Following on from yesterday’s little ditty, and jumping right back to the present days, our Mr Ghiyas just updated his FB profile. He’s now named:

Jazz Ghiasi

It’s quite likely all this ghiyas stuff is just an alias, possibly taking inspiration from a relation to a martial artist. Here’s what I recon:

Full name: Sulaiman Abu Abdul Rahim
Aliases: Jazz Ghiasi, Jaez Ghiyas, Jazz Ghiyas, Jaez Ghiasi
And appears to originate from Afghanistan.

There’s also a load of new pics. Could this one be near Keppel Road? Is the elusive Waqas Ahmed amongst them? Tune in later to find out why I’m still tailing this guy(s) months later.

EDIT: My bad – two facebook accounts.

http://www.facebook.com/Sulaiman.Abu.Abdul.Rahim
http://www.facebook.com/profile.php?id=100002816927619

Well, after thouroughly enjoying my new inspiration, I figure I should jump on yet another bandwagon. I have reason though. Funninly enough, I too enjoy the odd google. I too, given eBay’s apparent stance, find myself caught in the crosshairs of many a scammer. And I too figure it can’t be too hard to piece one and two, and three, and seventy six together. Unfortunately one thing I’m not is a lawyer. I don’t have a fancy way with words, and you won’t find amazing prose presenting factual and legally sound details. You will however discover how far one lazy kid can go to uncover just one of the many wonderfully tallented eBay INR scammers. And it all starts with them discovering me…

Firstly, let me point out all details are included as whoever’s involved in this is currently scamming their way through £1000s if not £10,000s, and may very well involve a few previously convicted criminals (hopefully), or indeed include stolen identity / account details. I’m yet to find out which, but I’ve no problems in posting details of scammers in order to prevent any further loss incurred by targets, or indeed alert any innocent victims of identity theft. But that all remains to be seen. Also, the timing of some details have been slightly moved to allow everything to make sense; at the time I grabbed as much as I could from as many sources as possible and pieced everything together later, working backwards in a way. The below should be at least somewhat legible.

On 8th April 2010 @ 19:04 BST, I get another eBay order. Specifically, for one “Blazing Angels 2 Secret Missions of WWII – PS3 Game sim”. The order was placed with the following account details:

Buyer Name: jaez ghiyas
Buyer ID: ghiyas1232011
Buyer e-mail: jaez_ghiyas@hotmail.com
Buyer’s shipping address:
Waq A
62 Keppel Road
Eastham
London, London E6 2BD United Kingdom

These details were later matched to their registered eBay info:

User ID: ghiyas1232011
Name: jaez ghiyas
City: Chadwell heath
County: Essex
Country: United Kingdom
Phone: 02089110884
Registered Since: Tuesday, 07 Oct, 2008 19:12:48 BST

Before I go on, please note the future (and previous) history of this ID; jazz65411 == ghiyas1232011:

User ID Effective Date End Date
jazz65411 04-Jun-11 Not a registered user
ghiyas1232011 23-Mar-11 04-Jun-11
jaez456 07-Oct-08 23-Mar-11

But we’ll come back to that. All of the £12.49 GBP price of the game was paid by PayPal, giving more details.

Buyer: Abdul Jaez Ghiyas
Buyer ID: ghiyas1232011
Buyer e-mail: jaez_ghiyas@hotmail.com
Shipping address – confirmed
Waq A
62 Keppel Road
Eastham
London, London
E6 2BD
United Kingdom

So, postage lables are auto printed, on to the package they go, so far so good. Jump forward a couple weeks:

The buyer opened a case: Item not received 22 Apr, 2011 at 10:53
Details provided by the buyer:
The buyer has not received the item
The buyer has tried contacting you
The buyer paid on 08 Apr, 2011
The buyer contacted you through email.
The buyer paid for the item with PayPal.
The buyer did not give permission to share a phone number with you.
Additional information:
“I haven’t recieved the item yet. It’s been longer then expected now. I should have recieved it by now if it was posted.”
The buyer wanted:
The buyer prefers a full refund.

Now I’m no eBay n00b, and anyone who prefers to jump straight in to forcing our hand by opening an eBay case gets the once over.

Let’s see if he’s tried this before, shall we?

First thing to check is the user’s feedback, including their feedback left for others. Another trick is to use eBay’s By Bidder search to uncover any of the last 30 day’s previous purchases and attempted purchases. Once you know what they’ve bought (in this case, a collection of gaming, tech and fashion) we can contact some of the sellers.

