𝐦𝐢𝐧𝐞 𝐒𝐢𝐦𝐦𝐨𝐧𝐬`
 
 
It is in a weird typeface with many typos.
Just for fun I cut and paste the link in a new tab and there was a capcha that wanted me to click the "conference rooms" hahahaha
I played the game and took screen shots, took me to a log in page that looked legit but did not auto fill with my info. I aborted the mission.
 
Message 1 of 6
latest reply
1 BEST ANSWER

Accepted Solutions

Phishing scam messagefrom buyer

@evry1nositswindy   thank you for the tag.

 

@nooni   As you state, that message contains a phishing or scam link. Do not click it (well, you did, but you quit before executing the phishing trip).

 

eBay links can be identified when ebay.com is immediately followed by the first single slash. For example:

https://www.ebay.com/somethingelse/and/more.html

In this case, we can see that the domain is NOT eBay. The domain before the first single slash is "listing-buy-it-now.center" not "ebay.com"

http://listing-buy-it-now.center/ebay

 

eBay's member-to-member policy page asks that you report eBay-messaging spammers to spoof@ebay.com

https://www.ebay.com/help/policies/member-behaviour-policies/membertomember-contact-policy?id=4262

 

However, that reporting process is normally used for email messages and website URLs rather than for eBay messaging and reporting members. So send the phishing URL to spoof@ebay.com and they can take down the website.

 

To deal with the person running the scam, you could contact customer support directly from the bottom of the above help page. Click the "contact us" option and type "agent" into the chat box that opens. That is probably the quickest route to terminating the member (or dealing with a compromised dormant account).

 

ShipScript has been an eBay Community volunteer since 2003, specializing in HTML, CSS, Scripts, Photos, Active Content, Technical Solutions, and online Seller Tools.

View Best Answer in original post

Message 6 of 6
latest reply
5 REPLIES 5

Phishing scam messagefrom buyer

If the buyer has not paid by day 4, on day 5 the seller can file a Cancellation with the reason Buyer didn't pay. The seller gets his/her FVF credited, the buyer gets an unpaid strike recorded on his account, no one can leave feedback. Two or more unpaid strikes, and the buyer will find it difficult to bid/buy from sellers who block buyers with 2 or more unpaid strikes. Do you have your Buyer Blocks in place?

 

https://www.ebay.com/bmgt/buyerrequirements


List as fixed price with Immediate Payment Required (you will need to switch to the advanced/business tool for that option, which is located in the upper right corner of the Quick Listing Tool), no Best Offers, and your listing will stay active until someone actually pays for the item.

disneyshopper
Volunteer Community Member

Message 2 of 6
latest reply

Phishing scam messagefrom buyer

Buyer is not on my blocked list.

 

Message 3 of 6
latest reply

Phishing scam messagefrom buyer

Read the whole post, it is some sort of scam

Message 4 of 6
latest reply

Phishing scam messagefrom buyer

It does look like a scam.  @shipscript will know!!

evry1nositswindy  •  seller since 2013
Volunteer Community Mentor

Message 5 of 6
latest reply

Phishing scam messagefrom buyer

@evry1nositswindy   thank you for the tag.

 

@nooni   As you state, that message contains a phishing or scam link. Do not click it (well, you did, but you quit before executing the phishing trip).

 

eBay links can be identified when ebay.com is immediately followed by the first single slash. For example:

https://www.ebay.com/somethingelse/and/more.html

In this case, we can see that the domain is NOT eBay. The domain before the first single slash is "listing-buy-it-now.center" not "ebay.com"

http://listing-buy-it-now.center/ebay

 

eBay's member-to-member policy page asks that you report eBay-messaging spammers to spoof@ebay.com

https://www.ebay.com/help/policies/member-behaviour-policies/membertomember-contact-policy?id=4262

 

However, that reporting process is normally used for email messages and website URLs rather than for eBay messaging and reporting members. So send the phishing URL to spoof@ebay.com and they can take down the website.

 

To deal with the person running the scam, you could contact customer support directly from the bottom of the above help page. Click the "contact us" option and type "agent" into the chat box that opens. That is probably the quickest route to terminating the member (or dealing with a compromised dormant account).

 

ShipScript has been an eBay Community volunteer since 2003, specializing in HTML, CSS, Scripts, Photos, Active Content, Technical Solutions, and online Seller Tools.
Message 6 of 6
latest reply