Phishing Group Caught Stealing From Other Phishers

An anonymous reader writes "Netcraft has written about a website offering free phishing kits with one ironic twist — they all contain backdoors to steal stolen credentials from the fraudsters that deploy them. Deliberately deceptive code inside the kits means that script kiddies are unlikely to realize that any captured credit card numbers also end up getting sent to the people who made the phishing kits. The same group was also responsible for another backdoored phishing kit used against Bank of America earlier this month."

How times have changed: you can't trust.....wait!

[whoever57]

But seriously, this is good news! It is always good news (for law-abiding people) when crooks start feeding off each other.

Re:How times have changed: you can't trust.....wai

[cortesoft]

Except they are actually double feeding off innocent people.... some poor chap's info gets stolen by both the guy who deployed the phishing kit and the guy who wrote it.... which means its probably at least twice as likely to get used for fraud.

Re:

[dubbreak]

at least twice as likely to get used for fraud.

Wow, so like a 200% chance it gets used for fraud?

Re:

[Impy the Impiuos Imp]

"There is no honor among thieves."

Actually, it's kind of comical that in games like World of Warcraft, not only do warriors and paladins talk about honor, but so to do thieves rogues.

Cutpurs3: Yeah, have a little honor, won't you? Just go invis and stab the guy in the back.

Re:

[Machtyn]

Sure, your cards are getting double-hammered. But that just makes the fraud more conspicuous. Hopefully, your CC company has anti-fraud measures in place to track suspicious purchases.

Re:How times have changed: you can't trust.....wai

[v1]

they aren't really feeding off each other, just more off YOU. Both thieves get a crack at your cc#. Would you rather have rung up $4000 on your card, or $8000?

Re:

[mh1997]

they aren't really feeding off each other, just more off YOU. Both thieves get a crack at your cc#. Would you rather have rung up $4000 on your card, or $8000?

It really does not matter how much is fraudulantly charged on my credit card. I am not responsible for either amount.

Looking at the larger picture, I want as small amount of fraud as possible because the cost of goods will be cheaper. Somebody has to recoup that $4000 or $8000 in your example, but what happens, everyone pays for fraud, but spread o

Re:

[skarphace]

For what it's worth, I have found a way to never have my credit card info stolen - I use cash. For you conspiracy minded people out there, my purchases are not trackable. Even better, the amount of debt I have is $0 which comes out to $0 per month in interest with a grand total of $0 per year.

That doesn't keep ID theft from happening. Someone gets your SSN and opens up an account in your name, you're screwed anyway.

Just do what I did, open up a bunch of cards, bury yourself, get bad credit. You can't

Re:

[mh1997]

Just do what I did, open up a bunch of cards, bury yourself, get bad credit. You can't open up accounts if your credit sucks. heh

I feel like an idiot! That is way better than my idea of work, self sacrifice, and delayed gratification.

Re:

[gr8scot]

Since this is the first I've heard of such a Ponzi Scheme among phishers, I won't claim to know whether, overall, phishing or other identity theft victims will be better or worse off as a direct result. My first guess is that in the big picture, it won't be much of a difference to anybody, even the banks and their insurers.

I do know that I got a bit of visceral pleasure from the headline, and the idea of crooks fighting amongst themselves. Like a prison riot, if all the guards aren't safely on the other s

Re:

[v1]

I used to take $40 out of the ATM every time I deposited a paycheck. Last year or so I've tried my hardest to use my bank's ATM/visa card as much as possible. I'm down to taking out a 20 about every 3 months. This means everything I buy I have a receipt for, and gets recorded in my checkbook. This goes into my computer, and gets categorized, so I can even tell you for example, how much I spent last year on transportation. (gas and vehicle maintenance) If you're paying everything in cash, you have to co

Re:How times have changed: you can't trust.....wai

[GroeFaZ]

Problem is, they're not feeding on each other; the feeding order is not circular, but rather pyramidal. The smart and resourceful ones get even richer through the bottom-feeders' "work".

