
I got my money back from a scammer by contacting his mom on Facebook (2016) - geek_at
https://blog.haschek.at/2016/how-a-scammer-stole-500-dollars-from-me
======
whalesalad
I was selling PHP based software around 2009. It wasn’t pirate proof in any
way. I was charitable with it too... if anyone was disadvantaged or a student
or similar I’d send them a free license. Some kid posed as a journalist for a
review copy and then once he had it, started to aggressively distribute it to
every leak/piracy site he possibly could.

Attempts to discuss it with him were futile. I was pissed. At the time I was a
freelancer and so this was a huge portion of my income. I basically lived off
the dopamine hits from each sale, not to mention the actual sale revenue via a
PayPal debit card. The OG ones that were that weird blueish silver sparkle.
Funds basically went directly from sales to paying bills and feeding myself.

So I used his personal info to track his location. Ended up finding his poor
old grandmother who was his caretaker and barely spoke English. I tried to
explain the situation to her and explain how unreasonable he was acting. She
didn’t understand anything I said but I think the mere act of getting her
involved scared him enough to undo everything he did. He was not happy I had
figured that out.

Check mate kiddo.

~~~
usaphp
How did you lock a php based software with a license? Could not they just dig
into code and remove the license restrictions, since you provided them with
the code?

~~~
krn
Zend Guard[1] was often used for licensing PHP code in mid-2000s.

[1] [https://www.zend.com/products/zend-
guard](https://www.zend.com/products/zend-guard)

~~~
amenod
And IonCube PHP Encoder [0] (not affiliated, had positive experience with them
as a customer). These apps solve real-world problem - sometimes it makes sense
from business perspective to make copying the software more difficult.

[0] [https://www.ioncube.com/](https://www.ioncube.com/)

------
tyingq
I had a b2b company with a aggressively rude sales guy calling me over and
over. Called his supervisor, and basically got "tough shit, it's a free world"
as an answer.

So I looked into what I could do and found that the email contact for their
domain wasn't working.

Reported to ICANN[1], and their domain was shut down for several days. Then
called the supervisor and let him know I was the one that reported it. The
sales calls stopped.

[1]
[https://forms.icann.org/en/resources/compliance/complaints/w...](https://forms.icann.org/en/resources/compliance/complaints/whois/inaccuracy-
form)

~~~
james_in_the_uk
Had a similar thing with an illegal robocall advertising a domain name. Whois
record revealed personal mobile phone number of the director. She was quite
surprised when I called her at 9pm to discuss the legality of out of hours
robocalls.

------
alainchabat
I lived 2 years in a "hutong" (old residential area) in Beijing. Rented an
apartment via a middle man that could only get those apartments. After signing
the lease, a friend warned me this middle man will certainly find every
excuses to not give back the deposit (many stories about it in the foreigners
circle).

The week I was leaving, she didn't want to give me the deposit .I warned her
I'll public shame her if she didn't gave me back the money, and use "internet
magic" to collect other poeople stories so it will stop people renting from
her. Nothing happened until 3 months later she sent me a wechat transfer. I've
closed the website. But then learned again she was keep doing the same thing
with an other business name. I've reopened the website with adding her new
business name. She didn't contacted me yet.

She get away since foreigners just don't want to to deal with that when they
are about to leave the country or deal with that.

You can Google/Baidu/Bing "courtyard007" or "homeudream"

~~~
DayDollar
The usual traditional farewell as a foreigner is to not pay the last rents and
she uses up your deposit for that.

~~~
alainchabat
In China, you usually pay the rent for the next 3 months so it's tricky to do

------
lukejduncan
I once had a landlord in Detroit who stopped paying his HOA dues In a large
complex. I had a court order to pay my rent to the HOA and he was not happy
about that. He threatened to evict me (not legal), but then his ex girlfriend
got involved. His ex girlfriend was a well known real estate agent with a
popular house flipping tv show on national television. She threatened to
blacklist me with every major landlord in the city and then only got more
aggressive. I looked up the realtors code of conduct, wrote a 10 page
complaint to the licensing board with cited evidence, and emailed them a draft
with the note “all I want to do is continue to pay my rent and legally occupy
this unit. I don’t want to fight, but if we can’t resolve this I will submit
it tomorrow.” His girlfriend went away and suddenly I had no problems (and
apparently he paid his over due HOA dues). I never mailed the complaint, but I
did move out within a few months.

~~~
sneak
You should have sent the complaint anyway; all this does is enable them to
continue abusing others. Make a paper trail, tarnish their perfect record, let
others know the truth.

