tip jar script scam

[Navy1 Coba]

Today I got an email from LL advising me they removed $XXXX lindens from my account saying it was obtained from a "unauthorized source". A bad actor came into the club along with another bad actor, who logged into my tip jar as a dancer. Both were 0 days, actor 1 tips actor 2(dancer) and the tip jar (per script), splits 90% to the dancer and 10% to the venue. This is a very common script used in SL for years. Bad actor 1 complains and they remove 100% of the tip from my account (and I assume returns it to bad actor 1). Bad actor 2 hops off the stage. I opened an ticket, then when I noticed it had been done a few hours before by another couple I called by phone. The nice linden lady said once they remove money, they don't give it back (I suspect just her opinion as I have usually found LL to be fair). I also filed an abuse report inworld on the 4. I now see she opened a 2nd ticket escalating it since I got a bit irate. As a precaution I removed all the tip jars and took credit cards from my account. If you run a venue where tip jars split the percentage, please look for 4 figure (out of the norm) tips and do your research.

Navy1 Coba

[Rolig Loon]

That sort of thing happens, fortunately not very often.  The person you talked to in Linden Lab is quite right, when they recover "stolen" money from your account, you will not normally get reimbursed.  After all, in most cases you would not have suffered a real loss.  You got illegal money and then it was removed: no net loss.  In this case, you had already passed along 90% of it to the dancer, though, so you really are out that 90%.  The person you have to get it back from, if you can, is the dancer.  Your deal with her through the split tip jar has nothing to do with the process of returning "stolen" money.  In fact, person you are calling Bad Actor 1 probably stole that money from another victim, who was the one who filed the Abuse Report and was the one that LL returned it to. That's the typical pattern.  You can try explaining all of this in your own support case to Linden Lab, or you can try to get the money back from the dancer, or you can swallow the loss.  Unless it's more than a few hundred L$, it's probably not worth spending much time worrying about.

[Lindal Kidd]

Thanks for calling our attention to this, Navy.  There are several scams going around based on gaming LL's policy of deleting fraudulent $L ($L obtained with stolen credit cards or stolen from phished accounts).  The scammers are using LL's enforcement policy as a way of getting "laundered" money or free goods from merchants.

[Lindal Kidd]

I somewhat disagree with Rolig on this one.  This is an example of a new class of organized scams that are taking advantage of LL's own policies regarding "stolen" $L...and their failure to look deeper into events than the surface level.  I think we all need to be diligent at reporting these, and reporting them as accurately as possible so that LL can be made aware of these new con artists.

[Navy1 Coba]

16 minutes ago, Rolig Loon said:

That sort of thing happens, fortunately not very often.  The person you talked to in Linden Lab is quite right, when they recover "stolen" money from your account, you will not normally get reimbursed.  After all, in most cases you would not have suffered a real loss.  You got illegal money and then it was removed: no net loss.  In this case, you had already passed along 90% of it to the dancer, though, so you really are out that 90%.  The person you have to get it back from, if you can, is the dancer.  Your deal with her through the split tip jar has nothing to do with the process of returning "stolen" money.  In fact, person you are calling Bad Actor 1 probably stole that money from another victim, who was the one who filed the Abuse Report and was the one that LL returned it to. That's the typical pattern.  You can try explaining all of this in your own support case to Linden Lab, or you can try to get the money back from the dancer, or you can swallow the loss.  Unless it's more than a few hundred L$, it's probably not worth spending much time worrying about.

wish it was only a few hundred. The dancer, it was pretty obvious, was part as was couple 2, prob all alts of the same person. Am sure as LL connects the dots, all 4 traded money among each account and my 90% and prob a bunch more is floating around since it takes a bit to cash out. All the accounts were 0 days so its pretty obvious all were involved. But in a purely selfish mode, not sure why I should take the 90% hit and the hacked account get 100% back. Probably clicked on one of those links in a group chat and logged in, giving away his/her log in info to our tipping boy. SMH

[Rolig Loon]

The basic point, however, is that unless you have some sort of evidence to suggest that the dancer was in on the scam -- if it was a scam -- she has simply received what she should have gotten -- her 90% of a tip that was paid to her through your account.  You can ask her to return it, explaining the situation, but your deal with her was legitimate, and she may refuse.  Linden Lab will not return money to someone who complains that it was stolen unless they have done a full investigation.  It's possible that Lindal is right, but I still strongly suspect that they returned it to the original owner, not to your Bad Actor 1.

