NB. This article is being written based on first hand investigation.
eBay is the biggest online auction site in the world, and I thought it was quite good at its security until placing the item on the site on Sunday.
Be it 1 hour after posting the item, it had sold to user pigslayer69 for £650+Postage along with a London address. I checked and the address exists, its 14 minutes from the Olympic Stadium.
An invoice was issued via eBay and not half an hour later I received an email saying that pigslayer69 had requested my User information details, and in the email was my details.
Then suddenly 3 emails in a row. The first stating that I had received payment, the second saying that eBay had confirmed the buyers address had been verified and that the buyer was "trusted" and that he had reasons which stated that I should ship the item internationally (remember that I stated earlier that postage was UK only)
Now is probably time to get in touch with eBay, the email with my personal information in came from them. In their Privacy Policy they state the following...
Our Disclosure of Personal InformationWe disclose personal information to respond to legal requirements, enforce our policies, respond to claims that a listing or other content violates the rights of others, or protect anyone's rights, property, or safety. Such information will be disclosed only in accordance with applicable laws and regulations. As stated above, we do not disclose your personal information to third parties for their marketing purposes without your explicit consent.We may also share your personal information with:[...]Other eBay users, whether located in your country of residence or outside of your country of residence, as authorized by you or your use of our sites, services, applications or tools. For example, where you are involved in a transaction with another user, the other user may view your email address and request and obtain your contact information (including phone number and postal address) to help complete the transaction.
I cannot see how the information would help complete the transaction, there was no problem with the transaction and as such the pigslayer69 did not need my phone number, postal address, no email for that matter. Thats why eBays Secure Messaging service exists.
After reading this I contacted eBay to tell them about everything had gone on with the transaction (to ensure I wasn't charged any fees) and was told my their representative that the email containing my personal information DID NOT come from eBay. Okay I thought, but then I thought I'd trace the email back to where the email came from.
The Customer Service advisor stated that eBay would never give your personal information out to anybody, forgetting that their own Privacy Policy states they will give your information to eBay Inc. owned companies, Business Service Providers, Other eBay Users, Law Enforcement, Credit bureaus, and other businesses that they may "plan to merge or be acquired by".
That said, by simply searching the term "get eBay user information" I managed to find this page where you can request user information of people you are involved in a current transaction with.
1. To better protect the privacy of eBay users, you can only request contact information for eBay users who are involved in your current or recent transactions. Examples are:-Sellers can request the contact information for all bidders in an active transaction and the winning bidder in a successful, closed transaction.
But how can that, in their own words "help complete the transaction"? The transaction between the "requester" and a "bidder" has not become real, at the moment its a promise that if the "bidder" wins, then he will pay the "requester" for the item.
Even if the "bidder" won, how would personal details "help complete the transaction"?
Thats the reason eBays own Secure Messaging services exists, its their for you to liaise with the buyer without revealing personal information.
Thats also the reason the Resolution Centre exists, for if there is a problem, eBay can resolve issues between the buyer and force refunds etc to help protect both buyer and seller if there is a problem with a transaction.
But eBay seem to currently be allowing anyone you deal with access your personal information. A scammer could post an item, get 100 bids, access all their personal information then cancel the sale and get away with stealing the personal information of 100 people.
bbc.co.uk
Interestingly, im not the only one, BBC's Rory Cellan-Jones also experienced a very similar scam when trying to sell a Blackberry for Children in Need, and I can only assume the scammer received his email address to send fake emails about the transaction from the same place, the eBay Advanced Search Contact Information page.
Since this I wont be relisting the laptop and have since decided to place it for sale on a site that rhymes with Shamazon, who coincidentally I have found no way to access the personal information of any user as communications are limited to their own internal messaging system, which to me is something I would expect from eBay. Not only does it protect the personal information of both buyer and seller, but it also stops the information being used for malicious intent.
Unfortunately I can find no way of protecting yourself from this, you can't remove your information from eBay as you need that to be able to sell, all you can do is be careful about buyers after they request your personal information PRIOR to them paying you.
Always check your PayPal account by going to PayPal.com before sending an item to ensure that payment has definitely gone through.
Never click links in emails to eBay, PayPal, or any other website, its safer to go there yourself by typing it in directly into your web browser.
Ive learned a lesson today, thoroughly read Privacy Policys and check how easy it is for someone to gain access to your information before sharing it, but most of all, I've learned not to buy or sell on eBay again (or at least until they patch up this flawed hole in their privacy policy).
Share This Article
