Why does Paypal (and Ebay) allow people to create and transact on accounts and not validate the email address used at signup?
I own a domain name say mydomain.com.
Some random fraudster Tom signs up to PayPal (or eBay) with the email address tom at mydomain.com
Neither PayPal (or eBay) validates that Tom is the owner of tom at mydomain.com and allows Tom to start selling non existent goods on eBay or other sites. Tom takes as much money from people before they start contacting Paypal asking for their money back but Tom has already taken that money out.
Now I start to get a barrage of angry customers emailing tom at mydomain.com because I am the person that all email to at mydomain.com goes to.
If PayPal simply verified email addresses prior to allowing people to transact, then there would be less fraud.
What is the easiest way to stop people using my domain to sign up to PayPal (and eBay)?
I can't think of any.
I have just tried to auto forward all emails from tom at mydomain to spoof at paypal.com but that will probably result in me getting more emails of confirmation thanking me for sending the email.
