Victims of a big fraud - And now what ?

[DomainEmpire.com]

It's the first time in my 19yr experience in the domain business that we get victims of a big fraud and I can't yet believe that, to be honest.

Well, in the first week of September I saw a domain auctioned at Flippa and I made a bid but the reserve didn't get met so the auction ended with the name unsold.

The auctioner approached me privately and proposed to close a deal out**** so we reached an agreement on a fair price and used Sedo.com for the private transaction (we had some credit there so we decided to use it despite the fact we paid a bit higher fee than on Escrow).

The transfer has successfully completed in few days so he proposed a second domain and we reached a fair agreement as well ... Again we used Sedo to close this deal and anything worked fine till Thursday when GoDaddy removed both names from our account by following an US court order.

Oh, we got shocked ! It seems this guy stolen both names from the original registrant and sold them fraudolently.

Well, we've lost an high $xx,xxx in favor of this scammer ... What next ?

Obviously we know nothing about him, we're aware of the identity theft fraud and similar stuff so, it's really worth investing on a legal action/investigation to try getting our money back ?

Obviously no, I'd say ... but I'd like to know your advice.

The only 'real data' is the bank account he has surely used to cash funds from Sedo so I've some questions here: let's suppose a judge should order Sedo rto reveal his bank account details then we should find a second judge belonging to that jurisdiction ready to order the bank to reveal their client details but what next ?

No bank account is anonymous, he might have used a nominee to open that account or who know what other dirty trick.

What's your thought ? It was really hard to suspect a fraud considering he was auctioning one of his domain at Flippa without being apparently in a rush to sell ...

But now I've other concerns regarding our future purchases too: let's say we find a domain listed with a fixed BIN of $200k on a public marketplace and we close a deal then few weeks later a court order force our registrar to move the domain back to his original registrant. How may we avoid similar frauds to happen again ? What should we do to prevent them ? Things are not so easier as in the past when all public details where listed in whois so it was easy querying whois history, calling the person who owned it till few months before (in case of a recent registrant change) and checking nobody stolen his name.

In the past we risked to be victims of a similar fraud but some lucky circumstances made as suspicious so we avoided it at the last second.

In that case, the hacker didn't change whois info (so there was no recent update to the whols record) because he gained control over the registrant email so it was very hard suspecting something was wrong there ...

 

[offthehandle]

Sorry to hear that you were defrauded. Why didn’t you contact Godaddy before completing it? Or did you? If it was under suspicion, you would have thought the court order was in process already if it happened that fast. With all the godaddy emails, it seems they would have known they better fix the 60 day lock on whois changes or disclose such ahead of time. They have access to lots of behind the scenes data and their whois that works, and can track even if under privacy Privacy it seems to be the route of so much fraud, and even to allow fake sales data to be hidden on high value names too being passed around and price discovery games.

You’ve been around a long time, so curious why you didnt login once and awhile here at NP and keep up. You can thank the EU and their brilliance of forcing this GPRP down the throats of the world. Worse yet all Registrars complying with it too.

Let me guess it was a too good to be true bargain price and undervalued?

Seller also didn’t provide KYC information required with a picture ID, simultaneous of him in the camera next to his Govt ID. You could have asked the seller to do a skype call, recorded it with his ID right there on screen, like Escrow too. That procedure has many here object to with Escrow since they don’t want to pay taxes and somehow believe their ID will be stolen. I imagine SEDO to comply with EU privacy does not vet like that, but I don’t know.

Read CQD thread, you are not even safe in background checks, it seems unless you use Escrow Concierge. Due diligence is buyers responsibility, and even the high end seller got duped in CQD. Suggest you use the Escrow concierge service too. I did not want scammers to read this, but there other tricks you can do to vett this better on your own.

https://www.namepros.com/threads/resolved-domainer-loses-26k-on-a-stolen-domain.1068888/

Just imagine even the owner of a registry took bitcoin and got scammed.

https://www.namepros.com/threads/deadbeat-megathread.1155446/#post-7407764

One more thing, you could also require funds be wired, based on your invoice for say a down payment or 50% up front to confirm who you are dealing with and their banking info.

 

[7363824]

I would reach out to Sedo's security team. Not sure if there is a way for them to reverse the payment but they could at least flag the seller's account.

 

[MapleDots]

In that case, the hacker didn't change whois info (so there was no recent update to the whols record) because he gained control over the registrant email so it was very hard suspecting something was wrong there ...

That was the unfortunate part, even with due diligence ie. sending an email to the registered owner, you would have had trouble avoiding fraud.

