[HELP]help me to get back my money from scammer

[MoparMiningLLC]

this may also help - when going thru the dm's between eseayan/rajubhusal there was a message from rajubhusal to eseayan




however, the image was not rajubhusal's it was djjacket's image



rajubhusal asked djjacket to put his (raj) name on the image. he then used that image as "proof" to eseayan of "ownership"

[1714809385]

1714809385

[1714809385]

1714809385

[djjacket]

this may also help - when going thru the dm's between eseayan/rajubhusal there was a message from rajubhusal to eseayan


however, the image was not rajubhusal's it was djjacket's image

rajubhusal asked djjacket to put his (raj) name on the image. he then used that image as "proof" to eseayan of "ownership"

I was initially in contact with eseayan about selling a set of Monero coins to him, but he passed due to another deal with someone else.
Later in the day, the user rajubhusal contacted me referenced in the PMs Mopar listed above.

Really sorry this happened to you eseayan.

Bitcointalk really needs two-factor auth at a minimum these days, and it looks appears it was a very savvy exploitation of previous PM messages to socially engineer a false transaction.

This really illustrates the need to be VERY careful when doing deals with people here and be sure you have a strong passphrase that is not shared with other sites.

[nutildah]

Bitcointalk really needs two-factor auth at a minimum these days, and it looks appears it was a very savvy exploitation of previous PM messages to socially engineer a false transaction.

I'm not sure about that. Since the signature really does verify, it means minerjones was in possession of the XMR address in the message, and it appears the funds in question were sent to that address.

We don't actually know what happened without MJ's input. Am I missing something?

[owlcatz]

Bitcointalk really needs two-factor auth at a minimum these days, and it looks appears it was a very savvy exploitation of previous PM messages to socially engineer a false transaction.

I'm not sure about that. Since the signature really does verify, it means minerjones was in possession of the XMR address in the message, and it appears the funds in question were sent to that address.

We don't actually know what happened without MJ's input. Am I missing something?

No, I don't believe so. Where is Minerjones

He cannot simply state he never received anything and wash his hands of this - I'm sorry but this is not right.

@minerjones - Man up here dude! Let's face it, you've always been particularly shitty about that, so I'm going to leave you a neg soon if you don't reply.... FFS, this is a lot of money.

Can you not even face a fuckin CAT ffs? LOL. 🤷‍♂️

[MoparMiningLLC]

Bitcointalk really needs two-factor auth at a minimum these days, and it looks appears it was a very savvy exploitation of previous PM messages to socially engineer a false transaction.

I'm not sure about that. Since the signature really does verify, it means minerjones was in possession of the XMR address in the message, and it appears the funds in question were sent to that address.

We don't actually know what happened without MJ's input. Am I missing something?

No, I don't believe so. Where is Minerjones

He cannot simply state he never received anything and wash his hands of this - I'm sorry but this is not right.

@minerjones - Man up here dude! Let's face it, you've always been particularly shitty about that, so I'm going to leave you a neg soon if you don't reply.... FFS, this is a lot of money.

Can you not even face a fuckin CAT ffs? LOL. 🤷‍♂️

it has been less than 48 hours - sometimes life happens and people are not always able to get here right away. Minerjones has escrowed millions worth of crypto and items and I dont think anyone can say he ripped them off. He also never said he never received the funds - that second dm simply states that he does not have the coins and does not have the funds.

[2stout]

A few questions remain to be answered and mostly likely will be in time, hopefully sooner than later.  Here's another one and I'm not pointing fingers but rather looking for more clarification:  Did anyone find it odd that someone would honor a request to take a pic of their own item with someone else's name and date next to it?

[minerjones]

I'm here.
Be able to respond more tomorrow.

[djjacket]

A few questions remain to be answered and mostly likely will be in time, hopefully sooner than later.  Here's another one and I'm not pointing fingers but rather looking for more clarification:  Did anyone find it odd that someone would honor a request to take a pic of their own item with someone else's name and date next to it?

You are correct.  That was probably not the best thing to do looking back at it and I should have realized something fishy was going on.  Not gonna make that mistake again...

[2stout]

A few questions remain to be answered and mostly likely will be in time, hopefully sooner than later.  Here's another one and I'm not pointing fingers but rather looking for more clarification:  Did anyone find it odd that someone would honor a request to take a pic of their own item with someone else's name and date next to it?

You are correct.  That was probably not the best thing to do looking back at it and I should have realized something fishy was going on.  Not gonna make that mistake again...

I would have expected more from a Hero member as a jr member would have know better.

