Do your dd! Even with trusted rolex botiques ! Almost lost $32k.

[Harry-57]

That was close.

I haven't sold many watches or bought many from used dealers but I do make a point of using dealers I can meet face to face at their premises.

[travisb]

Wow! Close call! You can never do too much double and triple checking.

[HogwldFLTR]

I've been lucky to sell my watches to a brick and mortar AD. Return may be less but the risk is much less!!!

[1William]

Good information. Thanks for sharing.

[RichM]

Wow, that was close. I’m glad you caught it in time and that in the end, it all worked out for you.

Any way this could be reported to the police or some other agency?

Thanks for posting your story.

[Zach69SS]

Very Smart! That would have been a huge loss not to mention the grief and headache.
Watch your 6 folks the level of scams everywhere is incredible.

[BroncoOne]

Wow. Thanks for sharing and I’m happy that you were able to figure this out.

[Guppydriver]

Help a fifty-something out please.

What exactly is 2 FA and how do I enable it?

[Deroya]

Originally Posted by Guppydriver

Help a fifty-something out please.

What exactly is 2 FA and how do I enable it?

I’m guessing he means 2 factor authentication, but that’s null & void when you’re talking to a reputable boutique via their official email.


Sent from my iPhone using Tapatalk

[77T]

Yes 2FA is 2 Factor Auth.

The mistakes were 2 fold though because he sidestepped all TRF measures to ensure comms were authentic.


Sent from my iPhone using Tapatalk Pro

[Deroya]

Originally Posted by 77T

Yes 2FA is 2 Factor Auth.

The mistakes were 2 fold though because he sidestepped all TRF measures to ensure comms were authentic.


Sent from my iPhone using Tapatalk Pro

I’m not sure what you mean, the measures on TRF’s WARNO specifically says “only buy from trusted sellers” and don’t click any links.

- There were no links involved here at all.

- I was emailing the trusted seller’s email advertised here & his other web pages.

This is why I posted this… In theory, I followed those warnings and did my own “DD” as the forum recommends, but that can mean an array of different things. I caught the phone number late. It means noone is safe even if you think you are… this was all thru a “trusted” boutiques official email address to which he admitted to me was hacked….


Sent from my iPhone using Tapatalk

[77T]

Originally Posted by Deroya

I’m not sure what you mean, the measures on TRF’s WARNO specifically says “only buy from trusted sellers” and don’t click any links.

- There were no links involved here at all.

- I was emailing the trusted seller’s email advertised here & his other web pages.

This is why I posted this… In theory, I followed those warnings and did my own “DD” as the forum recommends, but that can mean an array of different things. I caught the phone number late. It means noone is safe even if you think you are… this was all thru a “trusted” boutiques official email address to which he admitted to me was hacked….

I should have clarified my brief answer to the other member by saying "sidestepped TRF measures that ensure comms were authentic". I should add that neither Oscar or you are to blame - it's not about that.

What I mean is that emails and texts are fraught with risk. In this case you were the seller and were seeking a buyer but the point is the same. The scammer had taken over Oscar's addy & SMS. That's why we use PMs. Had you PM'd Oscar you'd have been blocked by a full inbox and none of this could occur - you'd move on to another dealer.

If one chooses to use PMs on TRF for comms with a 2FA enabled dealer then this type of situation is virtually impossible to foist by a scammer.

According to Microsoft, MFA can reduce the risk of compromise by 99% overall.

And even if credentials have been leaked, by 98%.

Of course no links were involved since you were emailing.

Hope that helps anyone who was confused by my earlier reply.


Sent from my iPhone using Tapatalk Pro

[Brich436]

Your email is the gateway to everything in your life. If they can penetrate that they can reset most of your accounts, steal your personal information and more. I recommend using a VERY strong password AND an authentication app (Google or Microsoft authentication) to protect it. Finally, remove any cell phone SMS reset for email. Its rare but a sophisticated hacker will attack your SIM in your cell phone and take it over to reset your accounts.

[Deroya]

Originally Posted by 77T

I should have clarified my brief answer to the other member by saying "sidestepped TRF measures that ensure comms were authentic". I should add that neither Oscar or you are to blame - it's not about that.

What I mean is that emails and texts are fraught with risk. In this case you were the seller and were seeking a buyer but the point is the same. The scammer had taken over Oscar's addy & SMS. That's why we use PMs. Had you PM'd Oscar you'd have been blocked by a full inbox and none of this could occur - you'd move on to another dealer.

If one chooses to use PMs on TRF for comms with a 2FA enabled dealer then this type of situation is virtually impossible to foist by a scammer.

According to Microsoft, MFA can reduce the risk of compromise by 99% overall.

And even if credentials have been leaked, by 98%.

Of course no links were involved since you were emailing.

Hope that helps anyone who was confused by my earlier reply.


Sent from my iPhone using Tapatalk Pro

I understand now, thanks.

