Romanian Fraudster Vladuz Arrested

There’s been some good news out of Romania  – cyber-criminal Vladuz has been arrested by the Romanian General Directorate for Combating Organized Crime. He had gained a measure of notoriety in the past year for numerous unsuccessful attempts to defraud members of the eBay Community.

This arrest came about because of great work between the Romanian Directorate, the US Secret Service, the FBI, and eBay’s global fraud investigation team, all of whom were directly involved.  You can read the press release here – it’s an excellent example of how eBay works with law enforcement around the world to bring to justice those who try to harm the Community.

More Info About the "eBay Security News" Announcement from John Canfield

Hopefully you saw the recent announcement from John Canfield about some new security measures we're putting in place to combat the fraudsters who try to break into eBay member accounts (usually after a successful phishing attempt). You can read the whole text here, but in a nutshell, we're going to start noting which computers members typically use to sell and buy. Then, around June, when a seller goes to list an item, we'll make sure they're using a trusted computer. If they're using one we've never noted before, we'll take a step or two to confirm their identity. This will usually be done via an automated phone call to a registered phone number. (As John mentioned, we hope sellers will take time to update their registered contact information and consider registering a cell phone as a secondary number - just in case we need to confirm their identity while they're on the road.)

This type of authentication is being used by other online industries, as well. For example, I need to answer security questions every time I access my bank account online from a computer the bank doesn't "recognize." And I know several friends who've received phone calls from their banks to verify their identity when they used their credit cards for an unusually large amount.

We've been doing some checking around our forums, and the reaction to the news has been pretty positive - a lot of "this is a step in the right direction" and "glad eBay is doing something about security"-type comments. We also saw some good questions, so we sent them over to John Canfield so he could provide some more detail.

John was part of this morning’s Town Hall event, and answered a few questions about this initiative – the archives will be available soon at www.ebay.com/townhall if you want to listen in.  His team will also be hosting an online workshop on May 6th to go over the program in more detail - stay tuned to the Announcement Board for the exact time. And without further ado, here are John's responses:

Q: What if I use multiple computers for my business - will I have to verify my identity every time I use one or the other?

A: We will definitely support multiple computers. During this information-gathering stage (now through June, roughly) we'll be able to tell which computer(s) you typically use to buy or sell, and as long as you're using one of these, you won't need to verify your identity. You also will be able to access multiple, different accounts from the same computer (such as in the case where a business has multiple IDs).

Q: How will you track which computer I'm using?

A: We generate a unique ID that identifies the computer you've used to connect to eBay. This unique ID is stored on your computer using cookies and Flash objects so that the next time you visit eBay, we're able to confirm that you're using the same computer. 

This unique ID doesn't include any personal information, such as your email address or eBay transactions, and won't be shared with anyone else.

Q: Will people who do not have a cell phone, or other alternate number that can be used when away from home, be able to verify their identity in some other way?

A: If you're away from your normal computer, you will be able to enter the telephone number where you are as part of the identity confirmation process. However, you'll also need to to answer your secret question to do so, as part of an additional security step. If you're not able to provide another number (for example, because you don't have a phone handy), you can use our Live Chat function so that one of our Customer Support Reps can verify your identity.

Q:  Why not just use a "challenge question" instead of phone calls?

A: Some businesses use challenge questions, some use phone calls, and some use a combination. We chose the phone method because we felt it provided the right level of convenience and security for the eBay Marketplace.

Q: What about ISPs that assign a different IP address for each session, or those that change the IP address each time the modem is rebooted?

A: We use a number of different variables to note what computer you buy and sell from. You won't need to verify your identity as long as you're using your normal computer(s), even if your IP address changes.

Q: How will listings submitted through a 3rd party listing service be handled?

A: You should not be affected unless you need to authorize 3rd party access to your eBay account. During that process, you will need to go through identity verification if we do not recognize that computer.

Q: Are you going to put similar security measures on bidders?

A: Right now this will only affect selling. But depending on the results of this initiative and changing fraud patterns, we may apply this program to other eBay activity in the future.

Q: Won't bad guys just change the phone number as soon as they take over an account so they then receive the phone call?

A: If we see that you've just changed your contact details (or basically any time we feel that the phone number may not actually be the seller's), we will ask you to answer your secret question as an additional security measure. This will prevent fraudsters from changing your account details and using the new info to confirm an identity.

