Three scams from one hacker . . .

[eelpie]

This hacker has used this account before. Please note the seller's "history" (dormant account for over a year), the silly opening bids, and that the photos all come from different sources . . .

Rolex Submariner 16610 Kermit 40mm Watch

Rolex Oyster Perpetual Date GMT-Master ll 16713

Rolex GMT-Master ll Batman 116710blnr Men’s Watch

It's no longer enough to look for inconsistencies in the fakes. Now you have to be aware of the people who steal photos and copy, who swear authenticity and possession, and who use eBay's own generic details, ratings and specifics to try to legitimize their scams.

[Yk101]

Did anyone challenged him/her to provide proof of ownership/possession of the items?

[eelpie]

. . . it's usually with, "if you're not comfortable bidding, don't ".

You have to be pretty brazen to try to sell $30K worth of Rolexes you don't own, so requesting proof of ownership is an exercise in futility.

Hackers seek out accounts that are dormant, or that haven't sold anything in more than six months or a year, and from what I've heard, they're frequently from the Ukraine. They're stoic and they keep plugging along.

A few weeks ago they posted 3,500 auctions on the retired account of capecodcloths. A week ago they did 10,600 on an account, but over the weekend they only did about 20, but they were all shiny new Submariners.

Sadly, eBay only has its user agreement, and a couple of levels of reporting such things. If man can devise a system, some slob will inevitably come along and try to cheat, and screw it up for everybody else.

[newbee1]

Interesting. Out of curiosity, how do you know all these stuff?

[eelpie]

Originally Posted by newbee1

Interesting. Out of curiosity, how do you know all this stuff?

I read a lot of mysteries, I work a lot of puzzles, and I try to employ logic & critical thinking.

It is not logical for a new seller to register on Wednesday, and offer seven Rolexes on Thursday, all with photos from different sources.

It is even less logical to bid on a $7,000 watch on offer for $1,200 from a seller who registered yesterday, but people like a bargain, and they like to believe they're clever . . .

It is also not logical for a seller of buttons and bows to go dormant for a year or more, and then come back with three desirable Rolexes, all with photos from different sources.

It takes one set of skills to see a flaw in the shape of an hour marker on a Submariner, and it takes another to sense there's something wrong with a new Daytona for $1700, with no reserve, and a user with a history of selling nothing other than vintage corkscrews.

[77T]

I’m coming up with this seller for the Sub - I’m not sure if this is who you meant?





Sent from my iPhoneX using Tapatalk

[eelpie]

. . . the villains and their patterns vary.

The Ukrainians usually post on Saturday, when eBay in San Jose is closed, but just about every morning there's a new auction from some guy who figures he's smarter than the system.

Most mornings I run a search for newly listed Day Dates, Subs and Daytonas and, sure enough, there are one or two or three new auctions from accounts that haven't had a sale in a year. The best clues are an unusually low opening price and the absence of a reserve.

Some of these gonefs are clever as they'll mention an F serial, or that the case has no holes, as they're learning the jargon.

Just look for auctions that don't smell right, and you'll start to see their pattern . . .

[newbee1]

Originally Posted by eelpie

I read a lot of mysteries, I work a lot of puzzles, and I try to employ logic & critical thinking.

It is not logical for a new seller to register on Wednesday, and offer seven Rolexes on Thursday, all with photos from different sources.

It is even less logical to bid on a $7,000 watch on offer for $1,200 from a seller who registered yesterday, but people like a bargain, and they like to believe they're clever . . .

It is also not logical for a seller of buttons and bows to go dormant for a year or more, and then come back with three desirable Rolexes, all with photos from different sources.

It takes one set of skills to see a flaw in the shape of an hour marker on a Submariner, and it takes another to sense there's something wrong with a new Daytona for $1700, with no reserve, and a user with a history of selling nothing other than vintage corkscrews.

Very nice. I'm learning a lot on this forum. Good work and good karma, you saved many people from getting scammed.

