Resolved - PrimalRS 6.85B+$240.44USD (LTC) stolen on service

Scammer's profile link: Primal

Amount scammed: $240.44 USD (LTC) + 6.8B 07 GP

Discord ID + Unique Discord ID: Primal - 943219807451480085 , phantomx69 - 909512696146300978 , ivorysofia - 806879900958195742

Proof that it's their Discord:

Screen capture - 158ad1b45a4938ce28f6288ad8f7710b - Gyazo
Screen capture - c8d554715617cf790683b4d9dcb9db3b - Gyazo
Screen capture - 90d1d76b32258680c506f2f5671de068 - Gyazo


Explanation of the trade:

Paid LTC to get 75-95 Slayer and 78.5-80 Agility totaling $240.44 USD in LTC.

How they scammed:

Transferred my RS account to a Jagex Launcher Account, stole gp off of the account within 12 hours of starting. Bank was valued at 6.85B+ (More than pictured, because I traded a venator bow for slayer).

Can provide email proof of account being stolen the night/morning of the services and Jagex locking and returning the account to a new email that I created. Unfortunately, since it was not a normal hack the bank was drained even when I had recovered it in time before the bank pin expired.

Why did I have that much wealth on the account?

There was an agreement that I waive my 10% server discount and pay full price so that Ivory would take the ticket. This was supposed to guarantee safety. She is responsible for higher value services and therefore has a bigger a deposit. I agreed to this. And have a screenshot below. When I say "Can I waive the discount?" that is the agreement that my higher bank value will be covered if I don't use the discount.

Order Confirm

Value/Let them know I was hacked


When I wake up, I check the hiscores for progress and the account is missing. I attempt to log in and it says no accounts are registered under this email. I check my email and there's a message from Jagex saying my account has been loaded under a Jagex Launcher. I notify Primal in my ticket and they tell me to wait and recover the account, and that hopefully my wealth is still there.

I reached out to Phantom in DM's when I got a break at work. It didn't occur to me at the time, but it is pretty strange to instantly come out saying don't worry, we will replace the bank no matter what happens, it will get resolved without needing a report on Sythe. To me this sounds like they know something I don't. At this time I still didn't think that it was Ivory, and when I recovered the account, my items/gp would still be there. I was coping when I said I think I was hacked in the below screenshots, deep down I knew what was happening.

Phantom DM's before recovery

And Phantom DM's Next Day

I want to state that this log in info was only provided to Ivory. Bank PIN, Temporary pass. I use a unique email for RS, not stored in any databases outside of Jagex. Never been hacked before.

Earlier today, I get an email from Jagex saying they locked my account and I can recover it to a new Launcher account. When I log in, everything is gone. (Can provide these email threads privately to protect information.)

I let Primal know in my ticket and they ask for proof to start an investigation. This is much different energy than the day before. Provided some screenshots of the response when I let them know I was cleaned.

Screenshot - 75d3c3265e9c184b2ed63fe67a69a44e - Gyazo

Screenshot - cf2d88679e979200e1a0c2cbf7076ff3 - Gyazo

Screenshot - 09310d0dd54b53cacac549fa1a6955da - Gyazo


And here we are. They've gone silent after I provided the email logs. Phantom told me that there's nothing that he can do and that it is up to Primal. I really didn't want to have to submit this report. It's hard because I am in communication with these guys every day, but I am not going to just sit here and let this go unnoticed.

Thank you mods, if you have any questions or need any information I am more than willing to comply.

Other relevant trade screenshots:

I've included my SS in the body of the report. If you need anything further please let me know.

 

Hi, sad to see this report as we have an ongoing ticket to resolve this in our server. To assure you this isn't going unnoticed I'll refund the LTC in this report. The owners went silent because they are sleeping.

"Phantom told me that there's nothing that he can do and that it is up to Primal."

This is true, the only thing I can do is refund the order the rest Primal will handle. Management has no intentions of "scamming" you. I apologize for your experience. The owners have "gone silent after I provided the email logs" due to sleep and will speak to you when they wake.

