The Ebay buyer who scammed me - and almost got away with it

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Hello I'm New here! Joined: 11 Oct 2013 Posts: 12

Before I tell the story of what happened to me, I want to say that I do feel really stupid that I fell for a scam like this. I'm usually not gullible or over-trustworthy, but this was my first time selling something on ebay and I know that is why I was targeted. I wanted to share my story in hopes that it might help someone else. Embarassed

I listed a watch on ebay on October 3rd. I had it starting at 50 dollars, with a buy it now option of $350. To my surprise, on Saturday the 5th of October I received an email from ebay saying that my item had sold. Granted, I was a little surprised as I expected to maybe have one bidder at most. However, I was excited at the prospect of getting the amount I had asked for. I then emailed an invoice to the buyer (through the legitimate email that ebay sends you), and waited for their payment. Instead of hearing anything through ebay, the person contacted me via email on Saturday night asking me how I would like them to pay. I found this a little odd, and looking back I realize that this is when the first red flag should have gone up. However, I answered them back stating that I would like to be paid through Paypal and to check the invoice I had sent them.

Things then went silent until Monday morning, when I woke up to 3 emails. The first was from ebay stating that the person's ebay account had been suspended due to unauthorized activity on their account. The next email was from the buyer, apologizing for this "mixup", saying that they were on vacation and had signed into their account on a device they didn't usually use. They then said they were trying to resolve things with ebay. The third email - which actually turned out to be a fake, which I unfortunately didn't realize until days later - was from "ebay" claiming that the issue with the person's account had been resolved. As I said before, I'm new to the whole ebay selling scene, so I didn't realize that this message should have also been in my ebay inbox. Looking back, this is when I should have cut things off. The buyer still had yet to pay me, so I emailed her again asking to be paid through paypal as soon as possible in order to ship her the item.

This is where things get messy. On Tuesday, I received a fake email from both ebay and paypal, saying that this bidder had paid for the item. Interestingly, the person emailed me again asking if I had received the email confirming that they had paid...and to check my spam folder. They also said this:

I have paid for the item and i want it shipped via Local Post or FedEx International Sign For Delivery to the following address below:

Name: Nicholas Patrick,
Address: 31 Aborishade Road
Lawanson, Surulere,
Lagos, 23401
Nigeria

I actually received 2 emails - the first from "paypal", saying a payment had been made through paypal with the total amount I had asked for plus shipping. There turned out to be another "paypal" email that went to my spam folder - which I didn't look at until later - which said the person had paid $350 plus $200 extra for "Fedex Priority Shipping".

Now, stupid me, I didn't listen to my intuition flaring up and saying something wasn't right. This address wasn't listed on their ebay account and wasn't confirmed. So, I proceeded to go to the post office and ship the package, paying $47. When I got home, I started looking at the emails on my computer, and realized they were not legitimate. I forwarded them to the spoof email addresses of both ebay and paypal and they responded to me by confirming these were phishing emails. I then called Canada Post to open an investigation and intercept my package, which thankfully hadn't left the country. The next day I also called the Canadian Fraud Agency and filed a complaint. Luckily for Nicholas Patrick, if that is his actual name, they have his full address.

I was also refunded from ebay for my seller fees, and they cancelled the transaction. I am really thankful that things didn't go farther than they did, because I know the next step they would have taken would have been asking me to refund them the "extra shipping" they "paid" me. I have since gotten a few more fake emails from "ebay" and "paypal", all which I have forwarded, as well as an email from the person asking for the tracking number, which I thankfully never gave them.

Hopefully I can get the package returned to me. I feel badly for the poor person whose ebay and email account was hacked, and for the people whom this person has probably scammed in the past. I hope that this story of mine helps even one person.

Sorry for the rambling Rolling Eyes

Posted: Fri Oct 11, 2013 11:31 pm

Welcome Phishtaco,

Please don't feel stupid. These things can happen to the best of us -- which is why many of us are here. I am glad you caught things in time. You may wish to visit our sister site, www.scamwarners.com and share your story there as well.

Again, welcome. If you want to stick around and learn how to mess with these dirtbags, we're here to help. Somebody will be around to post the links for more info here on Eater (bait safe, etc.).

EDIT: to fix link. It's been a long week. Laughing

Hello I'm New here! Joined: 11 Oct 2013 Posts: 12

Thanks TheFae, I'll for sure post it there as well. I think I would definitely find great satisfaction in making things as difficult as possible for these people Laughing

Posted: Fri Oct 11, 2013 11:53 pm

Hi phishtaco! That was a close one.