Re:

[cart_man4524]

hmmm....reminds me of something very familiar Oh yea....it sounds like American Business, so whats the problem?

Re:

[Zeinfeld]

Problem is, they're not feeding on each other; the feeding order is not circular, but rather pyramidal. The smart and resourceful ones get even richer through the bottom-feeders' "work".

Exactly, in the chat rooms the criminals are far more worried about each other than the forces of law and order. OK they are concerned that the person might be from a security company (our guys) or a police officer. But they are rather more angry about 'rippers' -criminals who take the money but never deliver the goods or

Re:How times have changed: you can't trust.....wai

[bhmit1]

But seriously, this is good news! It is always good news (for law-abiding people) when crooks start feeding off each other.

This would only be a good thing if phishers were stealing the account information of other phishers. But since they are just spreading your number to more phishers, your best hope is that competing phishers raise the fraud alert on your credit cards faster (credit card companies look for unusual purchases, and placing multiple orders in stores on opposite sides of the country at the same time is a pretty easy flag for them).

Personally, I still want to see financial institutions implement a system where you can get trojan account numbers to give to the phishers that appear just like real numbers. If the phisher uses them, immediately the institution knows to look for fraudulent activity from that source. Then everyone receiving this spam can provide so many bad account numbers that phishing is very difficult to do without drawing attention to yourself.

Re:

[morethanapapercert]

There is one slight flaw with that plan. How does a victim know when to give the trojan CC# and when to give the real one? The whole point of fishing is to look as safe and legit as possible*. If, for example, my mother-in-law from Mr. BadGuy Phisher gets an email offering (of all things) heavily discounted embroidery pattern files for her embroidery machine. She thinks he really has such files for sale, she actually does want the product, so she provides her real CC# and not the false one. Now, this is a w

Re:

[xenocide2]

Man. Remember when people wanted to use Credit Card numbers as proof of age for adult materials? Glad that never happened!

Re:

[brentonboy]

There is one slight flaw with that plan.

I don't think so. The idea isn't to prevent anyone from giving legit CC #'s to scammers. The idea is for enough astute people like you and I to give dummy CC's that all fraudsters either 1) get caught and go to prison or 2) decide the industry is too dangerous, and leave.

Re:How times have changed: you can't trust.....wai

[morcego]

Personally, I still want to see financial institutions implement a system where you can get trojan account numbers to give to the phishers that appear just like real numbers. If the phisher uses them, immediately the institution knows to look for fraudulent activity from that source.

One of my ATM cards has 2 different pin numbers. If I use the alternative one, the transaction is completed normally (so no one on the spot gets wiser), but the institution will flag it and notify the police at once, providing my identity and location. I have to pay a little extra for eat (about US$ 3/month), but it is well worth it. It is considered (and marketed as) an insurance. I have this since 1996, and I'm happy to say I never needed.

So yes, the banks know this kind of thing can be done. I wonder why other institutions don't do it or even why this is not mandatory for all cards.

I really don't mind the extra US$ 3/month for this service.

Re:

[deroby]

But that would only be useful when you're somehow "forced" to give your PIN isn't it (eg. when there's a gun to your head).

In the case of phishing you simply do not realize that you're giving away information to a fraud! You actually truly, veritably believe that you're doing something harmless, eg. paying for that book on Amazon (probably a bad example, but you get the drift). So why would you use the 'poisoned-PIN' in this situation ?

FYI : this reminds me of that urban legend where you were supposed to en

Re:

[Maximum Prophet]

While this is an urban legend, several legislatures have proposed requiring banks to have PIN "Panic Codes". http://www.snopes.com/business/bank/pinalert.asp [snopes.com]
In the case of palindromic codes, just flip them inside out. i.e. 1221 becomes 2112.

Re:

[Ajaxamander]

And what if my PIN is 1111? Should I enter the two's-compliment?

Re:How times have changed: you can't trust.....wai

[nacturation]

I have to pay a little extra for eat (about US$ 3/month), but it is well worth it. It is considered (and marketed as) an insurance. I have this since 1996, and I'm happy to say I never needed.

