Hacker News Reader

Comment by popol12 | Hacker News Reader

Just received 2 cheapo 64GB micro sd cards from aliexpress, they seemed legit, had tons of reviews with OK crystaldisk performance screenshots and... they're junk This tool quickly identified that they were counterfeit of type "Limbo", with 16GB of capacity instead of 64GB. Thanks to Michel Machado for writing this gem.

View on HN

A part of me will see stuff like "3TB Flash Drive" on AliExpress for $3 and briefly consider buying it. Like, I know it's obviously not true, it's obviously a lie, but I also am curious about what I would actually get.

I never do it because I don't really see the point of paying money for something that will immediately go into a landfill, but it's always tempting.

Back when it was being done with external hard drives there were YouTube channels dedicated to breaking them open and experimenting with how they did it.

Fun stuff to watch on a boring afternoon.

The potpourri of a youtube channel, Atomic Shrimp, has done a couple interesting videos doing just that.

His channel is where I first heard of this scam.

https://youtube.com/watch?v=UsWx1iO-aeA

For consumer stuff like this, you'll obviously get something else. But sometimes you can get recycled components if the price obviously is not sane, where recycling is an option.

It's only fraud if the description mentions new and original. :)

My trick to get decently priced computer equipment is to buy used stuff from data centers; generally that stuff will sell for pennies because their goal is to "get rid of it", not "get rid of it for a profit". Desktop network cards and switches are almost always available for very little (sometimes literally just $1 + shipping).

Look at govdeals.com for stuff from universities, they seem to sell a lot of their surplus hardware there.

Govdeals is sort of addictive. I've only bought stuff on there a few times, but it's fun to look around and see stuff like "pallet of 400 laptops" selling for $600.

How do you find such things? In person or online somewhere?

Sibling comment mentioned Govdeals, which is a place I'll look sometimes if I can find something near me or they're willing to ship.

You can look on Craigslist as well, especially if you live in a large metro area (I live in NYC so it's easy to find lots of corporate surplus). Companies will often need to upgrade all their infra and liquidate their equipment. My printer is a giant nearly 20 year old HP office thing that I got for $30 + $100 for the Uber back home from an office that did a full IT renewal.

When you say data centers, what do you mean? If I was looking on Craigslist or whatever for this, how would I be able to tell which seller is a data center?

A few sellers on eBay are honest

  Description:
  This item is upgraded by 32 GB Pen Flash Drive to 2TB
  32GB-2TB, the actual capacity is 32G, the computer displays 2TB, the detection is also 2TB, more than 32G things can be stored, but not displayed.

  https://www.ebay.com/itm/234810575961

That's not bad. Most counterfeits I get are just 2GB so hardly useful. Still, the counterfeit firmware makes compatibility issues more likely, so better to buy one without the counterfeiting.

Is there any reason I would deliberately purchase one of these over a standard 32GB drive? Trying to think of if there’s a case where I would want to trick some hardware into thinking it has a 2TB drive when it really doesn’t?

> more than 32G things can be stored, but not displayed.

That's certainly an interesting way to phrase it. I use /dev/null for a similar purpose with the added benefit that it can store petabytes of data, but sadly we don't have the technology to display it yet.

Lol. That's up there with the [1-bit Bloom filter](https://www.xkcd.com/2934/)

But why would anyone want a fake 2TB though?

Surely they write this to cover their ass when people don't read the entire listing.

Makes backups cheap and easy. Also if you _know_ it won't restore, you stop worrying about whether it might or not.

what you are buying is a piece of paper with a picture of an XBox360 on it

The issue is that if you exceed the (invisible) limit, you start overwriting the existing data. That's Bad (TM), since there's no indication that it's happening, until you attempt to retrieve the data and discover it's corrupted.

The subject of this topic, f3, will quickly probe the drive, determine the true size, and create a partition on it of the actual usable size. Using that partition, you will never lose any data. If you try to create a partition in the rest of the drive, it will be immediately corrupted, no tools will show it as good, you won't ever be able to get around to putting data on it to lose it.

> will quickly probe the drive

Some scam SSDs are smaller drives with hacked controller firmware that is bright enough to avoid detection with quick scans - you have to write beyond the real capacity then re-read to confirm corruption.

Have you found cases where "f3probe --destructive" didn't work for you?

Not first hand, though I've used tools of similar intent and found the quick heuristics, while usually very good, not 100% reliable, and for storage I want to be sure not almost certain.

Note that I was warning about quick tests, I'll have to try “f3probe --destructive” on something next time I have some playtime to see whether I'd consider that quick! Of course, it could be much quicker than the full capacity write some tools use to find a defective or deceptive drive¹² but quicker and quick aren't the same.

If a quick test says the drive is fake then it is, and many fakes can be detected these ways, but it takes more to convincingly state a drive isn't fake.

