Ebay fraud - Datron 4910 - Voltage reference

[try]

Hello there,

always during week-ends and preferably during night time in the responsable Ebay branch fraudulous offers appear.

Using stolen pictures and pirating good ebay accounts some fraudsters want to be contacted (and paid of course) outside of the Ebay platform. This is the dubious offer:

https://www.ebay.de/itm/193906296432?ul_noapp=true

I just informed the security department of Ebay Germany.

Best regards
try

[ScoobyDoo]

Hello Folks - same impostor is posting fraudulent auctions about 3458A unit ... - he uses stolen photos and someone else online shop.

https://www.ebay.com/itm/HP-Hewlett-Packard-3458A-Agilent-Digital-Multimeter-8-8-5-Digits-w-Option-2/203284989330?hash=item2f54bac592:g:96oAAOSwsnZgMali

If price is too good to be true - stay away and inform ebay ...

Best regards
ScoobyDoo

[try]

Hello ScoobyDoo,

could you give Ebay a ring? Will have to join a meeting now...

Best regards
try

[ScoobyDoo]

Hello Try - sent ebay a message about 3 similar fraudulent ads - I hope they remove those soon.

However this impostor returns every week using different hacked accounts from webshops ... - eBay should do more effort to stop these crooks.

Best regards
ScoobyDoo

some easy checks: 

location item [USA / Germany] and address webshop - VAT number [GB] does not match
They do not respond on messages coming from ebay which is against ebay policy
A pawn shop is involved but they only accept the minimum reserve and will make proposal to pay outside ebay system
Price is still too good to be true ... - a good 3458A starts around 4000$ (and above) these days or something is fishy

[Kean]

I've reported a bunch of these listings in the last days (and more in the weeks prior).  They keep matching some of my searches so I keep reporting them.
When you see a listing with that pawn shop image in particular, just click Report Item then choose "Listing Practices", "Avoiding eBay fees", "Contact info in listings" - or something similar.
Every time I've done this the listing dissapears within a day, along with any similar listings (possibly all listings) on the hacked seller account.
I've just done it for the two listings mentioned above.

[tggzzz]

I wonder whether fleabay responds faster to "avoiding ebay fees" or "fraudulent listing"?

[try]

Hi folks,

thanks for your engagement!
From what I learnt Ebay could be much faster in removing this ads.

tggzzz, I fear that "avoiding ebay fees" is the right answer!

I hope your reference is doing fine! Unfortunately it does not look like that there is opportunity for a comparison right now, unfortunately.

Anyway, I'd like to wish you all low measurement uncertainty in 2022.

[richnormand]

Seems to see lots of listing by these folks for the past 6 months, particularly on Keysight, R&S SA and signal generators.
They use different (stolen?) accounts every sew weeks and the photos seem to be often generic ones, not the actual items.
In reporting to ebay  the "avoid ebay fees" gets an almost immediate response compared to any other reasons I have used from the drop-down menu.

It is tempting to put an actual bid and press ebay to see if they stand by it (depending on the country I guess). If they were obliged by law I am sure these would disappear instantly.
Considering how long this has been going on, by the same party (same contact info), I am surprised ebay itself has not followed through on an order to get them in court. The scam must be profitable to continue with impunity.

 

[SilverSolder]

Seems to see lots of listing by these folks for the past 6 months, particularly on Keysight, R&S SA and signal generators.
They use different (stolen?) accounts every sew weeks and the photos seem to be often generic ones, not the actual items.
In reporting to ebay  the "avoid ebay fees" gets an almost immediate response compared to any other reasons I have used from the drop-down menu.

It is tempting to put an actual bid and press ebay to see if they stand by it (depending on the country I guess). If they were obliged by law I am sure these would disappear instantly.
Considering how long this has been going on, by the same party (same contact info), I am surprised ebay itself has not followed through on an order to get them in court. The scam must be profitable to continue with impunity.

You would be refunded, obviously, but you never get the time you wasted back.

[Cerebus]

These same fraudsters have been running the same scam for much longer than 6 months. I can't remember quite when we first noticed them, but for a while every Saturday morning in the TEA thread there was a rash of "The eBay fraudsters are back again. Reported them again." postings. It's at least a year, probably longer.

I don't know if eBay are useless or powerless, but they seem to have completely failed to stop them. Just the hijacking of accounts is enough under UK law to get them charged with criminal offences, and similar offences exist in most jurisdictions so there's no barrier to stopping them. They have to take money at some point for it to be a useful scam, and once there's a money trail there's a good chance of law enforcement tracking them down and charging them - repeated hacking is probably enough to get them locked up for long enough to prepare substantial fraud charges against them.

