Friday, June 4, 2010

Fraud on eBay and the failure of eBay to do enough to prevent it.

One of the key eBay statements was "people are basically good."

And yes, especially in the early days of eBay this was essentially true. The site was built on trust.

The problem with this is that eBay was way too slow to understand that they had become a target for crime. Listing fraud, Paypal money laundering and many other issues became a real concern on eBay.

Although eBay had, and now does use the tools to do a better job of preventing fraud, for the longest time they only worked in reaction to fraud, instead of being pro-active to stop it.

An enormous amount of the fraud perpetrated on eBay originated in Romania. Romania was a country that one had a very progressive attitude towards abortion, which was completely changed when Nicolae Ceauşescu took power. Abortions were no longer permitted, and most women were expected to be producing babies on a regular basis. Eventually what this lead to was a poor population and a lot of unwanted children, which ultimately leads to a society that relies heavily on crime. There's a lot more reading and learning that can be done on the subject, but for eBay purposes it helps to explain why so much fraud originated there.

eBay had tools that identified the IP address of an account at every stage. Sign up, log ins, bids, items listed...everything could be tracked by IP. And the one group of IPs that were literally red flagged were Romanian. Essentially ANY activity on eBay from Romania was considered suspect, and was investigated.

Romanians were heavily involved with account takeovers, where they through phishing emails they would steal someone's log in, log into their account, and list thousands of high ticket items that directed the potential buyer to transact outside of eBay. As many of these accounts were in the USA, they seemed to be safe to the unknowing member. However, there were no items, the account was being run from Romania, and it was all about fraud.

Despite this knowledge, and despite having the ability to actually BLOCK certain IP's, for years eBay refused to do so. They would react to the fraud and eventually remove the listings, but all it took was a brief amount of exposure for these listings to be successful.

Again, after allowing this to go on for years, finally eBay started blocking IP's that were known to be fraudulent. Although before this happened, I was amazed to read an email from an executive claiming that eBay didn't want to do this, because it could just be that the fraudster was using a web cafe in Romania, and eBay didn't want to block a potentially legit Romanian user from accessing the site. Compared to the amount of fraud on the site that came from Romania, the amount of legit Romanian members was microscopic.

Knowing first hand how incredibly stupid eBay was at dealing with issues like this, it was no surprise at all to read about the Romanian hacker who hacked into eBay's internal network.

1 comment: