Bitcoin Forum

What will you do when you pay money and get no shipment, using escrow to buy physical coins?

I used escrow to buy physical XMR coins here on August 28.
 I sent about 200 XMR to the escrow address  at the same day. But my bitcointalk account was hacked at the night, and the linked email was also changed. I found out that at second day(August 29) morning. In order to prevent the hacker to change my shipment address to steal the physical coins, I had to lock my bitcointalk account ASAP. I used my another bitcointalk account to post thread to tell escrow-man and seller to stop the deal until my account is back.  After about a half month I got back my bitcointalk account on September 15. So I PM escrow-man and seller. The seller(scammer) blacklisted me and sent no shipment. I asked escrow-man send my money back to me some times from September 14 to today(October 26), but escrow-man only replied my one time and rejected to refund me my money.

To buy physical coins I have sent the money, but got no shipment. And escrow-man rejected to refund me my money. Will I lose my money and get nothing? What should I do?


Some facts for you:
my thread to buy physical coins on August 20:
https://bitcointalk.org/index.php?topic=5355531.msg57792559#msg57792559

first connect escrow-man for escrow service on August 28:
https://ibb.co/RNdV7bc

pay money(xmr) to escrow address on August 28:
https://blockchair.com/monero/transaction/ed435c8c5aaa30a4ab9ea0ab0475986d3de27069538ff3535e096ed6a1a885a8
https://ibb.co/ZJP6KTR

my bitcointalk account is hacked, and linked email address is changed on August 29:
https://ibb.co/D9d4Cfs

another thread to notice escrow-man and seller on August 30:
https://bitcointalk.org/index.php?topic=5357216.msg57816116#msg57816116

seller(scammer) profile:
https://bitcointalk.org/index.php?action=trust;u=2300231


escrow-man gives seller untrusted feedback on September 5:
https://ibb.co/RbJ3z71

get back my bitcointalk account on September 14:
https://ibb.co/GQks83P

ask escrow-man to refund me my money  many times from September 14 to today:
https://ibb.co/F0NVgTT

escrow-man replied me only one time, and rejected to refund me my money on September 17:
https://ibb.co/p0gjdBD
https://ibb.co/9hXqfr7

Basically, if the item(s) were not shipped from the seller, no tracking # provided, unresponsive seller(no updates), no item(s) arrived on buyer's side on particular period of time considering the ETA, then a refund is a must.

Yes, No tracking ID. And now it has lasted about 2 months from August.

Just a quick guess on my part...  but judging from minerjones' response (what little we are allowed to see) it seems that he never received funds as he's asking if the scammer controlled your wallet as well.

My guess is that the seller pulled a Man-In-The-Middle attack and convinced the buyer to send funds to him while thinking he was sending funds to minerjones.  Again, just a guess since not enough information is provided in the messages, but the first thing I would do is check where you got the Bitcoin address to send the funds to escrow.  My again random quick guess of the situation is that you didn't get the address from minerjones.

To further make your case, you might want to go here and follow along- particularly Decode Outputs and Prove sending, to offer more proof and see what went where:  

https://xmrchain.net/search?value=ed435c8c5aaa30a4ab9ea0ab0475986d3de27069538ff3535e096ed6a1a885a8

The scammer did not controlled my XMR wallet, because I sent about 200 XMR to escrow address from my CEX account, which is secure and protected by Google Authenticator.

The escrow address is from the massage that escrow-man sent to me on August 28. Here is the massage:


https://ibb.co/FqtTHvK

---

I sent XMR to escrow address from my CEX account, and I don't have the private view key. How should I prove that in this case?

Here is printscreen of that XMR transaction.
https://ibb.co/8jYz2ZX

[moderator's note: consecutive posts merged]

It sounds like MJ never got the coins, but it looks to me like you sent them to the address he gave you. ???

Did you verify all the PGP signatures he gave you in the messages?

