OT: My Ebay Account Was Hijacked

[Archive]

Posted By: Dan Bretta

Not sure how it happened or why because I never click on any links in those ebay spoof emails...So I'm left wondering how they got hold of my password?? I thought the email from ebay was a spoof so I ignored it...later I tried to log into my account and it wouldn't work so I had to change my password.

[Archive]

Posted By: Matt

Dan - go through your eBay sent messages and see if the hacker did any damage. It's good you found it quickly.

My Trade/Sale Page

[Archive]

Posted By: leon

I got the same message tonight but haven't hassled with anything yet.

[Archive]

Posted By: Matt

Interesting. Someone with a Net54 vendetta?

My Trade/Sale Page

[Archive]

Posted By: Dan Bretta

Matt, there's nothing in there that I didn't do...I'm wondering though if ebay cleaned up anything the hacker may have done.

this is the email they sent me -

Hello southst9 (XXXX@XXXX.XXX),

We're writing to notify you that your account was taken over by an unauthorized person.

This person may have used your account to post listings on eBay, or to change some of your current listings. The email address on your account may also have been tampered with, which is why you may not have received any emails before this one.

***Please note***
We've taken several steps to secure your eBay account. All associated fees have been credited to your account, and any listings that were tampered with have been canceled. Your credit card information is stored on a secure server and can't be viewed by anyone.

***Securing Your Account***
We've sent you an email with instructions on how to change your personal email and eBay passwords. Please follow these instructions immediately. After you've changed your passwords, please change your Secret Question and Answer by taking the following steps:

1. Click "My eBay" at the top of most eBay pages. You may be asked to sign in.
2. Click the "Personal Information" link on the left side of the page. This link is located under the "My Account" heading.
3. Click the "Edit" link to the right of "Secret question", under the "Account Information" heading. For your security, you'll be asked to enter your User ID and password again.
4. Fill in the information requested.
5. Click the "Change Secret Question" button.

Finally, please verify that the contact information we have on file for you is correct. To verify your registration information, please follow these steps:

1. Click "My eBay" at the top of most eBay pages. You may be asked to sign in.
2. Click the "Addresses" link on the left side of the page. This link is located under the "My Account" heading.
3. If you need to change anything, click the "Change" link to the right of your registration information.

***Protecting Your Account***
To help keep your account secure in the future, you may want to learn how to recognize and report fake ("spoof") emails and Web sites. Please note that eBay will never ask for sensitive personal information by email.

For more information about spoof eBay Web sites and emails, please go to:

http://pages.ebay.com/help/confidence/isgw-account-theft-spoof.html

A secure password consists of a combination of letters and numbers, which makes it very difficult for anyone else to guess. For tips on how to create a secure password, please visit:

http://pages.ebay.com/help/confidence/password-secure.html

There are a number of computer viruses that can record keystrokes. We recommend that you keep your antivirus software up to date and use a firewall.

If you have any questions, please feel free to contact us through the following Web page:

http://pages.ebay.com/help/contact_us/_base/index_selection.html

We're sorry for the inconvenience, and we thank you for your patience and understanding.


Sincerely,

eBay Customer Support

[Archive]

Posted By: Dan Bretta

Leon, is your password working?

[Archive]

Posted By: Matt

Interesting. I'd think you'd want to know if any emails were sent form your account - just deleting them doesn't undo any potential damage that would have resulted. Sorry this happened to you guys.

My Trade/Sale Page

[Archive]

Posted By: leon

Nope, it's not...it was earlier today though....fun fun fun......

[Archive]

Posted By: Dan Bretta

Okay then...how does this happen?

[Archive]

Posted By: Anthony S.

It was probably Marshall. Bringing noise.

[Archive]

Posted By: Matt

Dan - could be any number of ways - most probably malware you downloaded without knowing about it that captured your credentials when you logged in to eBay and send the credentials to the hacker, but in theory they could have hacked the eBay servers and stolen people's info or network sniffed when you logged in, or other nasty stuff.

