I was victim of phishing attack on craigslist

T

Tom Roper

Veteran
I made a fast cash sale of my EF 85mm F/1.2L USM Canon lens on Craigslist to a legitimate buyer, but not before falling prey to a phishing attack. The scam works like this:

A perpetrator is on the lookout for people selling items that list their phone/cell number in the ad. If he finds one, he uses it to obtain a Google Voice phone number as a front for his various other scheming activities. He approached me saying "hi, i'm interested for your lens. i'll send you a google voice code. if your post is real reply the code, then i'll call you. can i send it? But it's not him sending me the Google Voice code, it's Google. But I reply to him with the code Google sent me allowing him to complete the registration making him look to Google like the owner of my number. Once he gets it, he completes the registration and whatever consequences arise from his scheming points back to my number. He can later disassociate the number from the trail leaving all the criminal activity pointing to me.

I received the code and replied back with it, then realized what a dupe I was and had to start up the Google Voice app and reclaim my phone number, which I was able to do, and also notify Craigslist I was the victim of the phishing scam. Really a dangerous world of bad people out there.
 
JPNola said:
Why do you guys list and sell anyplace other than here and similar forums?

If I were ever to sell any gear, that is what I would do. Or possibly on eBay.

If the answer is “fast cash”, well then you need to remedy your ever needing cash fast.
Click to expand...

I've bought and sold here before, and although I've had smooth transactions, scams can abound from anywhere. And I've been scammed on ebay too. If you were to ever sell any gear, you might know. There is nothing wrong with a fast cash sale. It just means you and the buyer have agreed upon a price mutually acceptable. I'm not using it for drug money and I don't appreciate the insinuation from you that I needed cash fast just because I lack your patience for taking the time to sell nothing.
 
Glad to hear you escaped unscathed, Tom!

Incidentally, Ebay can be a risky place to sell - I've heard stories of buyers scamming sellers by returning an item with the wrong camera in the box or claiming they received the wrong/cheaper camera, etc. And Ebay is much more supportive of buyers than sellers because the buyers are the product ebay sells. I've sold there a couple times and bought many times and had nothing but good experiences. But I feel much more comfortable there as a buyer
 
ahalpert said:
Glad to hear you escaped unscathed, Tom!

Incidentally, Ebay can be a risky place to sell - I've heard stories of buyers scamming sellers by returning an item with the wrong camera in the box or claiming they received the wrong/cheaper camera, etc. And Ebay is much more supportive of buyers than sellers because the buyers are the product ebay sells. I've sold there a couple times and bought many times and had nothing but good experiences. But I feel much more comfortable there as a buyer
Click to expand...

Thanks Abe! Let me tell you though about one insidious ebay scam as a buyer. It happened as follows:

I won an auction for Sony AXSM memory card for an AXS-R5 recorder (expensive). USPS tracking indicated the item had been delivered to my mailbox, but when I looked it wasn't there. I went to the post office to ask about it, speaking to the driver who remembered delivering it. He was incredibly helpful, and gave me the address of a salon where he said it was delivered. I paid a visit on the salon. They told me they had received a package addressed to them but there was nothing in it. They were able to pluck the empty packaging with label from a trash pail. The article was addressed to them but had the tracking number on it that had been given to me by ebay. What ebay does as a service for the seller, is allow him to print a correctly addressed shipping label containing the tracking number. The scammer doesn't use it. Instead he prints his own label to a phony address or front, but uses the tracking number that was provided by ebay. The customer complains to ebay he didn't receive his merchandise, ebay opens an investigation and asks of the seller who says, "Look! USPS says it was delivered on 9/11!" Had I not been able to produce the packaging with the false label, I don't know what the outcome might have been. The case ended with a decision in my favor, money returned.
 
I'm not clear what Google voice is and why you would need it for a craigslist transaction. You meet, he gives you cash, you give him lens.
 
For Craigslist transactions, I always meet in front of the police station, which in my town, only has 4 parking spaces and lots of windows looking directly at the parking spaces.
 
Peter C. said:
I'm not clear what Google voice is and why you would need it for a craigslist transaction. You meet, he gives you cash, you give him lens.
Click to expand...

Peter you're right! It had nothing to do with anything regarding the craigslist sales transaction itself. It's a phishing scam to use your Google account to obtain a proxy phone number, and Craigslist is an open pool of real, not proxy phone numbers belonging to item sellers. Google requires an actual phone number before they will grant a proxy number. That's where Craigslist fits into the scam.

I didn't know what Google Voice was either. What Google does is offer you the ability to choose an available phone number from any city, state or country. A call to that number is forwarded by Google to your real number. You can make an outbound call from a computer using the Google number. And (I think) that number will then show up on the recipient's caller I.D.. You can also receive a call from the Google number, as the service will forward it to your real cell phone or land line. It will show up on your caller I.D. as the number Google gave you. Before Google Voice will allow you to take ownership of one of their proxy numbers, they require a real phone number from your Google Voice account. And to verify that, they send you a six digit code to the real phone that has to be returned. The scammer doesn't possess the real phone this code is sent to, so the 'phish' is to trick you into giving it up.

