Going...Going...Gotcha!

Con Artists at Work

Hundreds of con artists are prowling Web auctions for their next victim. It's all too easy. Swindlers can easily set up fake identities by signing up for free e-mail accounts using false information. And to keep their identities concealed, deceptive sellers demand payment in the form of cash or a money order, since these are hard to trace. You should pay with a credit card, if possible, so you have a record of the transaction; in most cases, you can get a refund if you don't get the product.

Why would normal, intelligent people fall for a scam? "If it looks reputable, we trust it," says Philip McKee, assistant director of Internet Fraud Watch, a program of the National Consumers League. "And it's easy to look reputable online. It's not at all difficult to set up a personal Web site or an auction site with grammatically correct descriptions of goods and fancy digital pictures."

Con artists use varying methods to conduct their shady deals. Some crooks, like Guest, auction off merchandise they don't have or don't intend to give up. That's what happened to Deborah Salem, a horse farm manager in New Jersey. She wired a seller--who supposedly lived in Romania--$1584 for a Compaq notebook she bid for on eBay. The laptop never arrived. When she e-mailed the seller, she never got a response. "I'll never buy anything on an online auction again," Salem says. "It's just too risky." She logged on to the FBI's Web site, where a case number was assigned to her incident. But the agency has yet to prosecute anyone.

Cons also lie about products to induce sales. Jon Marshall, a computer engineer in Texas, got scammed when he bought a $1600 IBM ThinkPad on eBay: It had a slower processor and a smaller hard drive than advertised. "I e-mailed the guy, and he said he'd send me a refund to make up the difference in [features], but he never did," says Marshall. "Four weeks later, the seller's e-mail address was no longer good."

Marshall had paid with a credit card and tried to rescind the deal. But the credit card company refused because it had conducted a legitimate transaction with PayPal.com, a Web-based third-party payment service that Marshall had used to pay for the laptop. Customers enjoy limited protections when they use a credit card at PayPal. The company now reimburses defrauded customers--if the seller had previously passed PayPal's verification process. If a seller wasn't verified, however, customers aren't covered.

Despite his mishaps, Marshall still shops at auction sites--albeit more cautiously. "I finally found the ThinkPad I wanted on eBay," he says. "But this time, I made sure that the seller was local. I met him and closed the deal in person."

Most online auction transactions, though, can't be done in person. Shoppers often rely only on a site's information about the seller. Feedback forums, for instance, are places on auction sites where bidders or sellers can post feedback about trading partners. But the Web's anonymity lets dishonest sellers manipulate these areas.

"I've had cases where con artists have multiple e-mail addresses and use these different names to boost their ratings to build a stellar but false reputation," says Christopher Painter, an attorney with the Deputy Chief of the Department of Justice's Computer Crime and Intellectual Property Section. EBay's forum formerly allowed users to post numerical ratings about sellers and buyers without verifying that transactions between those parties had actually taken place.

One way to protect yourself from such a scam, suggests Painter, is to check the value of previous auctions when you look at feedback. If a seller has great feedback for a series of $100 sales, but you're bidding on a $1500 computer, then you might want to reconsider the purchase. For this reason, Yahoo Auctions includes the values of sellers' previous auctions in its feedback forum.

Anonymity also lets swindlers participate in their own auctions under a different user ID--a practice called shilling--to drive up auction prices. And if the seller is using a different user ID, it's difficult to spot the fraud and stop it. Recently, eBay canceled a $135,805 sale of an abstract painting to a computer executive because the seller had violated its rules by bidding on the painting himself.

One way to spot a shill, according to the NCL, is to determine if the seller's and a bidder's e-mail addresses include the same ISP domain name. That isn't definitive proof, but it can be reason for suspicion. If you suspect a shill even though domain names differ, check the seller's feedback postings. Is the suspicious bidder leaving positive feedback on the seller? Also, look at the bidding pattern--shills tend to bid early and high in an auction to set a tone. Of course, none of these methods is foolproof. Fortunately, if you make a bid but then have doubts, most sites will allow you to cancel it as long as you can give a reason.

