The problem takes advantage of the ease with which one can send an email and "appear" to be someone else - i.e., "spoofing". You simply change the settings on your email program and you can be the Prime Minister of England - or whatever. Worse yet, you can send an unobtrusive administrative message from eBay or PayPal asking the unsuspecting recipient to respond by filling out a form with their username and password. Once collected, the fraudulent sender can obtain and take advantage of their account to transfer money, buy goods, or perform other transactions such as selling illegal or stolen items.

eBay and PayPal have issued warnings that such messages are not broadcast to generic recipients such as "Dear PayPal customer:". Instead, they directly address messages to the recipient.

Any messages received from online auction or credit card companies should be examined with scrutiny, and should not directly request your entry of password information to "validate" your account. Spoofing is an unfortunately easy way to obtain your identity or, literally, steal money from you. Consequently, DO NOT respond to such messages with your username, passwords, Social Security Numbers, or other information that can be used to falsify your identity.

Detailed information on Spoofing can be found at http://www.cert.org/tech_tips/email_spoofing.html