BTCJam scam me? they prevent me to communicate/update my investor

[mauriek]

Hi guys,

Here is the story, i have been an investor in BTCjam for over 2 years, and couple month ago i decide to try their service for my small business, 1st month went without problem and the payment process was complete. The 2nd payment date is in few days and i send some of the payment fund to my account with txid f0bbdcab2ab77aef552ee73e76b5609504a25ada4f1c78ee319a247518ef505b, then later i try to login to confirm the fund is arrived in my account but i can't login using normal email login and have to use my social media account to login, then i noticed in setting my original registration/login email was changed to amitkumarpell@gmail.com, and posted/comment to inform my investor that i will email btcjam support for clarification.

https://btcjam.com/users/115875

now it's 4 days since my last email reply to btcjam support and i haven't received new reply.
in 3 Dec btcjam support told me by email that my account is secure despite they noticed several email changes, and still in the same day of their email there was unauthorized withdraw from my account and i just checked there was also one withdraw few days earlier on 29 Nov. i'm afraid to send more fund because i believe it will be withdraw again like the last and i can't stop that because the email for withdraw confirmation is not my email.

last email reply

Sun, Dec 4, 2016 at 5:27 PM

Dear support,

I believe my btcjam account is not secure, i just check today there
are also unauthorized withdraw in my account and bitcoin address
change, why don't you lock my account when you notice that several
email changes? i only use this email from the first registration and
access btcjam from known IP (my own country), can you also check for
unauthorized access and check if they still using my account.

I'm still traveling on my sales tour/training so i only can use/access
my email/internet once or twice a day. when i have a chance for faster
internet i will upload my photograph as requested, but first i need
help to make sure nobody can change my setting again after my email
address is back in place.

Thank you for your help, i really appreciate it.

Regards,
Mauriek

On 12/4/16, Support <support@btcjam.com> wrote:
> __________________________________
> Type your response ABOVE THIS LINE to reply
>
> ------------------------------------------------------------------------------------------------------------
> Customer: BTCJam Team
> Subject: (No Subject)
> ------------------------------------------------------------------------------------------------------------
>
> John | DEC 03, 2016 | 02:15PM PST
>
> Hello Mauriek,
> Thanks for being a member of the BTCjam. We have noticed several changes of
> your email address. Your account is secured, but we need you to follow the
> instructions and verify yourself. Please state which email address you wish
> to have for your account to log in and follow the instructions.
>
> In order to change the email on your account, please provide me with a
> photograph of yourself holding a government-issued identity document as well
> as a piece of paper with today's date on it (you can write it yourself) and
> attach it to this email reply. Make sure the information on your identity
> document is clear enough to read in the photograph. We will also be testing
> the email we currently have on file for your account.
>
> If you have any other questions, please feel free to contact us. Thanks for
> being part of the BTCjam community!
>
>
> Best,
> BTCjam Support Team

Today i login again to check my account, and i noticed my previous comment/update to my investors was cut/deleted, then i posted new comment to update the investors. but my new comment apparently is hidden from view for other and only i can view that last comment. it seem btcjam set that so i can't comment/update further.

I can't imagine any reason why btcjam try to prevent me to communicate with my investor, i'm trying to complete my loan but i'm out of choice here, btcjam not replying and i can't communicate with my loan investors.
any suggestion?

I think i will try to track and find some of my investors social media account/email with their information profile so i can explain the latest situation.

[1713577937]

1713577937

[1713577937]

1713577937

[1713577937]

1713577937

[eckmar]

0.5 BTC is not too large amount in order to get ponzi sites to scam(in my oppinion). I would wait few more days for their reply and if they still don't reply than declare scam

[mauriek]

0.5 BTC is not too large amount in order to get ponzi sites to scam(in my oppinion). I would wait few more days for their reply and if they still don't reply than declare scam

I agree, 0,5 btc is not too large, for one user anyway. i think my btcjam account is compromised somehow, and i think is not from my email because all my trade/wallet/exchange/other account is still safe while have much bigger balance than my btcjam account, 2FA is active in all of my account.

update:
finally they reply my email after i posted this thread, but don't explain anything about unauthorized access to my account nor provide any information about the unauthorized address change. they only ask me to provide image of me holding my id to change it back to my registration email. if that procedure is standard for email change why they don't ask the same to the person who change it several times as their own email said, and what guarantee that it will not change again in the future.

