Topic: Weird emails and pms about a paypal transaction I never made (Read 1001 times)

Hello, guys!

It was a good lesson for us also - not to send money first...I did not posted something here, because I did not wanted to waste time.

And I noticed that kenzawak visited this forum the last time in July and he has -13 in his reputation.

https://bitcointalksearch.org/user/kenzawak-1082600

do you really think so ? well , I don't.

I highly doubt that this is how scammers go about running their daily "business" , they must have planned all of this and there is not a single reason why the scammer would return 500$ and keep 1000$.

I am not totally denying the possiblity of your "theory" but on a scale of 10, i don't think it qualifies to 1 in terms of probability.  


True, however the refund part is not clear at all, the refund was either charged back real quick which makes his claim about the transfer being "Friends and Family" most likely a lie, the other possibility is that the alleged "scammer" did send him the money just like that ! which then brings us back to the question of WHY ?

I think only Ichanger can really clarify this matter.

The Stockholm IP address belongs to the Proton VPN service, which AFAIK is free and anybody around the world can use it. This means it mixes in the good users from the bad, and there's no way to use the IP information as a clue to identify where the hacker is located.


That was iChanger who took and posted the screenshot. It seems like the scammer suddenly wanted to take the first email address out of the equation.

There's no harm in iChanger reporting fraudulent activity on all 3 of the email addresses he received to PayPal.

He also threatened he could do a "chargeback" to his credit card in one of the Telegram screenshots. He should probably consider doing this (if possible) at the risk of damaging his PayPal account standing.



iChanger can also file a fraud report with their bank if they can't chargeback to their credit card (sounds like they used a credit card tho).

So the scammer suddenly became all honest and sent back the 500$ ? Or it was not sent as friends and family as he claimed and he actually got all his money back? But then why bother post the second screenshot that shows the "refund"?

I can't follow the logic !

https://prnt.sc/nx85wa shows the refund was for a purchase, so I don't think it was "Friends and family". But the latter is often used to scam people who try to avoid paying Paypal fees.
A warning: "Friends and family" means exactly that, you should only use it with people you trust, and not some stranger on the internet.

The victim of scam here has said that it's possible for them to make a chargeback via credit card so I guess this is the possible solution?


The receive can send the money back to the sender which has happened here between Emmanuel and iChanger. It was not a chargeback. Also, it looks like iChanger sent PayPal to 3 different people.

So you sent 500$ to Emmanuel as ( Friends and family)


Not true, you are pretty much responsible, your terrible security measures were the main cause for the possible scam, for all i know you could have used a VPN to fake your location, manupiuated the victim and ensured not to leave any trace on forum and shifted the trade to telegram.

I am leaning towards you being framed here, i tend to believe you are not a scammer, but it is stupid for you to think that you are not responsible for this.

So if i were you i would be more polite and not call the victim stupid and all that b.s.

Or any connection from an unusual "new" IP adress, ideally geo-filtered. A lot of services offer this.

For these using vpn connections or such, maybe make it an option that is opt-out.

Any connection from a new country or region could trigger a warning.

Perhaps there should be an option to be notified by e-mail whenever a personal message is sent, not just received. As we can see, a hacker can do quite a bit of damage by just sending PMs, right under the rightful account holder's nose.

Honestly - I don't know. It was as much a question as a statement of disbelief. I'd like to think that anything out of character for the user in question (larger than usual deal) would be suspicious but this thread shows that it wasn't.

Ok, in your opinion, where is the line between the "Earth" and normal?

And, of course, in my opinion


is anybody going to do 200$ without signed message.... Please....don't pull lines...

Whoa whoa... unlimited... 50 BTC... is anybody really going to do that without as much as asking for a signed message?

Back on planet Earth though, I'm with Darkstar_. If someone gets screwed due to my shitty opsec, I better be able to compensate or be labeled a scammer.

I can't agree with this.
Lets suppose hacker hack account and made a 50btc deal and "send first", which could have happened here. Hacked person should send nearly half million dollars in this case?