I have a solution as well: use your credit card so that there's no liability to you even if someone does use it fraudulently. And since 1996, you've spent about $400 on this insurance you didn't need. The only time I could see that as being useful is if someone robs you while you're in the process of making a withdrawal at an ATM.
 

Re:

[morcego]

There is a new fad around criminals in my country that is called "flash kidnapping" (loose translation). They grab you, put a gun in your head, and drive you around to several ATM machines.

Re:

[roninamano]

Actually the idea is that if a crook puts a gun to your head and forces you to withdraw money, you can comply with the demand while also having an alert sent out immediately. Excellent security idea. A lot of crooks are forcing their victims to use the ATM cards or to give them the pin. Usually in kidnap situations. Giving the crisis code immediately set the cops on the crooks, hopefully while you're still alive to appreciate it.

Re:

[sootman]

You've paid ((2008-1996)*12*3) $432 to "save" you if someone jacks you at the ATM... which typically has a limit of $300 per transaction. And you're paying for a service that is technically trivial to implement and should be given out for free in the first place. Nice.

Re:

[Kokuyo]

I'd prefer a system where I could generate a credit card number every time I made a purchase online. Naturally, this is not going to work in stores or such, but at least online you could limit the damage one could do because the number works just once. Furthermore by noting where you've used the number you'd know exactly who has been leaking or misusing your number.

Re:

[markov_chain]

Citibank has this feature. They call it "Virtual Account Numbers."

Re:

[jmauro]

Bank of America calls it "Shop Safe" [bankofamerica.com]

Re:

[budgenator]

What I want to see is financial institutions starting to use my chummer program [slashdot.org]; catch a phishing site and send the sharks a couple GB of stinking fish guts quality data, until the computer crash and burn from the strain.

Re:

[Machtyn]

I wish more companies would have software like Citi does. I can open up my Virtual Account Number generator, and generate a VAN that is tied to my account. This number has a limited amount on it, has its own CVN number, expires in one month, and is only good for one purchase... only. (I've tried to use a number twice, because I didn't know this.)

I use this service for all my online store purchases.

The slick thing about this VAN software is that you can click a button and it populates all the fields in

This isn't the same...

[TheGreatHegemon]

In the old days, if thieves stole from thieves, it meant the first thief was deprived of the stolen goods. This lead to conflict. However, with information like this, all it means is that *two* thieves have the same info.

Re:

[MrShaggy]

Twice the fun, none of the work. MMMM

There's no Such Thing as a Free Lynch

[Morosoph]

Not wanting to spoil the optimistic spirit of your own post :o)

Re:How times have changed: you can't trust.....wai

[Technician]

But seriously, this is good news! It is always good news (for law-abiding people) when crooks start feeding off each other.

I read an even better possibility into this. What if the kit was released by VISA/Master card, Discover, and American Express. They would have a front line into shutting down stolen card numbers, canceling cards and getting great data including IP addresses. Working with merchants, they could follow the canceled sales for a great bust of the ring. Brilliant if true.

Share

[Anonymous Coward]

Hey, it's open source. Information wants to be free. It's all about sharing. Why shouldn't the developer of the phishing kit get some reward from the organization that profits from repackaging his code?

If they reall wanted to do it right, they could just pool all their resources and split the rewards. They could even invite others to join in, with a BotNet@Home project. Lend your computer to the BotNet, and get a prorated share of the take from stolen credit cards credited to your PayPal account.

Re:

[nacturation]

They could release it under the GNU General Phishing License.
 

Re:

[budgenator]

I was trying to find the download site, I'd like to see state of the art phishing code myself; if they want data, i could send them a few TB for fun.

Re:

[Jeremi]

Lend your computer to the BotNet, and get a prorated share of the take from stolen credit cards credited to your PayPal account.

Just send them your bank account details and they'll post the proceeds directly to your account. You'll make thousands a week!

In soviet russia...

[Anonymous Coward]

...phishers phish phishers... Say that five times fast.

Re:

[Anonymous Coward]

"that that that that that"

Not so hard...

Re:

[Kasimir Gabert]

... because everybody in the world reads Slashdot? Look outside of yourself, at least once a month. I think it would be healthy :)

Re:

[Nullav]

Netcraft confirms it?

Proverb

[OldManAndTheC++]

Phish from a man and you take advantage of him for a day.

Give a man a phishing kit and you take advantage of him for a lifetime.

(of course by "man" we mean spotty-faced script kiddie, and by "lifetime" we mean until he wipes his harddisk, but proverbs are meant to be pithy and brief, not accurate.)

Re:

[GroeFaZ]

Well, you summarized TFA. Bonus points for avoiding a car analogy.

Re:

[cbotman]

Pithy means 'brief and forceful', so you don't need to say brief again. :)

Re:

[Torvaun]

Pithy, brief, and redundant?

Re:

[account_deleted]

Comment removed based on user account deletion

Re:

[Anonymous Coward]

I wait until I am at work to read those emails, I'm not going to risk my own computers.

Re:

[mrv20]

Don't mind the thudding sound you can hear in the background - it's just your sysadmin banging his/her head against the nearest wall in despair.

Re:I wish it were possible to zoom in...

[Mr. Roadkill]

Naturally Netcraft won't tell you the real site name :-)

Naturally. And who can blame them? I certainly don't - who knows what kind of nasties they might have lurking on those pages waiting for unsuspecting CEO's and CIO's and security experts who ought to know better?

However, Google is your friend. Within 30 seconds of looking over the Netcraft article for helpfully unique strings, I found it. And went looking with lynx :-) I won't give the URL, to protect the stupid from themselves, but it's not that hard to find.

They've got ready-rolled scams for abbey.co.uk, bankofamerica.com, cahoot.co.uk, chase.com, egold.com, ebay.com, hsbc,co.uk, lloydstsb.com, moneybookers.com, nationwide.co.uk, nbk.com.kw, paypal.com, regions.com, stgeorge.com.au, wachovia.com and westernunion.com - and in some cases, they have more than one for particular organisations.

Cool. Now who has a spare botnet, is willing to wade through this arsehole's source, and is willing to send garbage values to [e-mail] and [e-mail]?

Re:

[ASBands]

All the e-mail formatting seems to come from the "Mr-Brain.php" file. I'm not sure about how this Mr-Brain character licenses his software, but I figure it is some form of creative commons or (L)GPL, so I should be fine with attribution. So: the following source code was created by Mr-Brain and last updated 2008-Jan-07. If you would like to contact him, please send an e-mail to [e-mail] [mailto] or [e-mail] [mailto].

Never mind, I ran into the lameness filter of Slashdot for this guy's sourc

The real backdoor email address...

[Anonymous Coward]

It looks like you too have been misled by the code. The email addresses [e-mail] and [e-mail] are the ones that the 'script kiddies' are meant to change before using the phishing kit. The backdoor email address is actually encoded within the other scripts.

Looking at the code more carefully you'll see..

details.php includes this in the phishing page form:

logon.php has these lines of code:
$d="details.php";
$erorr=file_get_contents($d);
$IP=pack("H

Re:

[Mr. Roadkill]

It looks like you too have been misled by the code.

Looks like I just didn't look hard enough, or didn't have enough coffee or smoked too much crack - thanks for that.

I have to wonder, though, just how many sets of results he gets at the hotmail.fr or yahoo.fr addresses - it isn't hard to imagine a scenario in which one of the kiddies forgets to make the necessary changes, and ends up phishing for Mr Brain's benefit alone.

Re:

[markov_chain]

It's the php generation. The height of obfuscation is base64, and masterful hacking is considered typing URLs by hand. Long gone are the days when this email address would be found hidden in the code page of a binary. Lord have mercy!

Re:

[Maximum Prophet]

Cool. Now who has a spare botnet, is willing to wade through this arsehole's source, and is willing to send garbage values to [e-mail] and [e-mail]?

