[Omniscient]

Back in February I got a $20 Account Recovery Fee for the member @Lrrr@. This was the inital message...

Forgot my password, inactive for a while. Miss this forum so much...I would like to get back....I used to have 2fa everywhere so once my phone got broken I cant login even to my email....big loss. Would like my account back with new email and password.

After looking at the account I saw he's not been online for almost 2 years. Almost immediately I got email contacts asking about the Recovery. The problem was that my checks on the account showed no matching IP's to the person attempting to recover. They didn't know the account email nor have any other information linking the account. And Lrrr is a very reputable account, even more reason for me to be very diligent.

I had probably 20 emails back and forth with this person attempting to recover. On the actual account email I sent a contact hoping to get a response, nothing. The account thief even went so far as to contact other members to "vouch" for them. Two members both told me it was suspicious and they either didn't know Lrrr that well or that they believed this was an account thief.

A lot of time was wasted on this and eventually the person went away, I told them point blank I can't recover the account. I then proceeded to ban the account out of caution.

Today I got a reply and contact from the actual Lrrr who was grateful I was diligent and they hadn't checked their account email in a while.

So a few things to learn from this.

1. The $20 Recovery Fee is there for a reason. It dissuades account thieves from attempts. It covers the time I might have to put into confirming the account owner.
2. Fighting Bots crawling HF is important because one of the bot'd pages is member profiles. My guess is they're looking for a few things but one is definitely prominent accounts that might have Credibility but maybe haven't logged in for a while.
3. Be diligent about protecting your account by ensuring you have 2FA enabled and definitely backup the Secret Key.
4. I ain't no sucker falling for the bullshit.

Also, I think another account was attempted to get stolen/recovered to a thief a few weeks later.

Anyways, thought this was an interesting story to share. Had mentioned it in Convo so maybe some rumors floating around.

Enjoy your day.

[Pentatonix]

Nice work. There Lrrr would definitely be able to do some damage in an exit scam if his account was given to the wrong person.

[Syndicate]

Very nice catch, Omni! I'm glad that you kept another scammer off HF. :)

[Lrrr]

Very thankful for Omni and his dedication to security. I'm glad so many members reached out to me on other methods and let me know about this (even though I was MIA)

[Bullup]

Nice catch, glad the thief wasn't able to get passed your brain.

And the $20 is definitely justified, in my personal opinion even too low of a price for an account recovery considering it's in the users best interest to safe guard their account especially when they have awards attached worth more then $20 and years of history.

$50 would be more logic in my personal opinion especially when looking at a case like this, where you had to spend a significant amount of time and research.
Lets also not forget about inflation as well right, your time is worth more now then when you originally made that price.

[Lrrr]

Nice catch, glad the thief wasn't able to get passed your brain.


$50 would be more logic in my personal opinion especially when looking at a case like this, where you had to spend a significant amount of time and research.

Shut up, you're gonna make me feel like I need to buy an award to tip him for not giving my account away.

[Bullup]

Shut up, you're gonna make me feel like I need to buy an award to tip him for not giving my account away.

Listen, perhaps not the Bitcoin award, but maybe a cheaper one? 🤐

[Omniscient]

Nice catch, glad the thief wasn't able to get passed your brain.

And the $20 is definitely justified, in my personal opinion even too low of a price for an account recovery considering it's in the users best interest to safe guard their account especially when they have awards attached worth more then $20 and years of history.

$50 would be more logic in my personal opinion especially when looking at a case like this, where you had to spend a significant amount of time and research.
Lets also not forget about inflation as well right, your time is worth more now then when you originally made that price.

I think if it was $50 most people with average accounts would choose to just open a new account which might be more problematic. A lot of recoveries are just l33t accounts, some even normal accounts that are aged and just want to get them back. I could potentially scale the fee based on something like group or Credibility but meh...easy to just say $20 fee. Even had that month I was doing a $10 special. More than a few recoveries that month.

[Bullup]

I think if it was $50 most people with average accounts would choose to just open a new account which might be more problematic. A lot of recoveries are just l33t accounts, some even normal accounts that are aged and just want to get them back. I could potentially scale the fee based on something like group or Credibility but meh...easy to just say $20 fee. Even had that month I was doing a $10 special. More than a few recoveries that month.

Yeah that makes sense then i suppose, i assumed majority of account recoveries where trusted members.

Honestly an increase on price depending how repped an account is makes sense tho, when you send TCG cards out of grading towards PSA your fee is also based on the value of your card.

[Omniscient]

Yeah that makes sense then i suppose, i assumed majority of account recoveries where trusted members.

Honestly an increase on price depending how repped an account is makes sense tho, when you send TCG cards out of grading towards PSA your fee is also based on the value of your card.

Actually it's mostly people with L33t who might have not logged in for a couple years and lost access to either their email, don't know their email, lost their password, or changed devices losing 2FA. Sometimes it's a Vendor or Ub3r under similar circumstances.

[Jamika]

This scammer may have stolen the account and scam a bigger amount than the 20usd , good work man

[jcole]

Good to see that there are barriers in place to protect member's accounts other than the usual 2FA. Welcome back to the board Lrrr

[_V0X]

Well done on trusting your gut. I can’t imagine the damage a profile like that would do in the wrong hands

[Confound]

Back in February I got a $20 Account Recovery Fee for the member @Lrrr@. This was the inital message...


After looking at the account I saw he's not been online for almost 2 years. Almost immediately I got email contacts asking about the Recovery. The problem was that my checks on the account showed no matching IP's to the person attempting to recover. They didn't know the account email nor have any other information linking the account. And Lrrr is a very reputable account, even more reason for me to be very diligent.

I had probably 20 emails back and forth with this person attempting to recover. On the actual account email I sent a contact hoping to get a response, nothing. The account thief even went so far as to contact other members to "vouch" for them. Two members both told me it was suspicious and they either didn't know Lrrr that well or that they believed this was an account thief.

A lot of time was wasted on this and eventually the person went away, I told them point blank I can't recover the account. I then proceeded to ban the account out of caution.

Today I got a reply and contact from the actual Lrrr who was grateful I was diligent and they hadn't checked their account email in a while.

So a few things to learn from this.

1. The $20 Recovery Fee is there for a reason. It dissuades account thieves from attempts. It covers the time I might have to put into confirming the account owner.
2. Fighting Bots crawling HF is important because one of the bot'd pages is member profiles. My guess is they're looking for a few things but one is definitely prominent accounts that might have Credibility but maybe haven't logged in for a while.
3. Be diligent about protecting your account by ensuring you have 2FA enabled and definitely backup the Secret Key.
4. I ain't no sucker falling for the bullshit.

Also, I think another account was attempted to get stolen/recovered to a thief a few weeks later.

Anyways, thought this was an interesting story to share. Had mentioned it in Convo so maybe some rumors floating around.

Enjoy your day.

I'm glad you did the due diligence to ensure that the Lrrr imposter who attempted account recovery wasn't actually him.

Someone reached out to me on Discord claiming to be Lrrr, knowing that him and I were good buddies (through the Red Lions days), and it was clear within minutes that it wasn't him. The way he typed, English was clearly a second language. He also had no recollection of any of our past conversations which I tested him about. He stopped responding immediately after I called him out.

Had I known this was a larger issue, I would have reported it, but I just left it be. Glad you did the right thing though.

[Dredd]

Very thankful for Omni and his dedication to security. I'm glad so many members reached out to me on other methods and let me know about this (even though I was MIA)

Glad to see you're still about, interesting read.