I'm glad you made it to Eater and are going to post your experience at scamwarners.

If you would like to give baiting a go, please read here.....

http://forum.419eater.com/forum/viewtopic.php?t=237673

Any questions? Just ask.
Very Happy

Hello I'm New here! Joined: 11 Oct 2013 Posts: 12

Thanks Justcold! I'll check it out. Also, as an update, I tracked the ip addresses of the "buyer" and the fake ebay and paypal emails, and they are all showing up as california...which is strange because the ebay account's confirmed address was california as well. Do you think that means they're masking the ip?

Posted: Sat Oct 12, 2013 12:04 am

Can you post the original headers? Is it gmail by chance?

Hello I'm New here! Joined: 11 Oct 2013 Posts: 12

I do use gmail, but the scammer's email is a yahoo address. By headers, do you mean the subject lines from their emails and the fake paypal and ebay ones, or something else? Sorry Rolling Eyes

Posted: Sat Oct 12, 2013 12:25 am

Using gmail...pull up the email and select the "more" down arrow. It should have an option to "Show Original".

Click on that and a new page should come up. All of the information from the top down to where the body of the email starts is the headers.

Copy and paste that with your email information snipped..then post it here.

Hopefully I made that clear as mud... Laughing

Hello I'm New here! Joined: 11 Oct 2013 Posts: 12

Here you are Smile

Received: by 10.70.11.65 with SMTP id o1csp198987pdb;
Mon, 7 Oct 2013 22:32:03 -0700 (PDT)
X-Received: by 10.68.134.133 with SMTP id pk5mr34895254pbb.89.1381210323158;
Mon, 07 Oct 2013 22:32:03 -0700 (PDT)
Return-Path: <[email protected]>
Received: from nm41-vm5.bullet.mail.gq1.yahoo.com (nm41-vm5.bullet.mail.gq1.yahoo.com. [67.195.87.92])
by mx.google.com with ESMTPS id rq5si24851587pbc.273.1969.12.31.16.00.00
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Mon, 07 Oct 2013 22:32:03 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of [email protected] designates 67.195.87.92 as permitted sender) client-ip=67.195.87.92;
Authentication-Results: mx.google.com;
spf=pass (google.com: best guess record for domain of [email protected] designates 67.195.87.92 as permitted sender) [email protected];
dkim=pass [email protected]
Received: from [98.137.12.190] by nm41.bullet.mail.gq1.yahoo.com with NNFMP; 08 Oct 2013 05:32:02 -0000
Received: from [98.137.12.200] by tm11.bullet.mail.gq1.yahoo.com with NNFMP; 08 Oct 2013 05:32:02 -0000
Received: from [127.0.0.1] by omp1008.mail.gq1.yahoo.com with NNFMP; 08 Oct 2013 05:32:02 -0000
Received: from [41.138.183.149] by web126103.mail.ne1.yahoo.com via HTTP; Mon, 07 Oct 2013 22:32:02 PDT

Hello I'm New here! Joined: 11 Oct 2013 Posts: 12

That last ip address shows up as Lagos, Nigeria Shocked

Posted: Sat Oct 12, 2013 12:34 am

That is where your lad is scamming.

Lagos? Nigeria??? Who would have thought it so...? Razz

Hello I'm New here! Joined: 11 Oct 2013 Posts: 12

I wish I had known such things about Nigeria beforehand... Rolling Eyes

So I'm assuming this woman's email was hacked? Why are there numerous California ip addresses too?

Hello I'm New here! Joined: 11 Oct 2013 Posts: 12

Also kind of worried that they have my name and email address...but thankfully I didn't send them other information about myself.

Posted: Sat Oct 12, 2013 12:50 am

The California IP's are from the Yahoo servers.

Welcome to Eater phishtaco. Don't worry about this lad having your personal information. You were not baiting him, he was scamming you and has now moved on. If he does send you anything more, ignore it.

Posted: Sat Oct 12, 2013 12:53 am

Different routes that it takes to get to you...

Juan wrote:

Email Headers

"How can I find my lad's IP address?". Simply copy the full headers of your incoming email (most email systems will require you to click on a link for "show original" or similar to find it), then copy and paste it HERE. This will quickly give you the presumed originating IP. When you first connect, this site also automatically generates a map and details from your own IP address.

