Privacy is dead. Long live privacy

We don't really care about our privacy

FOREIGN criminals are stealing the credentials of British users of the internet auction site eBay to perpetrate large-scale fraud.

An investigation has identified one German-based fraudster who hijacked more than 30 accounts and used them to fleece UK car buyers.

It comes as increasing numbers of eBay users report concerns about trading on the site.

Figures from the government-funded Consumer Direct advice line show that calls expressing concern about eBay transactions are averaging 22 a day.

The auction site — which has 20m registered British users, equivalent to one third of the population — admitted last week that it was being forced to spend millions to combat fraud.

Conmen are targeting eBay users by acquiring their user names and passwords to pose as ordinary sellers with an unblemished trading reputation.

This undermines the basic security principle of the site, which relies on customers being able to gauge the reliability of a seller by looking at a history of their previous transactions.

Last week The Sunday Times tracked a prolific conman as he tried to sell more than 30 cars, in each case posing as a vehicle owner making a private sale.

The conman has duped several buyers into sending him thousands of pounds, according to a source who has had access to one of his e-mail accounts.

“There’s one payment this morning [October 12] for £6,000,” said the source. “Another of his purchasers is threatening to go to the police unless he returns the cash.”

North Yorkshire police confirmed that they are investigating a complaint against the man, who uses a series of aliases and has claimed to be a Croatian living in Germany.

Earlier this month the conman posted an advert on the auction site for a year-old black Audi A4.

The car, in good condition, was supposedly being offered for a quick sale at a “buy it now” price which was almost half the market value. A number of eBay members inquired about the car and each was instructed to contact the seller on an e-mail address.

When an undercover reporter offered to buy the car, he received a reply from a man calling himself Alex Lock, from Norfolk.

The man claimed he was in Germany for urgent surgery and needed to sell his car quickly to pay for the operation.

There was “nothing to worry about”, he said, because the cash would be deposited in an eBay payment protection account and could not be released until the car had been delivered.

For extra reassurance, he arranged for the eBay Motors section to contact the reporter by e-mail to vouch for the security of eBay payment protection.

The eBay e-mail and a subsequent billing invoice looked genuine, but they were sophisticated fakes. There is no such thing as eBay payment protection.

Further checks established that the same man was selling dozens of other cars at the same time and none of them existed. In each case he had stolen the identity of a real eBay user.

One of those users was Richard Tywang, a sports centre manager from Grassington, North Yorkshire. He had unwittingly surrendered his details when he responded to an e-mail purporting to be from eBay.

“It said that someone using the work computer had won an auction for a handbag,” said Tywang. “To find out who it was I had to log into the page using my password.”

Once the conman had the details he took control of the account, changed the e-mail address and used it to advertise a car for sale. Tywang was alerted to the sale by a would-be buyer who tracked him down because of his unusual surname.

Peter Jackson, owner of a limousine service in Manchester, received a call from a man interested in buying a cut-price BMW. He says he tried to alert eBay but it took three days before the car advert was blocked. “[eBay initially] replied saying that they couldn’t do anything because it wasn’t our e-mail address,” he said.

Meanwhile, the conman was proving elusive. One of his e-mail accounts proved to be registered to a Jonathon Cole who runs a cabinet-making business in Eldridge, Iowa. Cole checked his bank statement and found his card was being used by someone else.

Somehow Cole’s details had found their way across the Atlantic to Berlin. An identifying code on one of the conman’s e-mails led back to a computer in an apartment block on Hagenstrasse, in the former East Berlin. A bank account used to collect the money from British buyers was linked to a prefabricated apartment in north Berlin. The car seller was nowhere to be found at either address.

When The Sunday Times tracked down “Alex Lock” on the telephone, he claimed in heavily accented English that he was a genuine seller from Norfolk. “I’ve heard about these scams on eBay . . . If I were in your shoes I would be thinking the same,” he said.

This weekend eBay said it had investigated and contacted all the registered users of the site. It had also restored the settings of the accounts to the position before the conman had tampered with them.

This weekend eBay issued a statement saying that it worked “tirelessly” to prevent and detect fraud. It said all the conman’s suspicious transactions had been spotted and taken off the site before the end of the “auction”.

However, according to the source who had access to “Lock’s” e-mails, this was too late to save the victims from handing over their money.

The fraud was only possible, eBay said, because buyers were willing to enter into deals outside the site.

It added that preventing users from disclosing personal information was an “ongoing challenge”.