[Navy1 Coba]

8 minutes ago, Rolig Loon said:

The basic point, however, is that unless you have some sort of evidence to suggest that the dancer was in on the scam -- if it was a scam -- she has simply received what she should have gotten -- her 90% of a tip that was paid to her through your account.  You can ask her to return it, explaining the situation, but your deal with her was legitimate, and she may refuse.  Linden Lab will not return money to someone who complains that it was stolen unless they have done a full investigation.  It's possible that Lindal is right, but I still strongly suspect that they returned it to the original owner, not to your Bad Actor 1.

why would someone hack into an account then give away the money to another 0 day dancer, LL can track the IP and see all 4 accounts so if they want, they can put the pieces together. The original owner got his/her money back and after a bunch of these 0 day accounts do a pass around, they will cash out. My only hope for recovery is if the scam is large enough and they can freeze the players before they cash out. The sad thing about all this, is I had to remove all the tip jars from the club because until LL gives me any assurance this wont happen again, I cant take the chance of losing this much again. Since it is a roleplay club and not a real employee system that I could control, I'm not sure there is a way to prevent this without ruining the sporadic nature of the roleplay. The club operates on a small margin and things like this are absorbed out of my RL pocket. In addition to that, the freelance dancers that used the club will be out of work at my place and the other clubs that use a split tip script.

[Navy1 Coba]

1 hour ago, Lindal Kidd said:

I somewhat disagree with Rolig on this one.  This is an example of a new class of organized scams that are taking advantage of LL's own policies regarding "stolen" $L...and their failure to look deeper into events than the surface level.  I think we all need to be diligent at reporting these, and reporting them as accurately as possible so that LL can be made aware of these new con artists.

you are correct. Issue resolved, hacked account owner's money returned, let the club owner try and recover his money from the dancer, performer, whoever got the split, not bothering to look, as I did, that both couples (4 people) that did this are 0 day people all, and if a deeper look was taken, they would match an IP to one person. And it would be guaranteed that if all they did was cancel or reset the hacked accounts and the 2 dancers are not looked into and cash out, the hacker will repeat the scam until they get stopped at the 2nd level. Meanwhile, honest people working freelance for a percent of a venue no longer have a job or a place to work in. My club is a roleplay for couples to pretend, and the tip jar was set up as a more realistic experience. My 10% in the last year would probably not cover what I lost in this one event, so they will be removed.

[Navy1 Coba]

5 hours ago, Rolig Loon said:

The basic point, however, is that unless you have some sort of evidence to suggest that the dancer was in on the scam -- if it was a scam -- she has simply received what she should have gotten -- her 90% of a tip that was paid to her through your account.  You can ask her to return it, explaining the situation, but your deal with her was legitimate, and she may refuse.  Linden Lab will not return money to someone who complains that it was stolen unless they have done a full investigation.  It's possible that Lindal is right, but I still strongly suspect that they returned it to the original owner, not to your Bad Actor 1.

