eBay Announcement: Limit Email Lookup FAQ

Security Enhancement - Limiting Email Lookup

What change are we making to enhance security?
What features are affected by this change?
Why are we making this change?
What issues are we trying to address?
What are the main differences to the site?
Will I have to log in (using the Sign In feature) with my User ID?
What if I forgot my buyer or seller's User ID?
My User ID is the same as my email address. How will these changes affect me?
Why wasn't there prior notification of this change?
Isn't this just a way for eBay to limit open communication between members?
Why did you create the new Request User ID function?
Won't scam artists also use the new Request User ID function to look up email addresses to validate accounts?
I've been using my email address to log in (using the Sign In feature). What if I've forgotten my own User ID?

What change are we making to enhance security?
eBay is discontinuing the ability to use an email address to search for another member's information for all site features that accept a User ID. This will greatly reduce the chances of someone using "harvested" email addresses (those that were found due to people or robots copying them from web sites) to find member information. For example, on the "find members" page, previously a non-member could enter in any registered email address and be shown information about that member, including their feedback profile, trading activity or 'About Me' page.

What features are affected by this change?
All site features that accept a User ID (except Sign-In) have been changed as part of this project. Some examples include:

Feedback Profile Search
User ID History Search
About Me Search
Bidder Search
Seller Search
See Feedback Left by Member
Blocked Bidder / Buyer List
Pre-approved Buyer List
Leave feedback
Cancel Bid
Add favourite seller

Why are we making this change?
This change has been implemented to further reduce spam targeted at the eBay Community. Spam is often the source of "spoof" emails, which are fraudulent emails that appear to be sent by eBay or PayPal, but in fact are sent by scam artists to obtain passwords and other sensitive account information.

While still allowing members who are trading with each other to freely communicate through the Contact an eBay Member form and Ask Seller A Question feature, this change will prevent non-members from using harvested email addresses systematically on eBay's site to determine account validity and activity.

What issues are we trying to address?
We are virtually eliminating the ability for scam artists to systematically validate harvested email addresses through eBay. Lists of email addresses are obtained by "harvesting" them from sites by using people or computer robots to copy them, by purchasing lists or by robotically guessing. These email addresses could then be "validated" at eBay to see if a given address has an eBay account associated with it. The activity of validating an email address at eBay could yield not only the eBay User ID but other account information (feedback, dormancy, trading patterns, etc.) which allows Spammers and Spoofers to target only valid, active eBay members.

What are the main differences to the site?
Before this change, email addresses and User IDs could be used interchangeably for most features to search for another member's information (including the features identified above). Now these features will only allow you to look up another member's information with their User ID.

Will I have to log in (using the Sign In feature) with my User ID?
You can currently still use your email address instead of your User ID during Sign In. However, we plan to disallow the use of email addresses with Sign In in several weeks. We will provide more information as we approach the next phase of this effort.

What if I forgot my buyer or seller's User ID?
Members who may not remember their buyer or seller's User ID can use the new Request User ID feature to look up their User ID by email address. However, to make sure this feature is consistent with our security changes, there will be strict limitations to how often this can be used. To get to Request User ID, please visit the find members page: http://cgi1.ebay.com.au/aw-cgi/eBayISAPI.dll?MemberSearchShow#RequestUserID

My User ID is the same as my email address. How will these changes affect me?
Members are more susceptible to spam, spoof emails and account takeovers (accounts that are taken over to commit fraud by scam artists who harvest or guess their passwords) when their User ID and email address are the same. For these safety reasons, we strongly encourage these members to choose a new User ID.

Why wasn't there prior notification of this change?
In order to achieve the maximum benefit to the Community from this project, we needed to ensure that scam artists weren't able to do a mass look-up or conversion to eBay User IDs of all the email addresses in their possession before these changes were made.

Isn't this just a way for eBay to limit open communication between members?
eBay is committed to open communication between buyers and sellers engaging in eBay transactions. To ensure that our members are protected from spoof and spam emails, however, we have eliminated many of the loopholes that scam artists previously used to commit fraud. Members can continue to communicate freely by utilising these existing eBay features:

Contact eBay member
Ask Seller a Question
Request Contact information
Email display in feedback for trading partners

Why did you create the new Request User ID function?
Based on member input, we determined that there are some legitimate scenarios in which buyers or sellers may only know a trading partner's email address. For example, a seller might get an email from a buyer asking, "Have you posted my item?" with no item number and without they buyer specifying their eBay User ID. Before responding, the seller can use the buyer's email address to quickly determine what their User ID is and what specific item they bought.

Won't scam artists also use the new Request User ID function to look up email addresses to validate accounts?
This new feature has limits in place to ensure that automated "robotic" finding or copying of eBay account information cannot occur. While safe against scam artists, it also allows legitimate trading partners to find information they may need for effective communication.

I've been using my email address to log in (using the Sign In feature). What if I've forgotten my own User ID?
Until early August, you will still be able to log in using your email address. Your User ID is visible on the Sign In Welcome page, from My eBay, and in many other places on eBay. As part of this release, we have also added a new "Forgot your User ID" process, which will send the member's User ID to their email address on file.