I just had this happen to me this morning.  I called eBay and spoke to someone who said there was one specialist who's handling all of this.  She was going to transfer me to him and bring PayPal on the line and then she just cold transferred me to paypal without giving me any details, a case number or anything.

Very disappointing.

I looked at my Third Party Authorizations and I have none listed.  My eBay password and PayPal passwords are unique and very secure.  I have not been subject to phishing.  I work in IT and tech support.

Luckily, a family member runs an ebay business and has escalated this to his contacts.  I will update when I hear more.

On Sept 14, someone hacked my eBay account and set up a fake listing for a portable DVD player at around 1:55 am. A buyer purchased the item a short time later in Moscow, Russia. The listing was renewed several times and sold to the same buyer each time. I then received email notices of 42 shipping label charges, ranging from $59 to $216 each. The total for the shipping charges was almost $6,000! This was all billed to my PayPal account, which was linked to my bank checking account. PayPal saw the shipping charges as legitimate eBay shipping, and authorized the money to be sent to several recipients with legitimate sounding email addresses.

Fortunately I discovered the fraud a few hours later and notified eBay, PayPal, and my bank about the scam. They assured me that I would be reimbursed for any losses. I also closed the bank checking account immediately to prevent any actual funds from going to the fake eBay shippers. I did manage to stop the ACH transfer attempts from PayPal before any of my personal money was lost.  In addition to changing all my passwords, eBay removed the PayPal shipping authorization which allowed labels to be created without a PayPal login.  I also removed all third party authorizations and have ordered a security key to authenticate both eBay and PayPal logins.  A few days later, PayPal reversed all shipping charges to clear the large balance due on my account. 

What I find interesting is that despite my attempts to void all shipping labels from within eBay, and no actual payment of funds from me, the USPS tracking status shows packages in various states of delivery.  Packages have been dropped off in various cities in states such as TX, NJ, NY, and they are being sent to Russia and Moldova.  Who is funding these shipments, if not me?  I assume the shipping addresses are being altered so as not to be traceable, although delivery confirmation is indicated.  There seems to be no clear way to stop these shipments, once the process is initiated.

--------------------------------------------------------------------

If I had to guess, I would say they hackers are getting in via some type of cookie stealing through the long uncorrected xss flaws, or even cookie "making" via BEAST or possibly CSFR cross site forgey request, session hijacking, really any number of ways. This is one instance where I do not think they need anyone's password, nor is phishing the vector. Looks like pure hacking. Think about it... If you know where to look you'll find various new ebay/paypal scripting exploit snippets daily.

Oh yeh, one more thing in case it's not obvious. This looks like Russian hackers at work. You may want to do a litlle research. They can put some serious hurting on whatever/whoever they want, and it's a whole different attitude by them than other hacker/scammers you may have heard of. In short, ebay isn't safe, paypal isn't safe, and even less so that they're burying their head in the sand, covering their eyes, buttoning their lips, and only having secret back door customer service arrangements.

Five days ago I received 12 emails confirming over $1000 worth of international express postage I had purchased within 10 minutes for listings on my seller account.

However, I did not purchase over $1000 worth of international postage nor did I post the listings that were listed and sold for a fraction of the cost of the same titled listing that I do regularly post.

That's when the nightmare began.

I called Paypal customer support.  They answered quickly and but told me the $ would be put back in 5 to 10 business days after the cases were checked by their security dept.  I explained to them that that wouldn't work because I had an order in for supplies using the debit card on that account that would be billed the next day and I could not wait 2 weeks to get the money back.  They actually listened to me and put the $ back within 15 minutes.

Then they put me through to ebay CS.  After a 15 minute wait I was in India with a horrible phone connection speaking to someone I could not understand.  She kept referring to contacting my sellers and explaining the situation.  I kept telling her I didn't have sellers involved in this situation, that I was the seller and I had been hacked.  After 15 minutes of this I asked for a supervisor.  She said one would call me within a 1/2 hour.

Over 2 hours later an Indian supervisor called back and I was finally credited back for the "sales" but I didn't trust them to void all those shipping labels and did it myself.  She sent me a link to update my password and I did.

Four days went by and things were back to normal.  Then this morning I tried to relist an item and wasn't able to log in.  My password was not accepted.  I had also received an email that my Auctiva token was invalid again as it was 5 days ago.  So I called Ebay CS.  Someone was hacking in to my account again.

The first CS rep answered within a minute, then told me I needed to speak to another dept.  He put me on hold and after waiting for over 15 minutes and thinking about all the new charges that must be happening again on my paypal account, I hung up and called ebay CS again.

The first rep answered in less than 1 minute again (a US CS rep like the first time) apologized that it took so long to talk to the correct dept about the hack job and told me there was nothing he could do about it and I would just have to wait on hold until the correct dept could take my call.

I waited another 15 minutes again and worried about all the charges (again) that could be going on my paypal account.  Finally I was in India again with a terrible connection speaking to someone who didn't get it and I could not understand every other word out of her mouth!

She asked me if I had listed a (title left out) which is of course an item that I do list regularly, but since I could not log into my account I did not know if it WAS one I had listed or a fake one from the hacker again.  I tried to explain to her that there was no way I would know because I could not look at it because, as she knew, I could not lof into my account to see it.  I asked her what the price was, when she said $5 I knew it was not something I had listed (again).

As before she sent a link to change my password again before taking me on a wild goose chase looking at and discussing things that had no relevance to the issue.  Finally she said she would escalate my problems to the next level of security and I would receive an email in 24-48 hours.

I'm leaving out many many absurd ridiculous and frustrating parts of the phone calls with the India CS reps, but going through them again would give me a migraine.

I have no idea why this is happeneing, but the rep told me that there are many other sellers that this is happening to.

So be careful.  If I find out how this happened, I'll let you know.  I am extremely careful about clicking on links and phishing emails, so I am at a loss why it's happening to me.

hack, manipulation, whatever you want to call it....  I know this:  the crook was in eBay as ME, cloned one of my auctions, and then used another "hacked/manipulated" eBay account to Buy It Now.

Coincidentally, yesterday, my wife's eBay account was hacked/manipulated.  Not as a seller, but as a shill buyer.  She "won" five auctions for a total of $488.  I can say with dead moral certainty that she has not logged into that eBay account for months.

I am a database developer by trade.  Nobody "guessed" my password or my wife's password.  eBay must be freaked out.  Frankly, this looks like an inside job to me. 

I hate the inconvenience, but I am going to leave eBay and PayPal unlinked.  That means signing into PayPal to pay for EVERY label.  Fine.   

Just had this happen to me.  $2000 worth of labels in 45min.  I was on the phone with Paypal watching it happen.  I have my fingers crossed that it gets fixed quickly as Cyber Monday is just around the corner.