Third-Party Victims

Even more complicated than shilling, according to the Internet Fraud Council, a private, nonprofit organization that monitors online fraud, is the triangulation scam. Such a scheme involves three parties: a con artist, shoppers, and an online catalog company. It is this third party that gets ripped off. The swindler purchases merchandise from e-merchants using stolen identities and credit cards, then sells the goods at auction sites to unsuspecting bidders who pay via wire transfer. The scammer then sends the items to winning bidders, thereby converting stolen computers and VCRs into cash. "This type of scam is unique to the Internet and is fostered by the high degree of anonymity and speed inherent in online transactions," says Paul Fichtman, chairman of the IFC. Scams of this kind are still going on, and law enforcement officials have yet to prosecute such a case.

Though the fraud incidents that have been uncovered indicate the crooks are most often sellers, buyers can also be swindlers. Shoppers have used stolen credit cards to purchase goods at auction sites. They've also asked their credit card company to issue a refund for purchases they received by falsely attesting they never got the merchandise. Sellers are out the money if they can't prove they shipped the item (by providing a tracking number, for instance). More commonly, says Holly Anderson of the NCL, a dishonest buyer simply sends a bad check.

See You in Court

Last April, six defrauded shoppers filed the first class action suit of its kind against eBay, challenging its user agreement. The plaintiffs purchased autographed sports memorabilia that turned out to be forged copies. They argue that California law requires dealers and auctioneers of sports memorabilia to provide a certificate of authenticity to the buyer.

If the lawsuit is successful, all online auction sites will be required to authenticate at least the sports memorabilia that's for sale. "If we win," says James C. Krause, a San Diego attorney who filed the suit, "the wall that most auction sites hide behind will be cracked. Other suits could follow, extending liability beyond sports memorabilia."

Shielding the Sites

Auction sites are realizing that mounting fraud is likely to hurt business. But smaller sites aren't assuming too much responsibility for policing auctions, because they worry they'll be sued if something goes wrong. "They're [also] worried that too many safeguards would give the impression that [they] are not to be trusted, or that they aren't safe," says the NCL's McKee. And since auction sites get a percentage from each sale, most of them are focused on increasing volume rather than minimizing fraud.

Paul Luehr of the FTC says that some sites are lax in protecting users: "It's the smaller, newer sites, interested in carving out a niche, that typically have few fraud-prevention mechanisms in place." Some B2B auction sites, including TradeOut.com, don't provide even a feedback system. (See the chart "Who's Watching Your Back?" )

The big auction sites, though, are taking action to minimize scams. "[They're] realizing that fraud may discourage users from participating in auctions and may affect their business," says Luehr. So they're establishing mechanisms to protect users. Amazon.com Auctions and eBay, for example, offer buyers a guarantee on purchases, though many other auction sites do not. (At Amazon, items are guaranteed up to $250, with no deductible.) Another mechanism is a system that allows the bidder to pay by credit card to the auction site--the function of Amazon Payments service and eBay Billpoint. The site then sends a direct deposit to the seller's checking account.

"It adds security because the buyer doesn't have to send cash or a money order, or reveal the number of a credit card," says Jeffrey Blackburn, general manager of Amazon Auctions. "It also lets us verify a seller's bank account and social security number." About 70 percent of Amazon's auction listings offer the Amazon Payments option, which guarantees purchases up to $2500.

Amazon also has a fraud-investigation team that ensures sellers are who they profess to be. Amazon and eBay require bidders and sellers (and Yahoo requires sellers only) to provide a credit card number, an address that matches the billing address on the credit card, and a phone number. "We think a credit card can be a disincentive to committing fraud," says Kevin Pursglove, spokesperson for eBay. Even so, crooks like Guest can evade that by using illegitimate credit cards.

EBay insures transactions up to $200 (with a $25 deductible). Claims filed with eBay go to its fraud investigation team, and into the FTC's Consumer Sentinel database. EBay's fraud team monitors complaints, sometimes halting auctions or removing user privileges. The site offers an escrow service, i-Escrow.com, which holds payment until the bidder has inspected the purchase (see "Money Middlemen: How to Use an Escrow Service"). EBay's software can detect deceptions like shilling, and it will now let you rate users only if you've conducted a transaction with them.