Victims of a big fraud - And now what ?

[DomainEmpire.com]

It's the first time in my 19yr experience in the domain business that we get victims of a big fraud and I can't yet believe that, to be honest.

Well, in the first week of September I saw a domain auctioned at Flippa and I made a bid but the reserve didn't get met so the auction ended with the name unsold.

The auctioner approached me privately and proposed to close a deal out**** so we reached an agreement on a fair price and used Sedo.com for the private transaction (we had some credit there so we decided to use it despite the fact we paid a bit higher fee than on Escrow).

The transfer has successfully completed in few days so he proposed a second domain and we reached a fair agreement as well ... Again we used Sedo to close this deal and anything worked fine till Thursday when GoDaddy removed both names from our account by following an US court order.

Oh, we got shocked ! It seems this guy stolen both names from the original registrant and sold them fraudolently.

Well, we've lost an high $xx,xxx in favor of this scammer ... What next ?

Obviously we know nothing about him, we're aware of the identity theft fraud and similar stuff so, it's really worth investing on a legal action/investigation to try getting our money back ?

Obviously no, I'd say ... but I'd like to know your advice.

The only 'real data' is the bank account he has surely used to cash funds from Sedo so I've some questions here: let's suppose a judge should order Sedo rto reveal his bank account details then we should find a second judge belonging to that jurisdiction ready to order the bank to reveal their client details but what next ?

No bank account is anonymous, he might have used a nominee to open that account or who know what other dirty trick.

What's your thought ? It was really hard to suspect a fraud considering he was auctioning one of his domain at Flippa without being apparently in a rush to sell ...

But now I've other concerns regarding our future purchases too: let's say we find a domain listed with a fixed BIN of $200k on a public marketplace and we close a deal then few weeks later a court order force our registrar to move the domain back to his original registrant. How may we avoid similar frauds to happen again ? What should we do to prevent them ? Things are not so easier as in the past when all public details where listed in whois so it was easy querying whois history, calling the person who owned it till few months before (in case of a recent registrant change) and checking nobody stolen his name.

In the past we risked to be victims of a similar fraud but some lucky circumstances made as suspicious so we avoided it at the last second.

In that case, the hacker didn't change whois info (so there was no recent update to the whols record) because he gained control over the registrant email so it was very hard suspecting something was wrong there ...

 

[Jurgen Wolf]

we used Sedo to close this deal and anything worked fine till Thursday when GoDaddy removed both names from our account by following an US court order.

This court order is published somewhere?
Have you seen/read it?

 

[Jurgen Wolf]

Real surprising you would not use Escrow,com, even paying a higher cost at Sedo!

Sedo escrow commission is 3%.

 

[poweredbyme]

Same with US banking laws being forced on non-US banks, and transactions requiring compliance with KYC, many non US people disagree with them, rightly so but unlike GDRP, KYC actually are relevant to protect from financial fraud.

KYC is to prevent tax evasion only has nothing to protect people from illegals, terrorists, drug dealers, scammers, etc. That's why KYC is widely popular. It means more $$ to all governments. People know all transactions are recorded and reported to tax authorities so they are afraid of getting caught if they report income less. If you think illegal money would use financial system if KYC was removed, you are naive. Which illegal would enter to a bank branch with cash in hands? Those locations are full of voice and visual recording devices and probably connected to face recognition systems. If you were an illegal would go to such places? ID is not a big problem for illegals. In fact governments usually know their ID correctly but they can't catch as their locations are unknown, not their ID.

GDRP is protecting citizens, KYC is protecting governments. This is their real difference. It doesn't mean I support GDRP at least in its current form. But I am against to KYC in shopping. Domains are a shopping activity only. Money is already tracked if someone sells and buys something including domain. Online companies, unless they provide banking/financial services, wouldn't be requiring ID if governments do their job correctly. If governments doesn't stop this stupidity, even creating a forum account will require ID.

 

[poweredbyme]

It's very important. You may ask why ID is not a big problem for illegals? How do they steal ID of people? I believe their one of the biggest sources is fake KYC requirements of irrelevant websites. We don't know do they really protect our ID or if they sell our ID's to illegals. Why? Because internet is global. Most people send their ID to another part of the World just a sell or buy something for only one time.

Assume I will start a company and want to buy a domain. It's a one time purchase. Normally it's a shopping activity. Also I am not in the same country with the company requiring my ID. How can I follow their practices in protecting my ID? I can't. Do they know this? Yes. Because they require my address documents as well, so they know my location and know I can do nothing to them for the geographical great distances. If they lose or sell my ID can I do nothing? Maybe if I learn, at least I can report them to authorities in my country and let them take care the rest. But how can I learn with no doubt they have sold or lost my ID? It's impossible to learn it. Why should take such a great risk just to purchase a domain for only time in my life? It would be one of the biggest stupid thing I did. Marketplaces are not doing finance related business, have no authority to ask for ID. Furthermore, it's almost impossible have financial services remotely over the internet. To open bank account you have to physically sign the papers in front of the bank/finance company personnel. Basically you can do almost nothing on the internet that would require your ID.