They're on eBay every weekend and eBay don't seem to even slow them down, I can only presume that eBay haven't even spoken to the police about it. If we've spotted a pattern one would hope that eBay had managed to by now but either they haven't or they don't care. Other than reporting the individual fraudulent items there don't seem to be any way to point out the pattern to eBay in case they really have missed it.

I guess one could do a BD139 and shitpost all over Twitter about it. 

[SilverSolder]

These same fraudsters have been running the same scam for much longer than 6 months. I can't remember quite when we first noticed them, but for a while every Saturday morning in the TEA thread there was a rash of "The eBay fraudsters are back again. Reported them again." postings. It's at least a year, probably longer.

I don't know if eBay are useless or powerless, but they seem to have completely failed to stop them. Just the hijacking of accounts is enough under UK law to get them charged with criminal offences, and similar offences exist in most jurisdictions so there's no barrier to stopping them. They have to take money at some point for it to be a useful scam, and once there's a money trail there's a good chance of law enforcement tracking them down and charging them - repeated hacking is probably enough to get them locked up for long enough to prepare substantial fraud charges against them.

They're on eBay every weekend and eBay don't seem to even slow them down, I can only presume that eBay haven't even spoken to the police about it. If we've spotted a pattern one would hope that eBay had managed to by now but either they haven't or they don't care. Other than reporting the individual fraudulent items there don't seem to be any way to point out the pattern to eBay in case they really have missed it.

I guess one could do a BD139 and shitpost all over Twitter about it. 

I don't think hardly any resources are being put in place by law enforcement to detect and prosecute these kinds of crimes.  So the perps just keep coming back, hacking someone else's account and having another go.

[Cerebus]

True. The UK is getting slowly better in that regard. However, the fraud is the thing that would interest the police (one hopes it does when it's at this scale and persistence anyway) and the computer offences would be the "way in", rather like that expired tax disc/tag on your car can be the way into a discussion about your vehicle insurance, or outstanding warrants, or the funny smell coming from your cigarette.

[Stray Electron]

I don't think hardly any resources are being put in place by law enforcement to detect and prosecute these kinds of crimes.  So the perps just keep coming back, hacking someone else's account and having another go.

  A good CIVIL lawsuit and a substantial financial judgement against them (and their ISP and anyone else connected to them) by E-bay and/or PayPal would soon put an end to this kind of business. 

[guenthert]

  A good CIVIL lawsuit and a substantial financial judgement against them (and their ISP and anyone else connected to them) by E-bay and/or PayPal would soon put an end to this kind of business.

     You don't want to hold ISPs responsible for their customers' actions anymore than you'd want a restaurant owner where potentially some Mafiosis discuss their shady business. 

(substitute "Mafiosi" with spies, politician, capitalists, anarchists, terrorists, adulterers ... as it suits you)

[SilverSolder]

I don't think hardly any resources are being put in place by law enforcement to detect and prosecute these kinds of crimes.  So the perps just keep coming back, hacking someone else's account and having another go.

  A good CIVIL lawsuit and a substantial financial judgement against them (and their ISP and anyone else connected to them) by E-bay and/or PayPal would soon put an end to this kind of business.

Put them on a "no fly list" for bank accounts, so they can't open new bank accounts - that should stop it.

[tggzzz]

I don't think hardly any resources are being put in place by law enforcement to detect and prosecute these kinds of crimes.  So the perps just keep coming back, hacking someone else's account and having another go.

  A good CIVIL lawsuit and a substantial financial judgement against them (and their ISP and anyone else connected to them) by E-bay and/or PayPal would soon put an end to this kind of business.

Put them on a "no fly list" for bank accounts, so they can't open new bank accounts - that should stop it.

That opens up the question of "digital identity", which is a graveyard of good intentions. It is a classic example of amateurs thinking about how it might work, but professionals think about how it will fail.

[SilverSolder]

I don't think hardly any resources are being put in place by law enforcement to detect and prosecute these kinds of crimes.  So the perps just keep coming back, hacking someone else's account and having another go.

  A good CIVIL lawsuit and a substantial financial judgement against them (and their ISP and anyone else connected to them) by E-bay and/or PayPal would soon put an end to this kind of business.

Put them on a "no fly list" for bank accounts, so they can't open new bank accounts - that should stop it.

That opens up the question of "digital identity", which is a graveyard of good intentions. It is a classic example of amateurs thinking about how it might work, but professionals think about how it will fail.

Not sure I understand - a bank account is very much linked to a person (including limited company "persons" obviously).

Banks already have to follow "know your customer" rules and would get in trouble for opening accounts for money launderers etc., so this approach is already in effect today - just not for "petty" crimes.

[Cerebus]

Not sure I understand - a bank account is very much linked to a person (including limited company "persons" obviously).