NOTE: These seller IDs are all innocent victims, be nice to them .

Seller A – INR case opened and refunded.
Seller B – PS3 game INR opened ~15th April.
Seller C – PS3 game purchased ~ 9th April, INR opened, same shipping address, some claim of “it’s not my address”.
Seller D – Mobile phone cable, purchased ~9th April, INR opened.

This being most of the seller’s contacted, things weren’t looking good. Let’s send some standard shipping details to their eBay case and see if anything jogs their mind.

You have responded to the buyer. 22 Apr, 2011 at 15:45
Your message to the buyer:
“Dear Mr Ghiyas, Your item was posted on Monday 11th April 2011 to the following address provided by you: Waq A 62 Keppel Road Eastham London E6 2BD…”

The buyer has responded to you. 22 Apr, 2011 at 15:48
Buyer’s message:
“That’s not my address? so please refund my money back”

Funny, that. Another classic sammers trick is to provide some excuse as to why they must be refunded immediately. I guess this guy just doesn’t bother with the small talk. So off to Google we go, like a mother… thing.

=========

Let’s start by going back to their feedback. So, Mr Ghiyas / Waq A, when did all your stuff start going missing? Well, around the beginning of 2010 their feedback left starts becoming somewhat drowned out by feedback received. Here’s a tip: Most scammers don’t leave feedback for sellers, either positive or negative, so there’s little record of it on the site. Most sellers leave automated feedback as soon as an item is purchased, and don’t bother to update it should anything go wrong.

In June 2010 we see the first sign of trouble posted by a seller:

Be carefull did not pay for the item he won! Had report it unpaid. Seller 01-Jun-10 17:16
Apple iPhone 3GS (16 GB) Black Cell Phone UNUSED (#110534800347)

But Jaez / Waq does not just buy, he sells aswell:

Cheap copy without license key sold as new, sealed! Buyer 03-Jun-10 15:13
windows 7 ultimate 32&64 4 in 1 DVD (#270586473167) £60.00
Not Genuine …a copy with no serial number Buyer 03-Jun-10 14:02
windows 7 ultimate 32&64 4 in 1 DVD (#270586473167) £65.00

And after a spate of selling a few unlocked iPhones, I guess he ran out and needed another…

WAST OF SPACE TOTAL PRAT NON PAYING BIDDER YOU WIN YOU PAT YOU IDIOT !!!!!!!!!!! Seller 30-Jun-10 22:57
Apple iPhone 3GS (16 GB) Black Cell Phone (#300430534996)

Meh, maybe not. So what other eBay activity does Mr Ghiyas involve himself in? Unfortunately many of the following links are dead, but I’ll fill in the blanks.

http://cgi.ebay.it/FREE-GAME-PSP-GO-3000-2000-1000-firmware-6-20-6-31-6-35-/270723794681 – Piracy Chip, “ONES YOU INSTALL THE SOFTWARE YOU CAN DOWNLOAD 10000 OF GAMES OF INTERNET FOR FREE”
For sale by: ghiyas1232011

Sounds legit. Anything else?

http://cgi.ebay.co.uk/ws/eBayISAPI.dll?ViewItem&item=270695744169 – TOYOTA COROLLA 1.4 T2 VVTI 2003 SILVER – sold by user “ghiyas1232011″

In to cars, is he? Oh and a phone number to contact you on? 07956387567 . And collection from “Manchester”?!? Well, that’s interesting, because a quick google of that phone number…

AUDI A3 SPORT RED 1.6 Five Door (#320651812009)

Another listing for another car, with a very similar layout, similar spelling mistakes, similar wording “Very Clean car inside out”, and that same phone number listed as contact details. But wait, this isn’t a sale by ghiyas1232011, oh no, this is by homesick_60, but with Mr Ghiyas’ same details and clearly same listing style. Could it be an alternative ID? Hang on, what’s this in ghiyas1232011′s feedback received?

100% good Communication – 100% Ebayer Seller: homesick_60 ( Feedback score of 44) 05-Mar-11 22:39
AUDI A3 SPORT RED 1.6 Five Door (#320651812009)

An item sold by presumably the same user as was selling on the ghiyas1232011 account, leaving feedback on the ghiyas1232011 account. Why would one do that, unless one were shill bidding and padding some feedback? Why indeed.

http://cgi.ebay.co.uk/ws/eBayISAPI.dll?ViewItem&item=320656780876 – AUDI A3 SPORT RED 1.6 Five Door – sold by user “homesick_60″

Oh look, it’s been re-listed. Damn those shill bidders, they never pay up. Apparently relisted as the “buyer couldn’t be bothered to travel from london to collect it”. Orly. An “in” joke?

