Hello 2P2,

I am coming to the community to help resolve a multi-party dispute involving unfinished trades. Since these events occurred on Skype I will use Skype names. Sam Horrocks is KING SAMHOR.

veselin[CR], Kosta Toilios, and myself (RZ) are seeking reimbursement for unfinished trades by KING SAMHOR that were Hard Vouched for by Thomas Boivin.

Screenshot of Thomas Boivin Hard Vouches (below). Please note that these Hard Vouches are properly linked to the corresponding KING SAMHOR account that was trading and that it was confirmed that these were their real Skype accounts.

Thomas Boivin refuses to pay, claiming he was hacked which therefore absolves him of responsibility. Thomas admitted to not properly securing his account with 2FA or a complex password. This put his account’s security and everyone in the trading groups at risk.

Good luck on a resolution, I hope this is sorted for you

I posted this in one of the Skype swap groups and thought it could reach a larger audience here. Still havent fully fleshed out all my thoughts, neither party seems to be without fault, but it's given me a lot of pause regarding trades/trading groups as well as several questions:

1) How much responsibility is placed on the person who didnt properly secure their acct (King Samhor/MartoMchat) vs the person who didnt video call to confirm the HV (OP, Vesselin, Kosta)?
2) Are we supposed to video call both the person we trade with and the person who HVs? Is there a database of photos/corresponding names or usernames somewhere for future reference?
3) Should having 2FA be required to participate in these groups? I would argue yes, but if not...
4) Wasn't these sort of hacks/scams simply a matter of time? Eventually someone is going to get hacked/compromised and another person will suffer financial losses/consequences as a result. By being a part of these groups, are we all just agreeing to sacrifice that equity?
5) And most importantly, how do we better protect ourselves as a community?

Hi guys. Thomas Boivin (MarToMchat) here.

I’ll start by saying that I’m very sorry that you guys were scammed. I know the pain, unfortunately. I feel a profound disgust towards people who can do such things, namely stealing and taking advantage of others. I like to believe that, at the end, they’ll lose more than ‘us’, in which ever way that comes (karma etc.).

I’ll also add that I consider myself as a man of honor, and I believe that, to the people that know me, my Word is worth a lot.

Finally, like KING said, let’s remember we are all victims here. KING and I are victim of identity theft, and you guys are the financial victims of that identity theft. You guys lost money, time, energy. We lost a lot of time, energy, and potentially some reputation ‘points’ to some people that don’t know us personally. This sucks, there’s no way around it.

Structure of my answer:

1) adding crucial details that were omitted;

2) explaining my opinion in detail, because I think the victims (and now the 2+2 community) deserve to know my stand.

1) Extra details

a. The date the scams/trades happened was the Sunday 12th from around 6pm CET to 9-10pm CET.
b.
First, I was hacked. That’s the whole point of the story. I didn’t HV for anyone, somebody (I’ll call them “the hacker”) stole my identity by hacking my Skype account and used it to extract money from you. That is the reality we’re dealing with.

When I actually HV for someone, I will (obv.) take 100% financial responsibility if something goes wrong. That’s why I’m very careful on who/how I give my HV. This is NOT the case here, as I, Thomas Boivin, didn’t HV for any of the mentioned trades.

In the same way that it’s virtually impossible for you guys to prove that you were robbed, it’s actually hard to prove that we were hacked. However, I’ll do my best to provide as much evidence/clues as I can:

• I sent you (in private) the Skype logs showing the connections attempts (successful and failed) over the past 30 days. It actually doesn’t show any connection from the 12th, but only for the 13th (the next day when somebody messaged me on Discord about that mess, I changed my psw, etc). So I suppose the hacker gained access to my account prior to that day and stayed connected until then. We can also see many failed connection attempts (hacks) from all around the world prior the 12th (from22/8 to 5/09) using diff. IP every time.
• KING and I are strangers to each other. I would obviously never vouched for someone I don’t know.
• The trades happened in peak time of the Sunday session. Surely not a time me or my friends (who I usually HV for) do trades, and certainly not during many hours.
• Nobody verified either KING’s or my identity at any point of the trade (cf. next point).

c. None of you have taken any precaution or measure to verify the identity of ANYONE involved in the trades:

• You didn’t verify the identity of KINGs by anyway (video call or other) nor did you verify the identity of the voucher (me).

• You don’t personally know KING or myself at all.

• KING and I are strangers to each other (harder to verify for sure, but still relevant in terms of how suspicious were the trades).

