International cyber scammers are targeting Trade Me accounts in a two-tiered identity fraud to try to fool gullible New Zealanders.
Con artists from Indonesia, Nigeria and eastern Europe are sending "phishing" emails to Trade Me users, pretending they are from the online auction site and asking for personal details.
Bethlehem woman Claire Warren was sent a scam email on the weekend, which appeared to be from TradeMe.
"It said that there had been three unauthorised attempts to access my account [and] even gave IP addresses for those attempts,'' she said.
So she logged into her TradeMe account and contacted the support centre, who responded and said the email was a scam.
"[I] just thought people should be warned about this,'' she said.
By clicking the link embedded in the email, information is sent to the fraudsters, which gives them control of the user's account, a technique commonly used to obtain banking details and drain accounts.
But in this scam, the overseas criminals hijack Trade Me accounts to post fake sales listings on the website using the genuine identity.
Buyers who show interest in the fake sale are asked to contact the "seller" by phone or email.
At that point, the scammers try to con the Trade Me member with an array of confidence tricks such as trying to convince them to be a "money mule" and shift cash for them.
The head of TradeMe's security team, Jon Duffy, said none of the website's members had lost money in scams.
"We're pretty good at stopping this sort of thing. Most of our members are based in New Zealand, so a red flag goes up when a foreign IP address is used.
"There are proxies that mask [the true IP address] but we've got good technology to detect that too."
Mr Duffy said the "multi-layered" phishing attack showed the lengths to which cyber criminals would go.
Police say criminal groups worldwide are increasingly turning to cyber-crime and identity theft.
Ministerial briefing papers obtained by the Weekend Herald under the Official Information Act show that despite the rigorous Trade Me security, the police were concerned that criminals could hide their identities and trade illegally,
including by:
* Advertising goods for sale that do not exist, and taking payments.
* Selling stolen property.
* Running small businesses and avoiding tax.
* Selling chemicals that could be dangerous when mixed.
However, the papers said "on-line trading is most vulnerable to identity-based fraud", as there was no requirement under the Second Hand Dealers and Pawnbrokers Act for internet auction sites to make members provide photo identification.
Common identity scams on Trade Me include the use of multiple identities and false information to create accounts.
When one identity is shut down, another is created, using an address taken from a phone book in another town.
Trade Me and the police have a close working relationship and signed a memorandum of understanding in 2005 - the first such police agreement with a commercial enterprise - which allows information to be shared under the Privacy Act.
Nearly half the 2000 police requests for information each year related to stolen goods.
Of those, Mr Duffy estimated, 10 to 15 per cent resulted in "further action".
While members did not need to provide photo ID, Mr Duffy said, Trade Me could restrict accounts if suspicions were raised and those members were asked to provide identification.
Other security techniques enabled his team to detect when multiple accounts were created by one person.
He said "low-end fraudsters" created accounts with false names and sold goods that did not exist but Trade Me worked closely with the police in such cases.
"I can't recall an instance when we haven't been able to identify the person committing the fraud. Typically we follow the money."
Another scam happens when interested buyers leave their cellphone numbers in the Q & A section of a sale listing - in breach of Trade Me rules.
A fraudster can see the number without having to be logged in, and can then call the interested buyer pretending to be the seller.
"If someone wants to take you off our site to conclude a transaction, that should be a warning sign," said Mr Duffy.
Online trickster
An Auckland woman conned $46,000 from online traders for iPads and iPhones that did not exist.
Aaliyah Elmira Rafiee, 25, called prospective buyers on Trade Me and Sella and offered the Apple products at a cheap price.
She targeted those who left contact details in the question section of the auction, then arranged the sale away from the site.
More than 30 Trade Me members were swindled out of nearly $30,000 when the goods did not arrive.
Rafiee pleaded guilty to 59 charges of obtaining by deception and accessing computers for dishonest purposes.
She will be sentenced in the Auckland District Court in November.