[MoparMiningLLC]

A few questions remain to be answered and mostly likely will be in time, hopefully sooner than later.  Here's another one and I'm not pointing fingers but rather looking for more clarification:  Did anyone find it odd that someone would honor a request to take a pic of their own item with someone else's name and date next to it?

You are correct.  That was probably not the best thing to do looking back at it and I should have realized something fishy was going on.  Not gonna make that mistake again...

I would have expected more from a Hero member as a jr member would have know better.

first step is that he admits it - there was no proof of it, he volunteered the information. so that means he should learn from it.

[eseayan]

Thanks very much for your help, guys.

I have ask the CEX to provide me the XMR address and view key.  If they are got, I will post here.

[minerjones]

Going off of times from my PMs:

Aug 28 2021 073933AM: eseayan contact about escrow

Aug 28 2021 084554AM: Rajubhusal contact confirming escrow with release address of 43Xf5BWzcdbdhDeHnj6cF1dG4fGnasQEUHyn2F92LK9VbyvP96nbhkdGZuEJKHd2X9eYhhbKQn4C6E1 V2h8EHSSvVjGs1rZ

Aug 28 2021 045333PM: eseayan paid escrow

Aug 28 2021 082807PM: eseayan confirm that coins will be delivered in person

Aug 29 2021 113837AM: minerjones confirms payment

Aug 29 2021 120243PM: eseayan send PM saying the coins were received

Aug 29 2021 012253PM: Rajubhusal confirms, saying to release to given address previously (see above)

Aug 29 2021 014725PM: minerjones releases funds.

Aug 30 2021 045711PM: from new/alt account "aseayan" asking to stop the deal because account "eseayan" was hacked.

Funds were received and sent out:

[MoparMiningLLC]

so my guess is raj sent the dm's from eseayan's account saying it would be an "in person delivery" and then that it had happened.

some may wish to see those DM's as they are not actually in eseayan's account. and in none of the DM's presented was it stated it would be hand delivered.


edit - is there any way to retrieve deleted dm's?

[eseayan]

Going off of times from my PMs:

Aug 28 2021 073933AM: eseayan contact about escrow

Aug 28 2021 084554AM: Rajubhusal contact confirming escrow with release address of 43Xf5BWzcdbdhDeHnj6cF1dG4fGnasQEUHyn2F92LK9VbyvP96nbhkdGZuEJKHd2X9eYhhbKQn4C6E1 V2h8EHSSvVjGs1rZ

Aug 28 2021 045333PM: eseayan paid escrow

Aug 28 2021 082807PM: eseayan confirm that coins will be delivered in person

Aug 29 2021 113837AM: minerjones confirms payment

Aug 29 2021 120243PM: eseayan send PM saying the coins were received

Aug 29 2021 012253PM: Rajubhusal confirms, saying to release to given address previously (see above)

Aug 29 2021 014725PM: minerjones releases funds.

Aug 30 2021 045711PM: from new/alt account "aseayan" asking to stop the deal because account "eseayan" was hacked.

Funds were received and sent out:

I am glad to know the full process. I believe what MJ said is ture. But it is so bad to hear the xmr is funded.

No matter that I can afford the loss. It is a big lesson that I should learn from. Here I will not blame anyone. I appreciate to get timely help from nutildah, MoparMiningLLC, LoyceV, owlcatz, etc. Guys, you make me still believe bitcointalk is the best forum on cryptocurrencies.

Thanks again.

 
EDIT:

Aug 29 2021 120243PM: eseayan send PM saying the coins were received

This message should be sent by the hacker through my hacked account before I recognized my account is hacked. What i wanna buy is physical coins, which need some days to be shipped to me from USA to China. I will not send message to confirm I have received them after the second escrow day.

[LoyceV]

rajubhusal asked djjacket to put his (raj) name on the image. he then used that image as "proof" to eseayan of "ownership"

Really sorry this happened to you eseayan.

I remember a case in which someone signed a message with someone else's name, that was also used to scam. This is just as bad: it's common practice on the Collectibles board to ask for a photo with a handwritten username and the current date as proof of ownership.
You have single-handedly made this entire concept useless by doing this:

(screenshot taken by LoyceV from this link)

Aug 28 2021 082807PM: eseayan confirm that coins will be delivered in person

Was this part of the escrow deal? Even if the delivery would have happened, you would have no way to confirm this if either party says the other one didn't show up.

Aug 29 2021 014725PM: minerjones releases funds.

Why didn't you mention this to eseayan 19 days later, but instead just said you don't have the funds?

Minerjones said he doesn't have the coins:

https://ibb.co/9hXqfr7

I've verified this PM through OP's account. It's real:

« Sent to: eseayan on: September 17, 2021, 11:08:01 AM »

I must say I'm quite disappointed that 2 veteran Collectibles traders let themselves be used by a scammer!

edit - is there any way to retrieve deleted dm's?

