Someone has hacked my account and is posting a 5513

[donsidhu]

Someone has hacked into my account and has listed a 5513 for sale. I don't own this watch and have no idea how someone got into my account. It is a scam. Someone is pretending to be me. I've notified TRF admin and waiting to hear from them. I keep bumping it and explaining how someone hacked my account, but the hacker keeps editing my bump and deleting what I’m writing. I've tried changing my password but they are still able to access my account. Has this ever happened to any other forum members? Thanks

[Cryten]

It happens only too often.

Changing your password only works if they sign out, which they clearly won't.

Your account will be banned, but you might get it back if you can prove you aren't the scammer.

[digitalcrocodile]

Originally Posted by donsidhu

Someone has hacked into my account and has listed a 5513 for sale. I don't own this watch and have no idea how someone got into my account. It is a scam. Someone is pretending to be me. I've notified TRF admin and waiting to hear from them. I keep bumping it and explaining how someone hacked my account, but the hacker keeps editing my bump and deleting what I’m writing. I've tried changing my password but they are still able to access my account. Has this ever happened to any other forum members? Thanks

Not if your password is something like [09840qba[we9ur]AWE-0
Not if you never left your account open on a public venue
Not if you turn off BlueTooth when you are logging in and out on an unsecured network

[Cryten]

Originally Posted by digitalcrocodile

Not if your password is something like [09840qba[we9ur]AWE-0

Is that your password?

[123Blueface]

Originally Posted by digitalcrocodile

Not if your password is something like [09840qba[we9ur]AWE-0
Not if you never left your account open on a public venue
Not if you turn off BlueTooth when you are logging in and out on an unsecured network

Or just use a VPN

[77T]

I’m guessing OP’s alert to Mods has worked. There doesn’t seem to be a 5513 listed under his ID.


Sent from my iPhone using Tapatalk Pro

[cop414]

Correct Paul.

[Andrejb]

Poor guy. Don was a personal friend and really stand up guy. Hope he gets his acc back


Sent from my iPhone using Tapatalk

[red1108nyc]

Don is a good guy. Glad our great Mods jumped in quickly to prevent damage.

[GLADIATOR]

Originally Posted by Andrejb

Poor guy. Don was a personal friend and really stand up guy. Hope he gets his acc back


Sent from my iPhone using Tapatalk

The ban his account to stop anyone being scammed, but if contacts admin, they will allow him a new account.

[Andrejb]

Originally Posted by GLADIATOR

The ban his account to stop anyone being scammed, but if contacts admin, they will allow him a new account.

Fair enough.

He has told me he has attempted to contact mods but hasn’t heard back. What is the best way to contact so I can relay the message?


Sent from my iPhone using Tapatalk

[GLADIATOR]

Originally Posted by Andrejb

Fair enough.

He has told me he has attempted to contact mods but hasn’t heard back. What is the best way to contact so I can relay the message?


Sent from my iPhone using Tapatalk

Click the little triangle at the bottom left of each post. That does go to each moderator, but I think only Admin can help, and they may take a few days depending where/what they are doing
A

[cop414]

Originally Posted by GLADIATOR

Click the little triangle at the bottom left of each post. That does go to each moderator, but I think only Admin can help, and they may take a few days depending where/what they are doing
A

This is correct, the process has begun.
Remember guys, be very careful about links that you open, especially ones that brings you back to TRF look alike page and requests that you log back in. Do this just one time and your account is hacked.

[77T]

Tim is right about “man in the middle” types of redirects where hackers use mirroring.

One other thing to be careful about is this: TapaTalk App suddenly requesting that you log in again. Especially if you are on an insecure WiFi network. If that happens to you, it is very likely someone is piggybacking your TapaTalk session on TRF. They may be at a table next to you or across the ocean in a foreign country - IP is global and you don’t know what exploit is being used.

The fix? Presume it is IP attack...
Step 1 - First close TapaTalk and then “force quit” it. (Yes, I know Apple said you don’t need to do that - but the context was regarding saving battery life - in an IP piggybacking exploit by a hacker, it is a good thing to force quit TapaTalk). The next steps are variable depending upon your network options and the urgency with which you need to get back on TRF. The goal here is to treat this issue like a “canary in the coal mine”.

If you are mobile and can leave the WiFi network, then sign out of it and find another WiFi. It is best to get off that original WiFi pronto - it is likely compromised. And to be safe, turn off Bluetooth if you aren’t leaving the place your sitting.