No.

So the fact that I opened a bitcointalk account has exposed me to unlimited liability? That's pretty scary to me. 

If they reimburse then it's not really an issue, which is why it's generally expected that people do so.

Don't bother, I don't know for the rest of the world, but in my country you can get new phone number for 1$...sometimes for free...

Side note...
I was thinking, how does one prove that their account was hacked? I mean, it can happen to anyone, but how exactly will anyone prove that their account was hacked and they didn't scam?

I contacted their support, not sure they'll be able to do much though.

Afaik you can't report anyone on Telegram. It is part of their "guidelines". The only thing you can report a user for, is spamming.



Point taken even if PP still takes fees on numerous occasions, for instance when you change currencies.

And regarding the CC premium, there is none in most banks in France for instance. It is included for free. So in the end the merchant is paying it with his fees. Still pretty unfair.

CC has fraud/loss "protection" and yes, it's ok to use it because you're paying insurance premiums via fees.

PayPal F&F payment does not have such protections. That's one of the reasons scammers want to use it. Attempting to reverse an F&F payment in this situation would likely be considered fraud.

I just received this pm :




I answered this :



EDIT : anyone knows how to alert Telegram about that guy @iamanubis ?

This is slightly offtopic, but following your logic, if you loose your credit card on the street, and someone spends 10k on it, you shouldn't get the money back from your bank's insurance company, just because it was your fault in the first place?

Because this aspect is present in every single aspect of our lives. You only rarely pay direct costs. You usually pay a fraction of a total cost + margin for the company offering the service. This is true for paypal, but also any bank, or any insurance contract really. If your insurance is expensive, it is not because of the mess you make, but because of the mess of others.

Not sure what that has to do with anything. Scammers will use any tool available to them, if not PayPal then WU or whatever.

Defrauding PayPal with a feigned "chargeback" is NOT the right way to deal with this.

No it's ok, I understand and do appreciate the concern.
I do logon from hotel wifis when abroad, I don't have much choice if I wanna get online. This never happened though, that's the first time I get hacked.

I've been running antiviruses all day and I will format the whole laptop.

I'll also contact Theymos in a few days to check on the IP logs again as suggested.

I've never stated that. This is what I stated:

Is it?

Or maybe paypal will eventually enforce KYC on their accounts even under 2000€/$ like it was last time I used it.

This would actually avoid scammers using it.

It's a shitty thing to do though. The scammer most likely already cashed out so PayPal would have to cover it, which is one of the reasons for the exorbitant fees and ridiculous restrictions they put on legitimate users. I know most people here are not fans of big corporations but this scam is not PayPal's fault in any way. Personal responsibility FTW.

I'm also curious to know how kenzawak's account was breached. 

@kenzawak, did you use a laptop or a public computer to access your account while you were traveling?  Did you connect to an unsecured public wifi?  Did you download and install any software during that trip or just before?  Sorry if I'm being a bit nosy, but it's important to know how the account was compromised if you are to be certain it's now secure.



If it were me swimming in a sea of uncertainty I would eliminate any potential for doubt.  I'd boot that betty from a USB, shred the hard drive, nuke the partitions, low level format, and start with a fresh OS install.

---

@iChanger,
You'll be able to get your money back from PayPal.  Friends and family payments make it a bit harder, but not impossible.  Be the squeaky wheel.

If I were you, I'd like to see my logs again in 7-10 days period, you know...to make sure there are no further unauthorized visits.

The alleged first IP log from Sweden has been reported multiple times with different violations:

https://www.abuseipdb.com/check/185.159.156.5

^^
Thank you !

Verified.

Then you should have known better ! I don't understand how you can get scammed like this if you are so good at it.How many red flags do you need before realizing something's up ?