~~~
zuppy
not only that, but that may actually be considered blackmail.

------
Judson
One method I use for fighting “friendly fraud” in our b2b business (smb
customers) is to message their Facebook page after sufficiently attempting to
contact someone more official.

It has always worked.

I hypothesize it’s easy to rationalize things away, but the FB channel
typically requires a non-owner employee to ask the owner/purchasing manager
why the company isn’t paying their suppliers.

------
thelittleone
I once bought a set of Bose quiet comfort noise cancelling headphones on EBay.
The seller was in the USA and shipping was to Australia. The guy didn’t ship
and stopped answering messages. But I had emails from him with IP address. A
reverse lookup gave me his company. I called the company and the automated
switch asked me to enter name of person I wanted to speak with. I entered his
name and it validated he worked there. I have him an email giving him one more
chance to do the right thing. He didn’t respond so I sent an email to the CEO,
legal counsel and HR with subject “Company X employeeName conducting
fraudulent eBay auctions from company X network” with accompanying evidence.

He emailed me a few hours later with an express tracking number.

I kind of felt bad for him but doing he did from his office is extra stupid.

~~~
rootusrootus
> I kind of felt bad for him

While I understand the sentiment, we sure are softies when we sympathize with
the guy who got in trouble for trying to scam us. He earned that consequence
100%.

~~~
txdv
no sympathy, he had the chance to send the stuff when he was contacted
directly

------
PopeDotNinja
This is awesome. I once had an asshole of a roommate. When I had had enough
and moved out, they wouldn't return my security deposit. But I had leverage.
They had been getting school tuition money from their parents, but not going
to school. I tracked down their parents. & politely asked for my security
deposit back in exchange for not outing them to their folks. I got my money
back the next day.

~~~
hackcasual
Just FYI, if you live in the US, what you just described is criminal
extortion.

~~~
PopeDotNinja
Interesting. Looking up extortion...

[https://criminal.findlaw.com/criminal-
charges/extortion.html](https://criminal.findlaw.com/criminal-
charges/extortion.html)

"Most states define extortion as the gaining of property or money by almost
any kind of force or threat of violence, property damage, harm to reputation,
or unfavorable government action."

My IANAL interpretation of that would be extortion wouldn't apply here.
Because my security deposit is legally mine, and they were holding it on my
behalf, I'm not gaining anything. Demanding my own property back is not the
same as profiting. If I had demanded my deposit back plus $1, then it would be
extortion. Maybe. Again, IANAL. Fortunately the statute of limitations makes
me safe, as this was long ago :)

~~~
unlinked_dll
It's not about whether it's "legally" yours (and even that would be up for
dispute) but how you acquired it. You can't threaten somebody to get things,
that's extortion

~~~
tingletech
extortion usually involves a threat of force, this sounds more like blackmail?

~~~
ndzig
Perhaps "harm to reputation" as the GP says?

------
graeme
Had a similar thing happen after a guy left me a false review.

The guy was an employee of a local company. He cold called me. I was busy so I
just hung up, but I did hear the company name.

Then I saw a bad review left by someone pretending to have been a customer of
mine. He used his real name as it was a google review.

I googled, found out he worked for the company that had called me. Spoke to
the owner, gave the owner the info. He said he'd look into it.

Called back 30 min later, apologized for his employee's actions, said he
disciplined him and got him to admit his action was petty and wrong, and he
made him take down the review.

Real life leverage is a powerful thing.

~~~
kerng
Not understanding this story entirely. You just hung up on someone and then
they left a bad review. That's what reviews are for, no?

~~~
nosuchuser2
The person called them trying to sell something (a "cold call"), but then left
a bad review claiming to be a customer.

~~~
kerng
Ah, got it. Thanks for explaining.

------
zuck9
Reminds me of the time this lady contacted the mother of a man who sent her
violent threats and got him to apologize:
[https://twitter.com/AGlasgowGirl/status/1188128030268575744](https://twitter.com/AGlasgowGirl/status/1188128030268575744)

~~~
Moru
Or the masseur [0] that got fed up with "do you have happy endings?" and
started contacting the wifes of her customers.

[0]
[https://sverigesradio.se/avsnitt/1377985](https://sverigesradio.se/avsnitt/1377985)
(in swedish though...)

------
anonu
Great point from the end of the article: Your privacy settings on facebook are
only as good as your friends.

This is one of the pervasive dark patterns of social media. Even if you're not
on social media, you cant stop people from posting an image of you or tagging
your name. That feels wrong to me.

