Comment by disillusioned | Hacker News Reader

Comment by disillusioned | Hacker News Reader

Parent Full thread

I lost $2k in a Facebook scam that I'm really not proud of. A company spoofed BitMain's FB page and ran ads for their newest AntMiner models saying they had a batch that was ready to ship in limited supply. The BitMain FB account looked legit. The website itself obviously had an SSL cert (and was a pixel for pixel clone of their real site, except the product was in stock), but what I didn't notice was the microscopically small presence of a dot over one of the characters. It was an IDN homograph attack, and looking at the website and not noticing the unicode character, everything else looked right.

The fact that they took BTC as payment didn't raise any red flags either, because, you know, BitMain does.

I'm mostly infuriated at Facebook for not validating the company name or doing anything resembling protecting their audience. I lent them too much credibility because it looked like they were ads from the real company's page, and so I let down my guard elsewhere.

I've never otherwise been hacked or scammed, and I know allllll of the basics to look out for, but this one still infuriates me for making a fool of myself.

What browser are you using that is displaying IDN unaltered?

Every now and then I catch myself not doing this but by and large I always type out URLs for ads/emailed links by hand. It takes out a lot of the attack surface for me, and it looks like in this case it would have worked.

I wouldn't bet on proofreading even if the address was all ascii. It's inherently unsafe to click a random link, think you ended up in the right place and start doing all sorts of things.

Not blaming you at all, but a good tip is to look at the number of “likes” a page has and see if it sounds reasonable. Definitely not foolproof though.

Nope. Easily faked. There are centres where people get paid $5-10/day to like, follow, comment, etc here. They use bots too.

You can purchase an official ID under $10. Many Indian marketing firms use them.

Oh absolutely. I admit it’s not foolproof, but if a page named “Amazon” only had 100,000 likes, I’d be a bit suspicious. For comparison, the actual Amazon FB page has 19 million likes IIRC.

I have been scammed only once by a company so far. It was oyo (another gem run by softbank). They sold all my information, made me paid twice and left with such a poor service. Few of their actual employees were the scammers along with the hotel manager (likely) so I wasn't suspicious... because ya know, you are supposed to trust official communication portals.

It opened my eyes to how far scam can go. A billion dollar valuation or millions of likes says nothing.

I filed a complaint but have yet to follow up due to covid. It was a visit due to medical reasons so we didn't focus too much on it.

And this is why BitCoin will never fully take off.

If you made this transaction with your credit card, you could call up your bank two weeks later and get your $2k back that day.

BitCoin? Kiss that virtual fool's gold goodbye.

BIT-Coin is not a replacement for credit card so it's like comparing apples to oranges.

Think of it more like cash. If you give someone 2k in cash nobody is going to find that person and refund you.

>BIT-Coin is not a replacement for credit card so it's like comparing apples to oranges.

Except it's being used almost exactly like credit cards, so it is an apples to apples comparison.

>Think of it more like cash. If you give someone 2k in cash nobody is going to find that person and refund you.

Wrong. Tons of cash and debit card transactions can be undone, and banks can and will give you money back from fraudulent transactions.

6 months by law in the EU.

120 days in the US by law, unless I'm mistaken.

Reply on news.ycombinator.com