My Trade/Sale Page

[Archive]

Posted By: Dan Bretta

It will be interesting to see how many other Net54ers this may have affected. If it's just me and Leon I think I'd be smelling a rat.

[Archive]

Posted By: Chris

This actually happened to me a few years ago. I NEVER open any links at all and I thought the email was a spoof until my password wouldn't work. When I called Ebay, they said the problem was real. Someone had somehow hacked my account. They didn't know how, but it had happened. I was told that it may have been some kind of spyware that can detect key strokes.
I was fortunate that no damage was done. You may need to monitor things to make sure nothing happens with your account. Good luck with it.

Chris

[Archive]

Posted By: Matt

If you guys use Auctiva that had an issue the last few days with their system being hacked and since you store your credentials with them, a hacker could have gotten your credentials that way. Alternatively, any sniping service you use also has your credentials.

My Trade/Sale Page

[Archive]

Posted By: joe brennan

Is this all the sudden a Vintage card collector nightmare? You are the 4th BB collector in the last week that I know of that has had their accounts highjacked. I just checked mine and so far, so good.

In Rememberance of James W. Brennan Sr. 1924-1982. Dad, thanks for everything you did for me.

[Archive]

Posted By: leon

This happened to me about 6 months ago too. I contacted ebay and got it squared away but it was a real deal...I guess they had reason to believe someone had gotten into my account and locked it down. I didn't notice anything different and no bids were placed or anything....It just took a while to get it fixed (less than an hour)...I don't feel like messing with it tonight. I just found out when you told me, Dan....though I had gotten the email a few hours ago.

[Archive]

Posted By: Jon Canfield

Guys - happened to me tonight as well. Same thing as you describe... got the eBay email, went to log into my account later on (using the eBay page) and my eBay password didn't work.

I also NEVER log into eBay using those spoof emails and have never had a problem before.

I contacted eBay right away and I was told that eBay is now monitoring the computers users use to log into their eBay accounts. If someone tries to log into their eBay account with a non-recognized computer, the account immediately get's frozen as an attempted hijack attempt. Earlier today, I logged into eBay using my girlfriend's computer so this may have triggered it in my case.

Anyway, after about 30 minutes with eBay security live help, I got my eBay account up and running. While im confident it wasn't a true hijack attept, I changed my password anyway.

[Archive]

Posted By: Dan Bretta

Hmmm...well I access ebay on two computers everyday...the one at work and the one here at home, but it's never been a problem in the past. I guess I'd feel better if ebay actually shut down my account because of that.

[Archive]

Posted By: Matt

Jon - as I mentioned above, this could have happened any number of ways, even if you never logged into a spoofed web page. It's good that eBay is on top of this.

My Trade/Sale Page

[Archive]

Posted By: Jon Canfield

Dan - same thing here - I often access from multiple computers and never had a problem. However, my account was potentially "hijacked" soon after I logged on using the other computer. I also did not notice anything weird with my account - no improper emails, no bids, so items listed - nothing was out of the ordinary other than my password was changed (and later discovered to just be locked by eBay).

======================================
For the premier online souce of information on baseball-related cigarette packs, visit http://www.baseballandtobacco.com

[Archive]

Posted By: Alan U

Jon, exact same thing happened to me. It was okay at work, when I got home I couldn't log on. Did an online chat with ebay and they sent me a new password. Same reason for locking my account, something about using multiple computers.

edited for typo

[Archive]

Posted By: Glenn

Looks like they got me too. Anyone else?

[Archive]

Posted By: smtjoy

Last 2 days I have gotten phoney emails that pretend they are from ebay, one saying I have an unpaid strike, another saying my account has been tampered with, etc. They want you to open your account so they can see what password you used and these are like cookies tracking your keystrokes, just delete the emails and dont open them. I called ebay and my account is fine, they suggest only opening ebay messages in ebay on the same pc, ok to open these on a blackberry or other pc.

[Archive]

Posted By: jay wolt

I have 3 eBay ID's and one of them was "hijacked" twice
in the last 2 weeks. It was the account I had in w/ JustSnipe.
So I assume there was a correlation, so I cancelled the JustSnipe
service.
Perhaps eBay closed accounts thatweren't hooked up to your IP adresses.
So some sniping services drew a red flag.
Nonetheless it was a hassle and I lost a few snipes on cards I wanted
that went for less then my snipes.