~~~
paul7986
Well do no one wrong.. always do right and you won't have any issues.

~~~
anonu
What if you are just a private person? If I go out with a friend who tags me
on social media, I get innocuous questions from other friends like "Oh, you
were here or there last week with this person"... I don't need people knowing
where I was or who I was with. I am not robbing banks in my free time. I just
care about my privacy.

~~~
wolco
By the time you've made it to the club your picture has been taken several
times. On the bus,bank,street cams,house/driveway cams.

Don't go out or wear a mask or move out of the city.

~~~
dorkwood
The problem is that their friends are broadcasting their whereabouts and
activities to their other friends, which causes tension.

Photos taken by strangers on the bus or at the bank are not broadcast to their
friends, so they do not cause tension.

Also, wearing a mask to the club causes further issues, since your friends
will still tag you in their photos, and people who see the photos will now be
wondering why you are wearing a mask. When you answer that you were trying to
maintain your privacy so that your friends didn't broadcast your whereabouts
to your other friends, they will likely point out that your friends still know
who you are, and that wearing a mask does not prevent them tagging you.

------
peteretep
I had a similar story from eBay back in the day, where someone had sold me
faulty goods. Was worried I’d have to do a whole fraud process thing, but
managed to find his Dad’s contact details, threatened to contact him, and
suddenly the guy/kid couldn’t do enough to fix it

------
CDSlice
Maybe I'm just cynical, but I really think Christian should have gone to the
police about this. This scammer was NOT a kid, he was a 22 year old adult who
needs to take responsibility for his actions. His "apology" isn't sincere at
all and just makes excuses for his behavior and tries to elicit pity with
stories of panic attacks and being a broke college student. At this point all
that the scammer has learned is to have better op-sec and research his victims
better.

~~~
Falling3
Assuming this all took place in the US, the American justice system is pretty
horrific. I wouldn't want to call the cops on anyone unless it was absolutely
necessary. It's not an action to take lightly.

~~~
rootusrootus
I think that if someone wants to avoid interacting with the police, step 1 is
not to scam people.

Also, while the police do deserve much of their reputation, it's worth
remembering that citizens and police interact frequently, all day every day,
across the country, and mostly nothing newsworthy happens.

~~~
arthurdenture
Interactions can be extremely negative without making the news.

~~~
rolltiide
and positive

------
simplyinfinity
Eons ago when I was on a shared hosting account on bluehost, I had my site
compromised few times, and got my account temporarily frozen with the warning
that if I didn't stop getting hacked they would suspend my account
permanently.

So I started digging into the php files and found some sort of irc bot and
noticed the channel it logged on an the admin username that was allowed to
issue commands. Logged on the server and channel and hanged out for a bit but
no trace of the username. Started asking around for the person, and someone
messeged me and asked what's this about, I explained that I just want the
hacking to stop so I don't get kicked out of the hosting I was barely paying
for. I was met with understanding and the person said they would pass along
the message. The hacking stopped. And I was a happy kid 16 year old.

------
oftenwrong
"I will never do anything like this again."

I doubt that.

~~~
mysterydip
Spoken with the same sincerity of a politician who is truly sorry for their
momentary lapse in judgement.

That being said, back in the early 90s I was playing around with virus
generators (total script kiddie stuff) and ended up infecting my own system.
That was enough to keep me out of nefarious activities from then on.

------
umvi
So wait, the guy just sent the Apple cards and trusted he would be paid on the
honor system?