To be fair, even after PMing a person on either end, it usually transfers to email or texting for pics etc. Ive also had better luck with some of the bigger names with email/texting direct. PM sometimes takes forever or they dont respond at all. Hence why they list their emails and phone # on the ads for people to do this option as means of comms. But yes that could have probably eliminated this from happening, though if the inbox is full, most buyers will probably go direct to them via email or phone.

I guess the bigger question is.. why does TRF allow for inactive boutiques to be listed as trusted sellers? 2 out of the 7 listed haven't listed a watch in over 4 years. This is a small detail that many may miss...

[huncho]

Originally Posted by Deroya

I understand now, thanks.

To be fair, even after PMing a person on either end, it usually transfers to email or texting for pics etc. Ive also had better luck with some of the bigger names with email/texting direct. PM sometimes takes forever or they dont respond at all. Hence why they list their emails and phone # on the ads for people to do this option as means of comms. But yes that could have probably eliminated this from happening, though if the inbox is full, most buyers will probably go direct to them via email or phone. I guess the bigger question is.. why does TRF allow for inactive boutiques to be listed as trusted sellers?

i think the point is if you PM a seller with 2 FA here and they switch to email you know its 100% them, whereas just emailing them off the bat could end up with what you experienced. i've always started with a PM here then moved to text/emails but then again this could easily happen if you return to the seller later and just skip the PM

also if they're still actively posting on here then you know the email/phone number is correct and not hacked but the scary part here is that the IG account had the same email

[77T]

Originally Posted by Deroya

I guess the bigger question is.. why does TRF allow for inactive boutiques to be listed as trusted sellers? 2 out of the 7 listed haven't listed a watch in over 4 years. This is a small detail that many may miss...

In another post I also touched on this point.

A neglected Boutique is something worth addressing. But that fact, in and of itself, isn't causal. Before we had Boutiques a dormant seller account had some risk.
That's where 2FA comes in.


Sent from my iPhone using Tapatalk Pro

[Deroya]

Originally Posted by huncho

i think the point is if you PM a seller with 2 FA here and they switch to email you know its 100% them, whereas just emailing them off the bat could end up with what you experienced. i've always started with a PM here then moved to text/emails but then again this could easily happen if you return to the seller later and just skip the PM

also if they're still actively posting on here then you know the email/phone number is correct and not hacked but the scary part here is that the IG account had the same email

Agree, and exactly to the latter-piece of your post. This is why I made this thread, while I understand there are 10 ways to skin a cat and I could have probably done things differently, the bottom line is it still happened with their official email and it could happen to anyone...

I also checked the "whos who" forum and not much recently (this was also a flag), but there was one about 6 months ago and the feedback was "Oscar is the best in the business, yes you can trust him."

Some people would take that and run with it.. but the military in me decided to dig deeper. Really this was to bring awareness to direct emailing, but even texting doesn't seem safe to me these days. And worse thing it seemingly can happen to any of the trusted sellers.

Again, Not sure why 2 inactive botiques are still listed as active on here, I think that poses a threat and a neon-sign opening for scammers to jump in.

[brandrea]

Originally Posted by huncho

i think the point is if you PM a seller with 2 FA here and they switch to email you know its 100% them, whereas just emailing them off the bat could end up with what you experienced. i've always started with a PM here then moved to text/emails but then again this could easily happen if you return to the seller later and just skip the PM

also if they're still actively posting on here then you know the email/phone number is correct and not hacked but the scary part here is that the IG account had the same email

That’s very wise, but honestly I’d most likely have done the same as the OP for the reasons they mention. Good lessons all around

[JRell]

I know I am beating a dead horse here, but man I can’t imagine doing anything like this, selling or buying, online especially taking about 32k at stake. I’d even rather get less money locally in a store vs risking it online.

[Guppydriver]

Originally Posted by 77T

I should have clarified my brief answer to the other member by saying "sidestepped TRF measures that ensure comms were authentic". I should add that neither Oscar or you are to blame - it's not about that.

What I mean is that emails and texts are fraught with risk. In this case you were the seller and were seeking a buyer but the point is the same. The scammer had taken over Oscar's addy & SMS. That's why we use PMs. Had you PM'd Oscar you'd have been blocked by a full inbox and none of this could occur - you'd move on to another dealer.

If one chooses to use PMs on TRF for comms with a 2FA enabled dealer then this type of situation is virtually impossible to foist by a scammer.

According to Microsoft, MFA can reduce the risk of compromise by 99% overall.

And even if credentials have been leaked, by 98%.

Of course no links were involved since you were emailing.

Hope that helps anyone who was confused by my earlier reply.


Sent from my iPhone using Tapatalk Pro

Ugh... I hate sounding stupid and I don't like wasting your guys' time educating me about non watch stuff.

But..

I understand what 2 FA stands for but isn't it the thing that sends me a number to my phone when I log in from, say, an ipad or laptop? That's it right? How do we use 2FA when talking to trusted sellers?

