Bidding only crooks can win

THE BALTIMORE SUN

KANSAS CITY, Mo. - For a couple of days in December someone was auctioning Sony camcorders from Kevin Pilgrim's eBay account. But the auctioneer wasn't Pilgrim, who lives in Raytown, Mo.

More than two dozen online bargain hunters agreed to pay $605 apiece, in some cases wiring money to Germany. But there were no camcorders. The auction was a fraud.

The scammers who hacked into Pilgrim's eBay account to woo bidders did their dirty work before eBay shut his account down.

A frustrated Pilgrim watched the crime unfold, able to do little more than desperately e-mail warnings to bidders. Even the FBI told him that while these electronic purse snatchings were rampant, they could not afford to tie up agents' time on each one that popped up.

"We get calls like this every day, and that shows how rampant this is," said Jeff Lanza, a spokesman for the FBI in Kansas City.

Although auction fraud is skyrocketing, consumer protection is not keeping pace. As a result, auction users face growing risks. More are pressing for safeguards; some are becoming online vigilantes.

"You've got this monster market on the Internet, but you can be witnessing a crime in real time and be helpless to do anything," Pilgrim said. "There's no 911 number you can call."

Online auctions attract millions of users willing to buy everything from toasters to sailboats from strangers. The largest, eBay, posted revenues last year of more than $240 million. It's been reported that 35 million people buy and sell in online auctions.

"What we say is that we do $30 million a day in business," said eBay spokesman Kevin Purseglove. He said fraud taints no more than 0.01 percent of the transactions.

But that means lots of users get burned. Some experts believe the number of frauds may increase because they are so hard to track.

"By the time they're discovered, they're someplace else," said John Giubileo, vice president of products and services at eSecurityOnline.

The National Consumers League's Internet Fraud Watch reported that online auction complaints accounted for 87 percent of all Internet fraud complaints it received last year. The league said Internet fraud last year cost consumers $7,209,196 - $484 per victim.

The Federal Trade Commission's Consumer Sentinel, which gathers online fraud complaints for a law enforcement consortium, received more than 20,000 Internet auction fraud complaints in 2001.

While there are a lot of scams, each might affect no more than 50 people, a number unlikely to ring bells at the FBI.

While online auctions rely on trust between buyers and sellers, scammers take advantage of that trust to do their dirty work.

In the past, many scammers simply opened their own accounts to hoodwink bidders. But they were more easily traced. Now, the scammers - often international gangs - hack into the accounts of users with good reputations, sellers who showcase their positive feedback, and use those good reputations to ambush bidders.

That's what happened to Pilgrim. On Dec. 16, when he checked his e-mail, he found 18 eBay users wanting to buy camcorders from him. When he tried to access his account, he found he was locked out. The password had been changed.

He reported the fraud using an eBay message prompt. An automatic response said eBay would get back to him in "12 to 36 hours." He then called the local police, who said they were not equipped to investigate Internet crimes.

The next morning, the final day of the auction, Pilgrim called the FBI and the Justice Department's Internet Fraud Complaint Center, which gave him a complaint reference number.

He frantically returned e-mails to as many bidders as he could, warning of the fraud: "I was concerned that people thought I was the guy perpetrating the fraud."

More than 40 people had responded to the auction. An unknown number already had paid. Craig Rettmer, a Kansas City audio engineer, was one of the unlucky ones who lost $605.

"Kevin [Pilgrim] was quick to tell me he wasn't selling anything," said Rettmer. "I felt like such a fool."

Victims were beguiled by the scammers' slick appearance on the Net. After taking over Pilgrim's site, the scammers advertised Sony digital camcorders at a "buy now" price $200 below retail. The site included technical information and even offered gift wrapping. "They made you feel very comfortable," said Rettmer, who intended to give his daughter a camcorder for Christmas.

In retrospect, the payment directions should have raised a red flag. Bidders were told to wire payments by Western Union to an address in Nuremberg, Germany. Hoping to get his camera before Christmas, Rettmer wired cash. Other bidders paid by credit card and remain hopeful that they will get their money back.

The auction was over and the scammers were gone when eBay suspended Pilgrim's account Dec. 18. Purseglove, of eBay, acknowledges that the company appeared slow to react in Pilgrim's case but called that unusual. He said eBay tries to respond immediately to customer concerns.

"Certainly the auction sites should have the equivalent of a rapid-response team," said Beau Brendler, director of Consumer Web Watch.

J.A. Hitchcock, author of Net Crimes & Misdemeanors and president of Working to Halt Online Abuse, said one concern is the cost of increasing security. "Companies like these have grown too big, too fast, and are more concerned with the bottom line than their customers, which is a shame," she said.

Purseglove disputes that. He points to the many warnings and tips eBay provides to customers. He said methods hackers use to crack accounts include:

Sending a user an e-mail purporting to be from eBay asking for private and detailed information, which is then referred to a "spoof" site, where hackers take it. He said eBay never asks for that kind of private information.

Using programs that surf through accounts trying every word until they find one that works as a password. Including symbols in a password can help thwart this.

Asked if an Internet 911 number would help, Purseglove said it has been discussed. But a potential problem is that people would use the number for non-emergencies.

Others suggest that auction sites use programs that can detect excessive attempts by hackers to crack a person's account password and then lock them out. Purseglove said that is being considered.

Still, as complaints rise, FTC officials say consumers need to check the security offered by the sites. "Some auction sites offer more protection than others," said Delores Thompson, an FTC attorney. "Consumers should shop around. "

Some consumers aren't waiting for the auction sites or law enforcement to bear down on auction frauds. They're rooting through the Internet to find the bad guys.

"They say it's a small-scale fraud," said Alan Pollack, a Los Angeles physician who sent money for one of the camcorders offered on Pilgrim's eBay account. "But when it happens to you, it's a big deal."

Pollack is part of a posse of victims who have hunted down frauds on other sites and warned bidders. They look for potential fraud markers, including opportunities to buy now at prices too good to be true and with directions to wire payment to a foreign address.

The small Internet posse has pursued the scammers who stole Pilgrim's site to what appears to be a rooming house in Nuremberg. The vigilantes recently were notified that police received their documentation and are investigating.

Pilgrim is still clearing negative feedback off his site, which has hurt his reputation as an eBay trader. He hasn't decided to stop using eBay to trade in Indian art, but he thinks the site fell short in his case.

"They've got a great system but they didn't think to install a security system that is usable in an emergency. My identity was stolen and people lost a lot of money."

Copyright © 2019, The Baltimore Sun, a Baltimore Sun Media Group publication | Place an Ad
16°