I was thrilled with the generous $4,000 bid I'd received on eBay last year for a saxophone I needed to sell. But that too-good-to-be-real offer was actually an invitation into the world of online scams.
The bidder (let's just call him Hal — not his real name) asked for my email address so he could pay me on PayPal. I gave it to him. Minutes later, I received two emails that appeared to come from eBay and PayPal telling me to ship my saxophone within 24 hours to receive payment. In effect, they were telling me to complete the sale outside of eBay.
As a first-time seller, I naively followed their instructions.
Two days later, eBay sent me an alert that Hal had just deleted his account — a telltale sign of online fraud. By that time, though, my saxophone had already arrived at Hal's home in Bassett, Virginia, a small town in the southern part of the state. When I clicked on the senders in those emails, eBay@ebay.com became firstname.lastname@example.org, and email@example.com turned into firstname.lastname@example.org.
My PayPal account was empty. I'd been.
PayPal, eBay and my local New York police department all told me, "There's nothing we can do." Desperate, I called the Henry County Sheriff's Office, which has jurisdiction in Bassett. Investigator Everett Harper said he'd drive over to Hal's and try to retrieve my saxophone.
He called me back a half hour later. My saxophone was on its way home.
The story doesn't end here, because Hal said he never had an eBay account. It turns out, he'd been scammed too. In his case, it was by an online "girlfriend" he'd never met — not even through video chats. Hal was the unwitting victim of a well-known scheme tointo forwarding items bought in their name outside the country.
That's what scammers do in a "reshipping" scheme: hide abroad and lure a middleman in the US to do their dirty work. If a victim seeks prosecution, the middleman becomes the scapegoat. Other internet scams include auction, identity theft, extortion, pyramid schemes and the infamous Nigerian prince scheme, according to the FBI's Internet Crime Complaint Center. The phrase "buyer (and seller) beware" was never more apt.
The FBI has received more than 4 million complaints of internet fraud since 2000 — more than 301,000 last year alone, when victim losses totaled $1.42 billion, according to the center's 2017 report.
Anyone can be scammed.
Adam Wandt, who teaches digital forensics and cybersecurity at New York's John Jay College of Criminal Justice, found that out firsthand when he sold his first iPhone on eBay. The scammer paid Wandt with a stolen PayPal account and then claimed he'd never received the item. PayPal reversed the transaction and charged Wandt instead.
"You would think I'd know how to avoid scams online, but I was fooled," says Wandt. "Scammers are really good at paying you with other people's money, knowing that the bank will reverse the transaction."
PayPal and eBay didn't respond to requests for comment.
Don't be a victim
Online scams all prey on careless consumers who trust the internet too much.
"I'm not sure folks understand they need to be a lot more careful online," says Ira Rheingold, executive director at the National Association of Consumer Advocates. "Counting on e-commerce companies is not a good idea. You need to do your own investigation."
Finally, know that we are our own best lines of defense. Law enforcement can't protect us 24/7. E-commerce platforms can't vet all their users. Do your research and arm yourself with knowledge before doing business with strangers.
Here are some rules you can follow to prevent falling victim to scams like I did.
• Check the score: Always look at the merchant's or buyer's score for their credibility.
• Take payment: Never ship your item before getting your money in your PayPal account. If a buyer insists that you ship first, report that person to the relevant platform.
• Compare addresses: Check the sender's email address, and compare it to the company's official email on its website. You can also search the address on Whois to see who owns that account. It's a major red flag if the owner isn't what the site claims to be.
• Compare photos: Save the profile picture that person is using on social media, then upload it to reverse image searches — such as images.google.com, tineye.com and pixsy.com — to see who the image belongs to. Just be aware these tools aren't 100 percent accurate.
• Get it back: Ask the carrier to retract the item you'd shipped before realizing you were scammed. If it's too late, call the recipient's local police department, file a report and ask them to retrieve it. Timing is important: You have to reach the local police before the middleman ships.
• Tell law enforcement: File a complaint on the FBI website. That will help law enforcement catch the bad guys if your case fits a pattern.
This story appears in the winter 2018 edition of CNET Magazine. Click here for more magazine stories.
: Not all scammers are getting smarter.
: Scam websites are using that green https padlock to fool you