 

[namemarket]

Agreed, and in some 3rd-world countries there are entire districts filled with buildings full of scammers calling companies all day long, and social engineering trick to try and gain access to user accounts, bank data, personal info, etc. A lot of these "hacker hives" are in places cops won't even go, or are paid enough not to go there.

By a coincidence last night I was watching some very interesting YouTube Videos by several India Scam-buster channels covering the exact things you referred to above. They are genius in their scammer ability. It's really hard to believe how easily they can do it. P.S. The ones I watched were calling people in the US and UK (not companies) from call-centers and using the same methods to do the fraud.

 

[namemarket]

This court order is published somewhere?
Have you seen/read it?

I am fairly certain court cases of this type and decisions are always public information so Godaddy can be asked for the court location and the case can be found from the local court system.

 

[Jurgen Wolf]

KYC is almost everywhere nowadays... including popular cryptoexchanges...

 

[MapleDots]

that's what coiners want you to believe , every #c is traceable, even most of IDs

Hmm, I thought once you paid by bitcoin there was no way to trace the transaction, is that not why a lot of scammers use it?

 

[poweredbyme]

KYC is almost everywhere nowadays... including popular cryptoexchanges...

Crypto is currency. Currency exchange is a financial activity. Domain is a merchandise. Domain marketplaces are not providing financial service. They are not very different from ebay, amazon, etc.

Escrow services are mostly for physical goods, are deemed to operate locally or nationally with their warehouses. Physical goods like car/yacht usually may need to hold money and merchandise of people for a bit long term similar to banks. They can potentially manage large amount of money of other people for a long term. They can invest it to earn interest and their investments may affect financial system or may lose the money in risky investment and may need bailout from government. So escrow services need to be regulated as a financial service as they potentially can hold cash for a long term. But domain is a global thing, is quickly delivered virtually and buyer/seller may be foreign nationals. For me domain escrow and usual escrow are way very different. Domain escrow is not a financial service in nature. But in the practice it's mixed with usual traditional escrow of physical goods. Laws come later than new techs.

 

[Jurgen Wolf]

Without the detailed US court order/decision - nothing to discuss here...
Further work is for lawyers and appeals court...

 

[poweredbyme]

Hmm, I thought once you paid by bitcoin there was no way to trace the transaction, is that not why a lot of scammers use it?

Bitcoin transactions are recorded to blockchain permanently. It's visible to everyone for unlimited time.
Transaction data include
- date of the transaction
- amount of bitcoin
- receiver and seller btc addresses. I display my btc address below as my signature. So it's a meaningless machine code.
- transaction fee in bitcoin

There is no name of sender and receiver. So it's not traceable back to a particular person or entity. I can send bitcoin to my other btc addresses. An observer may think I have spent all my btc. There is no limit on btc addresses. Transactions allow multiple sender and receiver btc address. You can send btc from 1,000 btc addresses to 1,000 btc addresses. How can you trace it back to a person? It's impossible as you can't know how many different persons involved this transaction. In fact it's not very necessary. Bitcoin can not be seized by any authority. If a person wants to hide it nobody can find or know you own bitcoin, or can hide most of it. Governments are unable to make it illegal. It would be meaningless to make something illegal that's very difficult to prove its existence or absence.

 

[Jurgen Wolf]

Where is your wallet?
On your local machine? You play with blockchain directly on your own hardware?

For their wallet - most people use various cryptoexchange platforms which follow KYC.

 

[Jurgen Wolf]

Five myths about bitcoin

 

[poweredbyme]

Where is your wallet?
On your local machine? You play with blockchain directly on your hardware?

For their wallet - most people use various cryptoexchange platforms which follow KYC.

I keep my btc on my hardware since the beginning. I have read too much about it before getting started. If you don't own private key, it's not your coin. My concern is related to security of my btc rather than avoiding kyc.

For those who is avoiding kyc strictly, it's possible to avoid kyc for small amounts only that nobody would be interested, like purchasing some small things online. But, if you live off btc or make large transactions in btc, kyc is inevitable. Buying cars or properties will end up with kyc. I believe it's more related to government rather than btc. Some governments may ask source of cash if you buy a little bit expensive furniture for your home, some governments may not ask if you deposit high amounts cash regularly to your bank account. Btc does not play very big role in avoiding kyc, even in frauds and illegal things. Because illegals use cash more than crypto. We don't see the full picture and we are focused on only digital things.

Btc helps mostly unbanked people and people from poor countries who they can't have bank account or can't even go to the nearest ATM to withdraw money from rural locations. In some countries women may not be to allowed to open bank account under their own name. Some people may avoid kyc for innocent reasons like journalists and opponents in oppressive regimes or people who live in similar difficult situations. I think btc has started as a global social project. Banks didn't like it as it's an alternative to credit cards, and of course governments as they might tax banks less. So currently they defame btc and its users. In fact the usage capacity of btc in illegal things or tax evasion capacity of btc are less than cash that changes hands offline with literally no trace at all.