Feedback from Jaez to Homesick:

100% good Communication – 100% Ebayer Buyer: ghiyas1232011
AUDI A3 SPORT RED 1.6 Five Door (#320651812009) £1,220.00

Funny, both seemingly annoyed at this lack of payment, yet both leaving positive feedback. And is that feedback somewhat familiar? Lets see what else this Homesick / 07956387567 / car dealer is up to.

http://cgi.ebay.co.uk/1994-NISSAN-MICRA-WAVE-BLUE-/320689304892 – 1994 NISSAN MICRA WAVE BLUE – sale by homesick_60
http://cgi.ebay.co.uk/2003-SKODA-OCTAVIA-CLASSIC-SILVER-/320689294072 – 2003 SKODA OCTAVIA CLASSIC SILVER – sale by homesick_60

Both current sales as of 2nd May 2011, both listed as local in Manchester, both with 07956387567 as contact number, bother with very similar layout / wording to the other sales.

And, unsurprisingly, plenty of bids on other sales from new users. Such as “1***g ( 95 )”. That would be more shill bids from “ghiyas1232011 (95)” backwards and starred out, then. For security, like.

But as with all good sellers, he doesn’t restrict himself to eBay’s empire. Oh wait…

Gumtree. Printers. Another car. http://manchester.gumtree.com/manchester/25/74255125.html . The owner is listed as “M”, “Mur” or “Murd” of the Cheetham Hill area (seemingly close to a Layton Decorating Centre as seen in some images), and that same mobile number.

So who is this homesick_60? Any chance he likes the ID so much, he uses it elsewhere?

http://groups.yahoo.com/group/suhm/message/865?var=1
“HAA!!! These hindus will soon burn in fire worse then this for the unforgivable sins (shirk)…rmmber….We dont worship cows, WE EAT ‘EM!!!”

A lovely bit of racism, once fowarded to, oh yes…

Another disclaimer: If this scam involves ID theft, the following well educated individual could be entirely innocent. Or much thicker than his education would emply.

homesick_60@hotmail.com
http://www.facebook.com/profile.php?id=503539691

Murid Sak
Studied BEng (Hons) Engineering at: Kingston University 2008
Secondary school: Newham Sixth Form College
Activities and interests: WikiJob, The University of Manchester Careers – School of LLC, Muslim

And yet, the same e-mail:

http://www.myspace.com/148071638
“haroon”
Zodiac Sign: Scorpio

A man with few friends. One, in fact.

http://www.myspace.com/d3sire_x
Hometown: Iltownnnn

According to Google, “Iltown” is infact Slang for Ilford. A town on the boarder of Essex and East London. But we’re getting off track. So lets get even further off track and jump forward to the present day.

http://www.google.co.uk/search?q=07956387567

More cars, more similar layouts, more “single lady owner”‘s (does our murid like to cross-dress?), more contact of “M” on 07956387567 for collection in Cheetam Hill, Manchester. Amongst the sales of tech, but mostly cars and car parts, one shows a location…

http://maps.google.co.uk/?ll=53.49379,-2.23516&spn=0.00517,0.033023&t=m&z=16&vpsrc=6&layer=c&cbll=53.493792,-2.235168&panoid=Y27-Q2T-A3XoLKseWEVOQQ&cbp=12,189.6,,0,6.21

Collingham Street, Cheetham Hill, Manchester. A small industrial street, featuring a small Auto Repair store – Z Cars Auto Services. Could be a lead. This deffinately is:

http://www.gumtree.com/p/for-sale/epson-stylus-sx125-all-in-one-printer-with-individual-inks/87661528

Now listed with a location near the bottom of Smedley Road. Looks like we found the “shooting” location for a previous car sale…

http://maps.google.co.uk/maps?q=Cheetham+Hill+Road,+Manchester&hl=en&ll=53.503863,-2.227129&spn=0.001433,0.004128&sll=53.49568,-2.21087&sspn=0.022798,0.066047&vpsrc=6&t=m&z=19&layer=c&cbll=53.503787,-2.227036&panoid=i3N6IqZ1-JbPX-RJs331Ig&cbp=12,19.03,,0,6.2

http://www.gumtree.com/p/cars-vans-motorbikes/bmw-320d-se-blue-one-yr-mot-5-months-pvt-plate-diesel-price-reduced/83231193#gallery-item-full-4

Is Mr Sak a resident of Smedley Road? Is he connected to Mr Ghiyas? Are either of them connected to “Waq A” or any of the eBay scamming? Lets get back to eBay.

