The Rolex Forums   The Rolex Watch

ROLEXROLEXROLEXROLEXROLEXROLEXROLEXROLEXROLEXROLEXROLEXROLEX


Go Back   Rolex Forums - Rolex Watch Forum > Classifieds > WatchOut!!!

Reply
 
Thread Tools Display Modes
Old 24 February 2022, 12:45 AM   #1
Stranger
"TRF" Member
 
Stranger's Avatar
 
Join Date: Jan 2018
Location: NW US
Watch: Moser Streamliner
Posts: 183
Scammers are trying to steal our login credentials

I've had 2 scam attempts in the last few days, both of which were attempting to steal my login credentials. Here's how it works:

1) Legitimate user posts a watch for sale.
2) A TRF user says they're interested and provide a link to (1) their references on TRF or (2) their collection on TRF for a potential trade.
3) When legitimate user clicks the link, they get to a page made to look exactly like the TRF login page. If you look at the address bar in your browser you will see it is not pointing to rolexforums.com. If you enter your credentials, they will be captured and the scammer will be able to post on your behalf here.

I've had 2 attempts from users Dgercp and brandonmpennington (now banned). The former sent me a link via PM, the second sent me an email.

The email attack is particularly deceptive because it's an HTML document where the link *looks* like a TRF address, but then redirects you to the scam web page.
Stranger is offline   Reply With Quote
Old 24 February 2022, 06:21 AM   #2
214270Explorer
"TRF" Member
 
Join Date: Sep 2018
Location: United States
Watch: me buy Watches
Posts: 3,956
Good catch! This scam goes on constantly.
__________________
The display of actual intelligence terrifies much of mankind

Rolex "some"
Tudor "some"
Damasko "some"
Misc Pieces "some"
Marathon "some"
GS Spring Drive "some"
Hamilton "some"
Findeisen "some"
214270Explorer is offline   Reply With Quote
Old 24 February 2022, 08:45 AM   #3
Roosterfish5
"TRF" Member
 
Join Date: Jan 2022
Location: uk
Watch: GMT 1971/72
Posts: 15
I have just posted on general discussion

I received pm from “Dgercp” requesting a reference

Clearly a scammer
Roosterfish5 is offline   Reply With Quote
Old 12 March 2022, 12:45 AM   #4
Stranger
"TRF" Member
 
Stranger's Avatar
 
Join Date: Jan 2018
Location: NW US
Watch: Moser Streamliner
Posts: 183
User brain_009 is yet another scammer. Beware. Here's their PM to me:

"Hello,

I am a newbie, I am at the point of purchasing a watch(Rolex Watch) from DavidSW on the forum, He gave me some refs and told me to ask around about him.

Please have you done or know someone that has done a deal with him in the past. Please let me know asap, as I am about making payment.

See his listing below

http://arikanlar.com.tr/RolexWatch/R...lexForums.html

Thanks in advance"
Stranger is offline   Reply With Quote
Old 12 March 2022, 01:12 AM   #5
fmc000
Banned
 
Join Date: Sep 2011
Real Name: Fabio
Location: Como - Italy
Posts: 4,811
Quote:
Originally Posted by Stranger View Post
User brain_009 is yet another scammer. Beware. Here's their PM to me:

"Hello,

I am a newbie, I am at the point of purchasing a watch(Rolex Watch) from DavidSW on the forum, He gave me some refs and told me to ask around about him.

Please have you done or know someone that has done a deal with him in the past. Please let me know asap, as I am about making payment.

See his listing below

http://arikanlar.com.tr/RolexWatch/R...lexForums.html

Thanks in advance"
Got exactly the same PM and the user was already banned before I even logged in to TRF today :-)
fmc000 is offline   Reply With Quote
Old 12 March 2022, 01:19 AM   #6
Rrpdc
2024 Pledge Member
 
Join Date: Apr 2013
Location: Dc
Posts: 1,999
Got the same thing today from banned user. Han2han.
Rrpdc is offline   Reply With Quote
Old 12 March 2022, 05:10 AM   #7
101031-28
"TRF" Member
 
101031-28's Avatar
 
Join Date: Jul 2009
Location: USA
Watch: 1665
Posts: 4,736
WOW had no idea, thank you for the heads-up.
__________________
He could not just wear a watch. It had to be a Rolex.

