Do your dd! Even with trusted rolex botiques ! Almost lost $32k.

[Deroya]

Bottom line up front – The actual trusted boutique in question here (BODYBUMP aka Oscar/International Watch Vault) did NOT attempt to scam me.

Posting in 2 forums sections for awareness (general and watchout) as this is very serious.

I am still in a bit of shock since this happened last week but have taken time to reflect. I am a 10-year TRF member, bought and sold on here many times. I decided to sell a few of my personal watches as of late, and took it to TRF to post them, but also reach out to some trusted dealers listed as “boutiques” to see what they would offer for quick sale. I wrote a canned email with info on all my pieces to all of them. “Bodybump” was one of the several, who appeared to be a HIGHLY trusted seller on TRF as well as a heavy social media presence and active store. (Still listed as a boutique today).

I emailed the email on his most recent posting, but also the SAME email that matched his IG/FB business accounts. I was responded to normally with fair dealer prices to which I decided to move forward with. We agreed on a deal via email for him to buy 3 watches for $32.5K and I told him to text me to move forward with the label etc.

I boxed up the watches, and prepared them for shipment and before I sent the invoice for the label, I decided to do some extra DD. Regardless the fact he emailed me from his real account, and he was an established TD on TRF. It was here some things started to not add up. The biggest catch I had was the phone number he was texting me on was different than what was listed on his ad/social media pages, I would not have caught this if the area codes were the same. Further digging revealed his state for shipping was different than what I matched his business to.

I asked this person texting me, why is the # different? And they stated that was a business phone # and he was texting me on his personal line. I asked him to text me from the business phone to verify this and he stalled/diverted the conversation.

I then texted the business #, and the REAL Oscar verifies it was NOT him the whole time and his email must have been hacked? We exchanged a dozen or so emails over 2-3 days on his REAL business email account and the scammer I guess deleted everything in and out? The scammer also texted me fake drivers license info. I can share screenshots of all of it for anyone interested. I notified mods on the forum immediately and the dealer himself who apologized and said he would work out the hacking problem.

Regardless--- This SMALL detail prevented me from taking a $32.5K loss. The real Oscar seems awesome, but please….TRIPLE check everything, even if they are trusted “boutiques”. Do anything you can to ensure you are dealing with the actual dealer, because this would have been a catastrophic loss for me, and I would hate to hear it happened to someone else.

Stay safe out there.

[GGGMT]

Whoa. That is a nasty story!


Sent from my iPhone using Tapatalk

[Andad]

Have you reported this to the mods?

[77T]

Originally Posted by Andad

Have you reported this to the mods?

Yes - that was mentioned in the narrative.

This is puzzling because if Oscar's email was hacked, then there must be many more people in peril.

The OP goes into detail, but the best due diligence is for the seller to have 2FA enabled and use PMs as a secure measure.


Sent from my iPhone using Tapatalk Pro

[Andad]

Old age Paul.

[brandrea]

Geepers, that’s crazy. I could’ve easily fell for that had I been in your shoes. Glad you averted the scam OP

I’ve only ever done face to face transactions except for one purchased through a gray dealer here.

Although face to face has its drawbacks, I think I’ll continue that way if it’s a watch I can’t get from an AD.

[77T]

Originally Posted by Old Expat Beast

From what I can see, Bodybump doesn't use his Boutique space and hasn't listed any watches for sale here since March 2020.

Originally Posted by padi56

Have to agree Adam and its always up to the buyer to research any sale to anyone on forum or retail shop before parting with his/her money so all buyers be fully aware.

Yes - I agree guys. An aspect I didn't elaborate upon adequately is worth repeating...

The OP reached out to Oscar using email and also used text messaging. The OP wanted to sell some watches.

So the entire episode happened outside of the TRF realm. Then, when the alleged ruse by the scammer fizzled it was reported here.

Nobody can PM Oscar via TRF because his mailbox is full. The 64,000 dollar question is whether Boutiques that are idle for years, as well as their listings, should be eliminated to avoid such situations.