User ID Effective Date End Date
homesick_60 13-Jan-04 Present

http://www.ebay.co.uk/itm/2007-NISSAN-NOTE-SVE-BLUE-MOT-RD-Tax-Full-service-Hi-/320750864848

Seems to get through a lot of cars this lad, some of which aren’t all they appear to be. But lets leave Mr Sak for now, and go back to Jaez / Waq A.

=========

Jaez Ghiyas. What do we have, aside from links to a Manchester car dealer who likes to use Jaez’s account for some shill bidding?

02089110884.
020 is a London area code.
8911 is an Ilford area code. Ilford? Go figure.

Address is 62 Keppel Road, Eastham, London, E6 2BD. That’ll be, next door to Ilford / Chadwell Heath then. Here’s 62. Home to our scammer?

http://maps.google.co.uk/maps?q=E6+2BD&hl=en&ll=51.534924,0.055382&spn=0.011439,0.033023&sll=51.551139,0.081024&sspn=0.091478,0.264187&vpsrc=0&gl=uk&t=m&z=16&layer=c&cbll=51.534854,0.055426&panoid=vYvFH8etbr7f5JZZSL-aMg&cbp=12,82.4,,0,-1.58

Then there’s the user ID/s: jazz65411, ghiyas1232011, jaez456
And name: Jaez Ghiyas (not too popular?).

http://twitter.com/#!/jaez121
Jaez Ghiyas
@jaez121
Medical Student & pc hacker

An interest in cars, tech and iPhones? A user ID of jaez121 ?

http://www.thestudentroom.co.uk/member.php?u=381774

A student in London doing a masters in Surgery?

http://www.formspring.me/jaez1

A stethoscope?

Well, we also have, of course, jaez_ghiyas@hotmail.com.

http://www.facebook.com/Sulaiman.Abu.Abdul.Rahim

Note that originally, this profile had the same image as currently on the Formspring profile.

Jaez Ghiyas
aka. Sulaiman Abu Abdul Rahim
Staff Surgeon at Royal London Hospital
Studied MEDICINE MBBS M.D at King’s College London
Employers: Royal London Hospital, Staff Surgeon
University: King’s College London MEDICINE MBBS M.D
Secondary school: Leyton Sixth Form College School year 2010
Normanhurst School School year 2008
Interests: Medicine, Islamic studies, History, Knowledge

I like Knowledge too, Mr Ghiyas. Do you know what this knowledge gave me, before you so rudely privated your page details? Your “Friends”.

Waqas Ahmed

Now, unfortunately as I’m writing this, said privatisation of Ghiyas’ friends list leaves me a little lost, however I’m pretty sure Waqas also listed himself as a pupil at Leyton Sixth Form College School, or otherwise from the Leytonstone area. At this point, I’m gonna take a wild leap, and guess a facebook profile.

http://www.facebook.com/WaxAhmed

Same name, lives in London, supports Man U, enjoys a bit of videogaming. At least that fits.

http://www.google.co.uk/search?q=Waqas+Ahmed%2C+leytonstone

http://www.newsinsurances.co.uk/blog/fsa-bans-two-leytonstone-insurance-brokers-for-concealing-criminal-record/016910531#

Now, I’m not suggesting that Waqas Ahmed Siddique, criminal mastermind and insurance broker, of the Leytonstone area, is the same Waq A as we originally encountered. But hey, this is the internet, everything’s connected .

=========

Anyways, time to get back to the actual eBay scamming, a couple weeks after their claim of an incorrect address.

The buyer has escalated the case to Customer Support. 02 May, 2011 at 13:24
Customer Support reviewed this case and has put it on hold because we are doing more investigation to make a final decision. 02 May, 2011 at 20:25
Customer Support has refunded the buyer and debited your PayPal account for reimbursement. The case is closed. 06 May, 2011 at 03:37
Reimbursement information: A reimbursement amount of £12.49 has been debited from your PayPal account. View PayPal transaction – opens in a new window or tab
Final decision: This case has been decided in the buyer’s favour.

