I received an email today purporting to be from the ebay security team requesting that I access my account. The email, in HTML format, kindly provided a link to a page hosted at disguised as a link to ebay’s site. Since my mail client displays messages as plaintext (making it obvious where links actually go), this was a pretty obvious phishing attempt. (Hey! Another argument against HTML email, as if we needed one.)

In addition to this and the fact that I’m paranoid at the best of times, something else helped me spot that this was a fake: I don’t even have an ebay account, and never have. So I forwarded it to spoof@ebay.com, where they recommend you send abuse reports of this kind. If you’re interested in seeing what the fake site looked like, here’s a screenshot – it’s a pretty good likeness.

Note that on the fake page, they say that you can use your “registered email” address instead of your ebay ID, which differs somewhat from the real ebay sign-in page. There are a few other minor differences, but even so when you compare the two they do look very similar. Beware!