NOTE: many services, including Gmail and live.com currently strip the originating IP. It is not possible to determine the IP from headers of emails sent from such accounts.

Keep in mind as well that many scammers use satellite internet providers, VPNs, or proxies, which will make them appear to be in a very different location.

Remember too that lads can also check IPs, though most don't bother. Most baiters opt to use Gmail since the IP is stripped, but in reality the risk of your IP giving you away is almost non-existent. Even if a lad can pin down your general location, he would need a court order to get your specific information -- and that isn't going to happen.

The exception to the rule is static IPs. If your company has its own web site, it is more than likely has a static IP. This means that someone tracing your IP will find you. We do not recommend baiting from work since it is more than likely against the company rule

Send an email to yourself from a yahoo account to a gmail account and paste the headers here..

http://www.iptrackeronline.com/email-header-analysis.php

Then..send a gmail email to your yahoo account and do the same thing. Look at the difference.

Edit: and what Connie said... Very Happy

Posted: Sat Oct 12, 2013 12:53 am

The California IP addresses are Yahoo's server relays in Sunnyvale CA. The email address could be hacked, but I'm thinking it's more likely it's a scammer account.

Hello I'm New here! Joined: 11 Oct 2013 Posts: 12

Thanks guys, glad I found this site. Should I be concerned about them having my name, email, and possibly ip address?

Edit: Thanks Connie Smile

Hello I'm New here! Joined: 11 Oct 2013 Posts: 12

"We hereby wish to inform you that Cheryl McDonald (hootieshomemarket) the winner of eBay item have already paid for your item using PayPal in conjunction with eBay and they are yet to receive the shipment tracking number. And as part of our policy any payment made in conjunction with eBay must be shipped out within the next 24hrs or your eBay account will be suspended due to breach of contract.Your payment has been kept on hold for shipment verification,So post the item out within 24hrs so that you will receive your money and not be suspended from eBay."

sometimes you just have to laugh... Laughing

Hello I'm New here! Joined: 27 Jul 2013 Posts: 1

I had one scammer blow their script within 15 minutes of winning my auction. It was rather comical. They barely had sent me the fake paypal email when I get an outraged email asking why I hadn't shipped the order yet. I have run across so many eBay accounts that have been compromised, it's not even funny. I don't want to think about all the paypal accounts that are compromised as well..

Posted: Sat Oct 12, 2013 2:05 am

Received headers are read from the bottom up. The one at the bottom is Yahoo's webserver receiving the email from the scammer's web browser in Africa. (All IP addresses beginning 41 are in Africa.) The next one is the mail server on the same computer receiving it from the web server. (127.0.0.1 and ::1 mean "this very computer".) The two above that are Yahoo servers passing the message to other Yahoo servers using some Yahoo-specific protocol called NNMFP. The header above that is Google receiving it from Yahoo.

Posted: Wed Oct 16, 2013 10:00 am

phishtaco wrote:

Should I be concerned about them having my name, email, and possibly ip address?

No, not really. As long as you're fairly sure they don't know any other details you should be fine. Most lads wont know how to see your IP from the emails anyway and probably wont know what to do with it if they could. Nobody other than your ISP can pinpoint your exact location from your IP anyway, closest they will get is what city/town you're in. Your ISP will only disclose more accurate information after being given a court order to do so. Criminals wont go to that length...

However, do not bait this lad, not with your personal email address (especially not one that is linked to eBay or anything else like that). He may send a few more emails to coerce you into sending him the watch, but best thing to do now is just tell him you're aware he's scamming you and you wont be sending him anything and you're cutting contact now. After that, just ignore anything he sends. You've done everything right since you spotted the rat, especially in letting eBay know what's happened. They're all too aware of this sort of thing and will not suspend your account over this incident. It's an empty threat, there's nothing he can do now that you've already informed them.

At least now you know what to look out for when dealing on eBay. These things don't happen very often though.
Pretty much every genuine eBayer is happy to pay or be payed through paypal, so remember to simply check your paypal balance when they claim to have paid (always manually navigate and login to paypal, never click the emailed links). Spotting a liar is easy then and you shouldn't have any more problems.

If you'd like to try and bait these scumbags, make sure you read through the stickies on this forum, especially this one about safe baiting before you start.

The Ebay buyer who scammed me - and almost got away with it	View next topic View previous topic