Help some brothers out.. scammer content

mankytom

Looks like a couple of our members have been scammed out of a  few grand in threads by @suhrtone ;

i hope you don’t mind both @Fifty9 and @glitterjet, but I thought the community might pull together to help you out a bit. Any of us could have fallen victim to
that..

I hope this is ok mods

https://www.justgiving.com/crowdfunding/tom-regan

please don’t use my real name for evil 

Fifty9

Wow thanks @mankytom (impressive username too btw)

I am hopefully covered by PayPal Buyer Protection. Will be able to confirm that in the next few days I think but I've flagged it to them and they've said I will be covered. That should make the target just the amt for the LP.

mankytom

Fifty9 said:

Wow thanks @mankytom (impressive username too btw)

I am hopefully covered by PayPal Buyer Protection. Will be able to confirm that in the next few days I think but I've flagged it to them and they've said I will be covered. That should make the target just the amt for the LP.

I guess if it’s just the lester that’s easier to get to! I can’t see now how much it was cos he’s edited his ads but.. if you let me know I can update the total. (Assuming you’re ok with this) 

S56035

Why has the original thread been closed? What can possibly gained by closing a thread exposing a scammer?

glitterjet

Double wow, unlike Fifty9 who I hope is covered, looks like I am at a total loss. Never thought I would get caught by a guitar scam!!!     This would be awesome.   Thank you so much for suggesting this 

RobG3294

S56035 said:

Why has the original thread been closed? What can possibly gained by closing a thread exposing a scammer?

Exactly what I thought. The more discussion around this the merrier, helps highlight the issue and helps the community on here contribute ideas however big or small to maybe help the pair that have been bitten. No helpful thought is too small or irrelevant. 

And it's not like closing the thread is protecting suhrtone from abuse or a pile on etc as its clearly not the original account owner in control anymore, plus whoever is is a nasty piece of work. 

Mods... Let's keep some form of positive thread open on this for the lads that have been scammed. No one need be nosey beyond a surface level/reasonable interest but maybe someone on here may be of some help somehow, you never know. 

Roland

The thread was closed to limit the amount of information put in the public domain. We have received information from several other members already, including things which I don’t want published for this and other scammers to read.

S56035

Roland said:

The thread was closed to limit the amount of information put in the public domain. We have received information from several other members already, including things which I don’t want published for this and other scammers to read.Wouldn't it make sense to point this out so that questions are answered before they're asked ?

Roland

S56035 said:  Wouldn't it make sense to point this out so that questions are answered before they're asked ?

In an ideal world maybe, but we’re having a busy evening

digitalscream

OK, update - firstly, apologies to @glitterjet and @Fifty9 for being AWOL today, I had a family emergency...sod's law says it happens concurrently with this

I've scanned the logs and compared the code with all known Vanilla vulnerabilities, and I can't find anything which suggests the forum (or our hosting) was the source of the compromise (assuming the account was compromised in the first place, rather than suhrtone deciding to come back after a few years and start scamming people) - the user hit the sign-in page already knowing the correct password for the account. This is the second time this has happened in a couple of months, with the exact same pattern of behaviour - there just isn't any defence against somebody knowing an account's password.

At this point, I'm in the awkward position of being forced to assume the source of the breach was external, unless any further information comes to light.

I've taken some steps to at least limit what's possible, should this happen again (if anyone wants to know what they are, PM me - as @Roland says, I don't want to advertise it).

For now, my advice to everybody would be:

1 - Change your password to something that you've never used before. Password managers are good for that, and I believe most browsers have a reasonably good password generator built in.

2 - Check out the profile of anyone you're dealing with - if their posting behaviour's changed recently, or they haven't posted in a long time only to come back with sales only at crazy-good prices, move on or ask us to check them out.

3 - Always, always, always use PayPal buyer protection unless you've dealt with them successfully before, and they're using the same PayPal details.

4 - If somebody says they're using a family member's PayPal account, or they're suddenly wanting payment in a different currency...ditch the deal. It's a scam.

5 - If anything seems suspicious, or you feel even slightly squicky about it...move on.