[GLADIATOR]

Its a pity that eelpie did not post photos of the pieces.
Kind of makes the thread useless

Maybe in future he could post photos, then the thread stays in history educational??

Thanks
adam

[goldfixer21]

Originally Posted by GLADIATOR

Its a pity that eelpie did not post photos of the pieces.
Kind of makes the thread useless

Maybe in future he could post photos, then the thread stays in history educational??

Thanks
adam

All 3 were pics of genuine watches with different backgrounds, what could they possibly have taught anyone?

[JZD]

Originally Posted by GLADIATOR

Its a pity that eelpie did not post photos of the pieces.
Kind of makes the thread useless

Maybe in future he could post photos, then the thread stays in history educational??

Thanks
adam

How are you measuring utility? You are the one who goes around screaming everything is fake until someone else with actual knowledge comes around and corrects you. If you consider this string useless then I would suggest that what you do is less than useless. It is harmful. You besmirch buyers and sellers and TRF posters all the time without basis.

[77T]

Originally Posted by goldfixer21

All 3 were pics of genuine watches with different backgrounds, what could they possibly have taught anyone?

Yes I agree about the pictures - they might not have been useful but two of the links went to active legit sellers. Not to a dormant sleeper seller who had been hacked.

So if the scammer’s modus operandi is hijacking, it appears that the links are fleeting - they disappear as quickly as they appeared.

I agree with Adam in one respect - that snapping some screenshots of the auction itself would help. That - or post/preserve the names of the dormant eBay sellers. As it stands now, no way to report who or what was going on.


Sent from my iPhoneX using Tapatalk

[JZD]

Originally Posted by 77T

Yes I agree about the pictures - they might not have been useful but two of the links went to active legit sellers. Not to a dormant sleeper seller who had been hacked.

So if the scammer’s modus operandi is hijacking, it appears that the links are fleeting - they disappear as quickly as they appeared.

I agree with Adam in one respect - that snapping some screenshots of the auction itself would help. That - or post/preserve the names of the dormant eBay sellers. As it stands now, no way to report who or what was going on.


Sent from my iPhoneX using Tapatalk

Respectfully...please read the whole string. I think eelpie is trying to show some of the patterns typically followed by scammers on eBay. In this instance he was showing what it looks like when a dormant account gets hacked. I know many TRF users are all about TRF trusted sellers (even though there is no such thing officially) but the fact is a lot of people use eBay to buy a Rolex. I think this is especially true for first time Rolex buyers.

[eelpie]

Originally Posted by 77T

Yes I agree about the pictures - they might not have been useful but two of the links went to active legit sellers. Not to a dormant sleeper seller who had been hacked.

So if the scammer’s modus operandi is hijacking, it appears that the links are fleeting - they disappear as quickly as they appeared.

All three auctions were posted to the account of user ID 335hunter, which is a valid, active account that has zero feed-back as a seller for over a year. The reason the links disappear is because the links are to scams, scams are duly reported, and the scams are removed. That, in a nutshell, is the way scams and auctions for fakes are dealt with. There is no reason to let scam auctions run to their conclusions.

Just to illustrate how persistent the hackers are, he's re-listed the Batman from a couple of days ago:

Rolex GMT-Master ll Batman 116710blnr Men’s Watch

Now here's the deal: the photos are of a genuine watch, the description can be convincing, and the feed-back of 222 is respectable.

The problems are that the person offering the watch is not the actual owner of the account 335hunter, and the person offering the watch (aka: hacker, scammer, thief) doesn't own the watch being offered. The scammer / hacker has some photos of unknown origin, and a bit of semi-convincing patter and nothing more.

The whole point of a scam is to make it look as life-like as possible and as of this writing, the auction has been bid past $7000, from a ludicrously low opening bid of $1000.

The bidders have not noticed the account hasn't sold anything in over a year, or that this account has never dealt in anything even remotely as valuable as a Rolex.

Again, there is no actual watch involved.

By the way, posting and saving the compromised account names is pointless because after they've been caught a few times the thieves shuck the user ID and take up temporary residence under another user ID, sort of like a hermit crab abandoning one refuge for another.

