27

Someone I knew online asked me to log in to his account in Pioneerbanking.online and make a few transfers for him as he "couldn't do it by himself for a couple of reasons". I foolishly did help him made 2 transfers and he's urging me to do the 3rd which I declined.

I am now aware that it's obviously a scam but I am not sure how it works? How can he takes advantages of me for doing those transfers for him?

What I noticed is that the website he provided looks suspicious and the beneficiary is invalid ( I asked a friend of mine to transfer a small amount of money to that account and it was sent back to my friend's account)

Update: I reported it to the local police, they said I haven't lost money yet, what's there to report about? OMG

Update: Should I post link of photos of the supposed to be scammer here? Maybe someone knows who he is or his identity being stolen by the scammer.

17
  • 43
    Consider reporting this as soon as possible to the police and to the bank. If it is fraud, it might help that you came forward voluntarily before the authorities got involved. If it isn’t fraud, reporting doesn’t lose you anyth... nah, I’m pretty sure it’s fraudulent. If they are willing to post the access codes online, then they are online and have the access codes, so they can surely log in themselves to do the transfer.
    – Lawrence
    Apr 20 at 14:24
  • 13
    "couldn't do it by himself" + no problem contacting you through the internet = fraud Apr 20 at 19:14
  • 21
    It's clearly a fake website. I mean, they didn't even try. Apr 20 at 20:34
  • 28
    The employees of this bank are impressive. They also have time to run this very similar looking bank as well as a uniform company and several non-profit groups, all while serving on a civil air patrol!.
    – bta
    Apr 20 at 22:33
  • 10
    @OgrePsalm33 Working in IT, I sometimes see email chains of phishing attempts. Your comment reminds me of one I saw where the recipient was a little suspicious, so they replied to the email itself asking "Hey Boss, did you send this?" Of course they got the response back "Yes, it's me. -Boss" Apr 21 at 20:00
53

The scammer gave you login credentials to account X and had you move money to account Y.

The scammer didn't own account X. What is likely is that the person who owns account Y was told "I" will transfer $5,000 to your account, you keep $500 and send the rest as a money order to this address. The reason why account Y now appears invalid is that the owner of Y may have alerted the bank or the police.

When the authorities trace the transfer, they may track the login session to you.

The scammer also learned that you are willing to help them, at least for a little while.

13
  • 20
    @Dave: Misdirection is easier when you create a scapegoat. If no one held the smoking gun, they'd look more into finding who held it. If you manage to let someone else hold the smoking gun for you, it's more likely that they stop looking after they found your scapegoat. This shouldn't be the case (we'd hope), but in reality if often is - and this is often how scammers eek out their advantage.
    – Flater
    Apr 20 at 15:42
  • 3
    @Lan Anh I had a quick look. It is pretty good, but A) google does not think their address exists and B) the nameserver is dns1.namecheaphosting.com and they have most data redacted on whois and C) dead links in footer. I would not give them my money.
    – Dave
    Apr 20 at 15:55
  • 4
    @Lan Anh Also one of the "team" is actually this woman.
    – Dave
    Apr 20 at 16:02
  • 5
    If the site is a scam, and Lan Anh used scammer provided credentials (not their own for a real site), then they cannot have done any real damage yet?
    – Dave
    Apr 20 at 17:20
  • 2
    This answer doesn't make sense regarding the evidence that the banking site is fake. You might want to overhaul it.
    – Chris
    Apr 22 at 10:51
24

This sounds like the definition of a "confidence scheme", in which the scammer does things which at the beginning seem legitimate or, even if suspicious, work out exactly as they promise they will. Naturally it starts with small amounts as 1) a way to lure you in ("it's only a few bucks, what's the harm in that?" you might think), and 2) to build up your confidence in what they're telling you.

It gradually progresses to bigger and bigger amounts, then they start changing the game, asking to use your accounts or more of your money. Then they strike, take you for what they can get (which by then is usually a much more significant amount that you would miss!), and they're gone. Or worse, they get you to somehow involve friends or acquaintances, who might be the REAL targets (you're just the unwitting dupe in the whole thing), then you're stuck dealing with the aftermath.

ANY TIME SOMEONE YOU DON'T KNOW APPROACHES YOU ASKING FOR YOUR HELP IN MOVING MONEY AROUND, RUN!!

There's a reason why they won't do it themselves - what they're getting you to do is most likely illegal, or they want to make sure it can't be traced back to them in the event it isn't criminal in nature but could open them up to civil suits.

The mere fact that you, by your own statement, know it's a scam and posted here asking questions is enough to tell you to give it a wide berth. And unless it's merely for the sake of curiosity, does it matter how the scam actually works? (grin)

1
  • I think it might be true, a "confidence scheme" to be escalated soon. Thank you for your answer.
    – Lan Anh
    Apr 20 at 15:36
14

Yet another possibility is something along the lines of:

  • they ask you to perform an operation
  • they have the website display the outcome of a different operation instead
  • they claim you screwed something up and sent more money than you were asked to
  • they demand you compensate them

A recent video by Mark Rober showcases a real-life scam, primarily targeting older people, trying to guilt them into sending money in a way somewhat similar to what you describe.

1
  • +100 for the video.
    – jcaron
    Apr 22 at 13:47
12

Since the bank account is fake, it's practice.