-You sent money to Nigerian Paypal addresses. Three of them !
-You did it without any confirmation of the first transaction. Why didn't you wait for a tx id before sending money again ?
-You never ever (I emphasize on this) contacted me here before making those payments. I would have received notifications via email.
-You supposedly sent $1000 to a stranger for crying out loud, someone you know nothing about. Show me one post, just one where I'm involved in any kind of trade here !!!
-You say you can't get your money back from Paypal because you chose to send money in a specific way. How is that my problem ? Again you're the pro with your own website and such a great rep. MO means "modus operandi". It means here that I find all this pretty convenient. You chose to pay this way... every time apparently. You're the one chasing customers on this board, not me. Me I'm just the guy who a few hours ago had no idea what was gonna happen... and now I'm a scammer and I should send you money ?! Fuck that !
-Fix my security problems ? You have to fix your IQ problems ! What kind of moron are you for doing all the shit above ? You can only blame yourself here.

I'm in no way responsible for all this.
Your trade was made on Telegram (not here) with someone else, once again your problem, not mine.

For all I know you're the one who hacked my account.



Try to stay awake for 30 hours dealing with that kind of shit and see how that works out for you.

EDIT : I'd like you to show us some proof that you're trying your best to get your money back from Paypal. That shouldn't be too hard.

EDIT AGAIN : I reread your telegram screenshots. No way I'm paying for that level of stupidity. "I'm not home, I can't send you a screenshot". Seriously ?

Who said that I am newbie or noob?
You have to be more carefully (attentively) and read my thread twice to understand.
I am new on THIS forum, but on russian forums and exchange monitoring service "Bestchange" (some of you are sure using this service) I have excellent reputation.

Follow the links I posted in my exchange thread to read feedbacks, hint for you, in chrome you can translate feedbacks from russian to english.

You are not a really good detective like Sherlock Holmes, you try to find stupid excuses and facts (like same amount, same MO...what does MO mean?) on other side, but firstly you have to clear and fix your security problems. Or maybe there were / are no problems?)
It should work like it happened?

Sorry for my bad English, I hope that all users can understand what I mean.

I reported today PMs to administrator, now we have to wait for answer.

Ichanger, you definitely don't look like a newbie to me !

https://bitcointalksearch.org/topic/1000-paypal-usd-btc-wmz-epayments-bonus-1-5140227

https://archive.fo/EQ4yE


Same amount, same MO...

iChanger,

Paypal is still a bank and you can still contact them to tell them about the fraud.

Likely the funds have been withdrawn already, but if you are lucky and the scammer was stupid enough, it has been withdrawn to his actual bank account.

In that case paypal WOULD be able to recover your funds, and/or to bann the paypal account involved unless they go through KYC.

In this situation you want to make me guilty for your mistake?) Bravo...
If you don't compensate, I am sure that you are also involved in this scam.

You can make it again and again with the newbies using your "trust" and "status", which doesn't matter how we can see it now, because you feel not responsible for scam.

In my eyes you are scammer and I think, that the forum administrators should force you to make the right decision, otherwise on this forum new users will be everytime scammed by "trusted" users like you.

What ?

You're the one who sent two payments, not one but two !!!
Why didn't you wait for any kind of confirmation before sending the second payment ?
I never ever traded here, why didn't you check that ? There is no trace of any trade in my trust feedback !
Basically, all pms that were supposedly sent from my account say "hi" and are two Nigerian email addresses. The rest was done on Telegram. Tell me where the verification is !
There are photos of me in my post history. Do I look Nigerian ?
You had all the means to verify. You could also have checked the Telegram username, mine is @kewak, it's already been posted here. You didn't even send me any PM here before sending the money ffs !!!

Sorry but there's no fucking way I'm sending you money. If I do, everybody will think they can do the same.

You made a mistake, not me.

Can you sign message from this address  0xbdc1e8a238572e8E282b791e993F571BF8640d83 ?

On side note, why people don't ask those thingies before they make deal? No trading history, no escrow...

I'm using my Mycelium wallet.

It is pretty nice, that you all are believing me and untagged me us scammer. But what is with my money?