You were correct in your assumption of the way LL handled it, even though they admitted the dancer was probably part of the scam since she was also 0 days old, they say she broke no SL rule, since it was my tip jar that paid her, so she, alt or no, is free to cash out to RL money whatever amount she has gained at my or any other club. I should consider myself lucky the tip wasn't bigger but still, a sizeable chunk of my monthly tier has been removed in a venue that is set up for roleplay and not to line my pockets each month. Tip jars were mostly set up as part of the roleplay experience and a tip of a few hundred lindens wasn't rare in my 7yrs being open, so when a tip of quite a few thousand appeared, it did not go unnoticed. Since the club gets 10%, roleplayers tip a few lindens to their partner roleplaying as a dancer, reasoning the percentage to the club a thanks for your venue. Tip jars have been removed now since there is nothing to stop bad actor 1 from creating a new account, hacking someone else and tipping the same dancer another 4 figure tip, or even more since it worked the first time. LL also said if I did have the money in the account to repay (lets suppose I just paid my monthly tier) they would have frozen my account until it was repaid(imagine a tip of 75k in lindens). The thieves have stumbled upon the perfect scam as Lindal eluded to. After all the sole reason to hack any account is to get the lindens in it, and its a moot point if they can not successfully convert that to real world money. In this case the several tens of real world dollars came out of mine.

[Alwin Alcott]

quite easy to solve this scam in the future.. use protected jars.

Lot of systems i see around have restricted access, only staff members are allowed to dance and use it, or even only people who's name is in the jar itself.

Use the group on invite only and it won't happen again.

[Love Zhaoying]

3 hours ago, Alwin Alcott said:

quite easy to solve this scam in the future.. use protected jars.

Lot of systems i see around have restricted access, only staff members are allowed to dance and use it, or even only people who's name is in the jar itself.

Use the group on invite only and it won't happen again.

Or only allow people in the region who are more than 0 days old!

[Navy1 Coba]

Alwin, I don't have employees or staff. The club is a roleplay strip club for those that want to pretend to be a stripper for a night, so the only way is to remove the tip jars. It puts a stop to what is called Freelance dancers/performers unless you limit the free group to an aged avatar, then how old is old enough?  I did consider an SL age rating as many clubs do, but a good scammer can have a group of people aging while they blow the 10, 20, 30day old accounts out scamming and stealing. Stealing accounts for the money inside is probably the biggest scam out there and most times the people doing it know how to work the rules and it is professionally done. Fake MP links, click here for a free home, etc etc, and once the account is hacked, as quick as possible they post a link in all the hacked accounts groups and friends "click here, best friend" and gather those. After that, as quick as they can, they try to move the money in the account to somewhere they can turn it into RL money. I don't envy the people at LL trying to recover lost accounts and the money within. It is easy to see thief 1 transfer direct to thief 2 in an attempt to cash out before getting caught, but if they can move it covertly to thief 2 or in a manner that it is not possible to PROVE thief 2 is involved, they recover what they can from who. In this case, thief 1, moved the money to a tip jar owned by the venue, so the entire amount appears on the venues books, then the script splits to thief 2 and the venue at a percentage split by the script, usually 80/20 or 90/10, even 100/0 still gives the venue the money first. In walks Linden Labs tracing the money and all they can prove is thief 1 gave it to the venue, so they recover the full amount not bothering to trace it further, nor really being able to prove intent since it was scripted to thief 2. Thief 2's account is safe and continues the scam. The only way I can see thwarting this, is to have the dancer/entertainer OWN and wear/rez their tip jars similar to the way a musician rezzes his signs, set and tip jars at a music venue. All this becomes quite involved and I doubt my small venue will do anything other than remove anything owned by the club that splits tips or donations to anyone but the club. Then a hacked account gives the club money, I give it back, no loss no gain, however why would thief 1 give away money they can't recover.

 

[Navy1 Coba]

Many thanks to the abuse department for dealing with all this. Am sure it is a thankless job and fills their day with one scam after another. In my case, they actually were able to not only recover the money that was passed thru my club, but stop it from being forwarded and cashed into real dollars, which after all, is the main reason someone would gather information and take over another's SL account. This one was very tricky since the hacker was easy to find, but in passing the money thru a tip jar that split percentages, the initial solution was to recover the money from the tip  jar owner (me) and assume I could recover my money from the dancer involved. I was told my quick work in finding that all involved were 0 day people alerted them to the scam went deeper and were able to follow the money a few levels below and recover it before it was cashed out. The tip jar (or anything that spits money donated) still remains a avenue for abuse and it takes a very dedicated SL abuse person to put forth the extra effort. I was lucky to be assigned such a person. In talking with other club owners, my situation was minor compared to some of the stories of the same event resulting in hundreds of real life dollars lost. The key is quick reporting and detection. Had the hacked account not been aware and reported quickly, the money would have flowed along and cashed out to a quickly dissolved real world account.