The scammer is actually cultivating you. It's a confidence game, but in a form called "the long con".

For scammers, the limiting factor (the scarce resource) is the human resource: the scammer's own time. They can't afford to waste their own time working with skeptical "marks" who will ultimately refuse, or who will scam them right back to waste their time.

So they use elaborate methods to try to screen out those people.

For instance, consider Nigeria. Most people know Nigeria is associated with scams (and it's the only thing they know about Nigeria lol). So why on earth do so many scam emails mention Nigeria? There's a reason - they actually want to repel away the skeptical -- so they only deal with the gullible.

Also, a confidence game is about building confidence. For instance:

  • In some money-transfer scams, they sign victims up "as employees" and give them simple, zero-risk, zero-harm tasks like finding a low-price airline flight. To the victim that feels like real work done, and makes the victim more confident in the legitimacy of the work. Next they send money to the victim to buy common office supplies to be mail-ordered "to the scammer", and they make sure that transaction goes smoothly. *This makes the victim more comfortable with money transactions. Or alternately, the victim has said "Heck no, won't do it" - they are screened out.

  • Next, they know Bitcoin ATMs are alien to the victim, so they have them do more "harmless tasks" - such as finding local ATMs or taking photos of the ATMs. After that, they have the user step up to the ATMs and navigate the menus, with some excuse like wanting to see the software version used. Again a zero-risk, zero-harm activity, but the victim's confidence is rising that this is a real job, and their reluctance to interact with Bitcoin ATMs is falling.

  • Then, with the victim well-groomed, they start wiring money to the victim's bank account and having them deposit the cash in the Bitcoin ATM. That victim would have never agreed to that if that'd been their first request! But since all of this feels like "old hat", their guard is down.

The above is how the "long con" works.

The scammer's ultimate goal is to wire you (stolen or fake) money, and then have you wire that onward to them in a different method (Western Union, Bitcoin) which is irreversible. Then, when the stolen/fake money is exposed, you are left holding the bag.

As with the Bitcoin example, they know you'd never agree to that until you gained some confidence. So they have set up this fake banking site to let you play with fake money, so you gain confidence in their legitimacy. Eventually, after this type of thing "feels like old hat" and your guard is down, they will ask you to do the actually dangerous thing.

Note that this works best when the scammers can "automate" all this screening and confidence-building, so that each victim being groomed will take the least amount of their time. Controlling the bank website makes that easy for them.

Once they have manipulated your confidence, it'll become this.

"couldn't do it by himself for a couple of reasons".

  1. The legitimate account holder will claw back the money after detecting the theft
  2. they would follow the money to me, and I'd go to jail

Those are the reasons. Better plan:

  • Find a (second) victim.
  • Have victim 2 transfer money from victim 1's account to victim 2's own account
  • Have victim 2 transfer money from own account to mine
  • except, use a different transfer method that is irreversible
  • I have the money. Woot!
  • Victim 1 detects fraud and claws back money. Victim 2 sees account go negative.
  • Victim 2 tries to claw back money sent to me. Can't, because I chose an irreversible method
  • Victim 2 left holding the bag. #notmyproblem
2
  • careful there! You might be giving some idiot an idea they might actually try! (grin)
    – RiverNet
    Apr 20 at 19:42
  • 1
    This answer doesn't make sense regarding the evidence that the banking site is fake. You might want to overhaul it.
    – Chris
    Apr 22 at 10:53
1

YOU NEED TO CONTACT A LAWYER IMMEDIATELY!!!

They will recommend whether or not you should contact the police, and (if not) will advise you if (when?) the police come looking for you.

All the other answers explain possible details of the scam, but none of them spell this conclusion out explicitly!

You have almost certainly logged into an account and transferred money out of it, without the knowledge of the owner of that account. Depending on the jurisdiction, it seems likely that this is a criminal action. Some jurisdictions may not take into account that you didn't understand/know what you were doing.

Either way you need to get professional legal advice IMMEDIATELY!

3
  • 1
    I wouldn't say "almost certainly". While this could in theory be a money laundering scheme, there'd be almost no reason for a scammer who has login credentials for a real account to have someone else use them. I would think it far more likely that the scammer was using completely fictitious accounts to soften up the intended victim enough that the victim would later be willing to do something that involved one of his own (real) accounts. On the other hand, it's also possible that even if the accounts are fictitious the scammer might still try to extort money with empty blackmail threats.
    – supercat
    Apr 22 at 17:32
  • @supercat almost no reason for a scammer who has login credentials for a real account to have someone else use them Nonsense. If the scammer does the login and the transfer then it's far easier for that to be traced back to their, e.g. IP address. If they get someone else to do it, then there's an extra layer of separation; just like cartels using drug mules.
    – Brondahl
    Apr 23 at 9:44
  • The fact that many scammers don't bother to hide their IP addresses doesn't mean that doing so would be particularly difficult or expensive. When dealing with physical assets such as drugs or cash, there will be some risk at the physical location where they change hands, and so it's worth paying a human to shoulder such risk, but why go through the effort of paying or marinating a human to do a task that an open wifi and a device with a configurable MAC address can take care of for free?
    – supercat
    Apr 23 at 11:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.