It was verified via PM, we sent money like Family and Friends, so the payments can not be charged back.
You said, that you are DT1.
So you have more responsibility.
It is your fault, that your account was hacked.

So like DarkStar_ said in this situation you have to compensate us without discussion.

Thank you in advance.
In our life we often have to pay for mistakes.
You have to look on it like a lesson of more security.
If you don't pay, you will be able to let people scammed and say everytime, that you was hacked.

I'm sorry this is happening to you.

Can't get your message verified on brainwallet. Can you maybe verify?

https://brainwalletx.github.io/#verify

Just out of curiosity... what exactly are you using to sign these messages? As far as I'm aware, Bitcoin Core (aka Bitcoin-qt) does not support signing messages with bech32 (aka "bc1") addresses... and Electrum does not put "Version: Bitcoin-qt (1.0)" in signed messages.

Also, I'd feel far more comfortable with these signed messages, if you included a "datetime" and a more specific reason. Such a generic message could be easily re-used... something like this:

Did you reuse the password for your Bitcointalk account anywhere? Do you remember when the last time you changed it was?
Also, please run a malware/virus scan (Malwarebytes, Avira are two free ones that work well from what I've seen).

Apparently on June 1st (I definitely wasn't in Stockholm).



Other IPs are in France (home address or 4g address)
And the ones before that (the ones in New York) do match. I was in New York at the time, I posted about it in the Wall Observer thread.
https://bitcointalksearch.org/topic/m.51213854

Just out curiosity, can you tell when the breach started?  You can copy the code into a text editor and redact your IP address with a search and replace, then post the code here.

Theymos just answered me :



I also tried to alert telegram about this but I can't find @wakenz .

I'm afraid not, it's a Binance address.

Can you sign a message with the address quoted below from December 2017?

http://archive.fo/iypg5#selection-2942.1-2951.56


Looks like you used it January of this year.

http://archive.fo/5e0ge#selection-8575.0-8575.67

Run anti virus. Maybe you are infected or something...

Could you sign a message from an older address of yours?


I removed my counter.

Good !


I want to make it clear again, I have never traded here and if I ever do, it will not be with paypal.

I pm him back that I can only do $200 per transaction. And he seems not interested.

Did you make any transaction ?

I received a pm yesterday from him.

Thanks, I'll do that. Good idea.

Like I said, I reset my password here about two hours ago. Do you guys think that's enough ?

EDIT AGAIN : I also removed the tag I left to ichanger.

@kenzawak  

You can send theymos a pm and ask him to give you your recent IP logs. See if there are any irregularities, logs from IPs you don't necessarily recognize.

There have been at least two recent cases of hacked accounts to my knowledge. bbvedf and Mrengage

Could you use the "Report to Admin" button on the PM and link them to this thread so that they can confirm the PM is valid? Or allow a trusted member to temporarily access your account to confirm the PM.

I think you're telling the truth at this point, but it's better to have confirmation. The email notifications about PMs from kenzawak also lines up with this.


Even if he was hacked, the most likely expectation would be for him to reimburse you out of pocket if you can't chargeback.

WTF

Is it possible that my account here has been compromised without me noticing ?
I changed my password here about an hour and 20 minutes ago just in case.

EDIT : I also just contacted user "getpaidz" (the one I mention in op) via pm telling him to stay away from anyone pretending to be me, that I do not trade on this forum, especially via paypal.
I don't have a Nigerian name, I'm French. My telegram name is not "kenz". I never traded on this forum and would never use paypal if I did.

https://www.youtube.com/watch?v=2Ur9b7_m5-0&feature=youtu.be

Watch a video on your PC.
Oh the phone the quality is better.

Sorry, not OP, my mistake  

Shit, you're right my head's not clear.

Does it matter?

You has very stupid excuses (fake screenshots etc).

The fact is that you sent us PMs with instruction where to send PayPal but after that you sent us the last message, that you don't understand who I am.
It is easy to prove that messages were sent. I would like to ask moderators or administration to prove.
Our local time is now 02:40 AM, I can answer you in 8 hours, I go sleeping.

It seems like this "guy" has access to your account on forum. Does not he? Or maybe it is you and you are profiting from situation that you are verified user and I am newbie on forum?)

This isn't so hard to fabricate. Moderator could check this, in the meantime, @iChanger can you take screenshot of your inbox and post it like this:



It depends on time when they took screenshot.

edited OP -> iChanger 

What timezone did you put in your settings on the forum ?
 EDIT : I re-checked your screenshots. So I'm supposed to have sent my first pm at 10.44 am in your timezone ?
How many merits do you think I had at the time ? Not 763 like your screenshot says.
Checkmate fucker.

And that's one more tag for you.
https://archive.fo/Iy2ky

So at first I would like to say that you are also involved in this manipulation and scam.
We were contacted about 6-7 hours ago from telegram @wakenz to make trade from PayPal to BTC.
To be sure that we trade with some user with reputation we asked for verification via PM on forum, because we send money first. You sent us the message: "Hi"
Please look at the attached screenshot.
The administration of this forum can prove that this message was sent us by you.

After that you sent us 2 PayPal Emails also via PM, to which we should send money.
How do you explain it?

Look at all screenshots (from PM and telegram)

PS: Timezone on telegram is Kiev, because we are located there
Screenshots Forum
http://prntscr.com/nx7eqr
http://prntscr.com/nx7f00


Screenshots telegram
http://prntscr.com/nx7yr1
http://prntscr.com/nx80a4
http://prntscr.com/nx8142
http://prntscr.com/nx81ud
http://prntscr.com/nx82sv
http://prntscr.com/nx83ma
http://prntscr.com/nx847j

Screenshots PayPal
http://prntscr.com/nx85r1
http://prntscr.com/nx85ir
http://prntscr.com/nx85wa
http://prntscr.com/nx8612

Maybe but I doubt it. He is the one offering his services here, not the other way around. And he's the one threatening.
The tag is here to get his attention anyway. I find it weird that there is another newbie accusing others of the exact same thing here. Maybe he's one those guys trying to tarnish others' reputation with fake accusations. If he pretends I scammed him, he can just cancel the paypal transaction ffs. And he can post his supposed proofs here lol.

https://bitcointalksearch.org/topic/i-have-been-scammed-twice-stop-these-scammers-from-scamming-again-5148419

It's late where I am and I don't like having to deal with that kind of stuff now.
A mod deleted the two posts I made asking the guy for an explanation so maybe they know something.

EDIT : ichanger doesn't look like a naive newbie who doesn't know what he's doing. He's the admin of this site :
https://ichanger.net/

I would take it easy on the guy until you have the full story.

There are scammers contacting people on Telegram impersonating trusted members of Bitcointalk.org.  Many of these are trying to scam people for bitcoin to payal trades.  That may be what this newbie is talking about.  Maybe someone on Telegram is impersonating you luring unsuspecting newbies into sending them PayPal, or worse, bitcoin.

About an hour ago I received this pm from ichanger :




I never interacted with the guy before and have no idea who he is.
I checked his post history and apparently he is buying BTC with Paypal. I asked him to explain himself in two of the threads he posted in. I also tagged him waiting for an answer.

Then I reported his pm to the admins and answered him via pm as well.
 


I later noticed that my two posts addressed to him had been deleted.
https://archive.fo/Gu6uA
https://archive.fo/fwn0b

 I checked the mod log, the guy hasn't been banned, at least I don't think so.
I checked my mailbox and there is no notification of those deleted posts.
But in my mailbox, I got notifications for 3 pms sent by getpaidz

I can post a screenshot of those emails if necessary (address is [email protected]) :



I have checked my inbox, those messages are not there !

I also noticed this thread, it seems to be the same MO.
https://bitcointalksearch.org/topic/i-have-been-scammed-twice-stop-these-scammers-from-scamming-again-5148419