The only thing I would have done different is I would have done the deal direct and bypassed Sedo. I would have his bank account information and if possible have matched that to the whois data.

Nonetheless, I fell your loss and I think this topic may be a lesson for all on namepros.

I would post as much info as you have here in topic, maybe somehow some of our sleuths can piece some clues together.

I wish you all the best and sincerely hope you get your hard earned funds back.

Good luck.

 

[domainer111]

Sorry to hear about this, that is terrible.

It's definitely a strong case for crypto transactions. The best thing is to ID the person on Linkedin though this of course is far from perfect.

 

[MapleDots]

Sorry to hear about this, that is terrible.

It's definitely a strong case for crypto transactions.

Actually, quite the opposite, in a crypto transaction the funds are untraceable, the op is much better off having the funds go directly into the perpetrator bank account (through sedo in this case) because there will be a trail. Even if the bank account was phony the funds would have to be removed and transferred again, there is a trail of sorts to follow. With crypto that would not be an option and in the OP's situation that is probably his only hope of recovering the funds.

 

[lock]

Really sucks I have been scammed before a few times really you learn but bound to happen over 20+ years. Worst ones are just the ones when trusted people turn bad eg: accountant steals your money for casino. I see more scams than business and personal about 50% of the spam would be underhanded.

 

[Arfy]

Very sorry to hear about this, I am going to send you a PM.

 

[Lox]

... in a crypto transaction the funds are untraceable...

that's what coiners want you to believe , every #c is traceable, even most of IDs

 

[Lox]

The auctioner approached me privately and proposed to close a deal out**** so we reached an agreement on a fair price and used Sedo.com for the private transaction (we had some credit there so we decided to use it despite the fact we paid a bit higher fee than on Escrow)....

Me, in short, when buying above $10k:

1. Agreement (recorded conversation)
1a. Pre-contract (identity, rec. transcript, acknowledgment)
1b. Due diligence (usually cost $1k+)
2. Contract (lawyer, i’m using online SignNow service or face to face, lawyer = lawyer)
3. Bank transfer only ( call gaining bank to confirm the account (record conversation) , no online escrow or 3rd party involved).
...
Ask your lawyer how to make it right.
Regards

 

[biggie]

I saw a domain auctioned at Flippa

i don't go there, but that's where I would start recovery and id efforts

sorry bout what happened to you and hope you get some positive results.

imo....

 

[namemarket]

....so we reached an agreement on a fair price and used Sedo.com for the private transaction (we had some credit there so we decided to use it despite the fact we paid a bit higher fee than on Escrow)......

Real surprising you would not use Escrow,com, even paying a higher cost at Sedo!

This issue is going to be a bigger issue as time goes by with the recent surge in popularity of using places like Sedo Uni Flippa Dan Epik and others for escrow. These places are not real escrow companies and I am sure do not fully verify identities or do a complete job like escrow.com has done for so many years.

Your fraudster likely wanted to use Sedo because he knew it was easier to hide identities at Sedo. Have heard it said if this kind of fraud was at Escrow.com they may possibly take the loss not the buyer.

 

[D Haynes]

Well that sucks! I only ever use a credit card to purchase anything online. All purchases are covered against fraud etc so they will reimburse a victim. I think I'm right in saying that even if only 1 percent of a purchase is made with a credit card, most card providers will cover the whole purchase amount.

 

[DomainEmpire.com]

Thanks to anyone for your support and understanding of the situation.
Yes, it has been a bad experience but I've learned a lot.

It's probably worth hirihg a lawyer just to try doing a quick investigation maybe in cooperation with the attorneys hired by the real registrant (he might have an interest in sueing the hacker but who knows if we'll be so lucky to discover his real identity).
Strange to believe but the hacker proposed to use Escrow !
I had no reason to suspect this was a scam and I proposed to use Sedo where we already had a positive balance just to make things easier (I was travelling abroad and I had no time to take care of the bank wire etc ...).
Tons of strange circumstances didn't give me the possibility to consider this deal with the due calm.

Ok it happened but now I'm asking myself what was the hacker strategy in case we should have used Escrow ... who knows.
I'll update the thread in case we should get any success with our investigation, I'll now look a lawyer ready to cooperate with the Sedo security dept to see if there's something we can do.

 

[DomainEmpire.com]

Another suspicious thing happened here: we got both names on 09/05/2019 by transferring them from Dynadot to GoDaddy (the hacker supplied the codes and called the registrar to speed up the transfer).
The court order reached GoDaddy which moved both names to another account on 09/26 ... Multiple things happened too quickly here, it's really the case to investigate a bit more because I'm starting to suspect we might not have bought from the hacker but from another victim ... Just a possibility.

