Warning: Scammer in Buy & Sell

[Amin]

One of our moderators' accounts was hacked and used to create listings in Buy & Sell where the scammer was trying to get people to pay him using PayPal Friends and Family.

Unfortunately, it is common on many sites for a good seller's account to be compromised and then used by a scammer. Because of this, you cannot rely on good feedback as the sole way of protecting yourself from a scam.

I personally learned this lesson the hard way last year after I sent a wire payment for an expensive watch to a scammer who had hacked a seller's account on a site called Rolex Forums.

If you are a buyer, I strongly recommend that you avoid the use of PayPal Friends and Family (Personal) and other unprotected forms of payment.

For all members and especially those who use our Buy & Sell board, please make sure that you use a strong password on our site and that you don't use the same password on any other sites. If possible, use two factor authentication for extra security.

And if you get a PM asking you to click on a link that takes you to a site that looks like Mu-43 and asks you to login, don't do it! That is a common way that people get hacked. Please be careful!!!

----

7/18/21 Update: At least three more accounts have been compromised since I made this thread. I did not find any evidence of our site admin panel or database having been breached. The same advice applies.

I would strongly encourage all members to use two-factor authentication (two step verification) at this point. You can do so here: https://www.mu-43.com/account/security

 

[Holoholo55]

Thanks, Amin.

 

[L0n3Gr3yW0lf]

Would it help if it can be set as a rule to confirm the seller's intent for buy/selling with an email conversation to make sure that the account owner is aware of the situation? (In case of a account hack like this)

While email hacks are not uncommon they tend to be more difficult to access to as two factor authentication is more prelevent even for non tech savy (Google Mail is by default locked to an active Android device for authentication. And it's similar for iCloud and Apple).

 

[pixturethis]

Nice, right after I buy a camera from a user. Maybe you could pm people with a list of the hacked accounts to give us a warning.

 

[RichardC]

Nice, right after I buy a camera from a user. Maybe you could pm people with a list of the hacked accounts to give us a warning.

Amin said it was a mod's account that was hacked.

 

[Gsansoucie]

On the flip side, is there a preferred forum to post sellers who are trustworty based on actual transactions?

 

[Robstar1963]

Nice, right after I buy a camera from a user. Maybe you could pm people with a list of the hacked accounts to give us a warning.

? Or maybe you can just take notice of the warning given and follow the precautions mentioned

 

[RichardC]

There are things that you can do to protect yourself online.

As Amin said, Paypal 'friends and family' isn't easily verifiable. It's there for people who know each other, the clue is in the name.

Similarly, Paypal is not intended for online payments where goods are collected (you have no buyer protection in these circumstances) - PayPal is for distance selling only.

An invoice raised by the seller from a verified PayPal address is safer. https://www.paypal.com/sg/smarthelp...er-or-buyer-is-verified-or-unverified-faq1219

When you think about it, a scammer would need to verify an account by linking an existing bank account or credit card and receive a small PayPal payment. It would need to have the same name and location as the hacked account, so the profile would have to be edited. Then place an advert, and do so before the account holder realised what had happened.

Perhaps there should be a long delay and text verification before your MFT profile details can be changed (never tried it, so maybe you can't anyway)?

Personally I would avoid 'friends and family', escrow, bitcoin, Western Union. Bank transfer in the UK is name checked for some UK bank account holders, but not all banks are signed up to it. If you pay cash in to someone's bank account over the counter with the same bank as the account holder uses, you can ask them to check the name and branch location for you. Many bank sort codes are traceable online.

 

[Z-Shooter]

I saw those ads and wondered why they were so cheap. The old adage still holds true ...... "If it looks to good to be true, then it is."

 

[Brownie]

Well for Pete's sake, don't tell them now! I've sold the London Bridge twice and the Sahara Desert four times.

In all seriousness, other than taking as many precautions as possible, if someone wants your money they'll figure out a way to get it. Verified PayPal addresses ONLY and no F&F. If you're really concerned ask the seller for their address via email to confirm both their PayPal email address and the ship-to with PayPal.

As a rule of thumb, I won't buy or sell to anyone who isn't a regular on this board. By 'regular', I mean you're a participant in more than buying and selling and you've been here longer than a few weeks. I know that doesn't protect against the situation given, but it's a start.

 

[stevedo]

For all members and especially those who use our Buy & Sell board, please make sure that you use a strong password on our site and that you don't use the same password on any other sites. If possible, use two factor authentication for extra security.

Great advice. I would also advocate the use of a password manager.

Would it be possible to require a poster of a new buy/sell thread to authenticate using two factor authentication before the thread is posted?

 

[RichardC]

Well for Pete's sake, don't tell them now! I've sold the London Bridge twice and the Sahara Desert four times.

In all seriousness, other than taking as many precautions as possible, if someone wants your money they'll figure out a way to get it. Verified PayPal addresses ONLY and no F&F. If you're really concerned ask the seller for their address via email to confirm both their PayPal email address and the ship-to with PayPal.

As a rule of thumb, I won't buy or sell to anyone who isn't a regular on this board. By 'regular', I mean you're a participant in more than buying and selling and you've been here longer than a few weeks. I know that doesn't protect against the situation given, but it's a start.

I was going to buy London Bridge off you but have already sent all of my spare money to a Nigerian Prince to help him launder the oil money out of a dormant bank account. I'm going to make a fortune.

 

[Derek]

Nice, right after I buy a camera from a user. Maybe you could pm people with a list of the hacked accounts to give us a warning.

If you bought that camera you messaged @Andy H. about, don’t worry as he’s not a moderator, so it wasn’t his account that was hacked (he also sells things regularly and is quite active here). Since it looks like you recently joined, I‘d also like to reassure you that this kind of thing is a rare event here (I don’t recall ever seeing this issue before), and Amin is great about notifying us when anything is amiss. (Usual disclaimer: it’s still the internet, so due diligence is warranted, per this thread.)

 

[Derek]

Would it be possible to require a poster of a new buy/sell thread to authenticate using two factor authentication before the thread is posted?

I really like this idea. What say ye, @Amin Sabet?

 

[pixturethis]

Thanks Derek, good info to know. I've tried to sell My D850 and 5 lenses and have nothing but scammers try to but them, most are pretty easy to spot as they want to pay you more then your listing, or want to pay you right after you send it. We all have to be cautious as selling camera is one of the highest scam items bought and sold. Really sticks as I don't use my Nikon gear anymore after buying my M43 gear, really love it.

 

[Amin]

I really like this idea. What say ye, @Amin Sabet?

I was thinking about that as well. No decision as of yet.

 

[Amin]

Nice, right after I buy a camera from a user. Maybe you could pm people with a list of the hacked accounts to give us a warning.

Everyone who PM'd the hacked account has been notified that it was compromised. It was only one account that I know of.

 

[Darmok N Jalad]

Thanks for the head's up. Was this a spear phishing attack, or should we be changing our passwords?

For what it's worth, when I sell here or on other forums, I get the buyer's PayPal first, then send them a PayPal invoice. It offers the buyer some protection through PayPal, and it makes a clean record of what is being sold while also making creating a shipping label to the PayPal address a snap.

 

[pixturethis]

Thanks Sabet, as you know, new here still learning the ropes.

 

[Phocal]

Seems like you should have a talk with your admins about proper password generation and internet security.