Ian Fleming
101031-28 is offline   Reply With Quote
Old 14 March 2022, 08:54 PM   #8
Hendrikus
"TRF" Member
 
Hendrikus's Avatar
 
Join Date: Feb 2018
Location: United Kingdom
Watch: All of them...
Posts: 780
Received a similar message from an user "diplo526" asking me to click on a link in order to provide a reference on behalf of a TRF member.
__________________
A collector of Rolex, Patek, Vacheron, JLC and Cartier
Insta: @WatchtheWatchMan
Hendrikus is offline   Reply With Quote
Old 14 March 2022, 09:10 PM   #9
77T
2024 Pledge Member
 
77T's Avatar
 
Join Date: Dec 2010
Real Name: PaulG
Location: Georgia
Posts: 40,565
Good idea to alert us about this. I’m sure you’ll report any scammers to the Mods who haven’t already been banned.

If members have enabled two-factor authentication, then those scam attempts will fail.

Steve facilitated the ability to do that with Google Authenticator on the TRF servers.

Saying that for all members who might be concerned by the scam attempts mentioned above (as well as any that follow this post of mine).


Sent from my iPhone using Tapatalk Pro
__________________


Does anyone really know what time it is?
77T is online now   Reply With Quote
Old 14 March 2022, 09:31 PM   #10
swaini3
"TRF" Member
 
Join Date: Jan 2016
Real Name: Mo
Location: Dubai
Watch: 1675 GMT, DRSD
Posts: 1,421
I'll add to the above. Since 2FA, i have not had any of these crappy attempts. Everyone should enable it.
swaini3 is offline   Reply With Quote
Old 16 March 2022, 02:35 AM   #11
poppyoua12
2024 Pledge Member
 
poppyoua12's Avatar
 
Join Date: Mar 2009
Real Name: Justen
Location: detroit
Watch: 116610 Submariner
Posts: 174
I got one from annie_wood asking for ref.
poppyoua12 is offline   Reply With Quote
Old 16 March 2022, 02:36 AM   #12
poppyoua12
2024 Pledge Member
 
poppyoua12's Avatar
 
Join Date: Mar 2009
Real Name: Justen
Location: detroit
Watch: 116610 Submariner
Posts: 174
This person has no posts on the forum
poppyoua12 is offline   Reply With Quote
Old 18 March 2022, 06:27 AM   #13
bmock17
"TRF" Member
 
Join Date: Jan 2020
Location: Illinois
Posts: 107
Scammers are trying to steal our login credentials

I just got one too from anniewB. I did report it.


Sent from my iPhone using Tapatalk
bmock17 is online now   Reply With Quote
Old 18 March 2022, 09:38 AM   #14
cop414
TRF Moderator & 2024 Patron
 
cop414's Avatar
 
Join Date: Apr 2012
Real Name: Tim
Location: Pennsylvania
Watch: 14060M
Posts: 71,815
We’re banning them as fast as you guys report them, they’ve been out in force lately.
__________________

Rolex Submariner 14060M
Omega Seamaster 2254.50
DOXA Professional 1200T

Card carrying member of TRF's Global Association of Retro-Grouch-Curmudgeons
TRF's "After Dark" Bar & NightClub Patron
P Club Member #17
2 FA ENABLED
cop414 is offline   Reply With Quote
Old 18 March 2022, 10:05 AM   #15
77T
2024 Pledge Member
 
77T's Avatar
 
Join Date: Dec 2010
Real Name: PaulG
Location: Georgia
Posts: 40,565
Quote:
Originally Posted by cop414 View Post
We’re banning them as fast as you guys report them, they’ve been out in force lately.

And we are grateful Tim.

