4 ms·

I lost $2k in a Facebook scam that I'm really not proud of. A company spoofed BitMain's FB page and ran ads for their newest AntMiner models saying they had a b

I lost $2k in a Facebook scam that I'm really not proud of. A company spoofed BitMain's FB page and ran ads for their newest AntMiner models saying they had a batch that was ready to ship in limited supply. The BitMain FB account looked legit. The website itself obviously had an SSL cert (and was a pixel for pixel clone of their real site, except the product was in stock), but what I didn't notice was the microscopically small presence of a dot over one of the characters. It was an IDN homograph attack, and looking at the website and not noticing the unicode character, everything else looked right. The fact that they took BTC as payment didn't raise any red flags either, because, you know, BitMain does. I'm mostly infuriated at Facebook for not validating the company name or doing anything resembling protecting their audience. I lent them too much credibility because it looked like they were ads from the real company's page, and so I let down my guard elsewhere. I've never otherwise been hacked or scammed, and I know allllll of the basics to look out for, but this one still infuriates me for making a fool of myself.

jankeymeulen 6y ago
What browser are you using that is displaying IDN unaltered?
colejohnson66 6y ago
Not blaming you at all, but a good tip is to look at the number of “likes” a page has and see if it sounds reasonable. Definitely not foolproof though.
- searchableguy 6y ago
  Nope. Easily faked. There are centres where people get paid $5-10/day to like, follow, comment, etc here. They use bots too. You can purchase an official ID under $10. Many Indian marketing firms use them.
  - colejohnson66 6y ago
    Oh absolutely. I admit it’s not foolproof, but if a page named “Amazon” only had 100,000 likes, I’d be a bit suspicious. For comparison, the actual Amazon FB page has 19 million likes IIRC.
    - searchableguy 6y ago
      I have been scammed only once by a company so far. It was oyo (another gem run by softbank). They sold all my information, made me paid twice and left with such a poor service. Few of their actual employees were the scammers along with the hotel manager (likely) so I wasn't suspicious... because ya know, you are supposed to trust official communication portals. It opened my eyes to how far scam can go. A billion dollar valuation or millions of likes says nothing. I filed a complaint but have yet to follow up due to covid. It was a visit due to medical reasons so we didn't focus too much on it.
foobarian 6y ago
Every now and then I catch myself not doing this but by and large I always type out URLs for ads/emailed links by hand. It takes out a lot of the attack surface for me, and it looks like in this case it would have worked.
deleted 6y ago
[deleted]
tha0x4 6y ago
And this is why BitCoin will never fully take off. If you made this transaction with your credit card, you could call up your bank two weeks later and get your $2k back that day. BitCoin? Kiss that virtual fool's gold goodbye.
- Dahoon 6y ago
  6 months by law in the EU.
  - tha0x4 6y ago
    120 days in the US by law, unless I'm mistaken.
- reportgunner 6y ago
  BIT-Coin is not a replacement for credit card so it's like comparing apples to oranges. Think of it more like cash. If you give someone 2k in cash nobody is going to find that person and refund you.
  - tha0x4 6y ago
    >BIT-Coin is not a replacement for credit card so it's like comparing apples to oranges. Except it's being used almost exactly like credit cards, so it is an apples to apples comparison. >Think of it more like cash. If you give someone 2k in cash nobody is going to find that person and refund you. Wrong. Tons of cash and debit card transactions can be undone, and banks can and will give you money back from fraudulent transactions.
  - tha0x5 6y ago
    >BIT-Coin is not a replacement for credit card so it's like comparing apples to oranges. Except it's being used almost exactly like credit cards, so it is an apples to apples comparison. >Think of it more like cash. If you give someone 2k in cash nobody is going to find that person and refund you. Wrong. Tons of cash and debit card transactions can be undone, and banks can and will give you money back from fraudulent transactions.
GoblinSlayer 6y ago
I wouldn't bet on proofreading even if the address was all ascii. It's inherently unsafe to click a random link, think you ended up in the right place and start doing all sorts of things.

jankeymeulen 6y ago

What browser are you using that is displaying IDN unaltered?

colejohnson66 6y ago

Not blaming you at all, but a good tip is to look at the number of “likes” a page has and see if it sounds reasonable. Definitely not foolproof though.

searchableguy 6y ago
Nope. Easily faked. There are centres where people get paid $5-10/day to like, follow, comment, etc here. They use bots too. You can purchase an official ID under $10. Many Indian marketing firms use them.
- colejohnson66 6y ago
  Oh absolutely. I admit it’s not foolproof, but if a page named “Amazon” only had 100,000 likes, I’d be a bit suspicious. For comparison, the actual Amazon FB page has 19 million likes IIRC.
  - searchableguy 6y ago
    I have been scammed only once by a company so far. It was oyo (another gem run by softbank). They sold all my information, made me paid twice and left with such a poor service. Few of their actual employees were the scammers along with the hotel manager (likely) so I wasn't suspicious... because ya know, you are supposed to trust official communication portals. It opened my eyes to how far scam can go. A billion dollar valuation or millions of likes says nothing. I filed a complaint but have yet to follow up due to covid. It was a visit due to medical reasons so we didn't focus too much on it.

foobarian 6y ago

Every now and then I catch myself not doing this but by and large I always type out URLs for ads/emailed links by hand. It takes out a lot of the attack surface for me, and it looks like in this case it would have worked.

deleted 6y ago

[deleted]

tha0x4 6y ago

And this is why BitCoin will never fully take off. If you made this transaction with your credit card, you could call up your bank two weeks later and get your $2k back that day. BitCoin? Kiss that virtual fool's gold goodbye.

Dahoon 6y ago
6 months by law in the EU.
- tha0x4 6y ago
  120 days in the US by law, unless I'm mistaken.
reportgunner 6y ago
BIT-Coin is not a replacement for credit card so it's like comparing apples to oranges. Think of it more like cash. If you give someone 2k in cash nobody is going to find that person and refund you.
- tha0x4 6y ago
  >BIT-Coin is not a replacement for credit card so it's like comparing apples to oranges. Except it's being used almost exactly like credit cards, so it is an apples to apples comparison. >Think of it more like cash. If you give someone 2k in cash nobody is going to find that person and refund you. Wrong. Tons of cash and debit card transactions can be undone, and banks can and will give you money back from fraudulent transactions.
- tha0x5 6y ago
  >BIT-Coin is not a replacement for credit card so it's like comparing apples to oranges. Except it's being used almost exactly like credit cards, so it is an apples to apples comparison. >Think of it more like cash. If you give someone 2k in cash nobody is going to find that person and refund you. Wrong. Tons of cash and debit card transactions can be undone, and banks can and will give you money back from fraudulent transactions.

GoblinSlayer 6y ago

I wouldn't bet on proofreading even if the address was all ascii. It's inherently unsafe to click a random link, think you ended up in the right place and start doing all sorts of things.