So what the scammer does, is comb Craiglist for people who have listed real numbers, try to open a Google Voice account with somebody's real number to obtain a proxy number, and bait the unwitting Craigslist seller into giving up the code that Google sent to the real phone by making it sound as if the buyer was the one sending it (when it was actually Google who sent the code). The scammer's ruse is that he doesn't trust you are a real seller and will call you to discuss the sale once you confirm you are a real seller by giving him the code he sent you, except he didn't send it, Google did. The scam preys on people who like you and me who don't know much about the Google Voice service. What the scammer is going to do with the proxy number if he is successful in getting one from Google, is anyone's guess but the illegal activity ties back to your account and your real phone number.
 
Last edited:
Paul F said:
For Craigslist transactions, I always meet in front of the police station, which in my town, only has 4 parking spaces and lots of windows looking directly at the parking spaces.
Click to expand...

Exactly what we did. I met with the buyer in the parking lot of the Arapahoe County Sheriff's Department, as they invite Craigslist participants into using their lot for that purpose as a 'safe' place with lots of cameras.
 
Last edited:
Tom Roper said:
Peter you're right! It had nothing to do with anything regarding the craigslist sales transaction itself. It's a phishing scam to use your Google account to obtain a proxy phone number, and Craigslist is an open pool of real, not proxy phone numbers belonging to item sellers. Google requires an actual phone number before they will grant a proxy number. That's where Craigslist fits into the scam.

I didn't know what Google Voice was either. What Google does is offer you the ability to choose an available phone number from any city, state or country. A call to that number is forwarded by Google to your real number. You can make an outbound call from a computer using the Google number. And (I think) that number will then show up on the recipient's caller I.D.. You can also receive a call from the Google number, as the service will forward it to your real cell phone or land line. It will show up on your caller I.D. as the number Google gave you. Before Google Voice will allow you to take ownership of one of their proxy numbers, they require a real phone number from your Google Voice account. And to verify that, they send you a six digit code you have to return. So what the scammer does, is comb Craiglist for people who have listed real numbers, try to open a Google Voice account with it to obtain a proxy number, and bait the unwitting Craigslist seller into giving up the code that Google sent by making it sound like the buyer was the one sending the code because he doesn't want to get scammed and will call you once you confirm by replying the code that you are a 'real' seller. What the scammer is going to do with the proxy number if he is successful in getting it from Google, is anyone's guess.
Click to expand...
It's hard to keep up with all this stuff.
 
Thanks for sharing and sorry this happened. There is no end to the mischief out there. The salty dog side of me is weary of anything outside "normal" internet behavior, like using something like Google Voice that I am not familiar with. That is why the crooks use these services, nobody know how they really work and they can scam around them. Selling your gear used to be an integral part of the industry when things were more expensive. Now it is kind of a chore and not as rewarding. Lucky to get half of what you paid etc...
 
Tom - I had a near same experience a few weeks ago - listing something (a bbq smoker / grill) for my elderly parents (which is why I didn't want them listing it themselves).
Just a few hours after posting, I got a text from someone inquiring about price and expressing interest. And then they said they needed to confirm I was "real" - so would send me a link to click. And it was the google Voice activation link. Thankfully I recognized it as such and didn't fall for it.

Reminds me I need to report their number to Craigslist - or local authorities - to maybe see (probably unlikely) if they can be tracked down with the number they used to text me.
 
JPNola said:
Why do you guys list and sell anyplace other than here and similar forums?

If I were ever to sell any gear, that is what I would do. Or possibly on eBay.
Click to expand...

It's good to know about new scam tactics, as I'm sure most of us also sell things other than video gear on services like Craig's List. People have been scammed here before too, no place is safe, and someone who's new to the forum will have a hard time convincing us that they're trustworthy when they try to sell something on here, so that leaves them with Craig's List and similar services. Not to mention, some stuff is impractical to ship, can you imagine how much it would cost to ship a large photography studio stand? BTW, I have a fair condition 06 Impala with 136K miles, only $2K, you pay shipping. :laugh:

I've bought and sold a lot of stuff on eBay and Craig's List over the years, but recently have mainly used eBay as a buyer, as eBay & PayPal fees really add up on higher ticket items. I find that I come out ahead if I sell the item on Craig's List for less than I would on eBay, and circumvent fees.

Prior to selling something, I look it up on eBay's completed listings to guestimate the average market value, even if I'm listing it on Craig's List. I then price it at the average market value and stipulate that the price is firm in my ad, which I think helps keep the low-ball offers to a minimum.

In recent years, many Police stations have set up a dedicated E-commerce location in their parking lot with a light and 24/7 video surveillance. I haven't met people at the Police station, but I've always met people in a well lit public location, and fortunately haven't had any issues, but I'm protected by the good Lord, and a gun for good measure.

I've bought a few things on FaceBook Market, but haven't sold anything on there yet, perhaps it's a better option than Craig's List, at least for selling. The key is to lookout for counterfeit cash.
 
