Disturbing attempted scam involving multiple TRF users (or their hacked accounts)

[angelino]

Hi All

Long time lurker of TRF, with my first post over the weekend being a thread created over in the WTB subforum, to find a Patek 5196J for sale.

On Sunday I received a PM response from what appeared to be a legitimate power user in ragsk, advising that he had the same watch for sale. He directed me to email him in said PM, so he could send me through photos of the watch, which I did (happy to share the email address if permitted by moderators).

All the photos checked out on face value and in the course of further correspondence I procured both a copy of ragsk's driver's license and bank account details, with a name that matched said license (happy to post the individual's name and the license itself if permitted by moderators).

In addition to receiving photos and other information above, I asked ragsk for any references from past sales to other TRF users. He provided me with the accounts jpvw and kohuti02, both of which responded positively, alleging to have purchased a Sub Hulk and AP from ragsk respectively. Interestingly, kohuti02 specifically referenced ragsk by his alleged name, which matched the one on the license and bank account I had received.

At this stage I had agreed on purchase price with who I thought was ragsk and was getting ready to wire the cash later this week. Given my prior watch purchases have all been with local ADs or resellers, I had a degree of trepidation however and went down a bit of a rabbit hole within the forums to cross reference the photos I received with others that ragsk has posted, which was easily done given his posting prolificacy.

The location and person, based on wrist shots, didn't appear to match when comparing with the images I had received. Next step, Google reverse image search on the photos I was provided. At this point, the plot thickened and became more concerning.

All the photos matched those depicted in a thread at timezone forums, from back in 2018 (can't post the link given my post count is under 10, but can share with moderators separately). Save for one important detail in the image I have attached to this post, which shows a doctored purchase year on the certificate of origin, from 2011 in the timezone thread, to 2020. 2020 was the year that "ragsk" alleged he purchased the watch in correspondence with me.

At the very least, ragsk's account has been hacked. The other two, not sure. In retrospect it is clear that I was diverted to email correspondence rather than PMs by what I think was the hacker so that responses to the initial PM were not alerted by way of email to the real user behind the account.

In summary, always reverse image search.

Hopefully adminstrators can secure the account(s) impacted and ban any of the users that have in fact been nefarious here.

I'm still hunting for that 5196J but a bit scared of taking the plunge on TRF unfortunately!

Again, happy to share name and driver's licence details of who I think is the scammer if permitted.

Cheers
Angelo