[1] Only a little over true capacity should be needed for that, in the case where writes to anywhere up to capacity will work (which is common as creating a filesystem more complex than FAT/exFat often requires activity similar to what quick write/read heuristics do).

> Using that partition, you will never lose any data.

... unless/until the underlying flash fails. Which it probably will; there's every reason to expect these drives are made with the cheapest, worst flash available.

>A few sellers on eBay are honest

no, that's not honest, farthest thing from it, that's what makes it an actual scam. by having that in the fine print, you can't return it, and they won't be flagged.

You can certainly return an item if the title of the listing was inaccurate.

In my experience, eBay won't "flag" dishonest sellers of counterfeit storage products, anyhow. I tried to get a listing selling counterfeit Samsung micro SD drives taken down, but eBay did nothing. I was refunded, but the unsuspecting will continue to be duped.

I don't think buyers of these SSDs want to return it. The only reason to buy such an SSD is to resell it. Effectively they are enabling other scammers.

In what world is a title that says 2TB for a 32GB drive "honest"? Is your view that a lie becomes honest as long as you add some truths after it?

It's a fact of life that titles can't always be a fully accurate description of the whole subject. Otherwise we wouldn't need the part that comes after the title...

> It's a fact of life that titles can't always be a fully accurate description of the whole subject.

It's also a fact of life that there is a gigantic amount of room between "not fully accurate" and "blatant lie"

> more than 32G things can be stored, but not displayed

"Honest"?

They’re suppliers to other scammers

> 2GB so hardly useful

I used to buy 2GB drivers all the time. The only reason I stopped is because it's hard to find anybody selling them.

It's plenty of space for a portable drive, it's enough for a Linux installation, it has lots and lots of uses.

But I wouldn't buy a 2GB driver that pretends to be larger. At least not willingly.

> It's plenty of space for a portable drive, it's enough for a Linux installation

RHEL9 installer is 10GB.

I did this on Amazon knowing it was a scam and immediately returned it just to drive up their numbers and hopefully get them shut down faster. I have no idea if that did any good, but what disappointed me was Amazon only gave me credit, not a full refund.

Yeah, aliexpress returns real money.

And there's honest stuff on there too, loads of it actually. I bought a 128GB SSD from there many years ago for $10. I expected nothing but like you say, I was curious about what I'd get and something faster than a shitty USB stick with decent storage capacity was all I was after. I verified it, and it works perfectly and it's 128GB as described, it just lacks cache so it bogs down on super large files. But for $10 I couldn't buy a better USB stick.

They may have true capacity but long-term retention is yet to be established: https://htwingnut.com/2022/09/11/ssd-as-long-term-storage-te...

There's even SLC USB drives being advertised, an otherwise extremely overpriced item these days, with sellers posting the exact part numbers and pictures of the insides as evidence. Those may be using recycled flash.

A few years ago Micro Center had a coupon for a free 120gb SSD, which I guess worked because I ended up going there and buying stuff in order to redeem it.

The SSD wasn't great, it was pretty slow, but it did work, and I have used it in conjunction with a USB SATA adapter as something where I can write lots and lots of tiny files for projects I work on [1], and where I don't particularly care if I break it. Surprisingly, it's still holding up...pretty good for free!

[1] One project I've done involves breaking up video files into a picture of every frame, then do some kind of image processing, write the new files, and then glue them back together, which means there can be a ton of writes on there that I don't want to be done on the expensive and irreplaceable internal SSD on my Mac.

https://www.trendforce.com/price/flash

TLC flash is currently less than $0.10/GB. $3 will probably get you a 32GB drive with flash of dubious quality.

> had tons of reviews with OK crystaldisk performance screenshots

Select the 1-star reviews. Usually someone helpfully posts proof of the scam.

Until a new scammer runs a protection racket offering to withhold the scam accusation for a price.

Wow, they scam for that little of a price difference? 64GB costs almost nothing...

Yeah, really... I picked up a 128GiB card from the store on something of a whim a while back, and I'm not even sure I paid more than about $18USD (with tax) for it. I bet I could have gotten it cheaper, but I was impatient.

A helpful tool I recommend for buying from common outlets online is Fakespot [1]. It scans the reviews and looks for suspicious/fake reviews & other telltale signs of deceit. Mozilla recently acquired it, but you can scan Amazon URLs on their website, and they have a very helpful browser addon. There was a similar tool I used to double check called ReviewMeta, but they seem to be offline.

It's not a 100% foolproof way to determine if a vendor or product is fake, but it is helpful. There are some other things you can do to double check things as well. [2]

[1] https://www.fakespot.com/

[2] https://www.wired.com/story/how-to-spot-fake-reviews-amazon/

Every single product on Amazon has a fake spot of like D these days. They flooded the field.

