Bitcoin Forum

Hi........I just wanted to give a brief summary of how I was recently scammed......mainly for informational purposes and so others can be on the look-out for this method. I also would like to hear if this is a fairly common way to scam people...or something rather new.     I know I will get a lot of ridicule for falling for such a blatant scam............but I thought this could be a learning experience, so hopefully I  won't get too many negative comments.   :P

The scammer saw my post and asked me if I had ICQ      (trading BTC for prepaid debit card codes)

I set up my ICQ, and we negotiated rates, etc. He was very professional, patient, and he said said "I'll go first."  (He would start the transaction)

He asked me to create a Bitcoin wallet on blockchain.info so he could see that I had the coins ready for trade. So I moved my coins to the blockchain wallet.

He then said that since he will be taking the risk by sending the codes first, he would like to view my screen to make sure the code is used properly. (There may have been another reason for this too.)  In order to do this....he wanted me to download a program called "Team Viewer" that allowed him "see" my screen in real-time. 

I downloaded the program "Team Viewer" and started it up ...... he told me he could see my screen, etc......then somehow he asked to see my bitcoin wallet to verify the coins on blockchain.   Once I logged into my bitcoin wallet on blockchain........BLLLLLLLLLLLLLLLAAAAAAAAAAM....... I saw my bitcoin balance being withdrawn in a flash.     END OF STORY


So obviously, besides my stupidity, it was the "Team Viewer" program that allowed him to pull off this scam.  I'm still not sure how that program works.....for instance, how could it allow him to also be logged into my bitcoin wallet on blockchain???  How could two computers be accessing the same wallet like that? 

Thanks for any input and hopefully this will help somebody in the future from being scammed in this way.   I appreciate any constructive feedback...........

its ridiculous of course. you never research what the team viewer software can do?  its not a new scam, its actually a ridiculous way of scamming.


so you told him you don't know how to use the code, is that what you said to this scammer?

Ugh...that's fucking horrible.  I would say you made a really bad decision that probably should have been obvious to you, but I don't want to rub salt in your wounds.  Thanks for sharing about this honestly; usually we all require a lot of proof of such things, but I believe you.  It just sounds like he had his way with you the whole time.

How much did you lose, if you don't mind my asking?

He did NOT gain access to just your wallet, he gained control of your computer. It was as if he was sitting in the chair instead of you.

If you are going to trade, look into this sub-forum to learn about these things.

This. Did you check for malware in the computer aftergeometry? Scammer may have left something behind too. Maybe best formatting and reinstalling everything to be sure.

Did you enable that he could do more than just seeing your screen? Did you download the software from a link he gave you instead from the official website?

Thank you for some great feedback...........and not for laying it on so thick.....lol.  Yeah, I walked right into it. 

1.  He scammed me for about $350

2.  I downloaded Team Viewer from the website, not a link.

3.  Thank you for the tips about securing my computer, I haven't noticed anything weird...but I will do all the necessary scans.

4.  The question about the code.....no I told him I knew how to use it, but he wanted to see it applied to my debit  account online (we never got that far obviously....I'm not sure what exactly he said to me to get to my wallet right away.   I think something about needing to verify that I had the necessary amount available for the trade.)     I'm not exactly sure how the particulars of the Team Viewer work where he could actually gain access to my computer.............and empty those coins out.....did he somehow key-log my password on the blockchain? 

The funny thing is I used to scam....so it's like it all comes back around.  Scam and be scammed.  I don't know why I fell so hypnotized in this scenario....part of it was being a noob to this particular style of trading, part of it was just being too gullible - nice- thinking everybody was my friend.  Part of it was greed and needing to make a fast buck.  LOL, it's been a long time since I was on the opposite end of a scam....so perhaps I was overconfident.     I hope this helps somebody...or at least serves as a lesson on WHAT NOT TO DO.......

Thanks everybody for being constructive and not telling me how stupid I am (because I already am aware of that......lol)

I dont think TeamViewer allows you to log keys pressed by default. Did it happen instantly? I suspect it has something to do with the "code" you mentioned in your first post.


Best trading advice I ever got was: never get rushed and never assume you are superior.

