Wondering what is going on with this...

[m j b]

A couple of years ago I sold a Submariner to a guy in CA. He paid promptly and we spoke on the phone a few times. On February 28 he sent me the following email:

Hope all is well.I ran into some awesome deals on a few watches today was wondering if you would be interested in a black dial Daytona 116520 SS V series in MINT condition w/box and complete papers. My brother in law shipped me the watches for me to sell for him after running into some financial problems. He is only looking to get $9,000 which is a great deal for this watch. The watch is practically brand new. Also has a Omega Aqua Terra 150m/ Stainless steel case with a rose gold bezel on a brown alligator leather strap for $4,500, AP Royal Oak Volcano for $14k.

Then last month I sold my BLNR to a guy in D.C. He was very easy to deal with (unlike the first guy) and paid me within hours, and was satisfied with the watch (he's now listed it for $16,995 on his web site, FWIW). This morning he sent me the following email:

Michael,

Hope all is well, I ran into some awesome deals on a few watches and was wondering if you would be interested at all. I have a Stainless steel Daytona 116520 black face V serial in mint condition for only $9,000. It's a great price on a great watch, I'm helping my brother in law find a buyer for it after running into some financial problems of his own. It has a complete set of box and papers and includes extra links. I would buy it myself but I'm trying to sell the 2 I have right now.

Also selling for him is a AP Volcano like new and complete for $12,000 and a Rolex Submariner 116610LN like new and complete for $6,500 If your interested let me know. I'm emailing a few past customers of mine to see if there interested before listing these watches.

I replied to the D.C. guy asking what's going on and he has not yet replied. I don't think they are the same guy (different names, different email addresses) but it seems a little suspicious. Plus, I see now that the email address is different than the one that he used when he bought the watch from me.

I noticed too that none of the watches mentioned in the email are on his web site.

So, I guess this is a fraud alert, until I hear otherwise from the sender.

I wonder though how the scammer got my email address, as it is not the one that is associated with TRF and Paypal, unless someone hacked into the PM repository, and I never list in the "for sale" thread. Now I'm even more confused.

[m j b]

OK, just heard from the legitimate seller that it is indeed a fraud attempt.

Beware.

[stratlanta]

Yeah I got the exact same thing a couple of months ago and alerted the actual person that the scammer was impersonating because it was a scam. They seem to be mining the feedback posts in the "who's who" section. I got it right after I had posted there and I think a few others have as well.

[m j b]

Scammers are so annoying! Thanks, @stratlanta!

[beshannon]

I get this same scam letter about once a month

[77T]

Originally Posted by m j b

Scammers are so annoying! Thanks, @stratlanta!

It would appear (from a casual glance at the dialog) that the email of each of those genuine people has been compromised by the same malware.

Apparently it is an email botnet, and while they could be different scammers, the botnet uses a library of canned phishing spiels.

Could you check and see if the full headers on those emails are from the same domain or IP addy?

That might be worth posting (not the actual genuine email addy but the domain of the sending system.




Sent from my iPhone using Tapatalk Pro

[77T]

Originally Posted by stratlanta

. They seem to be mining the feedback posts in the "who's who" section. I got it right after I had posted there and I think a few others have as well.

Very possible. That is why I suggest people never post their actual email addy as a link.

Better to use a phrased approach. Not naming you - only sharing for all in the spirit of communication.

Example:

Instead of paul@pg.com (not me)

Use this: “my email is pg and you must add the @ sign with pg (dot) com”.

Ultimately AI bots will figure this out, but not for a while longer...

Sent from my iPhone using Tapatalk Pro

[m j b]

Originally Posted by 77T

That is why I suggest people never post their actual email addy as a link.

Good advice, however in these cases I never had my email address in any posting, nor was it in the feedback. Only via PM.

[77T]

Originally Posted by m j b

Good advice, however in these cases I never had my email address in any posting, nor was it in the feedback. Only via PM.

In your case it could be the other guys’ email that has been compromised.




Sent from my iPhone using Tapatalk Pro