Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

macswitcha2

macrumors 65816
Original poster
Oct 18, 2008
1,255
8
I sold an item on ebay and it looked fishy.

At first the buyer was said to be from Russia and I specifically declared no international buyers.

I then get an email to ship the item to you guessed it, Nigeria. I think I got a spoofed ebay message saying that I was payed but the money would not be there until the buyer received a tracking number.

I checked my paypal account and no payment at all.


Before I can report the buyer ebay notofied me saying the buyer was not registered.

HERE IS MY CONCERN AND QUESTION ( caps for emphases)

Therefore, I re-listed but noticed that I'm being charged selling fees for the attempted scam purchase. Is this right? Should I not be getting charged since I did not sell the item?

Below is a paypal email that looks scam-a-docious



The PayPal verification team needs to confirm the shipment of the item to to the buyers preferred address for the funds to be credited to your account.

Forward shipment tracking number to easymoneytransaction@mail2pal.com

We have rigorously examined and confirmed the Payment to be VALID.
Go ahead and create the shipment to the buyers desired shipping address in Nigeria only.

Name: Afeez Lawal
Address: 10, Olanrewaju St,
Ilaje-Shomolu
Bariga
State: Lagos
Code: 100007
Country: Nigeria.
Phone: 07051134933

Held funds can only be released to your account after shipment has been verified.

This PayPal® payment has been deducted from the buyer's account and has been "APPROVED" but will not be credited to your account until the shipment tracking number is confirmed by our shipment verification unit easymoneytransaction@mail2pal.com so as to secure both the buyer and the seller.


Thanks
PayPal Account Review Department
 

belvdr

macrumors 603
Aug 15, 2005
5,945
1,372
Post the headers from that email. My guess is the email is forged. I have never seen an email from PayPal like that.

Do _not_ ship the item. Notify eBay so they are aware, and ask them about the fees.
 

macswitcha2

macrumors 65816
Original poster
Oct 18, 2008
1,255
8
Post the headers from that email. My guess is the email is forged. I have never seen an email from PayPal like that.

Do _not_ ship the item. Notify eBay so they are aware, and ask them about the fees.


The header reads...***Tracking Number Required for Account Crediting***
 

belvdr

macrumors 603
Aug 15, 2005
5,945
1,372
The header reads...***Tracking Number Required for Account Crediting***

No, that's a subject line. The headers of the email look cryptic and you could have 20-50 lines in there. In some clients, you need to go into an advanced view to see them.
 

Cabbit

macrumors 68020
Jan 30, 2006
2,128
1
Scotland
You need to report the attempted scam and yes, the auction was ended successfully according to ebay so you get charged listing fees.
 

macswitcha2

macrumors 65816
Original poster
Oct 18, 2008
1,255
8
No, that's a subject line. The headers of the email look cryptic and you could have 20-50 lines in there. In some clients, you need to go into an advanced view to see them.


Sorry, I did not see this response...



Here it is I think...


Received: from [127.0.0.1] by omp207.mail.sp1.yahoo.com with NNFMP; 25 Jun 2010 22:00:59 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: 915937.10504.bm@omp207.mail.sp1.yahoo.com
Received: (qmail 79247 invoked by uid 60001); 25 Jun 2010 22:00:59 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1277503259; bh=OTDem1w/I88kZIq5jAxamBZxLTT8NRCTsVRtvhSB+CY=; h=Message-ID:X-YMail-OSG:Received:X-RocketYMMF:X-Mailer:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=HBpxcvWrM+D10OuPT1s1YEDZXUPa1fxp1B/e3qKrAMhlrvbEMxztO2X7jZ8K+PUDsrIrMQGnnUpo7i5U+sTemgJ/6KNk4PU38hU3Sou1WxYQO1Uu9NZ2i2c5OPqnYRGWysKfJ1PotHaIs/j8didoOrabYPEz2+437TW/Wem0N2k=
Message-ID: <660381.77777.qm@web43414.mail.sp1.yahoo.com>
X-YMail-OSG: Fdzuhs8VM1mNhnZrQt.4Xm5JZruIwXK2D.RIL1RggKmxWfS
i.2yUM7IYwCrv4mr9aoX6zc1TDNxyMN7HG5SzYEwJahDmmaiBhiKBG1hFWGm
271Z1xXY9VU3fKd9dC8knvUWt9Xil7IwwI_IR.k4BnPzqTGLoRLmxJLoiccm
Dqfdx7lrNxgmsTcx0QfREbznHJcev6OMjgMcru_CSGEdRbMxWjWnNGXYnH9j
4m95LtTmveTPEIqQxqFvMl1WeCM0efFl.1w0wlJ.JaYOrN2ChErp9O0COtP8
.kL4_AKBd45S3xo.iGYk7XoetM26ayuidWNrb
Received: from [41.155.42.241] by web43414.mail.sp1.yahoo.com via HTTP; Fri, 25 Jun 2010 15:00:59 PDT
X-RocketYMMF: servicepaypal11
X-Mailer: YahooMailClassic/11.1.4 YahooMailWebService/0.8.104.274457
Date: Fri, 25 Jun 2010 15:00:59 -0700 (PDT)
From: "service@paypal.com" <easymoneytransaction@mail2pal.com>
Reply-To: easymoneytransaction@mail2pal.com
Subject: ***Tracking Number Required for Account Crediting***

MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1972565870-1277503259=:77777"
 

belvdr

macrumors 603
Aug 15, 2005
5,945
1,372
That's it. They are spoofing the source email address:

Code:
Received: from [41.155.42.241] by web43414.mail.sp1.yahoo.com via HTTP;

So it was sent through Yahoo via HTTP. If it came from PayPal, this would say "via SMTP"

Code:
From: "service@paypal.com" <easymoneytransaction@mail2pal.com>
Reply-To: easymoneytransaction@mail2pal.com

See, they spoofed the from address field above. They entered "service@paypal.com" but the reply-to is back to them. This means that PayPal didn't send you this notice. They did and pretended to be PayPal in order to trick you into sending the goods.

I'd report this to both PayPal and eBay, including the mail headers. At the very least, you may get your listing fees refunded/waived.
 

macswitcha2

macrumors 65816
Original poster
Oct 18, 2008
1,255
8
That's it. They are spoofing the source email address:

Code:
Received: from [41.155.42.241] by web43414.mail.sp1.yahoo.com via HTTP;

So it was sent through Yahoo via HTTP. If it came from PayPal, this would say "via SMTP"

Code:
From: "service@paypal.com" <easymoneytransaction@mail2pal.com>
Reply-To: easymoneytransaction@mail2pal.com

See, they spoofed the from address field above. They entered "service@paypal.com" but the reply-to is back to them. This means that PayPal didn't send you this notice. They did and pretended to be PayPal in order to trick you into sending the goods.

I'd report this to both PayPal and eBay, including the mail headers. At the very least, you may get your listing fees refunded/waived.

Thanks! Wow...scamdocious!!!!
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.