Why changing your eBay password isn’t enough after eBay was hacked

I hate scare mongering – it happens too much when the smallest security issue appears on the news radar, but I feel I have to tell you why the revelations that eBay has been compromised and user information obtained by the thugs behind this is bigger than just your password – it’s an issue of identity theft.

eBay aren’t holding back – sure it took them some time to find out, and then fix the issue, however today their recommendation is clear – change your password.

And you should – immediately. However, there’s a more important security warning I want to give you, and it relates to this information which eBay shared near the end of their email to all users.

“However” they say, the file did not contain financial information.  Frankly, I’d prefer that it did.  I’d prefer they had my credit card, expiry, postcode and CVV number – at least I could cancel that card.

What they do have are some of the most important keys to my identity.  My Address, my Phone number, my date of birth, and yes, my name.

Think for a minute just how often that information is used to verify your identity when calling a bank or other institution?  Often.

Now let’s think about one of the biggest methods of scamming – email phishing.  This is the process where scammers send you an email that looks exactly like it’s come from a trusted organisation, a bank, the tax department – PayPal.

Check your recent emails from PayPal.  They make it clear how you can detect phishing.  Their way of proving their email is genuine?  They address you by your full name.

From today, you can’t be sure even those emails are genuine.  These scammers could – with little effort, send you an email that looks just like a PayPal email, and includes your name and email address – and the big trick is when you click “log in now” you’re actually taken to a site which again, looks like PayPal, but is actually a scam site just waiting to capture your PayPal email and password which as any PayPal user knows is like a blank cheque into your credit card or bank account.

It’s a genuine risk.

So, from today, again, I warn you, never click on links in emails that take you to a “login” page.  If you do – close that window and go to the site directly.  What that means is, even if you think the email is really from the ATO, your bank, or PayPal – open your browser and type the website address for that organisation yourself.  Then you know you’re giving your details to the right organisation.