Topic: Someone Loan using My Account - page 3. (Read 2638 times)

This appears to be a mirror or keylogger attack on many accounts; the OP was not the only victim; the same scammer gained access to two other accounts while attempting to obtain a loan; so, this has nothing to do with OP's close pals.

Always check your post history and make it a habit to change your password and email address on a regular basis.

I think that's far-fetched, but if it happens the lender only has himself to thank. My feedback clearly says "no". I can't help it if a future lender ignores a very clear statement.

In that case; add your own neutral tag to make it more obvious to others.

If that would be the case, it's unlikely to be abused for $1000 loan scams. Bitcointalk would pay a $10,000 to $50,000 security bounty for this.

The myips.php page only goes back 30 days. That means you couldn't have found this IP just now.

That would make many users worry unnecessarily. My IP for instance jumps back and forth between IPv4 and IPv6. Tor users and many others have a different IP every time.

That's a bad idea. Lots of people have ISPs that give them dynamic IP addresses, meaning their IPs change every now and then. And, as mentioned earlier, let's not forget about those who use VPNs or the TOR network to access the forum for legit reasons like privacy and security. This means that legit users who have no ill intentions could trigger false warnings simply due to the nature of their internet connection. So, if the forum starts setting off warnings for every IP change, it could end up causing a bunch of false alarms for regular users.

I think only those disposable account will not take responsibility on this kind of incident since his account will be surely negative trust in case he will not repay the loan that requested using his account. We have the responsibility to secure our account since it can be use to scam someone here in the forum especially if the rank is high or if it has a solid reputation.

Shasan loan service doesn't have a rule about signed message which makes this incident out of his hand imho. I might fall vicitm too on this loan scam if the OP ask for a loan on our local board since his password and email doesn't change while he is currently enrolled on a signature campaign. I will assume that there's no way for him to scam me with this criteria since he is trusted.

This loan incident is really scary since the hacker manage to have access on an active account from high rank user. This means that the method of hacking is very tricky AF.

---

@Peanutswar, Sorry for your loss brother. 1000$ is very huge in our currency. PM me, have an offer.

It has no sense for multiple reasons. I'll name just what first thought: many visit this forum with VPN or Tor not to be tracked, to improve security. So many accounts will have such a note constantly. And others who have a stable IP will have another kind of a problem: potential intruder will know whom to hack to distantly use their own system to scam on the forum. So it would hardly improve security, I'd say that it'll rather lower it.

Why don't the forum set a warning when a different ip login as they do for password/ email change and waking up  this will make the other party try to verify the account owner first.
!warning this account used a new ip to login date ****
In that case even if someone trying to fake a hack it won't work  

I'd be curious to know what commonality @Peanutswar, @mdgabrielzim, and @Woodie have had in their browsing history.  If they all clicked on a phishing link, or if they all downloaded some software, or if they all participated in an off-site give-away that asked for forum details.  It would seem they all fell into the same trap.

How does the so call impersonator knew the op password and login to the forum, and if really was hacked then the hacker can take any username and hack the password and use it to take loan. And if the impersonator used the op login details to login then it is a close friend of op that knows the forum very well. Well the op also agreed to pay the loan so Shasan has nothing to say again, but the op is also asking Shasan to extend the repayment of the loan.

Just for the record I did not delete that message of me making my inquiry of what was happening, thought the mods did!

Believe it or not, if I hadn't had another loan with Shasan,  today I would have been paying a loan of $900+ which I didn't not get or apply for... And in my case, I had a loan for which I was late by a day or so and I thought it was a way of Shasan trying to get at me as I only saw a quote of the loan application without actual application and this was done when I was going offline!
But whatever is happening someone has found some kind of backdoor or exploit to the system of impersonating users...maybe its a cookie hack!! Because I never reuse my passwords, am not the kind of person that clicks on unknown links and lastly the only possible way of my password being got was through lastpass, but after this failed loan attempt I have been moving away from the last pass. (Even if lastpass was compromised, at least i think a geolock would have prevented this from happening, besides what were the odds of a lastpass hacker knowing about the forum and the loan section ZERO CHANCE)

Unusual ip I found via bitcointalk.org/myips.php  based on the deleted post date and time thanks to the loyce club archives.

The loan I did not apply for as can be seen below


And this is how my pending loan saved me from a $900+ loan, its getting scary out here...

Oh btw sorry to hear what happened on you mate. Thats a huge loan but I admired you for taking the responsibility yourself. Some would probably not, but I can see that you value your reputation here over some funds. Anyway you could recover that in due time. The culprit should be punish and must be found cause who knows who will be next on their targets. Anyone seems gonna need to have extra careful from now on especially on malicious links.

That's not hard to imagine at all.  Have you known me to ask for a loan in the 5 plus years I've been here?

It's also not hard to imagine all the pea-brained lemmings jumping on the most recent and virtuous "cool-kid-bandwagon."  All this will do is give the account holder an excuse to shirk their responsibility of keeping their account secure (one already claimed that would be an "unnecessary fuss.")  Is that something you want to put yourself in the middle of when the account gets "hacked" and some lender issues a loan?  Mark my words, someone will abuse this and honestly I would expect a more critical stance on this silliness from you.