This is really fucked up to me.  ::)

Also, @buckrogers - why is his name in here? ??? [clarified by buckrogers below]

Edit - More info from MJ needed here for sure... I've seen something like this happen recently as well, to such an extent that I no longer trust ANYTHING about PM's on this forum - Not saying there is someone who may have infiltrated the server, but things are definitely getting shadier around here as time goes on, so I now prefer to use Telegram - How fuckin' sad is that, right? :P

I hope more info gets posted, that's a lot of XMR, and those are some of the sexiest coins on the planet. :(

Last edit: NEVER send XMR from an address you do not fully control if you need to PROVE you sent coins from it!

I’m not sure what’s going on here or why my name is mentioned - but I have nothing to do with whatever is going on here nor have I sold anything or requested or sent any money or whatever is being discussed in this chat  to or from anyone here.

Please keep me out of this drama and whatever scam your are trying to pull.

Thanks!

---

https://i.imgur.com/vlEnLEm.png (https://i.imgur.com/vlEnLEm.png)

What are you talking about dude??

I cannot open that link.

Post up whatever that scammer did to you, dont involve me in your crappy deal.

Verify? do tell! I'm curious what they sent you.

Thanks!

---

I'm ok to accept your apology in advance after you realize whatever that scammer pulled over on you and may have tossed my name in there somehow.

Do your due diligence before accusing someone here!!

Jeez

---

I found this in my messages from august 31st:

https://i.imgur.com/rGsvgtb.png
 (https://i.imgur.com/rGsvgtb.png)
I can only assume that raj dude scammed you,  and used my name for that purpose somehow.

I AM NOT INVLVED AT ALL HERE!



https://bitcointalk.org/index.php?action=profile;u=2300231;sa=showPosts (https://bitcointalk.org/index.php?action=profile;u=2300231;sa=showPosts)

let the detectives here go to work!

***shady - reviewing his lasts posts, changed names and emails a lot, lots of scam like history, sorry for that guys loss, but he didn't do his due diligence with a simple search , not sure what the "escrow-man" thinks?

[moderator's note: consecutive posts merged]

Looks like someone pretended they were someone else, used an alt, scammed you with fake escrow messages, and that's the brunt of it.

buck has as much to do with this as a golden windmill at the bottom of the sea: he's pretty deep doing fuck-all.

Btw uploading (on imgur or bbcode) full pics of the screenshots' of the conversation could be very helpful instead of a cropped one to fully understand the info while waiting MJ to respond here for more info.

Definitely need the full dm if you are accusing minerjones and/or buckrogers - your screenshots are not full - you crop off quite a bit

The only place I see minerjones is in the messages you sent him - in your images of his replies it’s simply quotes and quotes can be modified rather easily - especially for screenshots.

No.

The scammer(Rajubhusal) told me buckrogers is Rajubhusal,  this is his mobile account.
https://imgur.com/a/Man0O9w

Sorry Bud, thats not me or my account, looks you got scammed good, sorry for your loss.

Having someone "tell" you they are someone else and taking that seriously? you should have done your due diligence, instead of accusing me.

So where the fuck is "escrow-man" anyhow, having a "Break" someplace like usual when shit hits the fan? This guy can't confront a guy knocking on his door ffs.. :insert total pussy image here: ::)

Maybe it is true.
Let me tell you how it happened to me.

After I posted thread to buy physical coins on August 20, and buckrogers  contacted me for this on August 23.  On August 25 Rajubhusal
(first time to send me a massage) sent me a massage, and told me that Rajubhusal is buckrogers. Even this massage quoted the massage that buckrogers sent to me on August 23(At that time I did not understand how Rajubhusal got the buckrogers's massage if this is not the same man). At that time I suspected this may be scam. But I like monero physical coins and I wanna buy it. I thought that I can use escrow service , my money will be safe even if I don't receive the physical coins. So I contact MJ for escrow.

---

Here is the printscreen of that massages.
https://imgur.com/a/T9pnbZg
https://imgur.com/a/Man0O9w

[moderator's note: consecutive posts merged]

So what is MJ's response, just that he received no coins and that's it?

Edit this forum is TOTAL fuckin' scam lately, just beware everyone - something (everything?) is not right anymore. ???

I see that it appears minerjones really did send you the PM, however the signed message doesn't verify with the PGP key in his keybase.

https://i.ibb.co/yByTVSk/minerj1.png

Did you attempt to verify the signature against keybase before sending the funds?