$241 LTC portion of the "amount scammed" paid just now:
LTC Transaction 7a25dd56a15e42bf1a63ee58904295ed8978912b51abfccec1751a30ec8b92f9 | BlockCypher

 

Screenshot - c2f33ce3da7205fadbda55794597c91b - Gyazo

Keeping thread updated.

 

Good day,

The order in question was placed HERE, ticket number 10100, opened on <t:1694481360:f> - convert trough discord for universal purposes.
The terms of service agreed for this order, based on a prompt when opening a ticket are: Screenshot - 116610a0c4ffed6540ec06dcef6b3ce5 - Gyazo
Relevant clauses are to be considered: 5, and 17, with a mention of account security on 11.

The payment for the order was made here, in order to get 75-95 slay and 78.5-80 agility on @karryxyz account.
LTC Transaction 8e1d270f58053ef7b21287ea8c321be578235c2f24292790551231a7003ecddc | BlockCypher


The claim stated:
our worker converted the game account to a Jagex account, changed the username and cleaned out ~ 6.75B from @karryxyz bank.

evidence provided for this:

a "your account has been imported" email, of which you sent us a screenshot at <t:1694521500:f>
and a picture of a bank value of ~70M

We are currently trying to make sense of these accusations, but don't have much at this point.
a timeline will follow once we gathered the last pieces of information.

as things are standing now, we find no clear trace that implies our worker has taken anything off of your account.
The worker in question has had access to your account in the past (she recalled you giving her the same password back then, these are not saved anywhere so this can't be 100% verified)
this worker generally has access to accounts of even higher value & at the time of your order had access to multiple accounts of greater value.
there is no visible payment activity on our workers wallet


we feel like this is a setup, looking at how this ticket was setup & confirmed.


actions taken from our side towards resolution:

order has been refunded in full as shown here: https://www.sythe.org/posts/72557928/


actions we are currently taking to clarify what has happened:

building a proper timeline, awaiting a few replies from you and worker in this regard due to timezones.

 

I have no problem providing any information that you need.

I will be waiting for a mod response before doing so.

Thanks.

 

Updating this thread:

In my Primal ticket they are requesting that I submit screenshots of my bank. I agree to if a mod deems fit.

Screenshot - 202eb1fee4211398fb951f6ca999b83b - Gyazo

"so you don't want to help us resolve this?"

No, you don't want to help me resolve this.

Also, Phantom has since deleted his DM "Just so you know this will be resolved regardless of what happens we will work it out, won't end up in a report on Sythe."

If this isn't bad faith, I don't know what is.

Phantom's deleted DM

I will not be responding until a mod gets involved.

Thank you.

 

Karry - 135667850001121280

 

I had submitted a request on 9/03 for Slayer levels, but I was put off by having to forfeit discount.

It was in the ticket from 9/03, which I no longer have access to. I do have some DM's from that day though.

Screenshot - 2715f1fa91fdb9578d5af98a42e97bbc - Gyazo

I gave some thought and resubmitted my request, but adding in some additional levels.

 

So in this screenshot he explicitly says we'd be liable if it is our worker.

 

Screenshot - 9c51fd5f060dba7c51d0405f4e6421dd - Gyazo

Sorry forgot to attach link.

 

This conversation is before I got my account back. This is when I was waiting to hear back from Jagex on my recovery ticket.

Is there a way to pull the ticket from 9/3/2023 that outlines the agreement further? The one that I am referencing when I ask to waive the discount?

I'm not sure that it can get much clearer than him explicitly saying that they are liable and will replace my bank if it was their worker.

Screenshot - 96ba0d1d74592bd66cca219a9647263c - Gyazo

I reference the agreement here, "Can you still do the 6.8 without the discount?"

This refers the to the 6.8b bank value being covered if I waive my server discount.

 

Transcript in reported post above

 

Here is the screenshot of the previous ticket. Recovered from the bot.

Screenshot - 7b2b9b16a0f7e0f0c2d86e349dda8e0b - Gyazo