[favdesu]

hard lesson to be learned for you OP. do due diligence and void P2P bitcoin lending like the plague.

and avoid cloud mining.

[robelneo]

0.5 BTC is not too large amount in order to get ponzi sites to scam(in my oppinion). I would wait few more days for their reply and if they still don't reply than declare scam

I agree, 0,5 btc is not too large, for one user anyway. i think my btcjam account is compromised somehow, and i think is not from my email because all my trade/wallet/exchange/other account is still safe while have much bigger balance than my btcjam account, 2FA is active in all of my account.

update:
finally they reply my email after i posted this thread, but don't explain anything about unauthorized access to my account nor provide any information about the unauthorized address change. they only ask me to provide image of me holding my id to change it back to my registration email. if that procedure is standard for email change why they don't ask the same to the person who change it several times as their own email said, and what guarantee that it will not change again in the future.

I think you have a point,I don't have a Btcjam account but all the other secure site that I worked with that deals with funds do have a verification process,before you can change your email,it is security breach if your email account was changed without you verifying it through an email verification,thanks for letting us know I will warn my friends about this

[mauriek]

0.5 BTC is not too large amount in order to get ponzi sites to scam(in my oppinion). I would wait few more days for their reply and if they still don't reply than declare scam

I agree, 0,5 btc is not too large, for one user anyway. i think my btcjam account is compromised somehow, and i think is not from my email because all my trade/wallet/exchange/other account is still safe while have much bigger balance than my btcjam account, 2FA is active in all of my account.

update:
finally they reply my email after i posted this thread, but don't explain anything about unauthorized access to my account nor provide any information about the unauthorized address change. they only ask me to provide image of me holding my id to change it back to my registration email. if that procedure is standard for email change why they don't ask the same to the person who change it several times as their own email said, and what guarantee that it will not change again in the future.

I think you have a point,I don't have a Btcjam account but all the other secure site that I worked with that deals with funds do have a verification process,before you can change your email,it is security breach if your email account was changed without you verifying it through an email verification,thanks for letting us know I will warn my friends about this

They do have email verification for changing email and wallet address, in this case they said the change in my account come from my email, they claim my email was hacked, but one thing that doesn't make sense is why they insist to put back my original email in my account if they think it was hacked. i won't ask for them to put my email back if they somehow think my email is compromise and have proof of that claim, and perhaps help me with some information to investigate.

In the last email reply they seem to refuse further help if i don't send my image holding my id and change the email back. so i did send it and still wait for next reply.

BTCJam also insist that the withdrawal took place before i notify them, but from the time stamp it's clear that i notify them few hours before withdrawal took place, my investors can see my comment complaining the unauthorized email change and one of them reply to my comment, they even send email informing me that day that my account is secure only by the next day i found out how "secure" it is.

[ranlo]

0.5 BTC is not too large amount in order to get ponzi sites to scam(in my oppinion). I would wait few more days for their reply and if they still don't reply than declare scam

Technically, this is incorrect. There are sites that have been known to do selective scamming -- doing exactly what you said. Because when they take 0.5 from one user, others will write it off as "everything was fine for me." Until it becomes more widespread and then you finally get hit as well.

[jnicolau]