I would hope that would be the security guys at abbey.co.uk, bankofamerica.com, cahoot.co.uk, chase.com, egold.com, ebay.com, hsbc,co.uk, lloydstsb.com, moneybookers.com, nationwide.co.uk, nbk.com.kw, paypal.com, regions.com, stgeorge.com.au, wachovia.com and westernunion.com.

All they have to do is send some trogan card numbers that "w

Re:

[budgenator]

Check this out, I lost the code in a hard-drive failure but it's only one notch past "hello world" anyways so if you can't both learn Perl and rewrite chummer.pl [slashdot.org] in an half hour you don't belong in IT anyways.

Mr-Brain's site

[aerthling]

Here's his site: http://thebadboys.org/Brain/ [thebadboys.org]

SCANDALOUS!

[davidsyes]

Scandalous I say! this is just tooo literally virtually phishy. Thieves without a code of honour. Is there no honour among thieves? Real fishermen can't ... wait, they can poach, and steal other's fish.

Anybody got a literal virtual stick of dynamite to blow up the caught fish?

Re:

[arivanov]

I suggest you watch "Specifics of the Russian National Fishing" aka "Osobennosti Nacionalnoi Rubalki" on the subject of dynamite and fishing. You will laugh your a*** off...

This is really sad..

[DigitAl56K]

.. you just can't trust malware anymore!

Really though, this is nothing new. IIRC, some builds of Sub7 [wikipedia.org] had a reverse backdoor (not covered in the wiki article), as well as a master password that let the Sub7 crew take over a server (covered by the wiki article), and some builds even included hard drive killer when the master password was in use.

Re:

[LilGuy]

Sub7 wasn't the first. DeepThroat was the first major trojan to do this. It really sucked when the author convinced me and all my other IRC acquaintances to use it instead of BO and eventually told me he had a master password on it. By the time he gave the password to me his trojan was picked up by most of the major AVS' of the day. Dirty scoundrels. ;)

Nuke the phishers

[enoz]

What is stopping a law enforcement agency from putting out a 'phishing' kit that actually phished the phishers?

It reminds me of the ol' days on instant messaging when people would pass around a supposed 'Nuke' program that would allow them to reboot people's computers, only to discover that their own computer crashed soon after.

Re:

[gotzero]

Hopefully if get people far enough down the ladder this would actually work. My not just flood the database with bad info? Hopefully having to sort through it would make it bad enough...

Re:Nuke the phishers

[FLEB]

What is stopping a law enforcement agency from putting out a 'phishing' kit that actually phished the phishers?

The law, mostly. It's just as illegal for someone to make "counter-malware" to break into a computer uninvited as it is for anyone else to make malicious software that breaks in.

Just what is stopping law enforcement?

[swb]

Don't you ever wonder why there have been so few significant arrests of spammers/phishers/etc?

Isn't it trivial for a government agency like the FBI or Treasury to track payments charged to any kind of electronic banking back to the recipient? Wouldn't an investigation "following the money" ultimately lead you to either the thief or at least greatly disrupt his activities? At a minimum it would expose the people that made their transactions work (banks, hosting companies, other otherwise "normal" business people).

A couple of decent RICO prosecutions and you would drive this stuff out of the United States and greatly reduce the scale of it.

But it never happens, and I can only think that somehow the government has somehow turned these people into some espionage rabbit hole and high level prosecutions would disrupt intelligence gathering. Because there is little reason the government couldn't do something about it if they wanted to.

Re:

[NemoinSpace]

i am guessing you haven't considered Cock-up theory ? [wikipedia.org]

Re:

[MishgoDog]

Because it would take just one 'blind' using a bank account such as a swiss bank account to foil the 'follow the money' approach. International co-operation is never at its best when it involves significant amount of money flowing INTO a country. It's simply not that simple.

Re:Just what is stopping law enforcement?

[ShaunC]

Don't you ever wonder why there have been so few significant arrests of spammers/phishers/etc?

