Multitasking Fraudsters

I had a recent encounter with online fraud and social engineering that was unusually complex.

I was selling an item on eBay. The item was brand new, and retails for $250. So, imagine my surprise when I received the email announcing the auction ended with a winning price of $395!

This was followed about two hours later by another email from eBay, notifying me that the auction had been canceled due to fraudulent bidding.

I didn’t think much of it, other than being mildly frustrated at later having to relist the item and wait for another auction to complete.

The next day I received a poorly constructed fake PayPal “confirmation” email, showing that the winner of the auction had sent me funds, not only for $395, but with an additional $100 for shipping! The terms at the end were distinctly out of synch with the actual PayPal process (warning of account cancellation unless the item was shipped and tracking number sent, and the highly suspect paypalenquiryOfficeEmailnet address specified for communiations). The shipping address for the item? A location in Nigeria.

What I found interesting was that the hyperlink to the eBay item included in this fake payment email pointed to the United Kingdom version of eBay and with a completely different item number. That auction had been pulled as well by the time I recieved the email, so I couldn’t examine what was going on. My suspicion is that my original auction posting may have been duplicated in hopes that it would remain if the original auction was discovered as fraudulent and canceled. (BTW, kudos to eBay for quickly identifying and canceling both!)

About an hour after this fake payment message, I got an email from the “winner” of the auction:

Hot on the heels of this, I next received what ended up being the final communication:

Although the whole endeavor lacked a lot in establishing authenticity, I was intrigued by the different elements that were used in the attempt. To sum up, we have:

1. Fraudulent bidding to push an eBay item well beyond its reasonable value, along with…
2. Possible duplication of the auction posting in an attempt to support…
3. A fraudulent PayPal notice, which includes social engineering elements of both additional money and threatened account suspension, followed by…
4. Multiple communications from the auction “winner” that also include both negative (threatening to involve law enforcement) and positive (offer of possibly even more money beyond the already ridiculously inflated price) social engineering elements.

That’s a good amount of work to go through to get a hold of my $250 item! Nonetheless, I could imagine more sophistcated versions of such a multipronged fraud attack being disturbingly effective.