That is why I was saying to change the password as fast as possible. Or in other words, IMMEDIATELY. There is always the possibility that the person who made the bid didn't think of it or may have gotten into the account very recently and the thought of changing the password hasn't crossed his mind yet. Don't give him/her the time to think of it. Also I would, as I said, check on your bidding status etc. and make sure that other auctions aren't pending or have been completed that you are not aware of. And, to say it again, Notify eBay immediately after you have checked and changed the other two.

If there is a credit card attached to the account than you are correct, Cancel that as well and notify the issuer that you think the number may have been compromised. I opened my eBay account a long time ago and I don't recall that I had to put down a credit card number then. All I recall giving was my address and all.