I've bought a couple things from Aliexpress, and payment processing is such a hassle[1], I don't know why you would use it to buy things that are easily found from domestic sources? Especially SD cards which are widely counterfeited.

[1] This was a couple years ago, maybe things got streamlined? Of my cards that don't have a foreign transaction fee, Aliexpress wants the phone number off the back of one, which is sketchy; no thanks. The second one, charges don't go through, and the issuer customer service can't even see the attempts; I have to ask them to disable security on my card for ~ 30 minutes, and then the charges go through. Billing showed from England, IIRC. Doesn't (edit: Didn't! thanks) support any intermediates I do (paypal/amazon pay) which is usually my goto for low trust transactions.

They do support PayPal nowadays. Paying on AliExpress is as easy as on Amazon, and a lot of things do have a 5 day delivery guarantee and it does actually work. I've been using it quite a lot personally(I'm in the UK).

That sounds like issues with your bank, not AliExpress.

I entered my card number with them years ago and it just works.

What I hate is their login and search - both horribly broken.

But as to why, it's a better selection than Amazon for many things (for example components) and usually cheaper.

This tool could save you from corrupting data but once you buy these counterfeit cards you're better off trashing them than requesting a refund, shipping will cost you more that the drive itself.

Chargeback - goods not as described. No need to return them.

Supposedly, card processors are meant to suspend accounts when they get too many chargebacks. How is that number determined? If it's a percentage of total charges, then places like Amazon/Ali* will have so many other charges these will pretty much round to zero. Also, these vendors are "too big to suspend", so chargebacks will do nothing like what they are meant to.

What do you mean they don’t do what they’re supposed to? They get you your money back. That’s what they’re supposed to do.

Dropping the merchant is a bonus.

The chargeback is meant as last resort though when a company is not cooperating. The company has already been refunding without having to do a chargeback. The chargeback is meant to let the processor know that their customer isn't holding up their end of the agreement.

You're correct that it's a last resort, but its primary role is to, literally, charge back to the original merchant. "[letting] the processor know that their customer isn't holding up to their end of the agreement" is a side benefit. As is eventually dropping the merchant when there are too many chargebacks to justify supporting them.

> Through a chargeback, your bank can try to get your money back from the seller on your behalf it isn’t a legal right, but your bank is committed to helping you, and will treat any claim fairly.

https://www.visa.co.uk/how-you-pay-matters/chargeback-purcha...

> When a customer disputes a debit or credit card transaction, the card issuer must determine whether to provide that cardholder with a refund for the transaction amount—also known as a chargeback.

https://b2b.mastercard.com/news-and-insights/blog/what-is-a-...

> A chargeback is a rules-based mechanism, with time-sensitive workflows, that enables the issuer and the acquirer to determine the financial liability of a disputed transaction.

https://www.mastercard.us/content/dam/public/mastercardcom/n...

> A chargeback occurs when, after investigation of the dispute, we debit your account for the amount of the disputed transaction and credit the Card Member with this amount.

https://www.americanexpress.com/au/merchant/chargebacks-and-...

Notice none of them talk about it being a feedback mechanism. Because it's not. It's a refund mechanism used as a last resort.

> It's a refund mechanism used as a last resort.

you've just skipped over then entire part where the websites are freely refunding and not denying refund claims making the last resort of a chargeback entirely unnecessary

You are commenting in a thread about chargebacks as an option. You are the one that claimed chargebacks aren’t doing what they’re meant to do. They are, you just don’t know what they’re meant to do.

Whether or not a website does refunds on their own does not change the definition of a chargeback in any way shape or form.

Yes, you're so wrong. I've had merchant accounts before, and there is clear wording about the negative impacts of chargebacks. I've even done a chargeback as a consumer, and they asked me if I had already been in contact with the seller before making a claim.

So the blind advice of making a chargeback claim before making a refund/RMA type of request with the seller is really out of order in the steps to take.

Clearly the definitions from all three major processors, both from consumer and merchant documents, don’t mean anything. Your anecdotes are far more convincing, for sure.

> So the blind advice of making a chargeback claim before making a refund/RMA type of request with the seller is really out of order in the steps to take.

That wasn’t even your point in the first comment. It was that chargebacks don’t do what they say they do. Way to move the goalposts when your initial point was clearly proven wrong.

You don't need to ship them back. Aliexpress will fully refund fakes, if you send something resembling proof. I got refunds for even obscure stuff like opamps, transistors, etc., with just a quick video of a oscilloscope output.

Sometimes it's trivial to prove, like CMOS opamp with +6V absolute max Vcc supply happily working at +40V.

I did not know that. Thanks.

> Sometimes it's trivial to prove, like CMOS opamp with +6V absolute max Vcc supply happily working at +40V.

Double take

What was going on with that one?

Almost all cheap opamps on aliexpress are LM358 or similar supercheap bipolar design, no matter what's marked on the package.

Reply on news.ycombinator.com