hacking yahoo mail at Sky

Not perhaps a Sky BB problem in itself - but I think relevant to many Sky BB users.
I recently got a bill from eBay, asking for payment for an item, purchased on an account that was not mine. This account had been opened using my sky email address - which has never been used : it is only known to me and sky admin. Sky tell me that they do not sell email addresses and I accept this. Sky have been involving their customers with yahoo mail, recently, and the eBay issue is coincident with this activity. The "leak" or "hack" seems to me a vulnerability in the new system they are implementing - their tech people said they have had engineers working on a myriad of problems over the last month or two - but categorically deny a "vunerability " exists.
Any thoughts/experiences from other Sky users? Cheers, Les.

Is the sky address random letters/numbers or is it a relatively sensible name/word?

If it is something relatively readable then it could just be a mistake by the user and they may have miskeyed the address. I don't believe that to be a Sky issue.

I would say the issue here, if that was a real email rather than spam, is eBay. eBay should not accept an account email without verifying it first - and that is usually by sending a verification/activation link to the email address which unless someone has hacked the account they would not be able to access.

Either it is spam and therefore probably random email address selection or it is an eBay problem with the way they accept addresses for accounts.

More than like a phishing attempt, using "random" email addresses.

I've had several of these in the past, asking for payments for goods that I have never bought.

If you still have the email it might be interesting to see where the reply address actually goes (a fake eBay sign on screen may be a good bet).

But almost certainly nothing to do with Sky, or accounts being hacked.

Edited by deleted (Fri 03-May-13 10:46:11)

Thanks for the reply reply - but not, I think, a "normal spoof or phishing" exercise.
The eBay account was actually opened, and an item purchased by "lewis4099" who had opened a fresh account in the name of lewis king ( I have no problems stating that, as it has now been removed from my Sky account). He used the name "lewis king" to open the account, and then reneged on the transaction. The point I have made is that the details "lewis king" & the email address "[email protected]" could only have been culled from Sky itself, as the address has never been used in the public domain, since being generated by Sky many years ago. I have never used it, to allow it to be in the "air". The odds against someone having both the email address AND the name (incidentally, my father's middle names) generated "randomly" is, I think, massive. The only way that the two pieces of information could be accessed together, I would think, is that customer details have somehow become available from Sky - which is why I point to the recent email issues many, many people are currently having with Sky.
Thanks, anyway, for your thoughts, but I still feel other Sky users might be compromised. Cheers, Les.

Hello Ian, I agree with your point about eBay verifying email addresses, but the fact is they didn't.
I cannot see how the problem came from eBay's side, as the setter-up of the bogus account had to have both my sky address AND my username on Sky: neither has been in the public domain - ever. The email address was set up by Sky, donkey's years ago, and has NEVER been used.
Any other thoughts as to how someone had access to both my email address AND my username? As I said, in no way you eBay be the instigators of the problem, as they certainly never knew either of the details mentioned, before the fraudulent account was set up. Cheers, Les.

Hold on. So someone used the name "lewis king" and email address "[email protected]"? How is that difficult to make up that the name and email address match? Ever considered that maybe someone actually called Lewis King did it accidentally rather than maliciously? I'm not sure how it is much of a leap to connect those 2 pieces of information together? Doesn't require anything from sky.

If the name and the email address weren't related (ie the email was completely different) then I could see it would be a leap but on your example there is no leap to make. I strongly think this is user error on behalf of the person that created the account.

But, even then eBay should have a way of confirming the email address belongs to the person if it will be used in any way to hold that person to account.

Another thought - trying to eliminate possibilities -

You say the Lewis King name and email have never been used (outside Sky) but is the name and email address stored in your pc (or wherever) address book ?

Edited by deleted (Fri 03-May-13 14:04:48)

In reply to a post by ian72:

Hold on. So someone used the name "lewis king" and email address "[email protected]"? How is that difficult to make up that the name and email address match? Ever considered that maybe someone actually called Lewis King did it accidentally rather than maliciously? I'm not sure how it is much of a leap to connect those 2 pieces of information together? Doesn't require anything from sky.

I've seen it happen whereby someone tries to set up an address e.g. [email protected], but it's taken, so they create [email protected]. They later, when signing up to something, forget about the extra "1" and use [email protected]. But of course that's just an honest mistake.

If the "secret" email address was [email protected] then it's much more likely the address was leaked out somehow.

In reply to a post by ian72:

But, even then eBay should have a way of confirming the email address belongs to the person if it will be used in any way to hold that person to account.

As an Ebay user I can assure you that an activation link/confirmation code is always sent when opening an account or changing the registered email.

One purchase of £5 of Lego Stars Wars and no selling - a little strange...?

That profile may not be so strange... So far I've had an ebay account for about 4 years and bought 1 set of batteries and a suez canal badge. Never sold anything on there (ebay only used as an expedient to get difficult to find items).