Teamviewer gives him access to your computer. But I am sure how did he type his wallet address so fast to remove your money.

Teamviewer gives him access to your computer. But I am sure how did he type his wallet address so fast to remove your money.
[/quote] Thats is what im also wondering O.o

Not sure why everybody is saying it must be a "malware".Most easiest scammed he pulled off.Teamviewer gives control of your computer to him.He would have simply opened your wallet and sent the bitcoins to his address.Its as only screen sharing as you thought it is,he basically controls your computer from his chair.

EDIT : About typing the wallet address ,he would simply copy pasted it from his browser if it was on bitcointalk or pastebin I suppose.

You can't blame it on software!
You know now your lesson!
I saw those administrators from India how they helps people in securing their pc from viruses online. Instead of security they install malwares and  administrator rights ..https://www.youtube.com/watch?v=F9uTTXA-5dE

Team viewer is a program that allows control of a computer remotely. It is used a lot in technical support. I guess he had already copied his address, or used Teamviewer to send a scrypt that made the transaction. Thanks for sharing this, that's brave of you.

Everyday we read about new scams.
Scammers growing like mushrooms after rain..
How to trade safe, to whom to believe?
And people makes mistakes with such stupidity..

Shocking story, I end up in this forum because of reading about BTC being robbed from people from hackers and malwares.

But wouldn't this first need that the user enables the option that the other partner can interact on his pc? I think the default setting is that the partner only can see and there is a warning before you give him the right to move the mouse on your pc and such things.

So what happened here? Were the rights given?

I can only tell you that using an escrow is momentarely the best way to prevent being scammed. Very often scammer vanish silently already when you tell them you contact the escrow. Some play it smart and back out after the escrow had work with the contract. Most probably to find a valid sounding excuse. Still a prevented scam, though often enough people don't tip when a scam was prevented with escrow. Even though he had work and saved the user coins.

I know there was a well known escrow scamming lately but that is pretty seldom. An escrow is increasing safet ALOT.

If someone has a deal you can ask me, see my user profile to find my servicethread.

well team viewer it's like a rootkit basically, he have the access to your device, even if it was not team viewer, is still very stupid to give control of your pc like this, with a wallet also...

Its not that powerful without an exploit. I dont think an exploit was used here either. From what I read my best guess what happened is that the attacker had some sort of script that works only with blockchain.info. Like a series of key presses that quickly create a TX when logged in. OP logged in, the attacker used the script to create a TX and the coins are gone. If they had a key logger and access to the files they could have attacked any local wallet. There would have been no need to convince the OP to create a new wallet with bc.i. The mere request of creating a specific wallet should have rung all the alarm bells though. A signed message can easily be created for proof of funds.

Wow, that sucks man!
I haven't really heard of something like this before, thanks for sharing this experience. Through this we can all learn!

TeamViewer is a remote support tool. used by millions of people. it allows screensharing, remote control or net meetings. the problem isnt teamviewer, the problem sits between keyboard and chair, downloading software without having a clue what it is. When someone has remote control he might be able to do bad things. how about some tx ids showing funds are removed along with a signed message from those addresses.

teamviewer doesnt give you the ability to work super fast on the system you control. no way of just "baaaaaaaaaaam" all btc gone...



this video is total bullshit. calling malewarebytes "maleware" is like screaming "mooooooooooooon" on every stupid altcoin. ofc, downloading it from strange hosting sites may not be the way. i spent 50 minutes watching a stupid guy getting remote support from a very slow indian while the stupid guy puts stupid comments on screen. yeah blame the indians... and how the fuck are "administrator rights" are installed????

the way the indian guy did might not be the fastest and not the smartest and he didnt pay attention to what the customer said, but 99% of customers cant describe the problems. ofc telling about 100% protection is crap, but they didnt do something bad like you wrote. they trying to sell their support, thats it.

No, I had more smoke and mirrors in mind. Something quick and simple like changing the payment address or the login url. However it seems OP is no longer following the thread or unwilling to give more details so its just speculation anyway.

So to be exact, how dangerous is it to use it when you A) download and install it from the official source and B) the user is not enabling the option that the other person can do things on your pc... so that he only can see.