No, not really.

For the most part, these have been made federal crimes, even to the extent of superseding existing state laws. A few years ago, several states had passed fairly strong anti-spam laws. If someone violated the law, you could file against them in your local small claims court, and secure a guaranteed judgement (good luck collecting, but that's another story) if they didn't show. Slashdot regular Bennett Haselton made boilerplate of that process, as I recall. Then along came CAN-SPAM, which created huge loopholes and essentially declared that individual state laws about spam, if less tolerant than the federal statute, were no longer enforceable.

So now it's up to the feds to prosecute spammers, phishers, and other ill-willed malfeasants. Most of the time, the feds have better things to worry about, and unless you personally can prove tens of thousands in damages, they're unlikely to raise an eyebrow. You do remember how the FBI's last few technology initiatives turned out, right? The penultimate example being "Virtual Case File," a/k/a "Virtual Money Sink." What amounts to a data warehouse with a client app to query it, $200 million later and it's scrapped. Two hundred MILLION dollars down the drain on a failed initiative to, in essence, secure some data feeds, create some transformations, and develop a GUI to query the whole shebang. You really expect these guys to track down John Dodrescu in Romania who's spoofing a Bank of America website on some zombie PCs in Italy, oh wait, that was 10 minutes ago before the TTL on the DNS expired, now it's some zombie PCs in France?

Give me, a non-gov IT professional, a team of 10 people of my choosing, fund me with one single million dollars and some travel vouchers, and agree to keep the project going for one year. A lot of these assholes will be out of business inside of 6 months, with many of their contemporaries scared shitless of becoming the next statistic. No fatalities, just a lot of people behind bars. But the federal government doesn't work that way because as many of us are well aware, it isn't profitable to run an IT department. They'd rather hire 1,000 guys who may or may not be able to tell you which of (XM|XP|XTC) is a version of Windows, at $50K a year apiece, then bitch and moan that they can't stop the problem with $50mil so they can justify a bigger budget next year.

America is spending more money per day in Iraq than it would take to adequately investigate, build cases against, and convict all of the prolific spammers in the entire world.

No, I don't often wonder why these problems haven't been solved. The federal government has been tasked with solving them, and that's all the why I need.

Re:

[noidentity]

You do remember how the FBI's last few technology initiatives turned out, right? The penultimate example being "Virtual Case File," a/k/a "Virtual Money Sink."

No, but it makes me curious of the ultimate example.

Re:

[gujo-odori]

Speaking as someone in the security industry and very closely involved with anti-phishing efforts, I have to say that the million dollars and the team of 10 wouldn't do you much good, because the phishers are not only not in the United States or Canada, where they would be relatively easy to apprehend, but are almost all in Russia, Romania, and other eastern European countries where even catching them, let alone getting them prosecuted is a much more difficult proposition. Extradition? Forget it.

The only wa

Re:

[Propaganda13]

Multiple countries and banking regulations make this hard to follow.

Without actually getting money, you could use the bots to order things on the internet and get them shipped to a large apt building or your 90 year old neighbor who can't get up to answer the door.

When I worked for a mail-order sports store, there were zipcodes that they wouldn't deliver to because of fraud.

Re:

[mpe]

What is stopping a law enforcement agency from putting out a 'phishing' kit that actually phished the phishers?

Are law enforcement actually interested in persuing these kind of criminals in the first place?

Phishing...

[Derek Loev]

It's amazing how many large websites are so vulnerable to even basic attacks. SQL Injection is still rampant (a simple well devised Google search can show you that) and many corporations leave credit card numbers unencrypted. Somebody with basic knowledge of SQL could attack a large amount of organizations without any trouble. I've seen this happen to too many people for me to ever trust important information on smaller sites.

Reminds me of a Star Wars quote...

[Chabil Ha']

Machines making machines? How perverse!

Phishers phishing phishers, yikes!

Root Cause is Obviously Greed

[Axe4ever]

I can understand that people do hacking for fun..to show off their programming capabilities..but these kind of activities are forked off by greed..which causes these guys to go any way..i mean doing anything outta way to get a grab at other's grub..