Admin can restore deleted posts, I assume the same applies to PMs. But eseayan should ask for that, either by sending a PM to theymos, or by opening a topic in Meta. Admin may also be able to connect the account to other accounts.

This message should be sent by the hacker through my hacked account before I recognized my account is hacked.

Do you have any idea how your account got hacked?

[eseayan]

rajubhusal asked djjacket to put his (raj) name on the image. he then used that image as "proof" to eseayan of "ownership"

Really sorry this happened to you eseayan.

I remember a case in which someone signed a message with someone else's name, that was also used to scam. This is just as bad: it's common practice on the Collectibles board to ask for a photo with a handwritten username and the current date as proof of ownership.
You have single-handedly made this entire concept useless by doing this:

(screenshot taken by LoyceV from this link)

Aug 28 2021 082807PM: eseayan confirm that coins will be delivered in person

Was this part of the escrow deal? Even if the delivery would have happened, you would have no way to confirm this if either party says the other one didn't show up.

Aug 29 2021 014725PM: minerjones releases funds.

Why didn't you mention this to eseayan 19 days later, but instead just said you don't have the funds?

Minerjones said he doesn't have the coins:

https://ibb.co/9hXqfr7

I've verified this PM through OP's account. It's real:

« Sent to: eseayan on: September 17, 2021, 11:08:01 AM »

I must say I'm quite disappointed that 2 veteran Collectibles traders let themselves be used by a scammer!

edit - is there any way to retrieve deleted dm's?

Admin can restore deleted posts, I assume the same applies to PMs. But eseayan should ask for that, either by sending a PM to theymos, or by opening a topic in Meta. Admin may also be able to connect the account to other accounts.

This message should be sent by the hacker through my hacked account before I recognized my account is hacked.

Do you have any idea how your account got hacked?

Admin can restore deleted posts, I assume the same applies to PMs. But eseayan should ask for that, either by sending a PM to theymos, or by opening a topic in Meta.

sent a PM to theymos, copied to LoyceV

Do you have any idea how your account got hacked?

1.Maybe the hacker hacked my email, and my bitcointalk account password is same as that of my email account(I have changed them different passwords and applied F2A in my email account.).
2.Maybe the hacker instructed Trojan virus in my computer, because I had found some virus when I used windows defender to scan my computer some months ago.

[dkbit98]

Maybe the hacker hacked my email, and my bitcointalk account password is same as that of my email account(I have changed them different passwords and applied F2A in my email account.).

You should NEVER reuse your passwords for anything again, and I hope you learned a lesson about that.
Use some password manager like KeyPass for storing and generating new strong password for each website.

Maybe the hacker instructed Trojan virus in my computer, because I had found some virus when I used windows defender to scan my computer some months ago.

It could be a false positive, but it's possible that you have some clipboard malware that could collect your passwords and any keys related with crypto.
Switching to Linux may also be a good idea so you won't need to use any antiviruses, and offline computer is much better for dealing with crypto.

[Quickseller]

Aug 28 2021 082807PM: eseayan confirm that coins will be delivered in person

Was this part of the escrow deal? Even if the delivery would have happened, you would have no way to confirm this if either party says the other one didn't show up.

According to what appears to be the escrow agreement, the coins were to be shipped to the buyer.

This was not long after eseayan's password was changed, and should have set off red flags.

I am interested to see what MJ plans to do about the situation.

[MoparMiningLLC]

I agree that the earlier messages state it was to be shipped but, I am not sure what he can do if he received a pm from both buyer and seller that the coins would be hand delivered and then another set from both that the coins had been transferred in person and to release funds - what else can he do but release funds?

[LoyceV]

I agree that the earlier messages state it was to be shipped but, I am not sure what he can do if he received a pm from both buyer and seller that the coins would be hand delivered and then another set from both that the coins had been transferred in person and to release funds - what else can he do but release funds?

I would have preferred this:

I'd say: "Rule One: Never change the deal." applies (quote taken from The Transporter movie). If anything changes, a good default would be to delay the release of escrowed funds quite a bit.
Maybe a better solution would have been to refund the buyer if anything changes. If they agree to meet in person instead of shipping, that requires a new agreement in which buyer has to fund escrow again to a new address. But that requires strict rules from the escrow, known upfront, which wasn't the case here.

It looks like the scammer has at least one more account:

Facebook profile =https://www.facebook.com/profile.php?id=100027050231408
Twitter profile =https://twitter.com/ShitaNeupan

Twitter profile:  https://twitter.com/ShitaNeupane
Facebook:   https://www.facebook.com/profile.php?id=100027050231408