[Archive]

Posted By: marshall barkman

Dan.....how many people at your work use the same computer? It is very odd that both you and Leon got hacked into.

[Archive]

Posted By: D. Bergin

I had the same issue tonight. It was a legitimate message from Ebay. At first I thought it was a phishing attempt and just deleted it. Then I logged into Ebay and my password didn't work. Scared the crap out of me. It was in "My Messages" on Ebay also.

Reset the password and checked around and it didn't look like any damage was done.

Coincidentally it happened about the same time I cancelled a couple of bids at Gavelsnipe.

I'm actually glad I wasn't the only one.

[Archive]

Posted By: Dan Bretta

Marshall, I'm the only one that uses my computer at work.

I also use gavelsnipe and had to go in and change my password there too since I have a pending snipe. I think to play it safe though I'm going to put my bid in on the item.

[Archive]

Posted By: marshall barkman

It sounds to me like someone got into gavelsnipe but why are they going after baseball card folks on this board? Is it a coincidence or someone that is trying to hurt board members?

[Archive]

Posted By: quan

jay,

same thing happened with me and my account associated with justnipe. fyi i notify ebay a couple weeks ago i was travelling abroad for the next few weeks and they did tell me they'd add my laptop to the ok list...they do track individual pcs that log into your account.

[Archive]

Posted By: Marty Ogelvie

Dan,

What about the email account you have registered with eBay? My ebay account was hacked a few years back and that's how they got in.. they hacked my email account and then got my eBay password emailed to my account which they had...

marty

[Archive]

Posted By: Mark

Hello to All ,

Theres a thread on the UK Questions & Answers forum concerning this , if you sort the chaff out from the wheat there might be some answers on there .

http://forums.ebay.co.uk/thread.jspa?threadID=1200278282&tstart=40&mod=1235 636898165

----
Mark

[Archive]

Posted By: Rhett Yeakley

The same thing happened to me tonight. Everything was fine at work, I get home after a LONG day and checked Gavelsnipe & none of my snipes had registered. So, I go into ebay and can't log in and I have the same message from ebay in my email. Hopefully, it isn't simply an ebay power-play to try an kill the sniping services.
-Rhett

[Archive]

Posted By: D. Bergin

Nice, I finally bit the bullet and started using a snipe program a week ago and this happens.

Also wonderful if you're a seller. It gives people yet another reason not to bid on Ebay auctions.

[Archive]

Posted By: leon

I use gavelsnipe too...

[Archive]

Posted By: Scott Fandango

i bet you all use the same snipe service....

that is why i dont trust them...i snipe the old way...counting down from 20 myself!

[Archive]

Posted By: Steve F

It's a conspiracy. I the East African warlords want our Cobby's!


Same thing happened here last month. Account frozen, password reset, had to do something with the PP account as well. Scary situation and a little hassle, but no harm done.

As mentioned, the tech believed it was the multiple computer issue and ebay reacts immediately to any account farts nowadays, thankfully.

[Archive]

Posted By: Matt

One other thought on the issue. The accounts may not have been hacked at all, and your experience may simply be the result of an overly sensitive eBay fraud alert. As one possibility, the example above of eBay triggering such an email when the computer you use to login changes. If you use a snipe service and they change servers, then you all would get that email - no hacker involved.

My Trade/Sale Page

[Archive]

Posted By: leon

I haven't gotten the email ebay said they would send in order to reset the password. Anyone know a quick way to do it? Thanks in advance.

[Archive]

Posted By: Aaron Patton

..."they" got me too.

[Archive]

Posted By: Laura

I do wonder if there's a connection with Auctiva too. Do any of you who have been hacked use Auctiva? Or have you bought something from someone who does?

Have you checked your hard drive with an anti-virus program of late? I'd do so, if you don't have one set up to do regular scans.

