Resolved

[Fina]

Scammer's profile link: NiftyOSRS | Sell & Trade Game Items | OSRS Gold | ELO (sythe.org)
Vouches if they were exchanged:
Original selling thread: Legacy Email Logins (US) $0.30+/ea | Auto-delivery | 100k+ sold | Sell & Trade Game Items | OSRS Gold | ELO (sythe.org)
Proof of payment:

Proof of contacting seller: He not accepting inv on discord.
Discord ID + Unique Discord ID: .nfty. (UUID: 598422681486098442)
Login username of the account:

[email protected]

Terms of Service that was agreed to: idk just bought on his website
Other relevant trade screenshots:

Hello, I bought 20 US legacy accounts from @NiftyOSRS on Sellix because their post on Sythe led me to this site for the purchase. The payment went through, and the account information was automatically delivered to my email (email and password). Everything was working fine. I started building up one of the accounts, and today it has around 800 total levels.

I logged into the RuneScape website to check if there was any registered email on the account (normally there shouldn't be since these are unregistered accounts). To my surprise, there was indeed a registered email that I don't recognize. I thought it wasn't a big deal since these are old legacy accounts and presumably don't have recovery information. However, today, on July 24, 2024, the password has been changed, and I can no longer log in.

I can't initiate a recovery because I don't have any of the answers required (I only have the email to log in and the old password). I have two assumptions: either the seller themselves noticed the account was gaining value and reclaimed it, or they sold the same account multiple times and whoever changed the password first gets to keep it. I'm really disappointed because this account was starting to progress nicely.

 

[NiftyOSRS]

Hey man - I went on vacation on the 22nd and will return on the 29th, so I haven't been as active on Discord as I usually am.

My database of accounts is only available on my local network, so I will be closing down my shop until I've been able to run an audit across Sellix and non-Sellix orders. Unfortunately, there have been some instances of double sales as a result of a lack of automation around these multiple sale avenues and I have since added more failsafes for handling them.

In all of these cases, I am transparent with the people impacted and compensate as needed to atone for any process failure on my end.

Given my remaining account stock and intention to continue some form of business on Sythe in continuity, I'm certainly not doing anything intentionally malicious to customers.

Happy to be transparent with you and any mods involved as I look into things. In the meantime I do recommend registering emails and changing passwords on any remaining accounts you have.

 

[Fina]

Hey man - I went on vacation on the 22nd and will return on the 29th, so I haven't been as active on Discord as I usually am.

My database of accounts is only available on my local network, so I will be closing down my shop until I've been able to run an audit across Sellix and non-Sellix orders. Unfortunately, there have been some instances of double sales as a result of a lack of automation around these multiple sale avenues and I have since added more failsafes for handling them.

In all of these cases, I am transparent with the people impacted and compensate as needed to atone for any process failure on my end.

Given my remaining account stock and intention to continue some form of business on Sythe in continuity, I'm certainly not doing anything intentionally malicious to customers.

Happy to be transparent with you and any mods involved as I look into things. In the meantime I do recommend registering emails and changing passwords on any remaining accounts you have.

Are you able to recover the account ?

 

[Fina]

Can a mod handle this

 

[NiftyOSRS]

Are you able to recover the account ?

I won't have access to the registration information until I return from vacation - my account database is not accessible from outside of my home network - and I'm not equipped to conduct the audit until I return either. You can expect a response on the 30th.

Even with the information that I do have about the registration, I can't guarantee I'll be able to recover the account. It was not registered on my home IP, so it will rely on DOB, registration date and time, and the original password at creation.

If my negligence caused the account to be compromised, I will need more information about those 800 levels to determine compensation. If I don't find evidence of a double sale, I will replace the accounts from your order as described in my ToS.

My shop is closed and will remain closed until this is resolved.

I can assure you and anyone else reading this that I'm not risking it all for an 800 total account.

 

[Fina]

I won't have access to the registration information until I return from vacation - my account database is not accessible from outside of my home network - and I'm not equipped to conduct the audit until I return either. You can expect a response on the 30th.

