hacking yahoo mail at Sky

Not perhaps a Sky BB problem in itself - but I think relevant to many Sky BB users.
I recently got a bill from eBay, asking for payment for an item, purchased on an account that was not mine. This account had been opened using my sky email address - which has never been used : it is only known to me and sky admin. Sky tell me that they do not sell email addresses and I accept this. Sky have been involving their customers with yahoo mail, recently, and the eBay issue is coincident with this activity. The "leak" or "hack" seems to me a vulnerability in the new system they are implementing - their tech people said they have had engineers working on a myriad of problems over the last month or two - but categorically deny a "vunerability " exists.
Any thoughts/experiences from other Sky users? Cheers, Les.

Is the sky address random letters/numbers or is it a relatively sensible name/word?

If it is something relatively readable then it could just be a mistake by the user and they may have miskeyed the address. I don't believe that to be a Sky issue.

I would say the issue here, if that was a real email rather than spam, is eBay. eBay should not accept an account email without verifying it first - and that is usually by sending a verification/activation link to the email address which unless someone has hacked the account they would not be able to access.

Either it is spam and therefore probably random email address selection or it is an eBay problem with the way they accept addresses for accounts.

More than like a phishing attempt, using "random" email addresses.

I've had several of these in the past, asking for payments for goods that I have never bought.

If you still have the email it might be interesting to see where the reply address actually goes (a fake eBay sign on screen may be a good bet).

But almost certainly nothing to do with Sky, or accounts being hacked.

Edited by deleted (Fri 03-May-13 10:46:11)

Thanks for the reply reply - but not, I think, a "normal spoof or phishing" exercise.
The eBay account was actually opened, and an item purchased by "lewis4099" who had opened a fresh account in the name of lewis king ( I have no problems stating that, as it has now been removed from my Sky account). He used the name "lewis king" to open the account, and then reneged on the transaction. The point I have made is that the details "lewis king" & the email address "[email protected]" could only have been culled from Sky itself, as the address has never been used in the public domain, since being generated by Sky many years ago. I have never used it, to allow it to be in the "air". The odds against someone having both the email address AND the name (incidentally, my father's middle names) generated "randomly" is, I think, massive. The only way that the two pieces of information could be accessed together, I would think, is that customer details have somehow become available from Sky - which is why I point to the recent email issues many, many people are currently having with Sky.
Thanks, anyway, for your thoughts, but I still feel other Sky users might be compromised. Cheers, Les.

Hello Ian, I agree with your point about eBay verifying email addresses, but the fact is they didn't.
I cannot see how the problem came from eBay's side, as the setter-up of the bogus account had to have both my sky address AND my username on Sky: neither has been in the public domain - ever. The email address was set up by Sky, donkey's years ago, and has NEVER been used.
Any other thoughts as to how someone had access to both my email address AND my username? As I said, in no way you eBay be the instigators of the problem, as they certainly never knew either of the details mentioned, before the fraudulent account was set up. Cheers, Les.

Hold on. So someone used the name "lewis king" and email address "[email protected]"? How is that difficult to make up that the name and email address match? Ever considered that maybe someone actually called Lewis King did it accidentally rather than maliciously? I'm not sure how it is much of a leap to connect those 2 pieces of information together? Doesn't require anything from sky.

If the name and the email address weren't related (ie the email was completely different) then I could see it would be a leap but on your example there is no leap to make. I strongly think this is user error on behalf of the person that created the account.

But, even then eBay should have a way of confirming the email address belongs to the person if it will be used in any way to hold that person to account.

Another thought - trying to eliminate possibilities -

You say the Lewis King name and email have never been used (outside Sky) but is the name and email address stored in your pc (or wherever) address book ?

Edited by deleted (Fri 03-May-13 14:04:48)

In reply to a post by ian72:

Hold on. So someone used the name "lewis king" and email address "[email protected]"? How is that difficult to make up that the name and email address match? Ever considered that maybe someone actually called Lewis King did it accidentally rather than maliciously? I'm not sure how it is much of a leap to connect those 2 pieces of information together? Doesn't require anything from sky.

I've seen it happen whereby someone tries to set up an address e.g. [email protected], but it's taken, so they create [email protected]. They later, when signing up to something, forget about the extra "1" and use [email protected]. But of course that's just an honest mistake.

If the "secret" email address was [email protected] then it's much more likely the address was leaked out somehow.

In reply to a post by ian72:

But, even then eBay should have a way of confirming the email address belongs to the person if it will be used in any way to hold that person to account.

As an Ebay user I can assure you that an activation link/confirmation code is always sent when opening an account or changing the registered email.