[Archive]

Posted By: Glenn

Leon,

I never got that email either. I also tried the back-up method (phone call with a 4 digit code), and I never received the phone call. The third method is the live chat with customer service, and that went surprisingly well. It only took about 10 minutes.

[Archive]

Posted By: Jon Canfield

I also had a snipe on gavelsnipe last evening when I was "hacked." AFter changing my password, I updated my profile on gavelsnipe and my snipe went off without a hitch. It's possible that gavesnipe was the "computer" that triggered my alert.

Also, just as a FWIW, the email I received was not a phishing attempt - I also had the email in myeBay.

======================================
For the premier online souce of information on baseball-related cigarette packs, visit http://www.baseballandtobacco.com

[Archive]

Posted By: Scott Daloisio

This happened to me a few times over the years. Whenever this happens to you, you want to contact "Live Help." If you are waiting for the E-mail with a new password, most of the time your hair will turn gray (or grayer or bald) before you get it. Once you get "Live Help," and verify who you are, you can ask them to phone you. They will issue you a new password. Whole process normally takes a half hour or less.



Three things to prevent account theft on eBay.



1. Never, ever type in your password. Save it in a offline file and cut and paste it when you sign in. Same with your user name.



2. If you have a PayPal account, get a PayPal Security Key. If I remember correctly it only costs $5.00 and can be used on your eBay account as well. Only drawback is if you have it turned on and use snipe bids, it will block snipe bids. If you want to snipe bid and your are off line, just turn the security key off.



3. If you have a question from eBay in your regular E-mail box, never sign in using the link provided. Go to your "My eBay" account and answer the question from there.

[Archive]

Posted By: Jason

Yep I got wrangled up in this mess as well. I use Gavelsnipe.

[Archive]

Posted By: Eric Brehm

Same thing happened to me -- I received the "Account Security Notice: Restore Account" e-mail from eBay. It said my account was being used by someone to send unauthorized messages to other users. A hold was put on my account, and I couldn't log in. Nothing I did to try to reset my password worked, including getting them to send me several password-reset PINs by phone. I kept getting "session time-out due to inactivity" type messages. Finally I contacted Live Help and they reset my password for me, and now I am back in business.

By the way, I have never used a snipe program.

[Archive]

Posted By: Charles

Hi Folks,

I've been a reader of this forum and figured I'd add some input to this thread. I believe that this issue is due to snipe programs. My eBay account has been 'compromised' three times over the past two weeks. The first time I thought my computer had been hacked, but became suspicious after the second eBay email. This past Sunday, I placed some snipes, woke up Monday morning and was able to log-in to my eBay account. At that point I enabled that PIN token that I have for my eBay password so my eBay password is my password+random number from token. On Wednesday I received another email saying my account was compromised. For all intents and purposes not possible with said token activated.
The eBay rep told me that they are now monitoring where people log-in to eBay from (assuming IP address). She said that she would make a note in my account (whatever that means) that would allow me to snipe without having my account frozen every day or so.

Charles

[Archive]

Posted By: Jim VB

For what it's worth, Gavelsnipe swears that they have checked and there was no security breach on their end.

[Archive]

Posted By: Matt

Jim - did you ask them if they recently changed server IPs?

My Trade/Sale Page

[Archive]

Posted By: Jim VB

Matt,

I didn't ask that. It's way above my technical level of expertise.

[Archive]

Posted By: Bill Cornell

Charles' explanation above is correct. This isn't 'hacking' as it's commonly thought of. Every time you log onto eBay, it's recording information about your browser and your computer, which then becomes your 'footprint'. When they see you logging in from multiple locations (home, work, snipe service, etc.), the information doesn't match up exactly, so some accounts will get flagged as suspicious.

This is an attempt to stop ATO's (account takeovers) that were a plague until recently (what are those Romanians up to now? I'd ask craigslist...).

By the way, it's a lot more than just your IP address that gets captured. Below is a typical header with characteristics of a session.

Host: show-ip.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.6) Gecko/2009011913 Firefox/3.0.6 (.NET CLR 3.5.30729)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: [the URL where you came from, if known]


Bill