Digital Downloadable Goods...your questions answered

Brian Burke, eBay's Director in Trust & Safety who manages the Feedback system, recently announced that Digital Downloadable Goods must be listed using the Classified Ad listing format effective March 31st.  This policy affects items like eBooks, MP3 files, content in PDF format, recipes, etc. -- anything that is "shipped" to a customer via email or download link. These items cannot be listed any longer as auction-style or fixed price listings.

The Classified Ad format is a lead-generation tool which gives sellers an "ad" that shows up in default Search results for 30 days. Currently, the only accepted category is Everything Else > Informational Products. (To learn more, read Help: Advertising with Classified Ads.)

The reason for this change is the concern about Feedback manipulation (or artificially padding a member's feedback score). Since Classified Ad format listings are not transactional, no feedback is exchanged between buyers and sellers and no feedback manipulation can occur.

Members on the forums, as well as callers into Griff's eBay Radio show this week, have been asking some good questions about this change. The Chatter team made some time with Brian Burke to get additional clarification and insights. Our Q&A with Brian follows:

Question: Why is eBay requiring sellers of digitally downloaded goods to list their items in the Classified Ads format?

Answer: Most items that require digital delivery, once created, can be very easily replicated. This ease of replication creates the opportunity for sellers to list thousands of the same item in an attempt to manipulate the Feedback system. It also creates a perception that even legitimate sellers of Digital Goods are manipulating the Feedback system. This dynamic -- real and perceived -- undermines trust across the entire marketplace.

We understand that digital goods, by themselves, are not the cause of Feedback Manipulation, but clarity of policy and ease of enforcement require all digitally downloaded items to be offered via the Classified Ads format.

Safer Payments...PayPal Explains

There have been a few questions about some of the changes around Safer Payments that were announced on January 29th at the eCommerce Forum.  PayPal Director of eBay business in North America Monroe Labouisse -- who also participated in our last Town Hall -- helped to explain more about the goals for the Safer Payments initiatives on the PayPal Blog.   Regarding item holds, Monroe says,

" Safer Payments, as Jim described, requires some sellers to offer safer payment options that we know buyers trust – such as PayPal or major credit cards.  Second, sellers should understand that only a very small percentage of transactions – and I can’t emphasize enough the words very small – may result in funds being held by PayPal."

There's a lot of other good information in his article  -- I encourage you to read it.

“Psst! Wanna Buy This Item Outside Of eBay?”

Remember that Seinfeld episode where George concocts a fake charity, in order to wriggle out of buying holiday gifts for his co-workers? Instead of buying them gifts he claims that a donation has been made in their name to "The Human Fund" (with the slogan "Money for People"). The holiday season and the first few weeks of the new year might bring out the best in most people, but for fraudsters, it's a time to bring out their worst scams.

One such scam eBay members should watch out for is an offer to buy or sell listed items outside of the eBay website (instead of buying "on-eBay," which means bidding on or buying the item on eBay, and then paying through the eBay Checkout process). Going outside of eBay to buy or sell an item listed on eBay is worse than falling for an old, legendary scam like "Psst! Wanna buy the Brooklyn Bridge?" It's like going down a dark alley to settle the transaction with your buyer or seller. You might find your money or item taken, with nothing to show in return. It's an unsafe and unprotected way of doing business.

On the other hand, completing the transaction on eBay (and with PayPal) is safe, because eBay has many buyer and seller protection programs, such as the Purchase Protection programs and Seller Protection programs to protect you if something goes wrong.

Fraudsters will attempt to lure you off the eBay site with Fake Second Chance Offers
Recently one of our members (let's call him Robert) recently bid on an item that he really wanted, but didn't win. Shortly after the listing ended, he received an email in his personal email inbox that looked something like this:

"I am the seller of the item you recently placed a bid on: Hoover SteamVac F7425-900 Shampooer Steamer. The winner got rejected due to security reasons. Your last bid price is taken into consideration. If you are interested to buy it please email me at myemailaddress@aol.com and include your name, address and eBay ID. Please contact me at myemailaddress@aol.com with your response, either yes or no."

It seemed too good to be true, but Robert contacted the "seller" anyway. Robert thanked him, stated that he did still want the steamer and agreed to pay using the "seller's" preferred payment method, Western Union. He sent him $185 through Western Union. 

You can guess where this story is going. Robert didn't get the steamer, and ended up losing his money.

Another common method a fraudster might use to lure people "off-eBay" is by including an email address in their listing, telling buyers to contact them directly for a "better deal."