^+1

I did check ebay for a sense of market value, did price to attract a local buy accordingly, and I did check for counterfeit cash. If you shine a flashlight through the bill you will see a U.S. President's image that is not printed on either side of the bill, if it is genuine.
 
Tom, thanks for posting this. It's nothing to be ashamed of. I've been a computer programmer for almost two decades, I've known what Google Voice is, and yet I have not heard of this particular scam, and I didn't know what was going to happen until I reached the end of your story. (Then again, I haven't done anything on Craigslist for like a decade either. I do use eBay though from time to time. Nothing against Craigslist. It is just that I am usually very specific about what I want to buy, and eBay has a wider set of sellers to help find that perfect item for myself.)

The only advice I can give to keep up with all of these scams is that if it doesn't make sense to you, then don't go along with it. I too would have been tempted to go along with it, and click it, even though it didn't make sense to me. "Why would a buyer need to verify my phone number before calling me? Why not just call me?" But we all feel the temptation to just go along with what someone is saying, instead of saying, "That doesn't make sense," because we fear looking stupid --- even in front of a perfect stranger. I've seen it in areas other than security. I've been involved in high-tech projects where people are batting around technical jargon because one person said it but most people in the meeting don't understand what it means. I try to always be the guy that says, "Wait, can you explain that to me," even if I risk looking stupid.

You could try to keep up with all the latest scams and memorize them, and that's fine, but I wouldn't rely on your ability to understand the bad. I would rely on your ability to understand the good. It's like someone once said, anticounterfeiters don't memorize all the ways a dollar bill might be forged. Instead they get to know what a genuine dollar bill looks like, inside and out, intimately, and trust that instead. So again, instead of trying to memorize all the signs of a bad buyer, focus on whether you feel like a buyer is a good one. That may cost you, because some people are just kind of shady or rub you the wrong way for random reasons, and they never end up being someone scamming you. But I think it's easier in the long run on my poor wee brain :)

If someone is getting all fancy, high-tech and complicated, that's a red flag. It should be simple. The caller should call you up on the phone, ask a few questions, maybe ask for some more pictures by regular email or text, then agree to meet you in front of that police station and pay cash --- and that's it.
 
Last edited:
combatentropy said:
The only advice I can give to keep up with all of these scams is that if it doesn't make sense to you, then don't go along with it. I too would have been tempted to go along with it, and click it, even though it didn't make sense to me. "Why would a buyer need to verify my phone number before calling me? Why not just call me?" But we all feel the temptation to just go along with what someone is saying, instead of saying, "That doesn't make sense," because we fear looking stupid --- even in front of a perfect stranger. I've seen it in areas other than security. I've been involved in high-tech projects where people are batting around technical jargon because one person said it but most people in the meeting don't understand what it means. I try to always be the guy that says, "Wait, can you explain that to me," even if I risk looking stupid.
Click to expand...

Thanks Combat. A few things to consider here:

1.) The reason a buyer has to be wary of a fake seller is the risk of being robbed. Buyer brings the cash. Sellers generally don't get robbed for merchandise in Craigslist scams. So at first, the request while unusual, seemed understandable and I thought was a new take on security since it came under the auspices of a trusted name Google, albeit an app I had not heard of, Voice. Obviously I was naïve and confident instead of vigilant.

2.) I never imagined that giving up a harmless code that I hadn't asked for myself could expose me to danger. In other words, I underestimated the craft of the scammer that was already in the midst of opening a Google Voice account with my phone number, and that by giving the code sent to me by Google, someone could be on the other end giving verification back to Google as the owner of my phone number.

3.) Fasten your seatbelt. The caller next told me the number I gave didn't work for the code. Would I give another number to try? At that point, I said, "just call me." But instead, the caller made a ridiculous request, "Is there someone else in the house with a phone, mother/father/sister/brother/wife?" That's the exact point when it was crystal clear there was no interest in my lens. I immediately went to investigating for scams matching this one, and found plenty about it, right away. But this was good because it also meant there were instructions on how to reclaim ownership of my identity with Google and bring it to a halt. I also filed an online police report with Arapahoe County Sheriff's Office, which was accepted and case number given, just in case there is criminal activity associated to my phone number or account.
 
Holy smokes. Anytime a potential buyer or seller had some complicated nonsense they wanted me to engage in, I just check right out. I've been buying and selling gear on eBay for over 20 years and I've never been scammed. Sure some buyers and sellers can be a pain in the azz, but it's still the best and safest place to buy and sell gear.
 
Chris Santucci said:
Holy smokes. Anytime a potential buyer or seller had some complicated nonsense they wanted me to engage in, I just check right out. I've been buying and selling gear on eBay for over 20 years and I've never been scammed. Sure some buyers and sellers can be a pain in the azz, but it's still the best and safest place to buy and sell gear.
Click to expand...

Not necessarily true. See post #6 above for details on the ebay scam.
 
You must log in or register to reply here.
Back
Top