Hi mauriek,

First of all let me thank you for sharing your experience.
I've been in a nerve wreck since I was also hacked/scammed, same way as you. Now I'm afraid of my data being vulnerable in their web site. I've been trying to update the investors and my messages are now being hidden from them I don't know why. My account was hacked on the 23rd of October and I also managed to login using my Google account instead. I can prove that the hacker couldn't use my email account because my email account is protected by a very strong 2FA that requires access to my mobile phone and several other passwords. My computer has no remote access, no virus, no rootkits, no malware, all clean and verified by very good antivirus. I even went further on my investigation and checked Google security centre just to confirm that there were no logs from somebody trying to log in yo my Gmail account from other devices and there is nothing. Also no traces of that verification email used in order to allow changing email address. Still BTCjam insisted that the hacker used my own IP and that's just a lie because nobody knows how to do it in my family and my computer is password protected and nobody else knows the password. They didn't send me any logs and they didn't volunteer any help. Instead they told me that they will only collaborate when requested by the police (so I reported to the police).
This is what the hacker did:
1 - (23rd Oct) Changed my email address to ids@hostin.club
2 - Change my profile from Investor to Borrower (I used to have great reputation because I was a lender)
3 - They changed the withdrawal address to 1ov1ZH1mFhod6st1R4rndjWF86E7NTzc9
4 - They requested a loan of 3 BTC on my behalf
5 - (27th Oct) They got 70% of the investment and withdrawn it along with some little money that I had in my account at the time
My account notifications were also disabled so I only got aware of the hack one month later, when BTCjam sent me an SMS message (for the first time since the hacking) requesting me to pay the debt.
The important thing to note is that if the hacker had access to my GMail account then he wouldn't need to change the email address, he could logging in directly using the Google account, and that would have been much easier and safe for him. Also, if he had really used my account I would have got a "new email" notification in my phone in order to reply to the verification email, I know that didn't happen, so the explanation of BTCjam just doesn't make any sense, and now I know that I'm not the only one. I just started believing that this either an inside job (some employee maybe) or a hacker with full access to the Admin of the site. There is another user complaining the somebody used his account to post a message inciting other users to trust me. As you said BTCjam doesn't really care if your account have been compromised and I believe that it could happen again. Problem is that I know no way to force them to remove/delete my account. I'm also trying to inform the investors of the problem and BTCjam is hiding all my new messages (I can see them but the other users cannot). It's very frustrations, probably illegal, from a company operating from the US... unbelievable.

[ranlo]

It's very frustrations, probably illegal, from a company operating from the US... unbelievable.

It's an unregulated market. They are not licenced, and they are using a cryptocurrency, as opposed to a "currency" (note that in the U.S., Bitcoin is still not seen as money yet). As far as the law is concerned in this case, it's no different than you "loaning" rocks. There's no legal recourse here for lenders OR borrowers. And that's what makes it so dangerous.

[mauriek]

Hi mauriek,

First of all let me thank you for sharing your experience.
I've been in a nerve wreck since I was also hacked/scammed, same way as you. Now I'm afraid of my data being vulnerable in their web site. I've been trying to update the investors and my messages are now being hidden from them I don't know why. My account was hacked on the 23rd of October and I also managed to login using my Google account instead. I can prove that the hacker couldn't use my email account because my email account is protected by a very strong 2FA that requires access to my mobile phone and several other passwords. My computer has no remote access, no virus, no rootkits, no malware, all clean and verified by very good antivirus. I even went further on my investigation and checked Google security centre just to confirm that there were no logs from somebody trying to log in yo my Gmail account from other devices and there is nothing. Also no traces of that verification email used in order to allow changing email address. Still BTCjam insisted that the hacker used my own IP and that's just a lie because nobody knows how to do it in my family and my computer is password protected and nobody else knows the password. They didn't send me any logs and they didn't volunteer any help. Instead they told me that they will only collaborate when requested by the police (so I reported to the police).
This is what the hacker did:
1 - (23rd Oct) Changed my email address to ids@hostin.club
2 - Change my profile from Investor to Borrower (I used to have great reputation because I was a lender)
3 - They changed the withdrawal address to 1ov1ZH1mFhod6st1R4rndjWF86E7NTzc9
4 - They requested a loan of 3 BTC on my behalf
5 - (27th Oct) They got 70% of the investment and withdrawn it along with some little money that I had in my account at the time
My account notifications were also disabled so I only got aware of the hack one month later, when BTCjam sent me an SMS message (for the first time since the hacking) requesting me to pay the debt.
The important thing to note is that if the hacker had access to my GMail account then he wouldn't need to change the email address, he could logging in directly using the Google account, and that would have been much easier and safe for him. Also, if he had really used my account I would have got a "new email" notification in my phone in order to reply to the verification email, I know that didn't happen, so the explanation of BTCjam just doesn't make any sense, and now I know that I'm not the only one. I just started believing that this either an inside job (some employee maybe) or a hacker with full access to the Admin of the site. There is another user complaining the somebody used his account to post a message inciting other users to trust me. As you said BTCjam doesn't really care if your account have been compromised and I believe that it could happen again. Problem is that I know no way to force them to remove/delete my account. I'm also trying to inform the investors of the problem and BTCjam is hiding all my new messages (I can see them but the other users cannot). It's very frustrations, probably illegal, from a company operating from the US... unbelievable.