One purchase of £5 of Lego Stars Wars and no selling - a little strange...?

That profile may not be so strange... So far I've had an ebay account for about 4 years and bought 1 set of batteries and a suez canal badge. Never sold anything on there (ebay only used as an expedient to get difficult to find items).

In reply to a post by ian72:

That profile may not be so strange... So far I've had an ebay account for about 4 years and bought 1 set of batteries and a suez canal badge. Never sold anything on there (ebay only used as an expedient to get difficult to find items).

But as far as I know, you didn't hack into an email, assume another identity and fail to pay...

Hi again, No, it's not anywhere other than in the Sky system: I've never
used it, as I always used outlook express (Windows mail 2012 now) and
Thunderbird occasionally. This email was forwarded to me from my sky
account, but it is the only one I've ever had forwarded because, as I say,
the address was dormant and never used. Not on pc (other than accessible
should I log into my Sky account - and no-one but me can access Sky for
obvious reasons). eBay are at some fault because I think they should verify
new account email addresses provided, but someone had to have the address -
and user name "lewis king" - which only I and Sky have ever seen.
Cheers, Les.

Hmm, As I've said to Ian & HTTP, the emails are genuine - from eBay. They have confirmed an account was opened up using my email address. NO request for confirmation came from eBay regarding said account (I opened my OWN eBay account up over 12 years ago, and don't remember if I was ever sent a request for confirmation of same). This bogus buyer has not gone through with the transaction, which actually exists - the seller says he cannot contact the buyer. Obvious, as it's my address and I haven't responded by pressing "pay now". I still think the vulnerability is with Sky - despite other posters trying to persuade me that it is perfectly reasonable for there to have been an error on the part of a legitimate "buyer": were that to be so, then said buyer would rectify the problem - and they haven't. They've just disappeared over the horizon! The comment about there must be other Lewis Kings at Sky is possibly true - I suppose - but if it was all innocent, then the REAL Lewis King would have come forth.
No, nowt is going to persuade me that there's not a problem at Sky - along with all the others that are "being dealt with" there.
As and when others find themselves in my position - if they choose to tell others about it - perhaps Sky will concede that there is a problem that needs attention. Thanks, all, for the replies. Cheers, Les.

In reply to a post by lelboy:

but if it was all innocent, then the REAL Lewis King would have come forth.

Not if you are getting his emails.

Touche - to a degree!
Do you not think the real Lewis King would have rumbled by now that he'd messed up, and then done something to rectify the situation. The seller tells me that he's had no contact from "Lewis King" - with whatever email - so has closed the sale.
Why are other posters so intent on debunking my notion - and making excuses for Sky and a mentally defective "Lewis King?
Bizarre! Cheers, Les.

I just think someone entered your email address into ebay by mistake. If someone were to hack your email address, they are much more likely to send out a ton of "enhancement pill" spam and the like, rather than buy an item on ebay and not pay for it, don't you think?

I'm sceptical because I see no gain by the other party. Entering the wrong email address is easy and maybe they just think eBay have screwed up. You seem a little paranoid to think this is some great cockup by sky.

Ha, paranoia is alive and well in Beckton? I think not.
There have been so many issues recently with Sky and their "yahoo" venture: this has been confirmed to me by their retentions dept - on the phone. Were this eBay episode to have happened at any other time, I'd dismiss it as "one of life's mysteries", but I don't believe in coincidence, and at this moment in time Sky ARE having email issues. That's about all I can say, really.
Cheers, Les.

In reply to a post by lelboy:

There have been so many issues recently with Sky and their "yahoo" venture: this has been confirmed to me by their retentions dept - on the phone.

Yes, and I think this is making you eager to jump to conclusions.

Now, if someone had actually logged into your email account and sent mail out, it would be a whole different matter.

Hello again, I think I and the other posters are going to have to agree to differ.
My conclusion was made before I spoke to Sky - that's why I did!
Can only repeat so many times - if the "user" of my email had made a mistake, then it appears to me that he'd rectify it: the "seller" says he hasn't, so ergo there's something dodgy. My original post merely asked whether others had experienced anything similar, and I didn't expect to be castigated because of my caution and concern. All too many times folk have been slack in dealing with potential problems - which is why phishers and scammers continue: there's always a supply of inattentive people who find themselves in dire straits because they chose not to look deeper into suspicious activity. I'll close now, as from my perspective, I'm going nowhere.
Cheers, Les.

Ok, sounds like the seller understands the situation and that's the end of it, hopefully.

Edited by Oliver341 (Sat 04-May-13 21:41:14)

I've never sold anything on Ebay either and that's in 10 years.