Doesn't eBay make the other party pay first before you ship? I thought that
was the whole point of eBay.

~~~
Semaphor
They weren’t using ebay, the scammer just used it to prove he’s trustworthy.

------
changdizzle
This is crazy, for some reason this rang a bell and I checked my email and
sure enough, I ended up buying those gift codes from you! Funny how things
come full circle :)

------
wespiser_2018
Ha! This is a good write up, I had a run in with a "scammer" that was made a
fake facebook profile of my friends father, using profile pics my friends
father had set to public. Long story short, this really bothered by friends
father, so I decided to contact the fake account.

What I did, was set up a basic website with http request level logging, friend
the fake account, waited until the scammer contacted me over FB messenger, and
ask him to check out my "website". He did, I kept the conversation going for a
little bit, he got to the ask, and I said, "hey, you are a scammer, you live
in X town in Y country, I know more about you, and if you don't stop using
this account there will be problems!" Anyway, this was about 3 years ago, and
there has been no activity on the fake account since!

------
yellow_lead
I feel that the lesson at the end of the article should be something more like
"don't scam people on the Internet" but otherwise great post.

------
EGreg
I had a client that ran a startup who owed me $30K, after months of leading me
on and telling me I had to do XYZ, the sky was falling etc. Meanwhile they
paid others.

I had put the website up at Amazon and could take it down, but I didn’t want
to get in trouble for “unauthorized access” stuff. I considered doing a DMCA
takedown since they had never signed any copyright assignment. Would have
probably succeeded. Another thing I could have done was introduce a “bug” that
happened to hit at a certain day and demand being paid before I do any more
work.

But in the end I didn’t do anything. That $30K out of my pocket really set me
back for a long time. Lots of people were pissed at this startup, it was a
shitshow.

Story 2

A friend of mine was quite mistreated by a girl who went out w him. She liked
me so I contemplated inviting her out to an expensive restaurant, ordering a
large meal and then skipping out on the check. Never did it.

I even thought of doing something worse. Saying we should get matching
tattoos, except mine would be a fake one.

Story 3

Also I had met a girl and texted back and forth, she seemed excited to meet,
we made plans, I drove an hour to meet her and then she totally stood me up
and stopped answering.

I was pretty upset at her and I contemplated putting up an ad on Craiglist in
the “hookers” section (they had one back then) with her phone number and a
fake name that would make her realize I did it (“EGreg’s XYZ”). Suffice it to
say I never did that one either.

Conclusion:

I know how to be an asshole but seem to never choose to follow through lol

~~~
digitalsushi
It can be valuable for us to find an outlet to experience control, to avoid
escalating the fantasy of taking control over other human beings.

We're all humans and all terrible to each other, but in short bursts sometimes
we can anonymously improve the network by not contributing a negative action
to experience control. Good on you for not abusing your female acquaintances
with trick tattoos or besmirching someone as a prostitute, but it might feel
even better to find a way to avoid needing the fantasy altogether.

I enjoy pruning wild bushes. It gives me the pause to re-balance whatever is
getting to me. I wander through the woods looking for lopsided wild cherry
bushes and give them symmetry. It's still sort of a form of chaos but better a
wild bush than a person. It's my dumb thing, but there's millions of
activities that might be a good fit for anyone. Thanks for your post! Cheers.

------
jdnenej
Selling unwanted gift cards online is a huge scammer magnet. I tried to sell a
$50 card for $40 recently and wasted a bunch of time with people sending me
fake PayPal confirmation messages. Thankfully all of the scammers were pretty
stupid and it was easy to tell when they were scamming.

It's just super risky on both sides so very few legitimate buyers want to do
it since as a seller you could be giving them fake or used codes.

~~~
hn_throwaway_99
Good startup idea then to build an escrow service for this? I.e. buy discount
cards for 80% of face value, sell them for 90% of face value, and then act as
the trusted middle man to verify that the card is good and that payment was
made.

Not sure if any KYC/AML or other banking regulations would make this less
economically viable.

~~~
sgerenser
There’s already several sites like this, or at least there was a few years
ago. I think some of them went under due to (big surprise) getting scammed.
It’s too easy to just keep the numbers, sell the physical gift card to the
company, then use them online after a month or two.

------
clashmeifyoucan
Wait I'm confused, wouldn't it have been a better strategy to go half and half
if you have two cards?

You send them one card, they receive it and know they can trust you. They send
you the money so you trust them, then you send the final card. Worst case you
only lose $250.

~~~
terandle
His final line of the post was "Lessons Learned:" "Use an escrow service like
Transpact if you want to make trades via bitcoin"

~~~
clashmeifyoucan
That's fair, I was quite surprised that he gave both his cards away like that.

------
atlasunshrugged
Ha, this is awesome. I'm glad that the author got his money back. But use this
as a reminder, whether you're doing nefarious activities or not, you can
probably be found online with a few hours of research unless you're being
incredibly careful.

~~~
simion314
A better lesson, think what your mother will say/feel about the thing your
about to do (with the exception if you are not close to your family)

~~~
atlasunshrugged
Yes, true, although I hope most people already have internalized that they
shouldn't commit fraud whether or not their mother would approve

~~~
ackbar03
This is a good test though. I forgot where I read it from but there was this
saying if your doing something you would be ashamed to tell your freidns or
family about than you probably shouldn't be doing it

~~~
TallGuyShort
You might have heard it when former Google CEO Eric Schmidt was brushing off
concerns about online privacy.

