Tips to Spot scams - A new Trade Me buying scam attempt I haven't seen before

Kia Ora Mark,

Thank you for the time and work you have put in to sharing the message here - an excellent article 😊

A very similar case was commented through earlier today to which Lucy - Customer Experience Team has requested these emails be forward directly through to their Trust & Safety Team using the abuse@trademe.co.nz email address - Cheers.

Yes, I saw that email this morning and my success fee had been refunded.

Extra brownie points for TradeMe, I saw the user came up as "account suspended" after 2 negative feedback ratings (myself + someone else) last night. This morning the account looks fully suspended.

Great job for the system automatically disabling their account until a human could verify, that has would have saved more people they were trying to target!

The other known email reported on Community comes through with the Link "Proceed to the final step" to select and does indeed take one through to requesting Bank details Login & Password - You've highlighted this new attempt well here - Cheers 😊

Hi there, identical buy now situation and identical scam phishing email sent to me today, also from account with 0 feedback which has now been disabled. Have forwarded email to abuse@trademe.co.nz, hopefully they will refund fees as I receive an error message when I try to do this through the listing. Thanks so much for providing the above info, it has been most helpful as I wasn’t sure what was happening, really glad I didn’t click on any links!

Well Done Catherine, - As your Buyer's account has been disabled keep your eye out for an email from TradeMe which should also contain confirmation of your success fees refund - Stay alert to any further phishing emails which may come through, especially those you don't know and wouldn't be expecting - Cheers.

I had a success fee refund the next business day for my listing Catherine.

Hi guys, so I was refunded my success fee for the last item, thanks for all your help/advice on this, but the same thing happened again yesterday!! I changed all my auctions to only allowing bids from authenticated/verified members, this was a verified account with a large amount of all positive feedback - presumably a legit hacked account? The account has been disabled and my success fee refunded already, but incredibly frustrating and making me consider other selling platforms. Is there anything further to be done to prevent this and protect auctions? Cheers.

Yes Catharine, it could be someone's TradeMe account 'hacked'.

Sadly it happens on many other websites too. Someone I know recently had their social media account hijacked by this.

It's likely not 'hacked' from Trademe's side, what has likely happened is that the user has had their login leaked or session tokens leaked.

Example:

1. The person has accidently opened a file included in an email. -> The file didn't open and they thought nothing of it.
2. The file was an .exe or .scr executable file and it was malicious code running on their computer.
3. The file looked at their stored passwords and/or session tokens on Chrome, Edge, Firefox, etc and sent them to the attacker.

Session tokens:

This is when a website lets you stay signed in. It gives your browser a cookie with a lot of characters as the 'key' and it's used sort of like a password to keep you logged in. When you login to the site, your browser will let the site read the session token and the site's authentication will verify the token is still valid.

The token is valid for a short amount of time, but it's all about chase when it gets exploited and used! It's an example to be very careful which websites you save the passwords of and 'stay logged into'.

Thanks for that comprehension Mark, - That's a valuable insight to share & Much appreciated 😊👍