Not enough hours in the day…


Sent from my iPhone using Tapatalk Pro
__________________


Does anyone really know what time it is?
77T is online now   Reply With Quote
Old 18 March 2022, 10:24 AM   #16
cop414
TRF Moderator & 2024 Patron
 
cop414's Avatar
 
Join Date: Apr 2012
Real Name: Tim
Location: Pennsylvania
Watch: 14060M
Posts: 71,815
You’ve got that right Paul.
__________________

Rolex Submariner 14060M
Omega Seamaster 2254.50
DOXA Professional 1200T

Card carrying member of TRF's Global Association of Retro-Grouch-Curmudgeons
TRF's "After Dark" Bar & NightClub Patron
P Club Member #17
2 FA ENABLED
cop414 is offline   Reply With Quote
Old 19 March 2022, 08:50 AM   #17
Chris
"TRF" Member
 
Join Date: Feb 2021
Location: UK
Posts: 592
Received an attempt from Bill Mott, Cop414 dealt with him swiftly with a ban!!!
Chris is offline   Reply With Quote
Old 22 March 2022, 06:30 AM   #18
mvmbles
"TRF" Member
 
mvmbles's Avatar
 
Join Date: May 2011
Real Name: Nick
Location: Phoenix, AZ
Posts: 759
Hello all,

I also received a PM and email request on an active classified listing of mine from a nefarious character who has already been dealt with by TRF moderators. Just wanted to post a screenshot of the interaction so other innocent members of our community know what to look for.

Regards,
Nick
Attached Images
File Type: jpg scammer.JPG (58.8 KB, 454 views)
mvmbles is offline   Reply With Quote
Old 27 March 2022, 04:33 AM   #19
Bmats
2024 Pledge Member
 
Bmats's Avatar
 
Join Date: May 2021
Location: East Coast
Posts: 466
Quote:
Originally Posted by Hendrikus View Post
Received a similar message from an user "diplo526" asking me to click on a link in order to provide a reference on behalf of a TRF member.
Got the same exact message today. I went to the site here and so no PM so figured the email must be phishing.
Bmats is offline   Reply With Quote
Old 27 March 2022, 04:12 PM   #20
Azadwatches
"TRF" Member
 
Join Date: Mar 2022
Real Name: IG-Azadwatches
Location: New York
Posts: 267
I got this one today. looked real. Clicked the link took me to a logg in page but realized it was not the real.

DO NOT REPLY TO THIS EMAIL!
***************************

Dear Azadwatches,

You have received a new private message at Rolex Forums - Rolex Watch Forum from chad3041, entitled "Refs Check".

To read the original version, respond to, or delete this message, you must log in here:
https://www.rolexforums.com/private.php

This is the message that was sent:
***************
Hello,

Hope this email finds you in good health. Am in the process of purchasing a Rolex Hulk from a TRF member, Which he provided me with your Username to contact you via PM as his reference that you can vouch for him to be an excellent seller. Kindly fine his listing and details below for your perusal.

https://www.google.com/url?q=http%3A...3Ykc6fwzslvlmw

Thanks in Advance and stay safe.
***************

Again, please do not reply to this email. You must go to the following page to reply to this private message:
https://www.rolexforums.com/private.php

All the best,
Rolex Forums - Rolex Watch Forum
Azadwatches is offline   Reply With Quote
Old 12 May 2022, 03:38 AM   #21
Stranger
"TRF" Member
 
Stranger's Avatar
 
Join Date: Jan 2018
Location: NW US
Watch: Moser Streamliner
Posts: 183
And another attempt, this time from "user" jonadiolk93093 . This was sent to me as a PM:

****
Hello,

I am a newbie, I am at the point of purchasing a watch(Rolex) from Racerdj on the forum, He gave me some refs and told me to ask around about him.

Please have you done or know someone that has done a deal with him in the past. Please let me know asap, as I am about to make payment.

See his listing below

http://arikanlar.com.tr/RolexWatch/R...lexForums.html

Thanks in advance
****

See how the link is to a different domain name than TRF? You would get to a page that looks exactly like the TRF login page, from which they can capture your login credentials.
Stranger is offline   Reply With Quote
Old 18 May 2022, 04:48 AM   #22
Harvie
Banned
 
Join Date: Sep 2009
Real Name: Peter
Location: in my house
Watch: Yes
Posts: 132
Me too, just.like old days, trust but verify all and cover your own ass 100% of the time
Harvie is offline   Reply With Quote
Old 18 May 2022, 12:26 PM   #23
Armis
"TRF" Member
 
