Personal Message scam ***** pm scam **** pm scam

[cerbom]

yes.

[Watchie]

Okay, I screwed up and clicked on a link in an email to me asking that I confirm that the posting in the link was the watch the sender would be buying. That took me to what at first blush looked like the RF log on page, but not to my link. Stupidly I of course tried to log on with my user name and password. Ooops.

Since committing my sin I have read this thread in its entirety. What I could not find is what I should do now that I've screwed up. My immediate step was to change my password. Is that enough???

Thanks in advance for all helpful replies.

[Watchie]

Having been subject to this phish, how does the scammer (assuming he now has the ability to log in as me) take advantage of this information? Again, as posted above I have changed my password so hopefully he cannot pretend to me be, but if he could, where does that take him in terms of making any money off this?

Thanks.

[ArtNouveau]

The scammer will post watches for sale as you that will separate other forum members from their money. I’m surprised you have not been banned already, typically you have to prove to the facilitator who you are to be reinstated.

[Watchie]

Originally Posted by ArtNouveau

The scammer will post watches for sale as you that will separate other forum members from their money. I’m surprised you have not been banned already, typically you have to prove to the facilitator who you are to be reinstated.

Hopefully now having changed my password he won't be able to do that. Put another way, as he won't be able to log on as me he can't post as me, correct?

In any case, hopefully for all reading this string it will be a reminder to always "buy the seller." Get references, ensure proof of ownership/possession of the watch, do your due diligence.

[tjerem]

Appreciate it, Larry.

[stanc1]

Great Info!
Thanks for the heads up .

[Straggy]

ty larry

[stanc1]

Incredible!
Thanks Larry.

[Kamen]

I just got one. Fellow members beware!




Sent from my iPhone using Tapatalk

[Juhuatai]

^Just got this one as well!

[Jondouthit]

Me too


Sent from my iPhone using Tapatalk

[JSanta]

I received one as well. I suppose I should have checked this thread before notifying a moderator. Hopefully no one clicked on the link!

[squatchy]

This happened to me and it took me over a month to sort out with moderators to keep my original screen name. It should almost be a requirement to read this thread before you're active on the forum!

[Tools]

Originally Posted by Watchie

Having been subject to this phish, how does the scammer (assuming he now has the ability to log in as me) take advantage of this information? Again, as posted above I have changed my password so hopefully he cannot pretend to me be, but if he could, where does that take him in terms of making any money off this?

Thanks.

If you have been phished, the scammer may have already accessed your personal information page.

On that page is your personal e-mail and other data that is not available to the membership, as well as an immediate ability to impersonate you on the Forum.

Generally, if you are able to access your account and change your password, you will be able to continue on the Forum without issue. However, you do not know what other personal information has been accessed.

[efthi]

I just got scammed and all my info disappeared, this is really bad unfortunately. I have received a PM like a couple days ago with a link about a “sales posting”, just clicked and all my info went missing. I cannot understand how all our info is going missing, it is supposed to be in some server isn’t it? Even I provided my registration email to the admins but they could not work out anything at all.. crap!


Sent from my iPhone using Tapatalk Pro

[mikeyatc]

I just got the same email. Immediately changed my password. I hope that's enough.

[efthi]

I got the email and I clicked on the link, this is my new username... this sucks and it should not be that easy for someone to lose his whole data and history in the forum just like that... I am upset and disappointed RF

[Montes]

Thank you for the info Larry!

[sleddog]

Originally Posted by efthi

I got the email and I clicked on the link, this is my new username... this sucks and it should not be that easy for someone to lose his whole data and history in the forum just like that... I am upset and disappointed RF

Upset you fell for a simple and well known phishing attempt, or upset at TRF because you fell for the phishing scam??

[haidangwatches]

Noted and thanks for this. Sharp eye!

[watchprenuer]

thanks for the heads up larry

[watcher3223]

thanks for the heads up larry

[louisshields]

Useful info. Thanks for the tip.

[16arp]

Interesting. Thanks for the info

[Modiferous]

Clicking the link won't necessarily create an issue, but following through with whatever is requested of you at the other end is the phishing.

[seabreeze60]

Yes, clicking on the link through a private message gives the bad actor access to your RF sign-in name, not your password.

The OP can clarify how they do it.

[77T]

Originally Posted by seabreeze60

Yes, clicking on the link through a private message gives the bad actor access to your RF sign-in name, not your password.

The OP can clarify how they do it.

Paul
The bad actor already knows your TRF name or he couldn’t send you a PM in the first place. The classic phishing scam is to entice you to RE-enter your password to see the purported info at the link.

But clicking a link can open you up to other myriad malware exploits. And if you have used any of the various browser plug-ins to store passwords it is possible for the bad actor to harvest it.

Encrypted password vaults offer a measure of protection but the bad actors are hoping to find less sophisticated password savers with an eye towards financial website credentials.


Sent from my iPhone using Tapatalk Pro

[seabreeze60]

Originally Posted by 77T

Paul
The bad actor already knows your TRF name or he couldn’t send you a PM in the first place. The classic phishing scam is to entice you to RE-enter your password to see the purported info at the link.

But clicking a link can open you up to other myriad malware exploits. And if you have used any of the various browser plug-ins to store passwords it is possible for the bad actor to harvest it.

Encrypted password vaults offer a measure of protection but the bad actors are hoping to find less sophisticated password savers with an eye towards financial website credentials.


Sent from my iPhone using Tapatalk Pro

Thanks!

[77T]

Originally Posted by Modiferous

Clicking the link won't necessarily create an issue, but following through with whatever is requested of you at the other end is the phishing.

Clicking a link in a PM is just as risky as clicking a link in an email. While it is usually part of a phishing exploit, clicking the link could leave you with problems.

For anyone not aware, the following is just for educational purposes. But for our clueful members this will seem elementary - so HAGD and skip the rest of this post. Please accept my gift of time.

PM & Email fraud is designed to trick people by playing on their trust, or fears, or a sense of urgency, or a desire to help. It exploits human nature, not just technology. This makes anti-spoofing software and traditional security tools ineffective.

You may be aware of the potential threat, but a recent survey shows awareness does not mean preparedness. Only 40% of users (broad global scope) have any deep url inspection software to warn them that a link is malicious. These include the simplest browser warnings and the more sophisticated web filtering software.

Even people with the best protection against links attempting to access their user data are susceptible because they ignore or allow the link to be opened.

A website's reputation is correlated with the specific web reputation policy enforced on the computer. But there are still “Day 0” threats that pass through existing link filtering. That’s because scammers will hop from a website that’s been tagged as a threat. They gen new links to a new web address until they notice it has been tagged as a threat. And so on, and so on, etc...

So trust the OP’s advice, just don’t click.

Even if the PM is from a trusted member, don’t click - because it is always possible that member’s account has been hacked and you are among the first 100 people the scammer has targeted.

Once you click, a standard phishing exploit may launch to keep you reading or answering questions. All the while, in the background, a little bit of code could be launched to add a keystroke logger, or a bot to scan your files, or worse - ransomeware to encrypt your files before launching a lockdown until you pay a fee via bitcoin to unlock your phone, tablet, PC, laptop, or other systems.

Just sharing in the spirit of communication.




Sent from my iPhone using Tapatalk Pro