Oscar's been a tremendous supporter of TRF so this isn't any slam against him. Just a question we hadn't thought about perhaps.

PS: Oscar hasn't been active on any FB/IG sales platform since May 29th -
Sent from my iPhone using Tapatalk Pro

[Deroya]

Originally Posted by 77T

Yes - I agree guys. An aspect I didn't elaborate upon adequately is worth repeating...

The OP reached out to Oscar using email and also used text messaging. The OP wanted to sell some watches.

So the entire episode happened outside of the TRF realm. Then, when the alleged ruse by the scammer fizzled it was reported here.

Nobody can PM Oscar via TRF because his mailbox is full. The 64,000 dollar question is whether Boutiques that are idle for years, as well as their listings, should be eliminated to avoid such situations.

Oscar's been a tremendous supporter of TRF so this isn't any slam against him. Just a question we hadn't thought about perhaps.

PS: Oscar hasn't been active on any FB/IG sales platform since May 29th -
Sent from my iPhone using Tapatalk Pro

It started here on TRF, I found his boutique on here and emailed him via the info listed on here.


Sent from my iPhone using Tapatalk

[JSCP]

Lucky! Glad you did all the right checking.

There are only a couple of trusted dealers here that i “trust” from experience.

Sometimes a lower offer from a 100% checked dealer is bet.

[enjoythemusic]

Wow, great catch OP! Glad you discovered the anomaly.

[Harry-57]

That was close.

I haven't sold many watches or bought many from used dealers but I do make a point of using dealers I can meet face to face at their premises.

[travisb]

Wow! Close call! You can never do too much double and triple checking.

[HogwldFLTR]

I've been lucky to sell my watches to a brick and mortar AD. Return may be less but the risk is much less!!!

[1William]

Good information. Thanks for sharing.

[RichM]

Wow, that was close. I’m glad you caught it in time and that in the end, it all worked out for you.

Any way this could be reported to the police or some other agency?

Thanks for posting your story.

[Zach69SS]

Very Smart! That would have been a huge loss not to mention the grief and headache.
Watch your 6 folks the level of scams everywhere is incredible.

[BroncoOne]

Wow. Thanks for sharing and I’m happy that you were able to figure this out.

[Guppydriver]

Help a fifty-something out please.

What exactly is 2 FA and how do I enable it?

[Deroya]

Originally Posted by Guppydriver

Help a fifty-something out please.

What exactly is 2 FA and how do I enable it?

I’m guessing he means 2 factor authentication, but that’s null & void when you’re talking to a reputable boutique via their official email.


Sent from my iPhone using Tapatalk

[77T]

Yes 2FA is 2 Factor Auth.

The mistakes were 2 fold though because he sidestepped all TRF measures to ensure comms were authentic.


Sent from my iPhone using Tapatalk Pro

[Deroya]

Originally Posted by 77T

Yes 2FA is 2 Factor Auth.

The mistakes were 2 fold though because he sidestepped all TRF measures to ensure comms were authentic.


Sent from my iPhone using Tapatalk Pro

I’m not sure what you mean, the measures on TRF’s WARNO specifically says “only buy from trusted sellers” and don’t click any links.

- There were no links involved here at all.

- I was emailing the trusted seller’s email advertised here & his other web pages.

This is why I posted this… In theory, I followed those warnings and did my own “DD” as the forum recommends, but that can mean an array of different things. I caught the phone number late. It means noone is safe even if you think you are… this was all thru a “trusted” boutiques official email address to which he admitted to me was hacked….


Sent from my iPhone using Tapatalk

[77T]

Originally Posted by Deroya

I’m not sure what you mean, the measures on TRF’s WARNO specifically says “only buy from trusted sellers” and don’t click any links.

- There were no links involved here at all.

- I was emailing the trusted seller’s email advertised here & his other web pages.