Banks already have to follow "know your customer" rules and would get in trouble for opening accounts for money launderers etc., so this approach is already in effect today - just not for "petty" crimes.

Now sit back and have a think, and try and design in your head a system that will work worldwide, no matter where a person purportedly originates from, a system that will allow an individual to be:

• Uniquely and unambigiously identified,
• in which a person can always reliably prove their true identity (no false negatives)
• in which no other person is ever accidentally identified as the first person and thus denied something like a bank account by mistake (no false positives),
• that cannot be forged, even if the person claims to come from somewhere where official identity is difficult to establish (unreliable or corrupt governments that might issue false papers cheaply or even make a business of it [cf Malta]),
• that can be used by anyone worldwide, and doesn't rely on access to notaries, a reliable postal service or any other particular primary or secondary lynchpin typically used to prove possession of an official document or ability to receive post at some physical address, and isn't too onerous or expensive to expect everybody worldwide to use it.

If you have any imagination you ought to be able to come up with a way that any system you invent will fail or can be subverted within ten minutes of inventing it.

Proving identity electronically is a "hard problem"; proving transactional entitlement is on the other hand doable, which is why so many electronic systems rely on it (e.g. possession of a digital receipt that can be exchanged for some particular good or service).

Edited to add: In context, I've just opened a new bank account online with a major high street bank that I have never done business with before. The whole identify issue in doing so relied on (1) a scan of something that purports to be my driving licence, (2) a pdf of what purports to be my most recent bank statement from another bank I do business with, (3) delivering passwords and the like to a particular physical address, (4) being able to deliver email to a particular email address (that it so happens I created specifically for use with the bank account and that had never been used prior to making the account application). The difficulty of forging or subverting all of the above is not high.

[SilverSolder]

Not sure I understand - a bank account is very much linked to a person (including limited company "persons" obviously).

Banks already have to follow "know your customer" rules and would get in trouble for opening accounts for money launderers etc., so this approach is already in effect today - just not for "petty" crimes.

Now sit back and have a think, and try and design in your head a system that will work worldwide, no matter where a person purportedly originates from, a system that will allow an individual to be:

• Uniquely and unambigiously identified,
• in which a person can always reliably prove their true identity (no false negatives)
• in which no other person is ever accidentally identified as the first person and thus denied something like a bank account by mistake (no false positives),
• that cannot be forged, even if the person claims to come from somewhere where official identity is difficult to establish (unreliable or corrupt governments that might issue false papers cheaply or even make a business of it [cf Malta]),
• that can be used by anyone worldwide, and doesn't rely on access to notaries, a reliable postal service or any other particular primary or secondary lynchpin typically used to prove possession of an official document or ability to receive post at some physical address, and isn't too onerous or expensive to expect everybody worldwide to use it.

If you have any imagination you ought to be able to come up with a way that any system you invent will fail or can be subverted within ten minutes of inventing it.

Proving identity electronically is a "hard problem"; proving transactional entitlement is on the other hand doable, which is why so many electronic systems rely on it (e.g. possession of a digital receipt that can be exchanged for some particular good or service).

Edited to add: In context, I've just opened a new bank account online with a major high street bank that I have never done business with before. The whole identify issue in doing so relied on (1) a scan of something that purports to be my driving licence, (2) a pdf of what purports to be my most recent bank statement from another bank I do business with, (3) delivering passwords and the like to a particular physical address, (4) being able to deliver email to a particular email address (that it so happens I created specifically for use with the bank account and that had never been used prior to making the account application). The difficulty of forging or subverting all of the above is not high.

I guess digital currencies can do a lot, but when all is said and done, there just isn't enough interest in stopping fraud.

If you wanted to stop fraud with today's banking system, you would change the rules.  For example, if you wanted to be really draconian, make it so that as soon as an account is flagged as being involved in a fraudulent transaction, all transfers out of that account after the date of the first fraudulent transaction are reversed - every last one of them, with the onus being on the receiving bank or financial institution. 

The fraudulently obtained money is then returned to the sender out of the returned funds, and the account is closed.  This way, the bank that was insecure enough to actually hand money over to the criminal fraternity at the far end of the transaction chain ends up carrying the can - which is as it should be.  They would soon start to care a lot more about who their customers are, and it would become much more difficult to criminals to open a bank account. 

But nobody wants this.   The black "informal" economy accounts for some 20% of GDP...

[tggzzz]

In a world where information was correct, a justification could be made for something like that. But back on planer earth where all databases contain errors, it will screw you in correctly

Current example: someone I know trying to get a bank to acknowledge their identity, but the verification fails despite being on the electoral roll at the same address for 40 years. Why? Because the name on formal legal documents is Alpha Bravo Charlie Delta, but Experian knows him as Alpha Bravo Delta.