Hard to know exactly what happened without input from MJ. Right now I have to assume yours is a faked screenshot.

You said your account was hacked right? it doesnt take a genius to figure out it was this Raj guy who did it and took a DM and used it against you.

You should have checked with Escrow, me or anyone else on the forum, or posted in your thread at least that "something" was off or different. Kind of basic knowledge in life before sending a random stranger a few hundered XMR!

Instead you assumed and took his word for it, and in turn accused me of stealing your coins.

SMH

*** oh and id never say "Cheers"

I can provide all the massages I received since August 20(I posted thread to buy coins). Give me some times, I will try to upload them. Thanks.

He was scammed - most likely buy that Raj guy.

This is why escrows put in the PGP message - SO YOU CAN VERIFY IT!

OP:

Honestly I know it sucks, but you should have done your due diligence with all the tools that were freely provided to you by the escrow. Especially with that amount of coin.

Sad to see, but you aren't the first and you wont be the last to get scammed, hopefully someone besides the OP ofc can learn from this terrible mistake and scam, and triple check everything before sending out funds to anyone.

No.

The screenshot is true. What is my purpose to fake it?

---

His massage to pretend to be you is sent on August 23. It is August 29 to found out my bitcointalk account is hacked and linked email address is changed.

I do not accuse you. I even do not infer your name or even MJ's name before this problem becomes clear. Sorry for that.

---

Yes, I made a big mistake. I will learn from that.
MJ is a good man. I have used MJ's escrow service many times, and it works well.  I trust him, so I always send coins to escrow address without verifying PGP. But it failed this time.
Can help me to verify how the scammer fake the massage that MJ sent to me? Is the XMR address under control of the scammer? Thanks.

[moderator's note: consecutive posts merged]

This is really messed up and this whole thread and recent disappointing auction prices…seems like an advertisement for scarce city or some other legit auction house for our collectibles. Adds fees, commissions and kyc but at least we will see some proper premiums and weed out the lame scammers

Stay safe peeps…VERIFY! Never trust

Sel

You claim to have made a new account on August 30th, but the account shows it was created on November 23rd 2020, can you explain this and why you said this was your brand new account after being "hacked"?

https://bitcointalk.org/index.php?action=profile;u=2885681 (https://bitcointalk.org/index.php?action=profile;u=2885681)

https://bitcointalk.org/index.php?action=profile;u=2885681;sa=showPosts (https://bitcointalk.org/index.php?action=profile;u=2885681;sa=showPosts)

You'd have to agree to let a well-trusted member of the forum have access to your Bitcointalk account to verify the contents of the PM. I could do this for you if you like, there's probably some others like LoyceV, or you could have a global mod do it, though it might take a while to get their attention.

I agree with ^^^ I would want to see the actual DM from minerjones - your screen shot of his message was chopped off so we cannot see that it actually came from him (unless I missed a screen shot where you showed it)

My guess is the guy hacked your account, saw buck's dm and then pretended to be buck - faked a minerjones account and got you to pay him (the hacker) then after all was said and done, he then prolly changed your email and such hoping to keep you off the forums so you could not oust him for his bullshit.

I do find it strange that minerjones has not responded. I hope all is well with him, just spoke with him yesterday and he was fine then.

again - I would like to see the DM from minerjones where he supposedly gave you this address to pay in its entirety.

No, I do not claim to have made a new account on August 30th. My hacked account-eseayan is my main account to buy physical coins, and  my account-aseayan is backup account. Yes, my account-aseayan  was created on November 23rd 2020, but this account did not leave any thread or PM before this hacking affact. It means new to me after my account-eseayan can't be used.  This you quoted is from the massage i sent to you and MJ on August 30 to let you stop the deal from account-aseayan. It was a big time for me to prevent big loss. If my words confuse you, I am sorry for that.

---

Thanks for your help. I agree to let a well-trusted member of the forum have access to my Bitcointalk account to verify the contents of the PM. You and MoparMiningLLC are both Legendary and have good reputation. I chose to trust you. You can both access. Please tell me how do it.


[moderator's note: consecutive posts merged]

I just sent you a PM with instructions.

sent you a PM, please check it.

EDIT:
MoparMiningLLC: I sent you a PM, too. Please check it.

