My use of email and reference sites stretches back to near the beginning of on-line time. I recall using GE Timesharing in the 1960′s, “The Source” (predecessor to Compuserve) in the 1970s and many more long forgotten tools as they became available.
Today was the first time (that I know of) I was the direct victim of a colossal hack. Clean living (or, more likely very conservative use and a bit of luck) was the most likely cause of this long string of good fortune.
We have owned a classic American automobile for nearly 20 years. It was great fun. So much fun that we were numb to the vast sums it took to keep it reliably on the road. Several years ago we noted that the fun was waning. A few months ago we decided that we should sell it. A few weeks ago we listed it on AutoTrader and eBay.
Yesterday afternoon I received a call from a fellow in Northern California asking about the car. I described it, he asked questions and I thought I had answered them fully and accurately. A key question is price. I told him what my price was. He asked if this was as listed on Autotrader. I said yes.
Then things became a bit weird. He asked if I would be around on Friday afternoon. From his location the time to drive to our home would be about 12 hours. I becan to understand his intent. He intended to start from Northern California in a couple of hours and drive nearly straight through.
This fellow was in his sixties, maybe even his seventies. “Wow” I was thinking, that is really something. I would have done something like that 20 years ago but certainly not today, no matter how nice the car seemed to be.
So, roughly 18 hours after his first call I received another call from him. He was now nearing Phoenix and asked for more specific directions. Two hours later, roughly twenty hours after his first call, he had driven from near Sacramento to our driveway.
He looked the car over, he drove the car, then he looked the car over again. I could see he was planning to buy the car. Wow! It is usually more difficult to sell a high-dollar, classic car.
He again asked about the price. I told him it was as advertised and specified the amount. Big Frown! He then said that the Autotrader price was about 1/7th that amount. More Frowning! By both of us. I believe we were both thinking that when something seems to good to be true it probably is.
So I said, “lets go look at Autotrader.” And we did.
I could have fallen out of my chair when the Autotrader ad showed the 1/7th price. I called the Autotrader sales person who had helped me set up the ad. He checked the current ad and he checked my inputs. I had specified the right price, not the 1/7th right price.
He then explained that the Autotrader site had been hacked. A bunch of bogus emails were sent to advertisers (including me) saying that there was a message from Autotrader and gave a url. If you went to the url, or maybe just opened the email, it gave the hacker the ability to hack your ad.
I had looked at the message on my iPhone and only remember looking at the preview. In any case, apparently that was enough for the hacker to gain control of my ad. Other damage may have been done but at the very least the price was reduced by a factor of 85%.
The potential buyer stormed off. He had spent 14 of the prior 20 hours driving, would have to do it again to get home and probably will spend close to $400 out of pocket. I felt foolish, angry and disappointed since I though sure this would be a sale. Plus I really felt sorry for the potential buyer.
The folks at Autotrader had a bigger problem. There are dozens of automobile sales sites (eBay, cars.com, yahoo, edmunds and many other smaller, local or regional sites). eBay has the slickest interface and is easiest to use. I suspect it has the greatest audience. My ad on eBay hasn’t been hacked. I suspect the Ebay shields and firewalls are more robust. Also, eBay fees are primarily based on the vehicle selling. A hundred dollars out of the sales price is a lot less noticable than $100 up front as it is for AutoTrader.
The real cost will be born by AutoTrader. Such hacks could put them out of business.