CavemanGrogg

I hate it when people get scammed, and getting scammed at this time of year when most people are hemorrhaging cash due to the season and holidays just makes it so much worse, personal, and harder to recover from - not just financially but also with trusting others.

digitalscream

UPDATE: Some incredibly useful and timely information from @danishbacon (and some cross-referencing previous compromised accounts) has pointed us directly to the source of these account compromises - I'm 99% confident that's where it came from. I'm going to do some more digging to see if I can get hold of the breach file itself so I can compare it to our member list, but for now...I would strongly suggest that everybody checks their email address(es) here:

https://haveibeenpwned.com/

CavemanGrogg

digitalscream said:

UPDATE: Some incredibly useful and timely information from @danishbacon (and some cross-referencing previous compromised accounts) has pointed us directly to the source of these account compromises - I'm 99% confident that's where it came from. I'm going to do some more digging to see if I can get hold of the breach file itself so I can compare it to our member list, but for now...I would strongly suggest that everybody checks their email address(es) here:

https://haveibeenpwned.com/

How accurate are sites like haveibeenpwned.com?  I regularly check to see if my email address comes up, though to be honest I honestly don't know how much I should ''trust'' these sites search results or if I should trust them at all.

digitalscream

CavemanGrogg said:

digitalscream said:

UPDATE: Some incredibly useful and timely information from @danishbacon (and some cross-referencing previous compromised accounts) has pointed us directly to the source of these account compromises - I'm 99% confident that's where it came from. I'm going to do some more digging to see if I can get hold of the breach file itself so I can compare it to our member list, but for now...I would strongly suggest that everybody checks their email address(es) here:

https://haveibeenpwned.com/

How accurate are sites like haveibeenpwned.com?  I regularly check to see if my email address comes up, though to be honest I honestly don't know how much I should ''trust'' these sites search results or if I should trust them at all.

They're 100% accurate in terms of the breaches they show you. You can't, however, guarantee that you're safe if you don't come up on there.

jasonbone75

CavemanGrogg said:

digitalscream said:

UPDATE: Some incredibly useful and timely information from @danishbacon (and some cross-referencing previous compromised accounts) has pointed us directly to the source of these account compromises - I'm 99% confident that's where it came from. I'm going to do some more digging to see if I can get hold of the breach file itself so I can compare it to our member list, but for now...I would strongly suggest that everybody checks their email address(es) here:

https://haveibeenpwned.com/

How accurate are sites like haveibeenpwned.com?  I regularly check to see if my email address comes up, though to be honest I honestly don't know how much I should ''trust'' these sites search results or if I should trust them at all.

The guy running it has been supporting the security focused community for years. It is one of the legit sites. If you click their subscribe link from within an email to your address from them they will email you with alerts any time you appear in a breach list.

glitterjet

Update on financial loss.   Paypal want nothing to do with it, even though they could freeze/suspend the account which is being used for fraudulent purposes.    The bank it appears will look at it but very unlikely to refund.    So it looks like I am going to have to suffer the loss.   I thought it may have been an idea not to close the thread as it provided a good talking point around something which is of interest to all in the FB community.  For those that did not see the original ad I paid £1450 for the guitar, only wish someone had highlighted concerns before @Fifty9 did as at this stage I had only left a £100 deposit to hold the guitar until I came up with the rest of the money.  I honestly never thought this would never happen to me.

pt22

Sorry to you both.  

Better days ahead for sure. 

mankytom

I will update the total of the JustGiving when @Fifty9 is sure he’s getting his refund. In the meantime, I’ll let it run. 

Could have been any of us this. Those ads are very convincing, from a longstanding member. It’s been v sophisticated..

it would show the strength of community if people are able to help. Link in OP

DrCornelius

mankytom said:

it would show the strength of community if people are able to help. Link in OP

Agreed - plus chipping in for a bit of ‘community insurance’ is a small price to pay for those of us using the classifieds (a lot in my case !)

stonevibe

Ouch! Just saw these posts and the original ads. Not great.

Fifty9

Thanks @digitalscream & @Roland for getting to the bottom of things. Thanks all who’ve shown support.

PayPal have opened the case against them on my behalf - and have said I’m covered by Buyer Protection. Just have to wait to see how they respond by Jan 9th and see how this progresses I guess. I said I wasn’t the only victim and they’ve referred the account(s) to their ‘relevant team’ whatever that actually means but I guess they’ll do what they can to stop them using PayPal going forward.