Got scammed by Catardat

tasburrfoot said:

Is it possible these accounts were compromised?

Click to expand...

Yes, it looks like some of them were compromised - it also appears some of them were sold. I've had some support tickets from potentially the original owners of these accounts - catardat included - saying that they lost access to the accounts.

I'm going through all of these in depth and doing verification checks to ensure that we are actually talking to the original account owners. We're also looking into what's happened. We had a spate of compromised accounts shortly after the yahoo hack and also after a couple of other forums were compromised. In most of the cases I've looked at, I've managed to confirm that the source of the problem was either a compromised email account or login details duplicated across different sites.

Because several of the accounts are involved in SL disputes, we're going into a lot more depth before restoring the account to the original owners. It's likely to take a little while to get this straightened out but I'll updated as and when we find definitive information.

I've restored @catardat's account to the original owner. It appears that the account was compromised at some point between March 24th - 27th and anything posted or sent by Catardat between 24th - 29th March should be disregarded.

So what happen to his victims like me?
Im feeling sorry for him by losing account control, but he must have responsibility, right?

vltn3391 said:

So what happen to his victims like me?
Im feeling sorry for him by losing account control, but he must have responsibility, right?

Click to expand...

And I'm very sorry you got scammed by someone but I don't see how @catardat has responsibility for this. We're trying to work out how the accounts were compromised but, so far, the ones I've looked at in depth were accessed due a couple of different reasons. One member said that his steam account was hacked into recently and he was using the same login details for it as he does here. Another member I spoke to last month said that they were cycling the same couple of passwords for several years and they've had a WF account compromised in the same way. We also had several accounts change hands after the yahoo breach and all but one member was using a yahoo email account.

We'll continue to investigate the issues but, for now, it seems to be due to a combination of email breaches, members not using two-factor authentication and a small group of people exploiting this.

If Catardat had used 2-factor-authentication, his account wouldn't have been compromised. However, the fact that someone took advantage of this is not his fault in any way at all.

In the meantime, we tell all members to do their due diligence. You conducted business on skype away from the forum, the member didn't even have a marketplace thread and then you paid in bitcoins which are untraceable and unrecoverable - all of this makes it difficult for us to help you. Just like Catardat getting hacked, it's not your fault that you were scammed. if we find the person responsible for this, we will do all we can to get this resolved for the members. However, we repeatedly say that you should NEVER use a payment method that can't be reversed.

In the meantime, to anyone who's reading this: please PLEASE make sure that you use two-factor authentication to keep your account secure and you DO YOUR DUE DILIGENCE before making deals with random people on the internet - WHOEVER they are.

vltn3391 said:

So what happen to his victims like me?
Im feeling sorry for him by losing account control, but he must have responsibility, right?

Click to expand...

Someone steals your car and runs over 4 people. Are you responsible?

Someone steals your Xbox One and uses it to kill the neighbor's dog. Are you responsible?

Someone steals your credit card info and uses it to fund terrorist operations. Are you responsible?

If someone stole your account details and used your account to scam people on here would you like to be held responsible?

alwaysinvisible said:

Someone steals your car and runs over 4 people. Are you responsible?

Someone steals your Xbox One and uses it to kill the neighbor's dog. Are you responsible?

Someone steals your credit card info and uses it to fund terrorist operations. Are you responsible?

If someone stole your account details and used your account to scam people on here would you like to be held responsible?

Click to expand...

My friend, im new in BHW so after your post i need to recheck BHW rule.
But im wondering : how about im a trusted account in BHW, i will go to new vps, new ip... and log in to this account, scam somebody in here. then i tell admin that my account was hacked, i have no responsibility and pls give back my account again.
Is this a new make money method?

alwaysinvisible said:

Someone steals your car and runs over 4 people. Are you responsible?

Click to expand...

AND YOU WILL NOT COMPLAIN TO POLICE UNTIL SOMEONE GET KILLED??

alwaysinvisible said:

Someone steals your credit card info and uses it to fund terrorist operations. Are you responsible?

Click to expand...

AND YOU WILL NOT CALL TO YOUR BANK TO LOCK YOUR CC UNTIL SOMEONE TRANSFER THE FUNDS TO TERRORIST OPERATIONS?

alwaysinvisible said:

If someone stole your account details and used your account to scam people on here would you like to be held responsible?

Click to expand...

