eBay's take on this is that the account theft is the result of phishing, not hacking. eBay also say's members should check their message queue from eBay.

eBay members should always check their "My Messages" queue to verify any e-mail from eBay concerning their account. "If an e-mail affects your eBay account, it's in My Messages. If you get an e-mail that looks like it's from eBay about a problem with your account or requests personal information and it's not in My Messages, it's a fake e-mail," she said.

Suspicious e-mails should be reported to these mailboxes: spoof@ebay.com or spoof@paypal.com.

In theory, good idea; in practice, most of us can't keep up with our inbox now. People likely to become victim to a phishing scam using eBay in the lure probably don't know they have an eBay message queue let alone will take the extra step to check it.

We don't need to prevent all phishing but we need to drive the return on investment down for the phishers. I can think of a bunch of possible ways to improve the chances of victims correctly identifying a phishing lure, e.g. user selected images included in all emails from the vendors, digitally signed messages, etc. The only problem is I can think of even more reasons why these won't work in practice.

What do you think are the most promising anti-phishing techniques?