If you're faced with a situation like Robert's here are some tips to avoid the errors of judgment that he made:

• Do not use Western Union for eBay items. You will NOT be protected. Western Union is not an accepted payment method on eBay because it is unsafe when paying someone you don't know.
  • Check out a really creative page our friends in eBay Australia have come up with for tips on how to spot fraudsters using Western Union to lure you into an unsafe transaction.

• Ask Seller a Question – Sellers, beware of buyers asking you to contact them about a transaction at a personal email address instead of using the Ask Seller a Question feature.
• Report off-eBay offers to us – Lastly, if you receive an offer to to buy or sell a listed item outside of eBay, let us know about it! Here's how to contact us to:
  • Report an outside offer from a seller
  • Report an outside offer from a buyer
• Confirm all Second Chance Offers in My Messages – In fact, make sure you check My Messages for ALL communications from your buyer or seller. If it's a genuine email, you should see a copy of it in My Messages.

Lastly I encourage you to take the Buying Safely tutorial and spend some time in our newly revamped Security Center. There are some great tips in there for both new and experienced buyers alike.

Don't Miss The Last Town Hall of 2007

I can hardly believe there's only about a month left in this year -- how time flies! Well, tomorrow's Town Hall with Bill Cobb, President of eBay North America, at the helm will be your last chance this year to ask live questions to our senior execs. So think about what's on your mind, and call in your questions.

Bill and the Town hall panel will be taking your questions from 2:00 pm -- 3:30 pm (Pacific Time) tomorrow, November 29th. During the event, dial toll free -- 1-877-474-3302 -- to talk to them LIVE on the air! You can even email your question in advance at TownHall@ebay.com. Check out the Town Hall page for more details.

As usual, I'll be updating this post with photos during the event, so come back tomorrow at 2:00 pm (Pacific Time). Hope to "see" you there!

And we're off!! Here's Griff and Bill Cobb conferring a few minutes before the Town Hall began:

Click on the link below to see more pictures from the Town Hall. And if you want to listen to a recording of the Town Hall or to read a transcript, keep an eye on the Town Hall Archives page -- it should be up there in a few days.

Safety tip: "Passwords are like underwear...

...change yours often."

Did I get your attention? GOOD!

As the guy in charge of Trust & Safety messaging, you might say my job is an uphill battle.  Safety messages are, to be blunt, boring. (This is also one of the reasons why we're making our Security Center friendlier and more inviting.)

Most serious content on the vitally important subject of password security (including eBay's Help page, I'll admit) reads like mom's admonishment to "eat your vegetables" or "clean up your room." We roll our eyes and inwardly groan, "Not another litany about passwords...I know, mom! I KNOW!!"

We often feel like the messages are for someone else. We might even feel a bit patronized by them. "Of COURSE I use strong passwords, duh! My passwords are NOT my birthday, my pet's name, my favorite sports team, or the word 'password123,' so what could possibly go wrong?" we say.

Well, plenty.

We can thank the University of Wyoming for taking the subject of password security out of the realm of broccoli and room cleaning. Evidently someone there knows how to grab the attention of the notoriously capricious student mind. Heck, introduce underwear into the conversation – that time-honored, giggle-inducing topic we learn to love in kindergarten – and you make even the most apathetic of users sit up and read. We all are kids at heart, after all.

The picture is from U-Dub's brilliant page on Using Strong Passwords. Once you're done chuckling over the underwear analogies, you'll find that the information is pretty darn serious.

How fast can someone guess your password?
We all know that the bad guys behind phishing and identity theft scams are out to steal our passwords, but thinking that they're hunched over their computers trying out different combinations manually to arrive at our passwords is wrong.

These crooks write software programs that can "guess" passwords far more easily and quickly than you might think. Even desktop personal computers have now become powerful enough that they can process 100,000 encryption operations per second. And here's a sobering statistic: according to the University of Wyoming, if your password has 5 characters and uses only lower-case letters, it can be cracked in under 2 minutes. If it's 6 characters, it takes a bit longer, but it can still be cracked in under an hour!

The good news is that the longer and more complex your password is, the harder it gets for these rogue software programs to even come close to cracking it.

For instance, if you have an 8-character password that uses a combination of upper and lower case, it will take 17 years of computer processing to crack that password. If you add just one more character to your password, you're significantly upping the ante – the University of Wyoming says that it will take over 800 years to crack a 9 character password made up of upper and lower case letters. And if you throw numerals into the mix as well, the rogue programs will have to grind away even longer.