[77T]

eelpie -

Thanks for expanding upon your points.

Shifting gears, how would a typical buyer know which auction was bogus?

You and I have worked this space for years - we would automatically suspect a seller who never sold an expensive Swiss watch - nor anything else of value in the past year.

I think the average eBay'er might not notice...

That leads me to the "how" one might help unsuspecting bidders. Long ago, I wrote an eBay guide on spotting fake Rolexes. I think authoring an eBay guide on spotting these scammers might help - but unlikely unsuspecting bidders would look beyond their mobile device. Just an idea.

How would a scammer profit from such an auction? They would have to change the hijacked user's PayPal account, then the banking information, then pass through the bank validation process (remember how PP gets the money to you).

Not sure how successful that would be - but I guess it could be accomplished.

For now, and for TRF users, the best way I know would be to research the seller ID and call/email the seller directly about the auction. I'm sure the legit seller would disavow a bogus auction. If you pay via PP, you'll get your money back since the scammer's funds will be placed on hold (due to a large sale from a previously dormant eBay/PP account)

The eBay Community webpage allows such a lookup - I did that on my ID and annotated it below. I redacted my actual ID but left my IP addy there.

Chasing the scammer's IP address might help nail down the Country it is assigned to - but you'll also see below that the dynamic IP addy issued by my cable company is woefully inadequate in nailing down a city. I live in the ATL area and Charter uses data centers nationwide...


Just an idea to help unsuspecting TRF members.

[eelpie]

Originally Posted by 77T

Shifting gears, how would a typical buyer know which auction was bogus?

While your Rolex buyer is not typical per se, anyone is liable to fall victim to a scam if they're not aware of scams or looking for scams. It happens here, and it happens on eBay.

At last count there were 27 bids up to $7200 on the bogus Batman auction listed above.

At least some of these people believe they're trying to buy BLNR for less than the market price. They see a real watch, they see decent feed-back (although not recent) and they mistakenly believe they're actually involved in a real auction.

If you are not wary, suspicious, or a devotee of abstract thinking, it may never occur to you to look for the tell-tale signs of fraud . . .



And the Batman is gone for now.

[77T]

It could be much easier to catch-out a scam like this without much ado.

Since the scammer clearly doesn’t have the listed watch, a simple request for a picture of it, on a piece of paper with his user ID, and set to a specified time will weed out 99% of them. Simple DIY solution.

And eBay could do the same with a little AI filtering effort.


Sent from my iPhoneX using Tapatalk

[Hpozzuoli]

This is all very good information. How can a “hacker” take over the dormant account in the first place? Are they using some software to guess login credentials?

[eelpie]

Originally Posted by 77T

It could be much easier to catch-out a scam like this without much ado.

Since the scammer clearly doesn’t have the listed watch, a simple request for a picture of it, on a piece of paper with his user ID, and set to a specified time will weed out 99% of them. Simple DIY solution.

And eBay could do the same with a little AI filtering effort.

As I mentioned before, a scammer can merely respond to requests for proof of authenticity or possession with, 'if you don't feel comfortable, please don't bid', if they respond at all.

If I ask or you ask for proof of life, and it is not forth-coming, there are still plenty of bidders who rely on feed-back and a trust in eBay to bid without asking.

In my experience, asking for any sort of dated photo as proof has been a waste of time, but the request itself alerts the thief to the fact that there are doubts about his auction.

It is not beyond the realm of possibility that, once warned, they can end an auction early, ask for payment, receive payment and evaporate before the auction can be nullified.

No, when it seems clear to me that I'm dealing with a compromised account, I report it without tipping my hand to the hacker.

[77T]

Originally Posted by Hpozzuoli

This is all very good information. How can a “hacker” take over the dormant account in the first place? Are they using some software to guess login credentials?

Weak passwords are the prime cause. The other problem is created by the website - eBay allows your public seller ID to act as your UID.


Sent from my iPhoneX using Tapatalk