As a warning to all, BEWARE clicking a link in chat from an unknown person, and even from a friend, chat with them a bit to verify they are the person you know. IF you do click a link, NEVER LOG IN after it at the linked site. NOTHING OFFERED is ever worth it. If by some weak moment you do, IMMEDIATELY go to your dashboard at secondlife.com and change your password. IF done quickly, your chances that your account will be taken over are reduced greatly. Thanks to all that listened to my, at times, aggravated rant.

[Xray Carter]

The same thing happened to me...

I have a club and...

A person use illegal L$ and paid my tipjar
My tipjar split and paid automatic other people.
Recovery Linden AFTER tipjar paid other people.
This means that... I paid the person and SL still recovered the money from my account.
I lost twice ... illegal money and my legal money

I opened a support ticket and solved my problem... OK

But... the person is still there ... washing money in SL clubs.

SL needs to treat this as a new way of stealing money from others...

And properly investigate the avatars involved ... we have all the transaction history to prove what happened!

Nothing happens ... ban an avatar and let's create another avatar again ... as if nothing had happened ... Ban should be stronger ... able to detect all ALTs from the same machine ... SL needs to improve that.

[Lindal Kidd]

1 hour ago, Xray Carter said:

...Nothing happens ... ban an avatar and let's create another avatar again ... as if nothing had happened ... Ban should be stronger ... able to detect all ALTs from the same machine ... SL needs to improve that.

Xray, my understanding is that LL has the ability to do this.  I know for a fact that they are able to issue a "hashtag ban" that will target a specific computer, and they do so in cases where it seems warranted.

[Sonof Marvin]

On 3/14/2017 at 10:58 PM, Rolig Loon said:

That sort of thing happens, fortunately not very often.  The person you talked to in Linden Lab is quite right, when they recover "stolen" money from your account, you will not normally get reimbursed.  After all, in most cases you would not have suffered a real loss.  You got illegal money and then it was removed: no net loss.  In this case, you had already passed along 90% of it to the dancer, though, so you really are out that 90%.  The person you have to get it back from, if you can, is the dancer.  Your deal with her through the split tip jar has nothing to do with the process of returning "stolen" money.  In fact, person you are calling Bad Actor 1 probably stole that money from another victim, who was the one who filed the Abuse Report and was the one that LL returned it to. That's the typical pattern.  You can try explaining all of this in your own support case to Linden Lab, or you can try to get the money back from the dancer, or you can swallow the loss.  Unless it's more than a few hundred L$, it's probably not worth spending much time worrying about.

Couldn't the reporter do basically the same thing they did, and report the 90% as stolen and get it back? then theres 0 loss at all?  

[Alwin Alcott]

12 minutes ago, Sonof Marvin said:

Couldn't the reporter do basically the same thing they did, and report the 90% as stolen and get it back? then theres 0 loss at all?  

no because it is 100% stolen money

[Love Zhaoying]

Reading this thread, it almost appears to be form of griefing!

[Navy1 Coba]

The sad thing is, at least in my case, banning a computer or even an IP address only moves these people down the road. The way it was done suggests not a random player looking for a few dollars, but a skilled actor, easily moving money around at various locations. A new alt, moving your laptop to the next person of many sitting at a table and shifting an IP is done during lunch for these people. While we like to think it is some random kid trying to get money, more likely, these are attacks planned and setup to evade LL's systems and target the holes. With Second Life's transaction totals in the hundreds of millions of US dollars, it is likely to attract a few more bad actors than Winston on his mom's computer.