 

[lambo.com]

Me, in short, when buying above $10k:

1. Agreement (recorded conversation)
1a. Pre-contract (identity, rec. transcript, acknowledgment)
1b. Due diligence (usually cost $1k+)
2. Contract (lawyer, i’m using online SignNow service or face to face, lawyer = lawyer)
3. Bank transfer only ( call gaining bank to confirm the account (record conversation) , no online escrow or 3rd party involved).
...
Ask your lawyer how to make it right.
Regards

You are long and I would never do business with you like that

 

[capybara]

And thats one more reason to use installment plans as a seller (helps when your buyer is in doubts) and as a buyer too. Make two, three, four payments, see that things are alright and only then pay the rest. If you got scammed, you won't lose all of your money at least.

 

[capybara]

Agreed, and in some 3rd-world countries there are entire districts filled with buildings full of scammers calling companies all day long, and social engineering trick to try and gain access to user accounts, bank data, personal info, etc.

A lot of these "hacker hives" are in places cops won't even go, or are paid enough not to go there.

That is some kind of weird legend. What kind of social engineering can be done using voice without a proper spoken English? Anyone from a 3rd world country able to do that could certainly find themselves a better occupation.

Although many people won't disagree with this part – there are entire districts filled with buildings full of scammers – these are the governments' districts.

 

[Silentptnr]

GoDaddy continues to be a platform that harbors stolen domains. This is probably the 4th or 5th case very recently where someone buys a domain, then shortly after purchase, GoDaddy takes the domain.

Why is GoDaddy right there to repossess a domain as soon as it is sold and pushed?

What's going on there? Something is just not right.

Something is going on at GoDaddy. They are repossessing names left and right.

After a similar thing happened to me with GoDaddy, I will never buy another aftermarket domain housed at GoDaddy without calling them in person and verifying that there is no chance of repossession.

Just doesn't make sense that as soon as a domain is pushed, GoDaddy comes in and repossesses it.

They never give proof of anything. Sorry you are another victim of GoDaddy's poor service.

 

[Silentptnr]

To make matters worse, GoDaddy will re-auction those names they took from you.

 

[Bob Hawkes]

And thats one more reason to use installment plans as a seller (helps when your buyer is in doubts) and as a buyer too. Make two, three, four payments, see that things are alright and only then pay the rest. If you got scammed, you won't lose all of your money at least.

This is a very good point for payment plans that I had not thought of before. I could see sellers and platforms pushing it as a point in their favour. Yes in a few cases the buyer will abandon after a payment or two, and you need to resell, but I think it would convince some who have hesitations about buying any aftermarket domain.

 

[capybara]

Yes in a few cases the buyer will abandon after a payment or two

Wish that could just happen all the time! Selling one and the same domain over and over again without losing it, isn't that sweet!

 

[bidigitals]

You could have asked the seller to do a skype call, recorded it with his ID right there on screen, like Escrow too.

Wow! 26 yrs on the fringe of the industry, now fully, & applaud your suggestions as wise. Our concern is in the opposite direction, as all 8k domains were hand-registered, yet, "BOTH parties identifying themselves beyond question" is purely brilliant, and you just turned it into a 60-second secret!

@DomainRecap, you are one smart cookie I anticipate learning even more from. Huge thank you!

 

[bidigitals]

What are the odds of that, like a few hours would have saved this whole headache

"If it sounds too good to be true, it usually is."

Brilliant thumbs up, because it's a powerful rule to observe!

 

[BoothDomains]

Was it 2 NNNN.coms?

 

[Bob Hawkes]

This is probably the 4th or 5th case very recently where someone buys a domain, then shortly after purchase, GoDaddy takes the domain.

Why is GoDaddy right there to repossess a domain as soon as it is sold and pushed?

What's going on there? Something is just not right.

It certainly seems that way, but GoDaddy is by far the largest registrar, so I guess one might expect most to be there, possibly. But it does seem strange that at least the recent cases from what I recall all involved a sale on a platform other than GoDaddy and seizure almost immediately upon transfer or push at GoDaddy. Is it that change of ownership triggers a check, perhaps? But how are they served with legal papers from the owner almost immediately? Or if they had the information before, surely it is wrong to wait for the domain to change hands to an innocent third party to repossess it?

They never give proof of anything.

I think this is maybe the key point that is, as I see it, highly relevant to this thread. As individuals, it is seldom worth the effort to legal or consumer challenge the GoDaddy repossession, to get proof.
But if an insurer set up by legal minds is involved (as is being discussed in another thread on NamePros), i am pretty sure there will be pressure on any registrar to provide proof that a repossession is warranted. And I think that will be good for the entire industry.

In all of the cases, is it true that no proof, even privately, was provided? I am pretty sure if say my computer were to be repossessed, either for payment issues or because stolen goods, a police representative would show up at my door but he or she would in their hand have the legal order for repossession and show it to me prior to repossession. Why is this not true for domain names?

Bob