Feel free to PM me.

PMed.

I looked at eseayan's PM from minerjones and it is legitimate, and from the real minerjones. It matches what eseayan posted earlier.

Here is the PM being verified:


However, since the contents are the same, the signed message still doesn't verify with minerjones' keybase.

LoyceV and MoparMining feel free to double-check.

I have checked the DM's - I ignored all the other ones that were not related to this issue, reviewing only ones from the raj account, from buckrogers(1message) and from minerjones (2 messages) and I would have to agree that the message does appear to be from minerjones - but I get a "hash mismatch" when attempting to verify the PGP

what we need is to have minerjones chime in here - it appears he sent the dm and did supply the xmr address:

45gtrfipMYeYZ9ZRRLN4XKG5q2tiT7HUdSvqn5LUs5V3WmHSnQYHpF6ReaY1U2uGJfMo6QpP5zmS1gT hEASRcHdx3KZkDK6

I know somewhere above eseayan provided some screenshot of his exchange account that showed the first/last part of the "paid to" address and it appears to match the one supplied by minerjones. However, due to the nature of xmr - we cannot easily verify this txn.

I can see that the txn id: ed435c8c5aaa30a4ab9ea0ab0475986d3de27069538ff3535e096ed6a1a885a8 is a valid txn but that is about it. I cannot see the amount or addresses involved. having the address and transaction hash is only 2 of the 3 parts needed. we also would need the view key.

if minerjones sent that dm then he can provide verification on that xmr address whether it received funds or not. if minerjones did not send that dm - then it might be possible that at some point minerjones forum account was also compromised.

what it appears to me is that this raj account must have gotten access to eseayan's account and copied/used buckrogers dm to con/scam eseayan.

and then possibly changed the email address afterwards in an attempt to lock out eseayan.

---eseayan - can you get the view key from your exchange?

It is late and I am going to bed - I await to see what others say and what minerjones will say.

Thanks very much for your help.

OK, I will contact my exchange now, and try to get the view key.

This should have been a very big red flag: never trust someone who claims to be anyone without verifying it with the original user.

The quote (from hacking your account I assume) was a very good trick from the scammer, but you should have followed your gut feeling.

I haven't seen anything that gives me a reason to believe PMs are compromised. There's also a Security bounty (https://bitcointalk.org/sbounties.php) worth $10-50k for it.
Telegram makes it very easy for scammers to pretend to be someone else, change their nickname and delete posts from being viewed by the other party. I would not recommend it unless you know who you're dealing with.

I confirm this PM was sent by minerjones to eseayan:
I made a checksum to compare the exact quote: it matches.
Message details:

Another possibility would be clipboard malware.
In case someone doesn't know yet: https://bitcointalk.org/myips.php shows all IP-addresses that used your account in the last 30 days. Admin will probably have access to older IP-data too.

---

---

Is this "normal" when escrowing Collectibles? I would expect the escrow to receive and verify the goods personally before reshipping it to the buyer. Now the escrow can't possibly verify it if the buyer says he received something else, and the seller still has no evidence. What's the point in paying someone $500 to escrow only the payment but not the goods?

I am going to update this comment with an update - the pgp message does verify. Due to a 80 character limit there is a space in the address between the two red characters below - if you remove that space, the pgp will verify.

45gtrfipMYeYZ9ZRRLN4XKG5q2tiT7HUdSvqn5LUs5V3WmHSnQYHpF6ReaY1U2uGJfMo6QpP5zmS1gT hEASRcHdx3KZkDK6

https://i.ibb.co/wwp86R5/image.png (https://imgbb.com/)


so the challenge here is to prove where the funds went to.

my further guess would be that eseayan sent the funds to minerjones who in fact did receive them - but then that the "hacker" sent a message to minerjones from eseayan's account stating they had received the coins and to release the funds and that minerjones then paid the address provided.


