eBay helped to shut down a Russian Web site last week that was offering to sell stolen customer account information for as little as $5 each. Armed with an eBay customer’s login and password, a fraudster could post items for sale, collect payments, and then never deliver the goods. The site was also offering to sell a handful of PayPal accounts.
The site was inaccessible Friday morning, but Alex Eckelberry, president of security vendor Sunbelt, posted screen captures in his blog that appeared to show account information for sale from customers in the U.K., Germany, and Australia. His posting is available online. The site preferred accounts that were used infrequently, meaning a user would take longer to notice any suspicious activity, and asked a higher price for accounts with good feedback ratings. Prices ranged from $5 to $25 per account.
EBay reiterated its guidelines for customers to avoid having their data stolen: Be extremely wary of e-mail that ask you to update personal account information, download eBay’s toolbar with software that detects fraudulent eBay and PayPal sites, and report suspicious e-mail. It’s quite common to buy anything from hacked user account on estores to nice ICQ or MSN numbers…