Account association scams.

Hello.

I believe as a community we need to do something about the account association scams. Today, in this report:
Report a scammer @Hedgold

I was asked to repay 6M (thank god it wasn't more) to @Embowled (who is also an innocent party in this). So, to break it down into simple form for those that don't know.

A scammer may sell you an account, do a service for you or for some reason access your account. What's incredibly sneaky about this scam is that they dont even need to login in game, its all via the homepage. All they do is go into your account settings and link a gmail account to your account.

They then have immediate access via their phone app to login via google. This happened to me on a sale on playerauctions where i purchased an account and was ripped off 800m with absolutely no proof.

The only things that combat this scam;
- having an auth setup on your account (WHICH CAN BE EVADED, if you've previously given the scammer access to your account to do something for you they can click "trust this device for 30 says"
- checking your linked accounts BEFORE and AFTER every trade. - SAFEST METHOD.
- totally resetting your auth, which is risky as they have a window to access your acc.

This is a clever unassuming scam as Jagex are retarded enough not to even send your registered email an email to inform you someone has linked an account to yours.

It turns out I paid embowled but he had previously had a google account linked which fucked him. He is also in danger of damaging his current service with @DavidTheBig as his t.o.s states nobody can login whilst he's doing a service (i may have helped embowled prior to this taking place.)

Taking notice and being aware of this scam can save you $1,000s of dollars and prevent future service providers being liable for huge losses in the future without being able to defend themselfs.

The suggestion is that its required to be added to any service providers t.o.s that linked accounts are checked before and after every service - or that it's a rule in place that is a must before trading any accounts.

@Superfluous there is no way anyone could have ever known unless it was checked and thank god its happened to me before. Also thank god it was 6m.

 

I don't really understand what you're trying to suggest, but it's a known scam that everyone should be looking out for. The only thing we could do about it is add another sticky, but people tend to ignore them

 

I mean I agree with this. If what you say is true, and I don't deny that it is true, then sure adding a sticky is about as good as it will get. I think that scammers generally aren't this hungry for gp personally but ya. It wouldn't hurt to have a reminder to check for linked accounts prior to a service being started or account being sold.

 

It is indeed true, no one is as good at truth as me, what you're saying is that we should warn people prior and after the service. I'm not saying what you're saying is bad, but I'm not saying it's good either, because how will you enforce it?

 

We will build a wall my friend and to get through you need to speak into the magic conch. But in all reality, I don't think a TOS change will do anything as TOS can be interpreted by staff however they please and it won't really make any difference long term. I think that adding it into the discord pm template would possibly be a good thing too maybe? Thoughts @tigeris ?

 

The discord template might be a good idea @Bryan

 

I hate that you were scammed, but this almost sounds more like a rant than a suggestion.

It’s a pretty well known method, as Tigeris said.
Even doing a half-decent job of securing an account post-service will eliminate the chance of being scammed this way.

It doesnt occur frequently so I don’t see a need to change rules and processes on Sythe for it. No support.

 

We are thinking about what the discord PM template should look like right now (@Techie may be your go-to for this; if not he is now!)

If you have any suggestions different than what's here Update the current PM template for Discord definitely let someone know.