AND YOU WILL NOT CONTACT TO MOD ABOUT THIS? UNTIL SOMEONE OPEN A SHITLIST, RIGHT??

vltn3391 said:

My friend, im new in BHW so after your post i need to recheck BHW rule.
But im wondering : how about im a trusted account in BHW, i will go to new vps, new ip... and log in to this account, scam somebody in here. then i tell admin that my account was hacked, i have no responsibility and pls give back my account again.
Is this a new make money method?

Click to expand...

The mods can tell when people are using vps, vpns, proxies, whatever. They are not that easy to fool. As proof, it took @Apricot a while to give the account back to the original owner. She had to do some deep investigation and vetting before she made this conclusion. It was not made lightly.

So, again, I ask: if you got your account details stolen, and your account was being used to scam someone, would you want to be held responsible?

Don't try to be right. No one in their right mind would want to be held accountable for what was done with their stolen property.

You can't be held responsible for something that isn't your fault. He didn't have 2FA, he shared passwords across accounts, but he had nothing to do with what was done with his accounts.

You leave your safe open, someone takes your gun and kills a cat with it, are you gonna accept being arrested and tried for murder when you didn't commit the act?

Stop it.

vltn3391 said:

My friend, im new in BHW so after your post i need to recheck BHW rule.
But im wondering : how about im a trusted account in BHW, i will go to new vps, new ip... and log in to this account, scam somebody in here. then i tell admin that my account was hacked, i have no responsibility and pls give back my account again.
Is this a new make money method?

Click to expand...

The accused did not do what I highlighted in green. I 100% guarantee you that @Apricot knows that for sure. There is a lot of data that the Staff can see that would prove this is not what happened here.

Going forward, follow the advice that @Apricot shared.

1) Buy from the marketplace where the services are checked by a marketplace Moderator.
2) Do not pay in BTC/PP Friends and Family/Western Union or any other unrecoverable currency.
3) Do your business here on the forum and not via Skype/Slack/Telegram etc.

When in doubt or if you are buying something that is not offered in the Marketplace, hit up a Mod and see if they know the person and consider the person trustworthy. I am sure that all the staff members would be happy to check for you; I do that several times a week as it is and would be glad to do it for you as well.

editwork said:

AND YOU WILL NOT COMPLAIN TO POLICE UNTIL SOMEONE GET KILLED??


AND YOU WILL NOT CALL TO YOUR BANK TO LOCK YOUR CC UNTIL SOMEONE TRANSFER THE FUNDS TO TERRORIST OPERATIONS?


AND YOU WILL NOT CONTACT TO MOD ABOUT THIS? UNTIL SOMEONE OPEN A SHITLIST, RIGHT??

Click to expand...

First of all, stop yelling at me. Typing in all caps is for immature morons who want attention, not for people having a serious discussion.

Secondly, in every case you mentioned, the person is still not responsible. You call the police, they arrest the guy and charge him. Not you, the owner. Him, the person that committed the crime.

In the second and third case, some people genuinely do not pay attention to their things. If you saw a charge for $5000 on your account that you didn't make, of course you're going to call them and have security enacted. That doesn't mean you're responsible for what was done with the money.

Same thing with BHW account. Every user isn't on here all the time every day. The SL probably alerted him bc he hasn't been here in a while. That is not a crime.

Stop trying to be right, bc if it was your account that was compromised and the mods told you that you couldn't come back until you repaid all the money owed to people you didn't scam, you'd be pissed.

alwaysinvisible said:

First of all, stop yelling at me. Typing in all caps is for immature morons who want attention, not for people having a serious discussion.

Click to expand...

First of all, I am not yelling anyone i simply asked few questions in this case and yeah I can clearly see who is attention seeker in this thread.

alwaysinvisible said:

Stop trying to be right, bc if it was your account that was compromised and the mods told you that you couldn't come back until you repaid all the money owed to people you didn't scam, you'd be pissed.

Click to expand...

I am not trying to be Mr. right I wrote what i think because If it is my account
1. I will get a email notification when i change my password.
2. If you change your email you will get notification on your email.
3. If someone pmed you you will get email notification.

So this is what i am thinking. If that sounds appropriate on this thread MOD can remove my post.

Thanks

editwork said:

First of all, I am not yelling anyone i simply asked few questions in this case and yeah I can clearly see who is attention seeker in this thread.


I am not trying to be Mr. right I wrote what i think because If it is my account
1. I will get a email notification when i change my password.
2. If you change your email you will get notification on your email.
3. If someone pmed you you will get email notification.

So this is what i am thinking. If that sounds appropriate on this thread MOD can remove my post.

Thanks

Click to expand...