Is your password strong?
eBay has technology that detects whether your password is "strong" or not. If you have a password that our technology identifies as prone to being cracked by known patterns used by password-guessing tools, we present an additional layer of authentication to prevent your password from being broken. Remember how sometimes you see a combination of squiggly letters and numbers when you're signing in to your account? A password-guessing program can't recognize those characters, but a person – i.e. you – can. Despite this additional layer of protection, I'd still say that everyone should change their passwords often, at least every 30 to 60 days.

So here are some tips I urge you to use:

1. Read the University of Wyoming page and chuckle over the underwear references (or frown and say "Tsk! tsk!", if you're a mom).
2. Carefully read the serious information about creating a strong password.
3. Read eBay's Help page, as well.
4. Visit our remodeled and friendlier Security Center for more useful information on staying safe online.
5. Review all your passwords and change them frequently.

Otherwise, you may end up getting a password wedgie.

Pictures from Today's Town Hall with Bill Cobb

If you missed listening to last Friday's Town Hall with Bill Cobb, President of eBay North America, you can still hear a recording of the event or read a transcript on the Town Hall Archives page in a few days. Meanwhile, take a look at some pictures from the event.

For Friday's Town Hall, we had live participation not only from people who called in on the phones and sent in their questions via email, but also from the newest members of the Voices of the Community program, who were in San Jose last week. You can see some of them in the foreground in this picture:

A Good Buying Experience is the Best Holiday Gift You Can Give Your Buyers

***Update on 2/11/08: We are adjusting the processes noted in this post. Existing restrictions that limit sellers to a percentage of sales will be lifted. For more information about the seller non-performance policy, please read our Frequently Asked Questions.***

Last time I spoke to Lynda Talgo, Senior Director of Global Policy Management in Trust and Safety, she answered some of the most common questions our Community had about our Seller Non-Performance (SNP) policy. This policy now considers the number of negative and neutral Feedback ratings a seller has received in the last 90 days, along with Item Not Received claims. Sellers who have a greater than 5% buyer dissatisfaction rate are subject to new enforcement actions. (Read the policy for more details.)

In this latest letter, Lynda provides some tips and “best practices” that sellers may want to pay special attention to during the holiday season.

Lynda's message to sellers can be summed up this way – “Build positive relationships with buyers.”

                                                                     ****

I’m back to offer a number of tips to help sellers ensure they’re satisfying their buyers on eBay. For many sellers, these will just be a review, since the vast majority of our sellers meet or exceed their buyers’ expectations.

This list combines the best advice from teams around eBay, such as Customer Support, Seller Development, and PowerSeller Support.

• It doesn’t hurt to “over communicate” with your buyers.
  • Let them know you’ve received their payment.
  • Send detailed shipping information, such as tracking numbers, or the date you plan to ship the item.
  • Send a follow-up e-mail to check that your buyers have received their item and have had a positive experience.

• Remain positive and professional in all communications with buyers. There is nothing like a positive attitude to soothe ruffled feathers!

• Follow up on all buyer complaints immediately. Make sure that all buyer complaints are addressed promptly, and make every reasonable effort to satisfy the buyer. Most buyers will not leave negative or neutral feedback until after they have given the seller the opportunity to fix the problem. The longer it takes to resolve a problem, the harder it will be to turn that into a good experience for the buyer.

• If you do get a negative feedback, the first thing you should do is contact the buyer, and find out what you can do to address the problem. If you are able to satisfy the buyer, and if the buyer agrees, you can use the Mutual Feedback Withdrawal process. If the buyer is still unhappy, and doesn’t want to use the MFW process, be sure to be professional in your reply to the negative feedback. One way some sellers make their buyers happy is to leave them positive feedback as soon as they have paid for the item; this sets a nice tone for the overall transaction.

• Be accurate in your listing description and honor your selling terms. Make sure your item description and terms of sale are clear and accurate. And don’t “change horses in midstream” – honor those terms after the listing ends.

• Have a customer service infrastructure in place. PowerSellers and high-volume sellers should consider offering phone support for buyers.

• Build a reputation for yourself in the categories in which you sell. Share your knowledge as an expert and build buyer loyalty. Create an eBay Blog, write Reviews and Guides on the subject, or contribute to the eBay Wiki. You can also provide guidance to other sellers (and, of course, buyers) by answering their questions in the Community forums.