This is why I posted this… In theory, I followed those warnings and did my own “DD” as the forum recommends, but that can mean an array of different things. I caught the phone number late. It means noone is safe even if you think you are… this was all thru a “trusted” boutiques official email address to which he admitted to me was hacked….

I should have clarified my brief answer to the other member by saying "sidestepped TRF measures that ensure comms were authentic". I should add that neither Oscar or you are to blame - it's not about that.

What I mean is that emails and texts are fraught with risk. In this case you were the seller and were seeking a buyer but the point is the same. The scammer had taken over Oscar's addy & SMS. That's why we use PMs. Had you PM'd Oscar you'd have been blocked by a full inbox and none of this could occur - you'd move on to another dealer.

If one chooses to use PMs on TRF for comms with a 2FA enabled dealer then this type of situation is virtually impossible to foist by a scammer.

According to Microsoft, MFA can reduce the risk of compromise by 99% overall.

And even if credentials have been leaked, by 98%.

Of course no links were involved since you were emailing.

Hope that helps anyone who was confused by my earlier reply.


Sent from my iPhone using Tapatalk Pro

[Deroya]

Originally Posted by 77T

I should have clarified my brief answer to the other member by saying "sidestepped TRF measures that ensure comms were authentic". I should add that neither Oscar or you are to blame - it's not about that.

What I mean is that emails and texts are fraught with risk. In this case you were the seller and were seeking a buyer but the point is the same. The scammer had taken over Oscar's addy & SMS. That's why we use PMs. Had you PM'd Oscar you'd have been blocked by a full inbox and none of this could occur - you'd move on to another dealer.

If one chooses to use PMs on TRF for comms with a 2FA enabled dealer then this type of situation is virtually impossible to foist by a scammer.

According to Microsoft, MFA can reduce the risk of compromise by 99% overall.

And even if credentials have been leaked, by 98%.

Of course no links were involved since you were emailing.

Hope that helps anyone who was confused by my earlier reply.


Sent from my iPhone using Tapatalk Pro

I understand now, thanks.

To be fair, even after PMing a person on either end, it usually transfers to email or texting for pics etc. Ive also had better luck with some of the bigger names with email/texting direct. PM sometimes takes forever or they dont respond at all. Hence why they list their emails and phone # on the ads for people to do this option as means of comms. But yes that could have probably eliminated this from happening, though if the inbox is full, most buyers will probably go direct to them via email or phone.

I guess the bigger question is.. why does TRF allow for inactive boutiques to be listed as trusted sellers? 2 out of the 7 listed haven't listed a watch in over 4 years. This is a small detail that many may miss...

[huncho]

Originally Posted by Deroya

I understand now, thanks.

To be fair, even after PMing a person on either end, it usually transfers to email or texting for pics etc. Ive also had better luck with some of the bigger names with email/texting direct. PM sometimes takes forever or they dont respond at all. Hence why they list their emails and phone # on the ads for people to do this option as means of comms. But yes that could have probably eliminated this from happening, though if the inbox is full, most buyers will probably go direct to them via email or phone. I guess the bigger question is.. why does TRF allow for inactive boutiques to be listed as trusted sellers?

i think the point is if you PM a seller with 2 FA here and they switch to email you know its 100% them, whereas just emailing them off the bat could end up with what you experienced. i've always started with a PM here then moved to text/emails but then again this could easily happen if you return to the seller later and just skip the PM

also if they're still actively posting on here then you know the email/phone number is correct and not hacked but the scary part here is that the IG account had the same email

[77T]

Originally Posted by Deroya

I guess the bigger question is.. why does TRF allow for inactive boutiques to be listed as trusted sellers? 2 out of the 7 listed haven't listed a watch in over 4 years. This is a small detail that many may miss...

In another post I also touched on this point.

A neglected Boutique is something worth addressing. But that fact, in and of itself, isn't causal. Before we had Boutiques a dormant seller account had some risk.
That's where 2FA comes in.