Its a shame !!!

Free phishing kits with trojans

[kylehase]

What we need are free phishing kits with trojans that report phishing sites to phishing filter databases or better yet to the administrators of site they're trying to emulate since they'd have the most incentive to take action. The hard part is hiding the trojan and traffic it generates.

funny

[timmarhy]

what's the world come to when you can't trust someone selling phishing software!

Re:Script kiddies?

[DigitAl56K]

This is pretty much the correct usage.

From Wikipedia [wikipedia.org]:

In hacker culture, a script kiddie (occasionally script bunny, skidie, script kitty, script-running juvenile (SRJ), or similar) is a derogatory term used for an inexperienced malicious cracker who uses programs developed by others to attack computer systems, and deface websites. It is generally assumed that script kiddies are kids who lack the ability to write sophisticated hacking programs on their own,[1] and that their objective is to try to impress their friends or gain credit in underground cracker communities.

And that's exactly what's happening.

Customer support is available...

[fahrbot-bot]

Cost:

• $15/hour - Any major credit card.
• $10/hour - Personal check (w/2 forms of ID).
• $5/hour - Electronic Funds Transfer.
• $1/hour - PayPal.

Godphisher

[FreeDisk.nl]

As in any betrayal in the dark world of crime, there is only one solution. Masterphish to thief: "Now phirst you get one warning. But iph you do it again, you will sleep with the phishes..."

Rats!

[Fuzzypig]

Just like a bunch of nasty, hungry rats caught in a trap together, they all start turning on each other. Bloody funny!

Reporting a Phisher

[emil10001]

I know this is a bit off topic, but it is related. I'm in the middle of trying to get rid of a phisher/scammer who won an eBay auction of mine. They took over someone else's account (eBay knows about this), bid on my item and won. Then they requested that I send the laptop to Nigeria (in the auction I explicitly stated that I would only send it to the US, Canada, and the UK). I knew that this person was a scammer, it was fairly obvious from the wrong e-mail addresses and Engrish, so I told him/her to stop b

Re:

[markov_chain]

I would say cut your losses. This kind of thing is the cost of doing business on eBay.

Re:

[emil10001]

Yep, this is probably the last time that I'm going to use eBay. I was getting pretty annoyed with the number of scammers on CraigsList, but eBay is almost as bad. And, eBay doesn't seem to be handling this stuff well.

Re:

[mark-t]

If he hasn't *actually* locked up your paypal account, then simply make an offer to sell it to the next highest bidder for whatever the amount was that the bid was at _before_ the scammer bid on it. If he doesn't want it anymore, or there was no next-highest bidder, then tell ebay that the winner of the auction is requesting that it be sent to an address outside the shipping regions that were explicitly stated in the auction. They will probably waive the listing fees in such a case as long as you relist t

Re:

[emil10001]

I've done all this. But regardless, it means relisting it, several times, because of second chance offers. Basically, this is taking an extra week to get sold, and it might sell for less than the highest legitimate bidder of the previous auction. eBay is not waiving the fees because the scammer replied to eBay's notice about the nonpayment thing, eBay isn't really dealing with this situation too well.

The scammer did not lock up my account, rather, he claimed that his payment would be released from PayPal t

Re:

[mark-t]

Ah... you shouldn't have filed it with ebay as a non-payment at all, but simply told ebay that the winner was asking for it to be shipped outside of your explicitly stated shipping area. That way, any payment you may have received from the bidder you could just show ebay that you turned around and immediately refunded. Too late now, I suppose.

is there no honor among thieves?

[peter303]

My faith in humanity is shaken! :-)

Dummy accounts?

[Skeet112]

I never understood why creditors, or even government law enforcement, wouldn't set up dummy accounts and slap them onto a watch list. All they would have to do is discreetly release their "dummy" credit information, and let the morons come to them. It's a win-win situation.

Re:

[PenGun]

Ahhh! The meta master. [];