Scammers are trying to steal our login credentials

[Stranger]

I've had 2 scam attempts in the last few days, both of which were attempting to steal my login credentials. Here's how it works:

1) Legitimate user posts a watch for sale.
2) A TRF user says they're interested and provide a link to (1) their references on TRF or (2) their collection on TRF for a potential trade.
3) When legitimate user clicks the link, they get to a page made to look exactly like the TRF login page. If you look at the address bar in your browser you will see it is not pointing to rolexforums.com. If you enter your credentials, they will be captured and the scammer will be able to post on your behalf here.

I've had 2 attempts from users Dgercp and brandonmpennington (now banned). The former sent me a link via PM, the second sent me an email.

The email attack is particularly deceptive because it's an HTML document where the link *looks* like a TRF address, but then redirects you to the scam web page.

[214270Explorer]

Good catch! This scam goes on constantly.

[Roosterfish5]

I have just posted on general discussion

I received pm from “Dgercp” requesting a reference

Clearly a scammer

[Stranger]

User brain_009 is yet another scammer. Beware. Here's their PM to me:

"Hello,

I am a newbie, I am at the point of purchasing a watch(Rolex Watch) from DavidSW on the forum, He gave me some refs and told me to ask around about him.

Please have you done or know someone that has done a deal with him in the past. Please let me know asap, as I am about making payment.

See his listing below

http://arikanlar.com.tr/RolexWatch/R...lexForums.html

Thanks in advance"

[fmc000]

Originally Posted by Stranger

User brain_009 is yet another scammer. Beware. Here's their PM to me:

"Hello,

I am a newbie, I am at the point of purchasing a watch(Rolex Watch) from DavidSW on the forum, He gave me some refs and told me to ask around about him.

Please have you done or know someone that has done a deal with him in the past. Please let me know asap, as I am about making payment.

See his listing below

http://arikanlar.com.tr/RolexWatch/R...lexForums.html

Thanks in advance"

Got exactly the same PM and the user was already banned before I even logged in to TRF today :-)

[Rrpdc]

Got the same thing today from banned user. Han2han.

[101031-28]

WOW had no idea, thank you for the heads-up.

[Hendrikus]

Received a similar message from an user "diplo526" asking me to click on a link in order to provide a reference on behalf of a TRF member.

[77T]

Good idea to alert us about this. I’m sure you’ll report any scammers to the Mods who haven’t already been banned.

If members have enabled two-factor authentication, then those scam attempts will fail.

Steve facilitated the ability to do that with Google Authenticator on the TRF servers.

Saying that for all members who might be concerned by the scam attempts mentioned above (as well as any that follow this post of mine).


Sent from my iPhone using Tapatalk Pro

[swaini3]

I'll add to the above. Since 2FA, i have not had any of these crappy attempts. Everyone should enable it.

[poppyoua12]

I got one from annie_wood asking for ref.

[poppyoua12]

This person has no posts on the forum

[bmock17]

I just got one too from anniewB. I did report it.


Sent from my iPhone using Tapatalk

[cop414]

We’re banning them as fast as you guys report them, they’ve been out in force lately.

[77T]

Originally Posted by cop414

We’re banning them as fast as you guys report them, they’ve been out in force lately.

And we are grateful Tim.

Not enough hours in the day…


Sent from my iPhone using Tapatalk Pro

[cop414]

You’ve got that right Paul.

[Chris]

Received an attempt from Bill Mott, Cop414 dealt with him swiftly with a ban!!!

[mvmbles]

Hello all,

I also received a PM and email request on an active classified listing of mine from a nefarious character who has already been dealt with by TRF moderators. Just wanted to post a screenshot of the interaction so other innocent members of our community know what to look for.

Regards,
Nick

[Bmats]

Originally Posted by Hendrikus

Received a similar message from an user "diplo526" asking me to click on a link in order to provide a reference on behalf of a TRF member.

Got the same exact message today. I went to the site here and so no PM so figured the email must be phishing.

[Azadwatches]

I got this one today. looked real. Clicked the link took me to a logg in page but realized it was not the real.

DO NOT REPLY TO THIS EMAIL!
***************************

Dear Azadwatches,

You have received a new private message at Rolex Forums - Rolex Watch Forum from chad3041, entitled "Refs Check".

To read the original version, respond to, or delete this message, you must log in here:
https://www.rolexforums.com/private.php

This is the message that was sent:
***************
Hello,

Hope this email finds you in good health. Am in the process of purchasing a Rolex Hulk from a TRF member, Which he provided me with your Username to contact you via PM as his reference that you can vouch for him to be an excellent seller. Kindly fine his listing and details below for your perusal.

https://www.google.com/url?q=http%3A...3Ykc6fwzslvlmw

Thanks in Advance and stay safe.
***************

Again, please do not reply to this email. You must go to the following page to reply to this private message:
https://www.rolexforums.com/private.php

All the best,
Rolex Forums - Rolex Watch Forum

[Stranger]

And another attempt, this time from "user" jonadiolk93093 . This was sent to me as a PM:

****
Hello,

I am a newbie, I am at the point of purchasing a watch(Rolex) from Racerdj on the forum, He gave me some refs and told me to ask around about him.

Please have you done or know someone that has done a deal with him in the past. Please let me know asap, as I am about to make payment.

See his listing below

http://arikanlar.com.tr/RolexWatch/R...lexForums.html

Thanks in advance
****

See how the link is to a different domain name than TRF? You would get to a page that looks exactly like the TRF login page, from which they can capture your login credentials.

[Harvie]

Me too, just.like old days, trust but verify all and cover your own ass 100% of the time

[Armis]

Thank you for alerting us…I also just saw such a message in my inbox, which seemed a little light on the details besides the link. So I came to this section to see if anyone else had an issue, but I didn’t realize how rampant this scam is.
The guy had 0 posts and is banned now, thankfully.

[minute_man]

User Tom5518, registered 2009 with more than 1K posts

Sent an email address [email protected] to communicate on a possible purchase.

His response contains a spoofed TRF page where log in credentials are being asked.

[Eddie11]

I got the same thing as minute_man

[LGW-US]

i get a message from as follow :

New Message from The Rolex Forums from user " Tom5518" - where i report them ?



Tom5518 sent you message: "Rolex Submariner 16613 18K yellow Gold/Steel Blue Dial/Bezel 40 mm Box/Papers"



Hey Am interested in your watch. Please send me a direct message to [email protected] for quick reply Thanks

[cop414]

Guys I banned that account yesterday.
Report any suspicious activity via the red triangle in the post or PM, this sends the report to all moderators.
DO NOT open any links from this or any suspicious post/PM.

[surrounded21]

Same scam today from email [email protected]

Link ostensibly to his collection was a false login page!

Sent from my SM-G955U using Tapatalk

[underpar31009]

Originally Posted by surrounded21

Same scam today from email [email protected]

Link ostensibly to his collection was a false login page!

Sent from my SM-G955U using Tapatalk

I got the same message inquiring about a listing. Wow this is unsettling - I saw he has over 1K posts and was a member for a while. I’m so thankful the moderators caught him. Thank you!


Sent from my iPhone using Tapatalk

[jordanfsl]

Got the same one. Compromised account most likely.