------
packetslave
Reminds me of gaming journalist Alanah Pearce, who would report her online
abusers to their mothers.

[https://www.theguardian.com/culture/australia-culture-
blog/2...](https://www.theguardian.com/culture/australia-culture-
blog/2014/nov/28/alanah-pearce-tells-on-her-internet-trolls-to-their-mothers)

------
zupa-hu
I wonder if this would work with patent trolls.

------
DonHopkins
Did he say he was sorry he took the money?

[https://www.youtube.com/watch?v=BF_sahvR4mw](https://www.youtube.com/watch?v=BF_sahvR4mw)

~~~
geek_at
no he was just sorry he was caught

------
behnamoh
Any more blogs like this? I'd be happy to know more about such incidents.

~~~
geek_at
something similar from the same blog about a malicious raspberry pi in a
network closet and in the end the person who put it there was found out
because their wifi credentials were still in the Pi

[https://blog.haschek.at/2019/the-curious-case-of-the-
RasPi-i...](https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-in-our-
network.html)

~~~
steve_taylor
Reminds me of the time I was found out for changing my colleague’s desktop
wallpaper to My Little Pony, which is standard punishment for leaving your
machine unlocked.

 _Disk not ejected properly_

 _Eject "STEVE" before disconnecting or turning it off._

------
fortran77
He should have gone to the Police. He's just going to do it again.

~~~
wongarsu
The US justice system isn't known for reforming people, if anything it turns
small-time criminals into hardened criminals. The parents probably have a
better shot at doing something good.

------
paulpauper
dont mess with this guy

------
Scapeghost
> I think the mere act of getting her involved scared him enough to undo
> everything he did. He was not happy I had figured that out.

Most people only act evil under anonymity, thinking they can get away with it,
and can't withstand the risk of public shaming.

This applies not only to the internet, but government officials, entertainment
industry execs, etc, anyone who thinks themselves safe from scrutiny.

~~~
eloff
I think you can formalize this statement with game theory around how
reputations work among social organisms. This applies even to dolphins and
chimpanzees.

It doesn't mean you can't be evil in public, but it does mean it's a
suboptimal strategy for your own best interest.

Scarily if the public moral compass gets warped enough, then you can be evil
in public and get away with it because according to the public you're not
doing evil. Like Stalinist Russia or Nazi Germany. The definition of evil
itself changes.

~~~
Scapeghost
> Scarily if the public moral compass gets warped enough, then you can be evil
> in public and get away with it because according to the public you're not
> doing evil. The definition of evil itself changes.

Luckily their social superset, the rest of the world, saw them as evil.

Makes you wonder, what are we currently doing that is evil but the entire
world supports it?

China's treatment of Hong Kong and minorities comes to mind. And all the wars
and massacres going on that have the full support of the first world and its
media.

~~~
intenex
^^ Eating animals. Firmly convinced we're on the wrong side of history on this
one - when the world finally stops doing it en mass, either because clean lab
grown meat has become economically more viable or environmental concerns are
too overwhelming, etc., very convinced we'll look back on it as a horrific
practice just as we might slavery today.

Aside: this thread escalated quickly from scamming Apple gift cards on reddit

~~~
woah
What about other predatory animals? Are they also morally culpable? Should we
stop them?

~~~
pgcj_poster
Preventing wild animals from killing each other would require by far the
largest ecological intervention the world had ever seen, which would involve
humans either exterminating half the species on the planet, or domesticating
them and feeding them engineered vegetarian diets. In either case, it would
certainly cause massive ecological damage, and I don't think we have the
technology to do such a thing even if we wanted to.

This suggestion sort of like saying "Oh, you think our country should outlaw
wife-beating? Well why don't we conquer the entire world and stop every
country from practicing wife-beating?"

As for domesticated animals, I think we absolutely should try to find ways to
feed them without killing other animals. There are companies out there trying
to make vegan cat food, and although I'm not sure whether it's good enough to
keep cats healthy yet, I definitely wish them luck in achieving it.

------
MaupitiBlue
This is pathetic. A grown man whining to somebody’s mom because he was dumb
enough to mail something of value to a random person on the internet.

~~~
HocusLocus
I'd rather live in his world, than yours.

Besides, I've met few moms/brothers who weren't curious what their
kids/siblings were up to. Perhaps Christian helped him to become closer to his
family in the end.