Lenders should be considering a lot more than just the borrower's feedback, especially for an unsecured loan.  As it is lenders face a lot of challenges, and the last thing they need is a highly reputable and trusted member of the community giving some shitty account "plausible deniability" to further erode the lenders ability to recover loans.


"Not a perfect solution" would be acceptable, but this is far from that.  My fear is that you're providing an opportunity for scammers.


Don't make that your problem.


I don't think shasan should pay a penny, not the right president to set.  But at the same time this could have gone a very different way for him if Peanutswar wasn't a standup guy.  Maybe shasan needs to learn this lesson in the hardest way possible before he secures his service.

---

I don't think that many of them will ask for a loan in the future, but I think there's a very distinct possibility that one of them will, get it, then say it wasn't him and point to LoyceV's feedback as "proof" that it wasn't him.  Sure, the lender should have been more scrutinous, but as has been demonstrated in this case not all lenders are as scrutinous as they should be.  I already have a very strong suspicion that one of the accounts tagged by LoyceV is the sockpuppet of a loan defaulter and escrow impersonator.

Ah ok, my bad then. "Had a loan and paid it in 2 months. Thanks." is easy to understand the other way around to be honest.


I wouldn't as well. It's not Shasan's responsibility that users take their security serious.

If you're talking about the feedback from bL4nkcode, that was actually a loan to bL4nkcode, not the other way around. Peanutswar was the one lending the money.

You can check out their complete conversation in the Pilipinas local section:
https://bitcointalksearch.org/topic/m.56681642

The neutral tag does not hurt anyone, and many people overlook or even try to verify the message behind such a tag, especially if the user has more than four neutral tags. What most lenders consider risk is the reg paint, and that's the only thing that draws the most attention to someone's feedbacks page.

This isn't going to help much because almost everyone here has a neutral tag. ( Most DT use it as personal note nowadays)

I assume Shasan isn't convinced yet, and he doesn't appear to want to be a part of this discussion or accept responsibility for the OP's negligence.  To be honest, I wouldn't.

You write you don't care about loans or money of other people but your feedback history shows you had a loan in this forum in the past.

That's no attack against you, just stating the facts. 

Anyway, shitty situation for both, you and Shasan.

I don't have any plan to take a loan, I don't care about the money of other people,I don't take any loans even in real life too, after this incident I format all of my devices, and change the password too, hoping we have 2fa in the future in case plus the additional measurement of the post with the lending board to be the same as the service board to take 24 hours before can be deleting the reply.


LoyceV has a point too one of the measurements for taking a loan is having a signed signature and agreeing with other members, I signed my wallet address as one of the ways to secure my account. I guess we need Shashan's response too with this case.

Same didnt have any loan transaction here on forum. So I am thinking to do the same cause we dont know if ever we encounter like the same situation like OP. Its quite scary to know that someone will loan in your place but its not you. What can I say about those guys that took the tagged are they are confident to do so since they wouldnt literally do it. Perhaps some wouldnt like that but its their decision and no one can judge them by that actually.

What LoyceV offer is pretty helpful indeed. But DireWolf14 is right on one thing, that we should and its our responsibility to protect our account here. I myself can vouch that I wouldnt do any loans in the future, why? In real life I didnt take any from 0 until now why would I start later right?

I haven't made a decision yet, but I tend to think that it could be reasonable for me. I'm not the first day on the forums where some loans can be given and taken, and I never took any loan on forums for all the time. So hardly the situation will change so that in 3 years my behaviour will become dramatically different.

Of course the one who agrees to take such a tag should think in advanse, but why do you judge them right now? Why do you think, that many of them would ask for a loan in the future?

A lender should be cautious and not give a loan for the one has this tag at all. Of course it is a risk, so why a lender should take that risk? Being too greedy?

Why it is to hard to imagine some people know they'll never want to take a loan on Bitcointalk? The large majority of all internet users will never need it.

It's all possible, and in that case, it's just an (Untrusted) neutral tag that shows some of the history of the account.

Shouldn't a lender check a user's feedback history anyway before deciding on a loan?

I thought of that possibility too. One way or another, it's not a perfect solution.

Also true. But it's clear many people fail to keep their account secure. That's probably why more and more websites are bugging users with 2FA.

I was thinking the same too, and it's the reason I made the neutral tag suggestion to avoid this. OP's mistake was not keeping his account secure, but giving a loan is on shasan.
One solution could be to share the losses 50-50, but that would open the possibility for users to claim their account was compromised, and only pay back half their loan.

I have a sneaky suspicion that this might become more frequent in the future. Neither Peanutswar nor Woodie seem to have any idea (or they're not willing to share) how this happened, and mdgabrielzim remains silent about it. The first two recorded loan attempts were unsuccessful, but the third one went through. If the scammer has an effective technique for compromising other users' forum accounts, it's reasonable to assume that he will try it again.

If shasan, or any other lender for that matter, continues to give loans without conducting proper due diligence, it will inevitably result in significant consequences sooner or later. However, I suppose that decision ultimately rests with them.