Buyer: eseayan
Seller: Rajubhusal
Total amount: 196 XMR + your escrow fee (Paid by the buyer).
Seller's release address (xmr):
43Xf5BWzcdbdhDeHnj6cF1dG4fGnasQEUHyn2F92LK9VbyvP96nbhkdGZuEJKHd2X9eYhhbKQn4C6E1 V2h8EHSSvVjGs1rZ


I also reviewed the outbox from eseayan account - there are no messages between when eseayan provided the transaction id minerjones and raj - the next outbound message is the one saying eseayan got their account back.

but any outbound dm's could have been deleted by the "hacker"

if mj can provide verification he received the funds, show proof of a dm to release the funds and proof he did so - I think that leaves minerjones right where we all expect he would be - in the clear.

the problems here are:

1. eseayan not verifying raj was buckrogers and just accepting that raj was honest - for the amount of money involved - that is an crazy assumption to have made.
2. having coins sent direct to buyer - I would suggest always sending to the escrow - especially with this type of value.

no one deserves to be conned but it is everyone's responsibility to verify. I trust minerjones but I also verify every pgp he sends me when I do pay him - either that or I talk to him directly to confirm.  I have met him personally and I still verify.

DO NOT TRUST - VERIFY.

Good catch, I totally forgot about that - Bitcointalk has always done that with XMR addresses at that very same position, and I'm not sure why.

That's why I always used to use the [code /] tags when sending anyone XMR addresses in PM.

So where is the escrow guy? Seems like someone with a rep that big would be all over this... ::)

Minerjones said he doesn't have the coins:
I've verified this PM through OP's account. It's real:

agreed he did say that in the second pm

as I stated I believe he received them and then received some communication that the coins had been received by buyer and then released the funds to seller.

I would not easily believe MJ scamming….

Did a lot of buying from him, left stuff for weeks with him … worth a lot more as this particular issue and always got my stuff just how I want it….

MJ is very thrustworty imo and I think he’s not gonna be the issue…

Would still buy from him with no doubts or fear.

Would the owner of this address (minerjones) be able to provide a view key?
I don't really know how Monero works on block explorers, but I assume the owner would be able to view the balance on external sites. OP (eseayan) paid from an exchange so this could be the final piece of the puzzle.

this may also help - when going thru the dm's between eseayan/rajubhusal there was a message from rajubhusal to eseayan

https://i.ibb.co/kDBbJ7z/conv-4.png (https://ibb.co/DMWcYJm)


however, the image was not rajubhusal's it was djjacket's image

https://i.ibb.co/nrZsJgQ/unknown.png (https://ibb.co/Zdt6DLc)

rajubhusal asked djjacket to put his (raj) name on the image. he then used that image as "proof" to eseayan of "ownership"

I was initially in contact with eseayan about selling a set of Monero coins to him, but he passed due to another deal with someone else.
Later in the day, the user rajubhusal contacted me referenced in the PMs Mopar listed above.

Really sorry this happened to you eseayan.

Bitcointalk really needs two-factor auth at a minimum these days, and it looks appears it was a very savvy exploitation of previous PM messages to socially engineer a false transaction.

This really illustrates the need to be VERY careful when doing deals with people here and be sure you have a strong passphrase that is not shared with other sites.

I'm not sure about that. Since the signature really does verify, it means minerjones was in possession of the XMR address in the message, and it appears the funds in question were sent to that address.

We don't actually know what happened without MJ's input. Am I missing something?

No, I don't believe so. Where is Minerjones ???

He cannot simply state he never received anything and wash his hands of this - I'm sorry but this is not right.

@minerjones - Man up here dude! Let's face it, you've always been particularly shitty about that, so I'm going to leave you a neg soon if you don't reply.... FFS, this is a lot of money. ???

Can you not even face a fuckin CAT ffs? LOL. 🤷‍♂️

it has been less than 48 hours - sometimes life happens and people are not always able to get here right away. Minerjones has escrowed millions worth of crypto and items and I dont think anyone can say he ripped them off. He also never said he never received the funds - that second dm simply states that he does not have the coins and does not have the funds.

A few questions remain to be answered and mostly likely will be in time, hopefully sooner than later.  Here's another one and I'm not pointing fingers but rather looking for more clarification:  Did anyone find it odd that someone would honor a request to take a pic of their own item with someone else's name and date next to it?

I'm here.
Be able to respond more tomorrow.