Yeah, and everyone doesn't get notifications for everything going on with their account. You can turn notifications off, especially if they annoy the fuck out of you.

Again, this is not a crime.

Everyone isn't like you. Don't assume that they are, and pass judgement solely based on what you have done.

vltn3391 said:

My friend, im new in BHW so after your post i need to recheck BHW rule.
But im wondering : how about im a trusted account in BHW, i will go to new vps, new ip... and log in to this account, scam somebody in here. then i tell admin that my account was hacked, i have no responsibility and pls give back my account again.
Is this a new make money method?

Click to expand...

Maybe YOU stole the account. Went to mcdonalds with a streambook. And now you have all the BTC and want paid again from the actual owner! 2x profit. That's the real new make money method.

editwork said:

First of all, I am not yelling anyone i simply asked few questions in this case and yeah I can clearly see who is attention seeker in this thread.


I am not trying to be Mr. right I wrote what i think because If it is my account
1. I will get a email notification when i change my password.
2. If you change your email you will get notification on your email.
3. If someone pmed you you will get email notification.

So this is what i am thinking. If that sounds appropriate on this thread MOD can remove my post.

Thanks

Click to expand...

There's nothing inappropriate about asking honest questions and we'll answer them wherever possible.

Not all our members have email notifications turned on, sometimes they go into a spam folder, sometimes members don't check an email account for a while.

In most of the compromised accounts, they were inactive for a varying period of time and were used a couple of times before the emails and passwords were changed. I think @bartosimpsonio described these as tracer bullets - done to see how quickly the breach would be detected and whether the account is a viable target.

The IP address that changed the details was the same one that has been used with other compromised senior accounts listed here. The person responsible has taken to using tor proxies and other networking sharing devices - however these aren't consistently opaque and with a bit of patience and monitoring, we can pick it up.

So no, @catardat did not use a vpn to scam anyone. Unless, somehow, he's the person responsible for breaching multiple other member's accounts, was able to move halfway across the world in less time than it'd take to fly there, make the trip multiple times in a couple of weeks and then hack into his own account so he'd have the pleasure of dealing with a shitlist and being accused of scamming someone.

Guys, i think this case is very interesting to me
1. About the responsibility :
i'm member of some mmo forums, members can show their Skype, ICQ, Yahoo... account in profile for trading and chatting( forum message is slower than skype message, right?). Then members must have control to these accounts, any scam problem with these accounts will be set to the forum accounts. So forum admin will ban this member. ( Scammer is scammer, we just dont want them to get new victim, right?)
So the point here is : MY FAULT, have not read BHW rule carefully,then as Apricot advice we will take action seriously next times.
2. To catardat and everyone:
We should protect our account better, to keep our reputation. Because when some one want to make deal with you, if they search in forum and found this topic, they will hesitate to make deal with you(even you are innocent person in this case).

alwaysinvisible said:

Someone steals your car and runs over 4 people. Are you responsible?

Someone steals your Xbox One and uses it to kill the neighbor's dog. Are you responsible?

Someone steals your credit card info and uses it to fund terrorist operations. Are you responsible?

If someone stole your account details and used your account to scam people on here would you like to be held responsible?

Click to expand...

If someone steals your credit card info and uses it, Mastercard or Visa, or your lender will cover the charges - because it's typically their fault(unless they've stolen your card), and if your stuff is stolen from a skimmer at an ATM or something, the vendor will cover the damages - or more than likely their Insurance policy will.

Also in real world business if your stuff is compromised you're at fault, and there are insurance policies to protect against this. Company's pay 100's of millions a year in reimbursements for issues like this one[1].

If the threat actor is caught, they are faced with judgements and court ordered restitution to pay back the damages. I don't know how you can think there is no accountability out there.

The fact that people got scammed because of his NEGLIGENCE(because that's what not having 2FA is, is negligence, it's not ignorance, or a mistake) should make him liable for the damages imo.

Just my 2 cents.

[1]http://www.brokerlink.ca/blog/cyber-insurance/

Companies have public liability insurance policies to protect themselves against other people's loss of earnings.

Private individuals often lose money taken out of their account if it's compromised and they did not inform their bank. However, they cannot be held accountable for promises made using their name falsely. For example, if you hack someone else's bank account and use it to charge someone for building a wall, the person who owned the account is not then expected to build the wall in your place. That just doesn't make sense.

Without insurance, the liability stops at the point of money exchanging hands. If Catardat had money taken from his paypal account, it's likely he'd lose it. However, he's not responsible for commitments made by someone falsely misrepresenting themselves as him.