Step 2A - If your device has a dual LTE/4G network option, then open settings and turn off WiFi altogether. Now you can force quit all apps, restart your device, and open a browser window to reset your TapaTalk password. If you’re really concerned, you can reset your TRF password (along with the p/w’s of all forums that TapaTalk accesses for you). But remember why you were suspicious - TapaTalk was asking for your TRF password - it is unlikely the hacker has it. But a p/w reset is like belt & suspenders if you like to be doubly safe.

Step 2B - If neither leaving the Wifi nor using LTE is possible, force quit all Apps, turn off WiFi and restart your device later - you are done for a while. This step is to avoid the hacker’s ability to check on what you do next. In this case, once you leave the place where you’re getting WiFi - and can be on a secure network - perform Step 2A.

It goes without saying that you may have been compromised for other reasons. Out of date firmware, old OS or missing security patches are the easiest ways to be compromised.

Stay up to date...and...

Good luck!


Sent from my iPhone using Tapatalk Pro

[donsidhu]

Hey guys thanks for all the support. Your comments and advice is greatly appreciated. I'm back up and running now, and will be sure to protect my password going forward. Thanks 77T for the elaborate response. Interesting that I added the tapatalk app to my phone a couple of days before this happened. And I signed up on TRF in 2012 and this has never happened. So I just deleted my tapatalk app and won't use tapatalk anymore. Thanks Gents!

[cop414]

Happy that it’s all sorted out, sorry that I banned your account but, well you know.

[77T]

Glad it worked out. And good on OP for warning everyone once the hack was on.

Now it’s about keeping the account buttoned up methinks.


Sent from my iPhone using Tapatalk Pro

[pandrew6l]

Originally Posted by 77T

I’m guessing OP’s alert to Mods has worked. There doesn’t seem to be a 5513 listed under his ID.


Sent from my iPhone using Tapatalk Pro

His 5513 is up again a few minutes ago under the " For Sale " section

[dng992]

Originally Posted by Pandrew6l

His 5513 is up again a few minutes ago under the " For Sale " section

Should I be weary of this? or is it a scam. I had PM'd him also just inquiring about it...

[JayB]

Originally Posted by Pandrew6l

His 5513 is up again a few minutes ago under the " For Sale " section

Probably should delete the For Sale advert seeing as the OP openly stated he doesn't own the watch

[edweather]

So is OP currently selling a 5513 or not? I PM'd the seller of that watch a few hours ago, and he responded. So is there a chance I was talking to the hacker? Seems odd the OPs account is reinstated, and now he really IS selling a 5513

[77T]

While it does Appear confusing, I noted that Steve himself (the Capo di tutti Capi) announces that the account was reinstated.

I did message a Mod to double check. Were it me looking at that 5513, I would hesitate wiring money until the bona fides are sorted one more time.

The real original OP is a stand up person methinks but the recent hijack raises the “be careful” factor.


Sent from my iPhone using Tapatalk Pro

[77T]

Apparently - and coincidentally - the OP did post an update to that 5513 FS listing to allay concerns.

https://www.rolexforums.com/showpost...82&postcount=3



Sent from my iPhone using Tapatalk Pro

[edweather]

[donsidhu]

Hey guys, yes I realize the confusion because the hacker did post a 5513 (but for those who saw the ad, it was maxi dial 5513, and it looked like the person took the photos from a current or recent posting of a maxi 5513 from someones ad). But anyway the 5513 I posted yesterday was a meters first - which is a different watch than a 5513 maxi dial. I hope this will alleviate concerns, but if you go to timezone and see my listings (including my meters first) under my handle DonTO, you'll see pages of history. And all my postings have similar wristshots of my wrist and hands. I've been at this hobby for many years and have known and done deals with several TRF members over the years. I'm confident that my passion and knowledge of vintage Rolex will prove to be a net contributor to this forum. Thanks. Also, the meters first is now sold and the buyer has paid half the cash to me already. Cheers.

[Dcormsby]

FYI, I just received an email from [email protected] asking about a Seamaster I have listed on the forums. He asked about the watches history, and asked if I would be interested in a trade. He sent a link saying he had a listed of watches for trade on the Rolex Forum. I clicked on the link, and it was asking for my Rolex Forum log in info. Needless to say, I didn't sign in.

Just be careful out there! Never sign into your account from a link!

[donsidhu]

Thanks for the heads up, Dcormsby. Much appreciated. That's definitely not my email, so yes, if anyone receives an email from that address, please do not reply to it. My true email address is my full name, [email protected]