You are correct.  That was probably not the best thing to do looking back at it and I should have realized something fishy was going on.  Not gonna make that mistake again...

I would have expected more from a Hero member as a jr member would have know better.

first step is that he admits it - there was no proof of it, he volunteered the information. so that means he should learn from it.

Thanks very much for your help, guys.

I have ask the CEX to provide me the XMR address and view key.  If they are got, I will post here.

Going off of times from my PMs:

Aug 28 2021 073933AM: eseayan contact about escrow

Aug 28 2021 084554AM: Rajubhusal contact confirming escrow with release address of 43Xf5BWzcdbdhDeHnj6cF1dG4fGnasQEUHyn2F92LK9VbyvP96nbhkdGZuEJKHd2X9eYhhbKQn4C6E1 V2h8EHSSvVjGs1rZ

Aug 28 2021 045333PM: eseayan paid escrow

Aug 28 2021 082807PM: eseayan confirm that coins will be delivered in person

Aug 29 2021 113837AM: minerjones confirms payment

Aug 29 2021 120243PM: eseayan send PM saying the coins were received

Aug 29 2021 012253PM: Rajubhusal confirms, saying to release to given address previously (see above)

Aug 29 2021 014725PM: minerjones releases funds.

Aug 30 2021 045711PM: from new/alt account "aseayan" asking to stop the deal because account "eseayan" was hacked.

Funds were received and sent out:
https://i.imgur.com/wzeT3Ik.png

so my guess is raj sent the dm's from eseayan's account saying it would be an "in person delivery" and then that it had happened.

some may wish to see those DM's as they are not actually in eseayan's account. and in none of the DM's presented was it stated it would be hand delivered.


edit - is there any way to retrieve deleted dm's?

I am glad to know the full process. I believe what MJ said is ture. But it is so bad to hear the xmr is funded.

No matter that I can afford the loss. It is a big lesson that I should learn from. Here I will not blame anyone. I appreciate to get timely help from nutildah, MoparMiningLLC, LoyceV, owlcatz, etc. Guys, you make me still believe bitcointalk is the best forum on cryptocurrencies.

Thanks again.

 
EDIT:
This message should be sent by the hacker through my hacked account before I recognized my account is hacked. What i wanna buy is physical coins, which need some days to be shipped to me from USA to China. I will not send message to confirm I have received them after the second escrow day.

I remember a case in which someone signed a message with someone else's name, that was also used to scam. This is just as bad: it's common practice on the Collectibles board to ask for a photo with a handwritten username and the current date as proof of ownership.
You have single-handedly made this entire concept useless by doing this:
https://loyce.club/other/imageusedtoscam.jpg

Was this part of the escrow deal? Even if the delivery would have happened, you would have no way to confirm this if either party says the other one didn't show up.

Why didn't you mention this to eseayan 19 days later, but instead just said you don't have the funds?

I must say I'm quite disappointed that 2 veteran Collectibles traders let themselves be used by a scammer!

Admin can restore deleted posts, I assume the same applies to PMs. But eseayan should ask for that, either by sending a PM to theymos, or by opening a topic in Meta. Admin may also be able to connect the account to other accounts.

Do you have any idea how your account got hacked?

sent a PM to theymos, copied to LoyceV

1.Maybe the hacker hacked my email, and my bitcointalk account password is same as that of my email account(I have changed them different passwords and applied F2A in my email account.).
2.Maybe the hacker instructed Trojan virus in my computer, because I had found some virus when I used windows defender to scan my computer some months ago.

You should NEVER reuse your passwords for anything again, and I hope you learned a lesson about that.
Use some password manager like KeyPass for storing and generating new strong password for each website.

It could be a false positive, but it's possible that you have some clipboard malware that could collect your passwords and any keys related with crypto.
Switching to Linux may also be a good idea so you won't need to use any antiviruses, and offline computer is much better for dealing with crypto.

According to what appears to be the escrow agreement (https://bitcointalk.org/index.php?topic=5367587.msg58271192#msg58271192), the coins were to be shipped to the buyer.

This was not long after eseayan's password was changed, and should have set off red flags.

I am interested to see what MJ plans to do about the situation.

