• PC World
• »Consumer Advice

Imagine Melissa Perenson's surprise when a Good Samaritan suggested by e-mail last week that she withdraw her recent eBay bid for a notebook because the seller appeared fraudulent. She hadn't placed a bid on the site since before Christmas.

Turns out somebody commandeered her eBay identity and went on to win two separate bids for $1400 notebooks from a seller claiming to be in Romania. No money or products changed hands (it turns out the seller's contact information was hijacked, too.) But the situation rattled the tech-savvy PC World associate editor.

"A week later, I'm still a little unnerved. When it happens to you, you wonder what else did they get?" she says. "What allowed this to happen, and what else is in jeopardy?"

What's the Game?

Perenson's situation is unique in that most eBay identity thieves use a person's good name and seller's reputation to set up fraudulent auctions, says Kevin Pursglove, eBay spokesperson. Typically, they'll auction an item, collect the money, and disappear. It's not until a buyer complains that fraud is discovered.

The company is currently investigating a handful of such incidents, he says. Ebay was unable to accommodate PCWorld.com's request to speak with other victims.

It's difficult to understand how Perenson's eBay ID was used. Little was gained by a con artist participating as a buyer in that particular fraudulent auction, Pursglove says.

However, in other situations stealing an identity to bid in an auction could be useful for a con artist. By acting as a shill and pushing prices higher, an individual, or a team, could convince an unsuspecting legitimate buyer to get in on the action, let that person "win" the fraudulent auction, and then disappear with the money.

Despite Perenson's situation, fraud is relatively rare on eBay, Pursglove says.

The service lists about 7 million items daily, with about 1.1 million new listings each day. In all, eBay users generate about $28 million in sales per day. Of all those transactions, less than .01 of one percent result in confirmed cases of fraud, he says. That said, when you're the victim, it hurts.

Identity Theft

Pursglove says identity hijackers have two basic methods. One involves establishing a Web presence, then spamming eBay users with e-mail suggesting they need to provide their eBay password in order to complete a recent transaction. Some messages request a credit card number or even a driver license number, he says.

When an unsuspecting eBay user complies, the bad guys use the password to take over the account, he says.

A second method apparently involves software that scans eBay for customers who haven't used their auction accounts recently, Pursglove says. When the program identifies such a user, it enters a series of random passwords.

"It's a kind of Russian roulette with passwords," he says. Sometimes it works. Since these users check their accounts infrequently, they're less likely to notice someone has hijacked it to sell false items--until it's too late.

Simple Passwords

Guessing a person's password would seem close to impossible, but Pursglove says too often people make it easy. "Passwords can be cracked, and [some are] fairly pedestrian," he says.

For example, if your user name is Mr. Sun, a hijacker or the hijacking software will try Mrs. Sun as the password. Unfortunately, often that works.

Perenson insists, however, that her password, while simple, had no relation to her eBay identity. Software probes or not, one would be hard-pressed to guess it, she says. Her growing unease with the eBay circumstance is making her question the safety of other online financial transactions.

"I use online bill-pay, I do all my banking online, and I do purchases online. It certainly hammers home how vulnerable we all are, in spite of all the precautions we might take," she says.

Slow to Respond?

Perenson used her PC World connection to get eBay's immediate attention. However, most users must go through standard eBay procedures. Perenson tried that route first, but quickly became so frustrated with the company's online help and automated phone service that she called Pursglove.

It's not the first time users have complained about eBay's handling of fraud complaints. Last fall, a handful of eBay users complained the company was slow to respond to an alleged fraud ring out of the Ukraine.

Pursglove points to the site's volume as a reason it takes time to handle complaints. "There is just a phenomenal level of activity on the site each day," he says. Plus, what constitutes fraud varies in the eye of the beholder, he says.

"We can get a complaint from a user that thinks their problem is fraud. It may be a dispute over the actual color of an item. That's important to a buyer--but that's not fraud. Sometimes our queues can back up."

Once eBay identifies a true case of fraud, it may investigate--but ultimately, law enforcement will handle a legal case. EBay has no say on how fast the cops act, he says.

Ebay is also in a precarious position, Pursglove says. The company wants to suggest ways for customers to prevent such problems. On the other hand, a broad statement may give away too much information to perpetrators, he says.

"In the next several weeks we'll be issuing some suggestions, and we may contact some individuals," he says. "However, we don't want to disclose too much detail, and much will be done behind the scenes."

Small Percentage

The Federal Trade Commission tracks online auction fraud. While complaints are up, the FTC attributes that partly to online auctions moving toward mainstream ubiquity. The agency got approximately 20,000 Internet auction complaints in 2001, more than twice the previous year, says Delores Gardner Thompson, an attorney in the FTC's bureau of consumer protection.

However, the percentage of fraud complaints has dropped, she says. And remember, the number of auction transactions more than doubled during that time, she says.

In other words, fraud is a problem for online auctions, but it is not an overwhelming one, she says. The key, of course, is to be careful with your passwords and personal information.

Should something happen, contact the auction site and the FTC right away. You can file complaints on the FTC site.

EBay's Pursglove also encourages fraud victims to contact their local law enforcement agency, as well as that of the seller, to get an investigation rolling.