Hi, i agree there is some similarity in both our case, actually i found out about your case after one of my investor reply to my comment "this is happened to jao too", after that btcJam cut/delete my comment, and i have to track one of my investor social media profile through google to ask information and provide some clarification/update.

I as a victim and my investor are the looser party here, i even have to actively insisting my account is not secure from comment and later with email before they lock it and i also have to do extra work tracking some of my investor for information because they didn't even answer many of my question, and only want to blame me because they claim my gmail is compromised, claim which i also doubt, but still keep an open mind that my gmail may somehow compromised from their evidence (if btcjam can provide me with the proof). so many of their claim is not making common sense and against the time stamp proof of every action happen, i consider my self an experienced user in IT and cryptocurrency in general but their answer/claim is just din't make any sense,  and i also investigate by asking some user how btcjam previous procedure with first time email/wallet address change and some of the users gave me their email copy of their communication with btcjam support regarding that and i can say that there also procedure violation in my case because they let several email/address change and notify it but still claim my account is secure.

Thank you for your explanation, i really appreciate it, it really clarify some of unanswered question.

It's very frustrations, probably illegal, from a company operating from the US... unbelievable.

It's an unregulated market. They are not licenced, and they are using a cryptocurrency, as opposed to a "currency" (note that in the U.S., Bitcoin is still not seen as money yet). As far as the law is concerned in this case, it's no different than you "loaning" rocks. There's no legal recourse here for lenders OR borrowers. And that's what makes it so dangerous.

Yes, you are right, but money is still money for me and my investors, despite i lost some money but i really hate to see my investors lost in this and it also can hurt my reputation. maybe there will be some good comes from these similar cases for cryptocurrency community in future, i would love to take this case to the law but the problem is i doubt btcjam will provide me any information needed to build the case.

[JasonXG]

If the company is run properly the way it should be then this should never be a problem. It should be almost impossible to steal funds.
I don't think you should avoid lending it is a good way to make money. I just think you need to be more careful and maybe not use btcjam.
Rather take collateral from someone instead or use another lending site. Sites on the darkweb are very secure if they can do it then what is btcjams excuse ?

[Tulkas]

As we have explained to this user over email, his account had the email changed by using our "change email" feature that requires the user to have access to the previous email to complete the process.

We also offer 2FA but the user did not had it enabled in his account.

We are not responsible and cannot prevent an attacker if the account is not properly secured and the attacker has access to the users email, if you want extra security please enable 2FA.

[mauriek]

As we have explained to this user over email, his account had the email changed by using our "change email" feature that requires the user to have access to the previous email to complete the process.

We also offer 2FA but the user did not had it enabled in his account.

We are not responsible and cannot prevent an attacker if the account is not properly secured and the attacker has access to the users email, if you want extra security please enable 2FA.

Well, always same reply template to all similar issue right? that is your one sided claim and always put blame on your user without helping them to solve the problem, i frequently asked your help to provide me with some information that support your claim that my email was the source of the problem so i can make action if that is true, considering that you openly lie about 2FA in my account, make me think something is wrong in your internal management, either you don't get the right information before replying or you covering something, because i believe you can always check the timing when i activated 2FA for first time or when it was deactivated.

Even when i actively try to find solution and communicate and tracking my investor, your support only trying to mislead the case, not answering simple direct question, claiming false action. for example, i'm the first to notify there was suspicious email change and comment to inform my investors, yet your support said they suspend my account after that but unauthorized withdraw still happened in that same day, so either your support lie about the timing of account suspend or it was done deliberately, and there are also few other suspicious action/claim from your support that was not correct if it compared with the timing stamp of every action, and by avoiding to answer simple direct question make whole communication process difficult.

From this case obviously we can assume that your "change email" feature did not protect your users and since unauthorized user can change registered email several times like your own support said and without your support asking for identification for repeated attempt of using/abusing that feature.

[mummybtc]

One thing I've learned on this P2P lending sites can't work presently, I left the site when the default rate keeps increasing. I still have some unrefunded BTC on the site and the team  is doing no or little effort to get my BTC back. If BTC keeps increasing the P2P system is not sustainable