Also Paul, are you saying we should only use DM's through TRF to communicate with trusted sellers? I've had transactions with Thanh and Patrick and I always just texted the phone number on the forum listing or from their website. I just emailed Amir last week with questions about a watch.

Was I taking unnecessary risk doing that?

[77T]

Originally Posted by Guppydriver

Ugh... I hate sounding stupid and I don't like wasting your guys' time educating me about non watch stuff.

But..

I understand what 2 FA stands for but isn't it the thing that sends me a number to my phone when I log in from, say, an ipad or laptop? That's it right? How do we use 2FA when talking to trusted sellers?

Also Paul, are you saying we should only use DM's through TRF to communicate with trusted sellers? I've had transactions with Thanh and Patrick and I always just texted the phone number on the forum listing or from their website. I just emailed Amir last week with questions about a watch.

Was I taking unnecessary risk doing that?

PM is the best first method if you don't already have a relationship with a dealer but not a requirement.

2FA comes in many forms. For example, texting a code to a known, registered cell phone #. Or for less urgent authentication, to an email address.

However both of those methods require some additional bookkeeping for system admins.

Therefore, Steve and the Mods manage using a public token generator like Google Authenticator or another like Authy. It's easy to use, you get a challenge screen and then go to the app or website to get the token. Enter it and you're into TRF.

To save time, you can look at the stickies on TRF about 2FA and/or read more about it on those 2 token generators I mentioned.

The day Steve launched it I was on board.


Sent from my iPhone using Tapatalk Pro

[Deroya]

Originally Posted by Guppydriver

Ugh... I hate sounding stupid and I don't like wasting your guys' time educating me about non watch stuff.

But..

I understand what 2 FA stands for but isn't it the thing that sends me a number to my phone when I log in from, say, an ipad or laptop? That's it right? How do we use 2FA when talking to trusted sellers?

Also Paul, are you saying we should only use DM's through TRF to communicate with trusted sellers? I've had transactions with Thanh and Patrick and I always just texted the phone number on the forum listing or from their website. I just emailed Amir last week with questions about a watch.

Was I taking unnecessary risk doing that?

To answer your very last question- yes


Sent from my iPhone using Tapatalk

[troybell]

Thank you for sharing and glad to hear you activated your military skills dug deeper.

[alllexandru]

That was a close call, glad it ended well for you OP.

[Deroya]

Originally Posted by troybell

Thank you for sharing and glad to hear you activated your military skills dug deeper.

Originally Posted by alllexandru

That was a close call, glad it ended well for you OP.

Thank you!

[eurofunk]

Certainly frightening! The same thing happened to me between an AD in Texas. Went to the boutique in person, they gave me a name card with email and everything. After many exchanges with the correct email, boutique claims they were not the one who were corresponding with me.

It’s either their email was really hacked and intercepted by hackers or the store themselves are pulling a fast one (which the cops say could be an insider job) Either way, have a very bad taste with that particular AD in Fort Worth if anyone is wondering which AD this is. Be cautious and never deal via email.

[L_S_SHOE]

Yikes. Well done figuring this out.

I’ve bought watches from trusted sellers on TRF but never sold, but I have bought and sold other things on other forums.

I’ve never shipped an item without payment upfront, and I’m sure the seller who sold me my last watch on TRF would not have shipped me the watch unless I paid him upfront. That’s just part of the deal buying watches online.

My question is, how was this guy expecting make money off of this scam if he was going to have to pay you upfront for those watches?

I mean this sincerely, I’m just trying to understand how it works.


Sent from my iPhone using Tapatalk

[Deroya]

Originally Posted by L_S_SHOE

Yikes. Well done figuring this out.

I’ve bought watches from trusted sellers on TRF but never sold, but I have bought and sold other things on other forums.

I’ve never shipped an item without payment upfront, and I’m sure the seller who sold me my last watch on TRF would not have shipped me the watch unless I paid him upfront. That’s just part of the deal buying watches online.

My question is, how was this guy expecting make money off of this scam if he was going to have to pay you upfront for those watches?

I mean this sincerely, I’m just trying to understand how it works.


Sent from my iPhone using Tapatalk

When you sell watches to TDs, 99.9% of the time you need to ship them the watches first and they do not pay you until after they inspect them. I’ve done it this way before and that’s how most on this page do it as they won’t assume that risk until they do a proper inspection.


Sent from my iPhone using Tapatalk

[Deroya]

Originally Posted by eurofunk

Certainly frightening! The same thing happened to me between an AD in Texas. Went to the boutique in person, they gave me a name card with email and everything. After many exchanges with the correct email, boutique claims they were not the one who were corresponding with me.

It’s either their email was really hacked and intercepted by hackers or the store themselves are pulling a fast one (which the cops say could be an insider job) Either way, have a very bad taste with that particular AD in Fort Worth if anyone is wondering which AD this is. Be cautious and never deal via email.

That is crazy, and honestly I had thoughts of the same.


Sent from my iPhone using Tapatalk

[00Seven]

Scary stuff. Glad you caught it before mailing!