I agree that the earlier messages state it was to be shipped but, I am not sure what he can do if he received a pm from both buyer and seller that the coins would be hand delivered and then another set from both that the coins had been transferred in person and to release funds - what else can he do but release funds?

I would have preferred this:

It looks like the scammer has at least one more account:

I would not have agreed to escrow a transaction that involved in person delivery. What if for example, the OPs account had not been hacked, and there was simply a dispute as to if the physical coin was actually delivered? There would be no way to resolve the dispute as it would be one persons word against the others.

Notwithstanding the above, if the terms of the trade changed, I think it would be prudent to delay the release of the money. This would allow for the buyer to flag something as being wrong.

I dont argue against your points.

I just dont see what alternative minerjones could have had if both buyer and seller appeared to agree to an in person exchange and then both parties appeared to express satisfaction with the deal.

how can you delay funds transfer if there has not been any notification that  the account was compromised and no indication of it either?

The point of delaying the release of the money is to wait for someone to potentially say that something is wrong. If he already knows something is wrong, there is a dispute and he should mediate accordingly.

at the time he was told there was a physical exchange, there had been no indication of any issues. at least that is how it seems to me - that it was not until the next day that an alarm was issued when the account was identified as compromised.

Any last-minute change to the deal should be considered a big red flag, which justifies a delay.

Agreed on this. It's as if the escrow is useless if the transaction is delivered in person.

On the other note, I guess this can be prevented if the involve party used a different messaging app for faster communication or the escrow has other means of way to communicate, obviously to ping on what had happened to the buyer/seller.

agreed - there is no point in escrow for an in person exchange unless the escrow is there.

the deal does appear to have been a transaction where the items would be shipped.

I am not sure of the body of the dm's that "came" from both parties that suddenly changed it to an "in person" exchange.

Perhaps it would have been better to have returned the funds to the buyer and allow them to pay the seller direct.

If that had occurred the scammer would have been the only loser here.


in further review of the dm's - several were restored by Theymos - with a disclaimer, if one party still retains the dm, then it can be restored but if all parties on the dm have deleted it then the message is gone. So there is possibility of further messages that cannot be restored if all parties deleted them.

that being said, I can see where I believe eseayan's account was compromised. The sending account should be flagged.

the incoming dm
https://i.ibb.co/Pw70GCY/link1.png (https://ibb.co/TmVdMhT)

inspection of the link
https://i.ibb.co/ScLT76S/link2.png (https://ibb.co/kJdn6GZ)

close up of the link
https://i.ibb.co/KbzHnjb/link3.png (https://ibb.co/34YHKy4)

also - in the restored dm's were dm's to mj from eseayan stating it would be an in person transaction and then a followup stating the transaction was concluded.

notice to minerjones that this would be an in-person transaction
https://i.ibb.co/3Wy7KQw/in-person-1.png (https://ibb.co/ZK6V973)

notice to minerjones to release funds and that coins were in eseayans possession
https://i.ibb.co/5rkYrSw/in-person-2.png (https://ibb.co/fk98kyL)

and a dm to eseayan and minerjones from raj thanking both for a smooth transaction.
https://i.ibb.co/592ybrZ/raj-stating-all-good.png (https://ibb.co/YWbMHcg)

then the dm from minerjones stating funds were released
https://i.ibb.co/09by5Y8/release-of-funds-dm-from-mj.png (https://ibb.co/T03MyPp)

this does not help eseayan recover his funds but it does show it was some elaborate scheme/scam on the part of raj and the "mtowfiq" account. Worth noting is that the mtowfiq account had been actually identified as an account being used to impersonate other forum members and was actually left negative feedback by minerjones about a week before the dm to eseayan was sent.

Good ideas. I will try to do that now.

If you start using Keepass: don't forget to make regular backups of your password database.

As for the virus you found: I would never trust a once infected computer again without wiping it and doing a clean installation.

Yeah, I have bought a new computer to do things about cryptocurrencies. And the old one will be formatted and newly installed.

Once again, sorry about your lost eseayan.

Based photos/proof, you account it's hacked through link phishing. It's almost same of the date I got some PM here and sharing to other members here : https://bitcointalk.org/index.php?topic=5355723.msg57746225#msg57746225  not with some virus(maybe).