 

[wwwweb]

Another suspicious thing happened here: we got both names on 09/05/2019 by transferring them from Dynadot to GoDaddy (the hacker supplied the codes and called the registrar to speed up the transfer).
The court order reached GoDaddy which moved both names to another account on 09/26 ... Multiple things happened too quickly here, it's really the case to investigate a bit more because I'm starting to suspect we might not have bought from the hacker but from another victim ... Just a possibility.

What are the odds of that, like a few hours would have saved this whole headache, the paperwork was probably sitting on a desk waiting to be locked down. When it is to good to be true, it usually is. All mid level 5 figure wholesale deals need long inspection periods if you have no reputation of the seller confirmed.

Sorry, for your loss, in most cases you are chasing a ghost here, the lawyers will just eat you into 5 figures with all this chasing, and doors closing. Everyone got paid except you.

 

[poweredbyme]

If the precautions mentioned above work why scams never end?

But now I've other concerns regarding our future purchases too: let's say we find a domain listed with a fixed BIN of $200k on a public marketplace and we close a deal then few weeks later a court order force our registrar to move the domain back to his original registrant. How may we avoid similar frauds to happen again ? What should we do to prevent them ?

If a deal is too good to be true, I would stay away from it. This the best protection. I am after fair deals, not very good ones.

If you can't stop looking for too good to be true type offers, stick to registrar marketplaces. They provide the best protection for buyers as well as sellers. Imagine if you bought those domains from a registrar marketplace. How likely would you get scammed? Yes they charge more than third party escrow services. Maybe their fee is not too good to be true?

 

[namemarket]

....Strange to believe but the hacker proposed to use Escrow.....

That is incredibly strange the hacker wanted to use escrow.com the one place where it's much more difficult to scam than elsewhere. Makes me think there's more to the story.

 

[MapleDots]

That is incredibly strange the hacker wanted to use escrow.com the one place where it's much more difficult to scam than elsewhere. Makes me think there's more to the story.

That is probably how he established a trust relationship, who would suspect someone of fraud when they are asking or proposing escrow.

I would like to use escrow, but we can use anything you like.

OK so he mentions the trusted and secure and then steers to a more insecure way to pay.

Crooks can be master manipulators.

 

[wwwweb]

Well maybe he is a legit buyer from a second party who had stolen it, so their escrow account could be legit.

It is basically hot potato, and the one left holding the bag, gets stuck with the bill.

 

[Keith]

That is probably how he established a trust relationship, who would suspect someone of fraud when they are asking or proposing escrow.

I would like to use escrow, but we can use anything you like.

OK so he mentions the trusted and secure and then steers to a more insecure way to pay.

Crooks can be master manipulators.

I believe that the onus falls on the platform who ensures a secure transaction. If Flippa, Sedo, godaddy... decide to take a listing and facilitate the transaction, they are 100% on the hook if it goes south.

That’s my opinion. Selling stolen property is a crime...

 

[domainer111]

Actually, quite the opposite, in a crypto transaction the funds are untraceable, the op is much better off having the funds go directly into the perpetrator bank account (through sedo in this case) because there will be a trail. Even if the bank account was phony the funds would have to be removed and transferred again, there is a trail of sorts to follow. With crypto that would not be an option and in the OP's situation that is probably his only hope of recovering the funds.

Agreed, I misread the case facts and had the funds going the wrong way. At least with the banking system, there is a good chance of a trace.

 

[wwwweb]

I believe that the onus falls on the platform who ensures a secure transaction. If Flippa, Sedo, godaddy... decide to take a listing and facilitate the transaction, they are 100% on the hook if it goes south.

That’s my opinion. Selling stolen property is a crime...

As many times that has happend, I have never heard once of the platform owning up to covering the losses.

 

[poweredbyme]

Ok it happened but now I'm asking myself what was the hacker strategy in case we should have used Escrow ... who knows.

It's interesting. I can think of 2 possibilities. Perhaps the hacker can hack escrow accounts as well Maybe the hacker gave them a fake ID, used hacked bank account or a bank account opened with fake/stolen ID. I would expect there is no trace left behind if the hacker is a part of a crime organization. If an organization involved they may have great resources and different people with different skills. Everyone seems like assuming there is only one scammer with limited resources.

 

[DomainRecap]

You can thank the EU and their brilliance of forcing this GPRP down the throats of the world. Worse yet all Registrars complying with it too..

Hardly.

the hacker didn't change whois info (so there was no recent update to the whols record) because he gained control over the registrant email so it was very hard suspecting something was wrong there