Can this still be exploitet so that the solution would be to never use teamviewer?

Downloading TV from the hompegae is no risk at all. I could mirrior my screen to you all day long, you could just watch what i do. If i give you full remote access and leave you alone then, you could do whatever you want.

Never download anything especially a exe file. Remember.

You used to scam? Sorry I have no sympathy for you. As others have said, never allow someone to take control of your computer!

Strange story! Full of beginners mistakes?
You just gave him all privileges of your pc..I can't understand that kind of naivety?
Maybe this topic was created for open discussion not for finding truth.
Just like Pulp Fiction :D
https://upload.wikimedia.org/wikipedia/en/0/0b/PulpFictionTwist.jpg

damn son... that was extremelly harsh...
At least you now know how to avoid these squemes

with that program he had access to your drive... never trust anyone you don't know online... sorry for your lost coins

Honnestly... I wouldn't say you're stupid.

Even after your explanations I had to take some time to understand everything. I didn't know TeamViewer either so I understand that you rushed a bit and trusted the man in front of view.

That's a rather elaborated scam. I think I would have felt for it.

Thanks for sharing, you maybe saved me some money in the future!
And sorry for your loses, like most of us you learnt something the hard way  :-\

Scammers are there day in and day out pooling people but yeah now we learnt one more technique which they use to scam people so it's up to us to be smart and never get scammed when it comes to bitcoin

Ok, that's what i was wondering about. So the only way this could have happened was when OP downloaded the software either from a fake domain, so the exe was a trojan, or when he allowed the other party not only to watch but to act on his pc.

If someone downloads from the offical website and does NOT allow the other person to act on his pc then it is still fully save, right?

I already became unsure if it is a general risk. :D

No, i think it was a good step to post this since for sure you warned some people to be cautious with teamviewer.

What i wanted to know, since you mentioned somewhere that you scammed before, how big of a scammer were you? Since especially i'm interested into knowing if scammers on bitcointalk all play alone for themselves or if they meet in some community or so. Would be interesting to take a look in such a community, maybe watching scams on bitcointalk in realtime.

Only an idea. :P

But did you not saw the mouse pointer moving or when he did enter his wallet and the ammount?

First of all , I feel sorry for your loss, I know how it feels to be scammed. Anyways your story was similar to what happened to me back when I was a newbie, same modus operandi involving a teamviewer. In my part, we communicated on FB and I was using a local bitcoin wallet/exchange. That kind of procedure was pretty common I guess, especially for noobs who don't have any idea how teamviewer works.
Just be vigilant next time

Fancy things you can do with teamviewer:

- Black out the remote screen, therefore you need to install a "screen driver" via TeamViewer, depending on the connection that can take 1-2 minutes.
- Lock the remote keyboard and mouse

The easy and quick way:
So lets imagine i am the guy trying to scam you. I tell you: download teamviewer, personally i would send you to the real site www.teamviewer.de or .com (doesnt matter)
I will ask you for your teamviewer id and pass, its displayed when you open up TV.
I will connect to your system. I will instantly start to install the driver and black your screen in addition once your screen is black lock your keyboard and mouse.
No i have from 1 second to 15 minutes, in relation how smart you are, to roam around your pc. if you are using the core client and its open already ill send all you have to my own address.
as long as the connection is working i wll start searching for "wallet.dat" and copy each of those files to my system (in case you have other coins i would note which wallets you have installed.
if my connection is still working and i was prepared to scam you i might install some nasty tools or start to delete files and maybe uninstall some devices.
Sooner or later you might have come to the idea to switch your pc off, disable wireless (if oyu have a button for it) or pull your ethernet cable.

If you using something like electrum (what i do) you cant just send coins without a pw.

Anyways: NO WAY, coins vanish RIGHT AWAY after a connection is established. i mean the second someone is in. doesnt work that way.

op might have downloaded a poisoned teamviewer somewhere but i dont think so. you have to be cautinous about giving stranger access to your pc, no matter how the tool is called. some would be possible with a simple rdp invite.

its not the tool to blame, its PEBKAC (Problem Exists Between Keyboard And Chair).