• If a buyer does not pay, file an Unpaid Item dispute. In cases where buyers do not respond to the dispute, eBay can remove feedback left for the seller.

• Be crystal clear on shipping costs and times. Don’t promise anything in your listings that you may not be able to deliver due to 3^rd party arrangements. Plus:
  • Remember; shipping and handling is meant to represent actual cost to ship and actual cost of packing materials – nothing more.
  • List actual number of days to deliver rather than “business days” to avoid buyer confusion. Many buyers assume that, because eBay’s website is accessible 24/7, every day is a business day! 
  • When shipping internationally, use a shipping service that offers tracking numbers.

• Respond to all Item Not Received/Significantly Not as Described disputes. Prompt response, plus the willingness to work with the buyer through the dispute process, can turn a bad situation into a positive one.

• When something goes wrong, fix it. Good businesses are always looking for ways to be more efficient and make processes work more smoothly. Think of a problem as an opportunity to make an improvement that will pay off for all your future transactions.

Above all, be professional! Sometimes things go wrong – there’s no avoiding that. But if you stay friendly and helpful, and take responsibility to fix the problem, your buyer is much more likely to stay happy, and come back.

Shop Victoriously... and Safely!

I'm John McDonald from eBay's Trust & Safety team. With the biggest shopping season of the year right around the corner, it's more important than ever that internet users – on eBay and off – stay safe when they're on the internet.

I'll be blogging here every couple weeks with important safety tips, as well as news about advances we're making at eBay and PayPal to help the marketplace stay safe. 

Feel free to share my blog posts with your friends and family – safety is everybody’s business, so spread the word!

This week, I'd like to share some positive developments with you related to Phishing emails and also bring you up to date with what we're doing to keep eBay buyers and sellers well-informed about the recent spate of product recalls.

1) eBay, PayPal and Yahoo! are partnering to reduce dangerous Phishing emails
eBay, PayPal and Yahoo! have joined forces to reduce the number of phishing emails that eBay and PayPal members get. All emails from eBay and PayPal have a digital signature (a bit of code that spammers can’t replicate).  Yahoo! Mail will now check all emails claiming to come from eBay or PayPal for this digital signature. If you use Yahoo! Mail for your eBay or PayPal activity, you will receive only genuine email from eBay and PayPal in your inbox, because authentic emails will have the correct digital signature.  However, a phishing email that is pretending to be from eBay won't have the digital signature, and so Yahoo! Mail will automatically prevent it from reaching your inbox. This is a huge victory in the ongoing battle against phishing.

For now, this effort will help only our members who use Yahoo! Mail, although we hope to form similar partnerships with additional ISPs in the future.  (Read more about this project on PayPal's blog. )

Speaking of phishing emails, remember these important safety tips:

Please -- don't get Phished! An email from your bank, PayPal, eBay or another institution that asks for you contact information or for your immediate response is fishy – or possibly PHISHY!  Here are some steps to take:

1. Stop.  Don't rush to reply or take action – even if the request is really urgent sounding.
2. Look. Read the text several times, and ask yourself why this information or call to action is necessary.
3. Check. Check My Messages for an eBay email, or contact PayPal customer support. 
4. Forward.  Forward any suspicious emails to us at spoof@ebay.com and spoof@PayPal.com.

2) Shopping safely – Toy Recalls
If you read our General Announcement Board regularly, you've noticed a number of U.S. Consumer Product Safety Commission (CPSC) recalls lately. We want to make sure our Community stays safe, and doesn't buy or sell items that could pose a health or safety hazard. As a service to our Community, we announce toy recalls or major recalls that could affect to buyers and sellers.

One way we're working to increase our Community's awareness about eBay's Recalled Items policy is by including links on various product category pages, such as Toys & Hobbies and Baby. You can see a bunch of helpful resources on the bottom right of the category page, under "Category Community Links." We provide notices to sellers when they are listing items that may be part of a major recall. We also have links to the Recalled Items policy and other resources on the Toy & Hobbies Discussion board.

Finally, our Security and Resolution Center (which you can find at the bottom of most eBay pages) also has one-click access to the CPSC, making it easy to get helpful safety tips directly from the CPSC. On the CPSC site, consumers can also access a searchable database of recalled products, and sign up to receive email notifications of newly recalled products.

That's it for now.  Until next time, Shop Victoriously – and Safely!!