Even with the information that I do have about the registration, I can't guarantee I'll be able to recover the account. It was not registered on my home IP, so it will rely on DOB, registration date and time, and the original password at creation.

If my negligence caused the account to be compromised, I will need more information about those 800 levels to determine compensation. If I don't find evidence of a double sale, I will replace the accounts from your order as described in my ToS.

My shop is closed and will remain closed until this is resolved.

I can assure you and anyone else reading this that I'm not risking it all for an 800 total account.

Add me on discord and I will

 

[NiftyOSRS]

Add me on discord and I will

I have zero pending friend or message requests at the moment

 

[NiftyOSRS]

I won't bury the lead here: I didn't find any evidence of a duplicate sale.

My approach for the audit is as follows:

1. I exported all invoices from Sellix from December 2023 onward - the account in question was created in January 2024 - and consolidated a list of their associated logins using the Sellix API.
2. I requested all of my data from Discord, which includes .txt and .csv file links from those sales done directly over Discord. The Discord data included all messages from July 21st backward.
3. I parsed all of my Discord data for the .txt and .csv files as well as for non-file based sales (i.e. the amount was small enough that Discord did not require me to upload as a file) and downloaded the files. Since I am the one sending the files / messages with login details, there is minimal risk that a file / message was deleted.

Sellix:
- All Sellix orders are programmatically checked for duplicate sales against other Sellix orders. In this audit, I found the same duplicates that I have resolved in the past.

Discord:
- All Discord sales are checked against Sellix orders. Since the potential source of duplicate sale are with a Sellix order and there are instances where I send the same logins to the same user over Discord (usually to provide additional registration details), I limited the audit to a Discord / Sellix comparison. The files with additional registration info often have the details formatted username: password:day(DOB used):month(DOB used):year(DOB used). Regardless, my scripts capture login details from these extended fields.

If any mods would like more details on the scope, process, or scripts used, then I am happy to provide additional data within reason (e.g. I won't turn over full login details of other orders or customer email addresses). In the interest of removing possible avenues of account compromise, I will delete the files and my consolidated view in 10 days.

Given the lack of a duplicate sale, I will offer replacement logins as specified by my ToS. Going forward, I'd like to make it mandatory that the buyer registers an email and changes the password within 1 week of purchasing accounts.

I will attempt to recover the account later today and, if successful, I will send the new information to the email associated with the Sellix invoice provided.

Obviously, this leaves the question of whether I routinely monitor sold accounts and recover them when the user either trades wealth or levels them up. The answer here is no.

I bot maybe 1-2 accounts at any given time and do not sell anything other than logins at this time. I have roughly 10k remaining logins and the damage to my reputation as a seller and the effort required to monitor these accounts, register emails, and change the password when they hit some predefined threshold far exceeds any potential upside to re-sell the accounts. Moreover, I'm aware of the 1 month recovery window. If I were actually interested in systematically scamming my customers (which I'm not), certainly I'd be sophisticated enough to do so outside of the window where repercussions would actually be involved.

I'm not sure what happened with this account, but whatever did was not a result of any negligence or wrongdoing on my end.

Update: recovery request submitted and awaiting response. I'm not confident it'll work, but we'll see. Once I get a response I'll work on login replacements or arranging the account transfer.

 

[NiftyOSRS]

Recovery was unsuccessful. I've provided all the registration information to the user if he would like to continue trying to recover as well as replacement accounts.

 

Sorry for the delay here gentlemen as it appeared you two were working this out amongst yourselves.

@Fina it appears @NiftyOSRS has advised he's provided replacement accounts for you. Can you confirm you've received this?

 

[Fina]

Sorry for the delay here gentlemen as it appeared you two were working this out amongst yourselves.

@Fina it appears @NiftyOSRS has advised he's provided replacement accounts for you. Can you confirm you've received this?

Yes I confirm

 

Thank you for both resolving gentlemen.

@Fina As with any account(s) purchase it's pretty important to change the password/associated email. I'd recommend doing this in the future on any purchases.