Would you do a demo with me? I will prepare a victim VM for you.

new way for scamming never heard this way before .
but was you using second factor authentication with the blockchain at that time ??
sorry for your lost
good luck next time

i was helping someone out with some stuff once and it was suggested to me i install teamviewer..

i was like, nah.. lets share a screen session instead. heh.

it amazes me how prevalent that utility is.

Team Viewer... yuck. Sorry to hear that -.-

Well he remote your computer if you use team viewer so its better to move your team viewer maybe he can access again with your team viewer.
Provably he hits the withdrawal and send it to his wallet.
Now you learn that using team viewer is not safe if you login with your bitcoin wallet so next time if want to trade to some one find a escrow here or you may try escrow service in my signature.
Nowadays they are many scam out there and also here in our forum so beware and make sure to use a trusted escrow before you deal.

Didn't know that can happen with the normal teamviewer version and he only being allowed to watch. Though you somehow write as if he could do more from the start?

And when you say he can install a screen driver then doesn't that mean already that he can run scripts on the other pc? He then could run an autoit script and clear the wallet... at least if unencrypted.

Sure, why not. Prepare a system and we will do a simulation.

First red flag and clear scam indicator is where he asked you to move coins from your wallet into an online wallet to "See that you have them". You can see on any block explorer just as easily that there is coins in an address. Do not move coins to an account based on someone attempting to trade. If it feels like unneeded steps, it likely is.

If someone has a session  established that allows remote control he can operate the system like sitting in front of it. Thats the idea of teamviewer or remote tools in common.

I've never been scammed. But I guess that's because I protect everything.
Because I have 3 computers here. And only 1 has team viewer.

Guys.... you dont get scammed because of running teamviewer. You get scammed because of allowing some random stranger full access to your system. Thats two pairs of shoes.

I have running tv all day long and nothing happens...

Ok, it sounded like you meant that the other party can do it even when you did NOT give him remote access. When you only allowed him to watch what you do...

Ok then, good to know that it's still safe as long as... :P

i feel sad t hear your story,and tobe more aware to keep my bitcoin,and of course more warn to spam activity from unknown people,thanks for sharing,i hope you get better amount of bitcoin.

We are about to do a demo and I think I have found the problem. There is a setting "Send key combinations" that attacker(!) can set. It would probably allow them to see your password. No, we tested it. Its not a keylogger it just shares the clipboard which could be a problem if you use a keymanager.

https://i.imgur.com/rGlQUNj.png

---

Also - by default - you allow someone else Full interaction, this allows the attacker to install a display driver that locked me out completly. I was however able to defend by simply pulling the plug and restarting the machine.

https://i.imgur.com/rWpg9SD.png

---

Overal we think OP is lying.

i showed shorena this could never happend the way the story was told to us, lets wait for him what he has to say.

That's bad. I would if I were you a good code put on it.
And keeping an eye on.
You should not download anything and everything going.

That is indeed very mean. For you must indeed be careful with what you do.
And especially well protected. But I think you just have to be very careful.

good story to post here,and feel sorry for what happen to you,its a warning for us,there was some hacker that use application,they really smart,and now we have lesson,dont trust any download that you dont want to do it.

Somehow i didnt see this comment before... why are you people not stopping posting bullshit about a tool you dont understand. I guess half of the people here havent used teamviewer ever. The tool is safe. The problem is the person sitting in front of the computer allowing some stranger to connect. God damn educate your self....

The later part applies on security issues, too.

You can consider nearly everything ... not using online/website wallets ... storing backups of your harddisk ... always encrypt wallets using strong passwords ... writing down passwords on paper somewhere (LOL)*) ... never storing paper and backups on same place ... endless possibilities.
In the end, you will loose some coins. Not much getting around that experience. If you are acting responsible the amount will be merely a "reminder size"

*) I messed up like that. Brute force cracking your own wallet, tools like that anywhere available?

Yep, spread your coins around so you will only miss a fraction and not all of them. I also prefer to play around with different wallets and small amounts to get a feeling for them before I store larger amount on them.

You can try -> https://github.com/gurnec/btcrecover to brute force your wallet password. If you have questions feel free to open a thread on the wallets section or send me a PM.