[tggzzz]

As for digital identity certificates, a quarter of a century ago Stefik Zaba made the point to the government by correctly pointing out "my name is Donald Duck and I have a digital certificate to prove it".

[SilverSolder]

In a world where information was correct, a justification could be made for something like that. But back on planer earth where all databases contain errors, it will screw you in correctly

Current example: someone I know trying to get a bank to acknowledge their identity, but the verification fails despite being on the electoral roll at the same address for 40 years. Why? Because the name on formal legal documents is Alpha Bravo Charlie Delta, but Experian knows him as Alpha Bravo Delta.

Attempting to get a driver's license in the US, I ran into the problem that the DMV wouldn't accept my social security card...  because the name on the card was truncated compared to the passport.  Reason:  the social security card has a limitation on the number of characters it can have in the name field, so they shortened it down...   (It eventually got resolved but a supervisor had to be called over to talk sense into the clerk.)

Bottom line, live with the fraud, and think of it as a kind of QE...  after all, the crooks create demand in the real economy with their ill gotten gains!   As long as the defrauded people are covered, it seems to work OK without anyone having to do a lot of hard work...   the default situation with government! 

[tggzzz]

Shamelessly "researched" from https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/

I have never seen a computer system which handles names properly and doubt one exists, anywhere.

So, as a public service, I’m going to list assumptions your systems probably make about names.  All of these assumptions are wrong.  Try to make less of them next time you write a system which touches names.

    People have exactly one canonical full name.
    People have exactly one full name which they go by.
    People have, at this point in time, exactly one canonical full name.
    People have, at this point in time, one full name which they go by.
    People have exactly N names, for any value of N.
    People’s names fit within a certain defined amount of space.
    People’s names do not change.
    People’s names change, but only at a certain enumerated set of events.
    People’s names are written in ASCII.
    People’s names are written in any single character set.
    People’s names are all mapped in Unicode code points.
    People’s names are case sensitive.
    People’s names are case insensitive.
    People’s names sometimes have prefixes or suffixes, but you can safely ignore those.
    People’s names do not contain numbers.
    People’s names are not written in ALL CAPS.
    People’s names are not written in all lower case letters.
    People’s names have an order to them.  Picking any ordering scheme will automatically result in consistent ordering among all systems, as long as both use the same ordering scheme for the same name.
    People’s first names and last names are, by necessity, different.
    People have last names, family names, or anything else which is shared by folks recognized as their relatives.
    People’s names are globally unique.
    People’s names are almost globally unique.
    Alright alright but surely people’s names are diverse enough such that no million people share the same name.
    My system will never have to deal with names from China.
    Or Japan.
    Or Korea.
    Or Ireland, the United Kingdom, the United States, Spain, Mexico, Brazil, Peru, Russia, Sweden, Botswana, South Africa, Trinidad, Haiti, France, or the Klingon Empire, all of which have “weird” naming schemes in common use.
    That Klingon Empire thing was a joke, right?
    Confound your cultural relativism!  People in my society, at least, agree on one commonly accepted standard for names.
    There exists an algorithm which transforms names and can be reversed losslessly.  (Yes, yes, you can do it if your algorithm returns the input.  You get a gold star.)
    I can safely assume that this dictionary of bad words contains no people’s names in it.
    People’s names are assigned at birth.
    OK, maybe not at birth, but at least pretty close to birth.
    Alright, alright, within a year or so of birth.
    Five years?
    You’re kidding me, right?
    Two different systems containing data about the same person will use the same name for that person.
    Two different data entry operators, given a person’s name, will by necessity enter bitwise equivalent strings on any single system, if the system is well-designed.
    People whose names break my system are weird outliers.  They should have had solid, acceptable names, like 田中太郎.
    People have names.

This list is by no means exhaustive.  If you need examples of real names which disprove any of the above commonly held misconceptions, I will happily introduce you to several.

[rsjsouza]

Attempting to get a driver's license in the US, I ran into the problem that the DMV wouldn't accept my social security card...  because the name on the card was truncated compared to the passport.  Reason:  the social security card has a limitation on the number of characters it can have in the name field, so they shortened it down...   (It eventually got resolved but a supervisor had to be called over to talk sense into the clerk.)

Hah, I can surely relate to that. I have four names/surnames and a preposition in the middle. Try to fit that into First Name, Middle Initial and Last Name.

That is the reason why some of the more "official" forms ask about "other names you are known (including maiden)". I tend to fill whatever I have registered on the DL, the SS, the Passport, the bank account, the credit card...

[TimFox]

@ tggzzz:
A special case of the assumptions in the list (fitting into several of the lines) is that names never include diacritical (accent) marks, even if the family name is French, Spanish, German, etc.