Join Date: Oct 2016
Location: USA
Posts: 1,390
Thank you for alerting us…I also just saw such a message in my inbox, which seemed a little light on the details besides the link. So I came to this section to see if anyone else had an issue, but I didn’t realize how rampant this scam is.
The guy had 0 posts and is banned now, thankfully.
Armis is offline   Reply With Quote
Old 24 May 2022, 05:42 PM   #24
minute_man
2024 Pledge Member
 
minute_man's Avatar
 
Join Date: Aug 2015
Real Name: Basil
Location: Athens, GR
Watch: BoctokKomandirskie
Posts: 2,868
User Tom5518, registered 2009 with more than 1K posts

Sent an email address watchzags82@gmail.com to communicate on a possible purchase.

His response contains a spoofed TRF page where log in credentials are being asked.
minute_man is offline   Reply With Quote
Old 24 May 2022, 08:25 PM   #25
Eddie11
"TRF" Member
 
Join Date: Dec 2008
Location: Broken Arrow
Posts: 162
I got the same thing as minute_man
Eddie11 is offline   Reply With Quote
Old 24 May 2022, 11:05 PM   #26
LGW-US
"TRF" Member
 
Join Date: Apr 2022
Real Name: Jacob
Location: New York
Watch: Rolex Daytona Gree
Posts: 31
Scammer

i get a message from as follow :

New Message from The Rolex Forums from user " Tom5518" - where i report them ?



Tom5518 sent you message: "Rolex Submariner 16613 18K yellow Gold/Steel Blue Dial/Bezel 40 mm Box/Papers"



Hey Am interested in your watch. Please send me a direct message to watchzags82@gmail.com for quick reply Thanks
LGW-US is offline   Reply With Quote
Old 24 May 2022, 11:07 PM   #27
cop414
TRF Moderator & 2024 Patron
 
cop414's Avatar
 
Join Date: Apr 2012
Real Name: Tim
Location: Pennsylvania
Watch: 14060M
Posts: 71,815
Guys I banned that account yesterday.
Report any suspicious activity via the red triangle in the post or PM, this sends the report to all moderators.
DO NOT open any links from this or any suspicious post/PM.
__________________

Rolex Submariner 14060M
Omega Seamaster 2254.50
DOXA Professional 1200T

Card carrying member of TRF's Global Association of Retro-Grouch-Curmudgeons
TRF's "After Dark" Bar & NightClub Patron
P Club Member #17
2 FA ENABLED
cop414 is offline   Reply With Quote
Old 24 May 2022, 11:41 PM   #28
surrounded21
"TRF" Member
 
surrounded21's Avatar
 
Join Date: Mar 2016
Location: California
Posts: 551
Same scam today from email watchzags82@gmail.com

Link ostensibly to his collection was a false login page!

Sent from my SM-G955U using Tapatalk
surrounded21 is offline   Reply With Quote
Old 25 May 2022, 12:14 AM   #29
underpar31009
"TRF" Member
 
underpar31009's Avatar
 
Join Date: Jan 2013
Real Name: Ryan
Location: USA
Watch: AP and JLC
Posts: 346
Quote:
Originally Posted by surrounded21 View Post
Same scam today from email watchzags82@gmail.com

Link ostensibly to his collection was a false login page!

Sent from my SM-G955U using Tapatalk

I got the same message inquiring about a listing. Wow this is unsettling - I saw he has over 1K posts and was a member for a while. I’m so thankful the moderators caught him. Thank you!


Sent from my iPhone using Tapatalk
underpar31009 is offline   Reply With Quote
Old 25 May 2022, 12:31 AM   #30
jordanfsl
"TRF" Member
 
Join Date: Jan 2020
Location: Los Angeles
Posts: 53
Got the same one. Compromised account most likely.
jordanfsl is offline   Reply With Quote
Reply


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Takuya Watches

Bobs Watches

My Watch LLC

OCWatches

DavidSW Watches

Coronet


*Banners Of The Month*
This space is provided to horological resources.





Copyright ©2004-2024, The Rolex Forums. All Rights Reserved.

ROLEXROLEXROLEXROLEXROLEXROLEXROLEXROLEXROLEXROLEXROLEXROLEX

Rolex is a registered trademark of ROLEX USA. The Rolex Forums is not affiliated with ROLEX USA in any way.