Well that figures. Especially given I didn’t reply. I rarely waste time on scammer. Because of them, sure, but not on them. Instead, I sped my time filing reports with eBay, PayPal and Manchester Trading Standards, the latter of whom kindly informed me any shill bidding would be a criminal matter and therefore not their forte. The other two, well…

A few weeks later, after repeated e-mails to certain eBay employees, around May 4th ghiyas1232011 is finally NARUd (kicked off eBay) At least some action from some authority. But wait…

ghiyas1232011 23-Mar-11 – 04-Jun-11, jazz65411 04-Jun-11 – …

You mean, a month later, you allowed them back on, let them change user name, and allow them to pottentially continue commiting fraud? Geez, a young man could take advantage of this situation. And oh, how much advantage there is to take…

TBC

http://www.popehat.com/2011/09/18/anatomy-of-a-scam-investigation-chapter-five/

/\ How to bring down a business scam. Which got me thinking, how much evidence can I gather up against my new favourite eBay scammer? Let’s see… TBC.

Been meaning to review this thing for some time, putting it off due to a pretty much state-the-obvious stance, but they say a picture paints a thousand words and I now have a few pretty ones for you.

Background reading: MyCE’s info on PI/PO/Jitter tests, the important bits of which are:

PI (Parity Inner): No larger areas on the disc should exceed 280 PI-8 errors, do not worry too much about high single spikes that exceed 280.
PIF (Parity Inner Failures): No larger areas on the disc should exceed 4 PIF-1 errors, do not worry too much about high single spikes that exceed 4.
Jitter: An average jitter value of 8% or less is considered very good. You should not worry too much if the average value is slightly above this figure.(9% – 12% = average, 12%+ = poor).
The Parity Outer stage is performed next and will detect and attempt to correct any errors that are still left after the PI stage. Any column that has errors is counted as a Parity Outer Error (POE), and any column that has un-correctable errors is counted as a Parity Outer Failure (POF). If a POF occurs the drive can sometimes re-read the problematic spot and correct the problem; this happens only during normal reading and not during scanning, however.

Well now we’re all informed, I’ll just skip the nonsense and get to the graphs, and explain later if you don’t get the message very quickly. And apologies for the size of some; they’re not resized from my screen res but make them easy to compare. As such, hit more, cos there’s lots of stuff to bore your bandwidth with.

(more…)

Just encountered this posted by another user on the eBay Powerseller boards:

I phoned ebay and the rep on the other end told me’ It is normally better to open a item not arrived rather than [an Item Not As Described case], as if it hasnt arrived you can get a full refund, as if you open a wrong dispute it costs you to post it back.’

Unverified, but I wouldn’t be surprised. Might explain why there’s so many users making fraudulent INR claims.

Just added a captcha to comments, meaning no/less spam, meaning all posts have now been opened up for commenting (not just the last 75 days worth). Now lets see how many people really read this blog

A quick one too.

Store A) Pick a game off the shelves, take it to the (very stressed looking, just off the phone to Parcel Force complaining they hadn’t delivered a parcel, then complaining that the number had routed them to someone who didn’t know how to find the parcel, then giving up on the parcel altogether and slamming the phone down, as if you’d give your customers the time of day if they acted like that) sole employee, who takes said game and continues to root through every boxed copy available to pick out the *worst* condition one available and sell that. Even downgraded it to a re-release version too. Marvelous.

Store B) Pick a (popular yet surprisingly cheap) game off the shelves, watch as the (always happy despite minute customer levels) sole owner verifies it is indeed the GOTY edition despite standard looking contents, then explain how it’s actually priced at the standard edition rate as they felt the GOTY was stupidly expensive anyway. Makes sense now.

What a difference crossing the road can make. No names, no enemies

Next time, a tale of how a simple flourescent pen makes the difference between millions of successful orders and one ditched supplier. Oh yes, they fucked up *another* one.

Q2 2011, iG now eBay UK’s 12th largest video game seller by sale volume. As my colleague says, time for the helicopter delivery and TV advertising. And christ, the entire stock is still only two shelving racks large. Who the hell are these other 11 sellers and how lazy are they if we can get 12th place off of a <400 sq ft office? Meh. Gotta go do more listing work. Single digit ratings await… And another plus, we ain’t been looted yet. Geez if no one else bothers I’ll loot the damn place myself, a kid can feel left out you know?

Now to find something it’ll actually work with instead of just scanning the config codes to change the beep tone

According to eBay’s latest seller report mailout, iG is eBay’s 25th highest ranking UK video game seller by volume. Wonder who the other 24 are…