Sent from my iPhone using Tapatalk Pro

[Guppydriver]

Originally Posted by 77T

I should have clarified my brief answer to the other member by saying "sidestepped TRF measures that ensure comms were authentic". I should add that neither Oscar or you are to blame - it's not about that.

What I mean is that emails and texts are fraught with risk. In this case you were the seller and were seeking a buyer but the point is the same. The scammer had taken over Oscar's addy & SMS. That's why we use PMs. Had you PM'd Oscar you'd have been blocked by a full inbox and none of this could occur - you'd move on to another dealer.

If one chooses to use PMs on TRF for comms with a 2FA enabled dealer then this type of situation is virtually impossible to foist by a scammer.

According to Microsoft, MFA can reduce the risk of compromise by 99% overall.

And even if credentials have been leaked, by 98%.

Of course no links were involved since you were emailing.

Hope that helps anyone who was confused by my earlier reply.


Sent from my iPhone using Tapatalk Pro

Ugh... I hate sounding stupid and I don't like wasting your guys' time educating me about non watch stuff.

But..

I understand what 2 FA stands for but isn't it the thing that sends me a number to my phone when I log in from, say, an ipad or laptop? That's it right? How do we use 2FA when talking to trusted sellers?

Also Paul, are you saying we should only use DM's through TRF to communicate with trusted sellers? I've had transactions with Thanh and Patrick and I always just texted the phone number on the forum listing or from their website. I just emailed Amir last week with questions about a watch.

Was I taking unnecessary risk doing that?

[77T]

Originally Posted by Guppydriver

Ugh... I hate sounding stupid and I don't like wasting your guys' time educating me about non watch stuff.

But..

I understand what 2 FA stands for but isn't it the thing that sends me a number to my phone when I log in from, say, an ipad or laptop? That's it right? How do we use 2FA when talking to trusted sellers?

Also Paul, are you saying we should only use DM's through TRF to communicate with trusted sellers? I've had transactions with Thanh and Patrick and I always just texted the phone number on the forum listing or from their website. I just emailed Amir last week with questions about a watch.

Was I taking unnecessary risk doing that?

PM is the best first method if you don't already have a relationship with a dealer but not a requirement.

2FA comes in many forms. For example, texting a code to a known, registered cell phone #. Or for less urgent authentication, to an email address.

However both of those methods require some additional bookkeeping for system admins.

Therefore, Steve and the Mods manage using a public token generator like Google Authenticator or another like Authy. It's easy to use, you get a challenge screen and then go to the app or website to get the token. Enter it and you're into TRF.

To save time, you can look at the stickies on TRF about 2FA and/or read more about it on those 2 token generators I mentioned.

The day Steve launched it I was on board.


Sent from my iPhone using Tapatalk Pro

[Deroya]

Originally Posted by Guppydriver

Ugh... I hate sounding stupid and I don't like wasting your guys' time educating me about non watch stuff.

But..

I understand what 2 FA stands for but isn't it the thing that sends me a number to my phone when I log in from, say, an ipad or laptop? That's it right? How do we use 2FA when talking to trusted sellers?

Also Paul, are you saying we should only use DM's through TRF to communicate with trusted sellers? I've had transactions with Thanh and Patrick and I always just texted the phone number on the forum listing or from their website. I just emailed Amir last week with questions about a watch.

Was I taking unnecessary risk doing that?

To answer your very last question- yes


Sent from my iPhone using Tapatalk

[Brich436]

Your email is the gateway to everything in your life. If they can penetrate that they can reset most of your accounts, steal your personal information and more. I recommend using a VERY strong password AND an authentication app (Google or Microsoft authentication) to protect it. Finally, remove any cell phone SMS reset for email. Its rare but a sophisticated hacker will attack your SIM in your cell phone and take it over to reset your accounts.

[JRell]

I know I am beating a dead horse here, but man I can’t imagine doing anything like this, selling or buying, online especially taking about 32k at stake. I’d even rather get less money locally in a store vs risking it online.