2) My opinion

a. The responsibility to protect our money
I firmly believe it’s the traders’ responsibility (and only theirs) to make sure they won’t get scammed aka to protect their money. Scamming within these trade groups is NOT a new thing. It should be common practice by now to take additional measures in order to avoid getting scammed. Namely:

• only trade with people you personally know + verify their identity (VC or other);

• Trade with people you don’t know personally but can confidently find pictures of them online + verify their identity;

• Trade with people you don’t know and can’t confidently find pictures online, but only accept HV coming from someone you can confidently identify + verify the identity of the HV.

This takes literally 30 seconds. If the traders fail to do so, they expose themselves and I don’t see why anyone else would have financial responsibility when (eg.) identities are stolen and used against them.

b. The risk/reward
When we don’t make sure the trade is 100% legit/secure, we all know there’s a very small chance of getting scammed. That’s the risk of the trade. In EV$, it’s very small ofc since the chance is usually very low. When 2 traders make a trade, they accept the risk because they believe it’s worth the reward – getting what they want, where they want it, quickly, barely any trackability, etc. What ever the reason is, it’s always a risk/reward situation from which ONLY the traders are profiting. Therefore, I’d assume they also take full responsibility of the risks.

Because of these two points, I believe I have no financial responsibility towards the traders.

I know losing money that brutally is painful. When it happened to me, I (after a while…) liked to think that these life lessons will save me much more over my lifetime than what they costed me. I hope we can all learn as much as possible from this.

As for now, I’m doing my share to gather information on the hackers/their method. I will keep you updated if anything relevant comes out.


PS: I want to say that if we were going to take this publicly, we could have done it together, in an impartial way. I don’t think your post was written in an either fair, professional or optimal way to solve this situation; and somewhat disrespectful too.

PPS: I took a lot of time to reflect about my opinion on this matter, and also consulted many of my friends with exp. in trades (mostly reputable HS players). fwiw they share the same opinion. They don’t leave a chance to be scammed (again), because they take full responsibility to protect their funds. I’m not going to ask them to answer this post because I value their time, but I’m happy to share with you some of their thoughts if you want.

Hello, my name is Adam Picken/Demonic16 on Pokerstars, I was also scammed for 9k euro. I'm not exactly sure on this situation tbh and who is at fault, but I said my piece privately and was asked to post here too.

I am an infrequent user of various trading groups.
---------

This idea that the people that got scammed could somehow verify kings identity, bearing in mind he uses a charmeleon avatar isn't exactly feasible. I have no idea what either person looks like.

I did 2 trades that weekend and not one person video called to request an identity check. Even the person that hard vouched for me didn't verify that way, although I did message them on FB too. Also he is a HSMTT player, and he was able to HV on a Sunday. (Pads fwiw)

Its also interesting to me that many HS players that you have spoken to privately agree with you, but from what I could see in the public discussion in the money exchange chat 2 from 3 sided with the chop resolution and one seemed to be in favour with you?

Also, this is a bit of an aside, I strongly disagree with the timing and content of the 2+2 post initially but I feel the same frustration I'm sure Redzill felt as you have still failed to post any evidence you were actually hacked. King immediately dmed me on my request a reasonable level of proof and I'm reasonably sure will send me quickly the rest of his logs I've asked for.

I'd also like to add this narrative about you and King being victims of identify theft is pretty troll. As of now, neither of you have suffered any negative consequences beyond some small-time loss and perhaps very very minor reputation loss at this stage. Your line about this being a valuable life lesson to the victims is also classless and tasteless even if true it definitely shouldn't be coming from you.
(I would also argue due to your own perception that you are not at fault at all and thus will be cleared in the court of public opinion the damage is non-existent.)

You have to realise you should bear some fault for not properly protecting your account that could be used to hard vouch for someone in groups. Whether this means you actually bear financial responsibility for this I'm not actually sure, but this idea that you bear 0 guilt is something I'm heavily opposed to. Its very irresponsible behavior to not have 2fa and be in these transfer groups and I'd argue more egregious than the traders not verifying Charmander or your own identity. However, I am also not familiar with the current methods used to transfer and whether video calling both the transferee and hard vouch is standard practice. If it is, then obviously I think the scammed parties don't have that much cause for respite, however I'm not sure it is. I certainly am willing to accept I made some mistakes, sending crypto first to someone was rather stupid, even if they did have a hard vouch. A transfer to a poker account/e-wallet would add a second layer of security.

There has been a tremendous amount of fluff posted by Martom at this point and zero evidence. Given the scam happened 10 days ago now I think everyone will agree this is unacceptable. You have had time to make this post and comment in the group chat but you should be focusing on actual exoneration because at the moment you are asking the aggrieved parties to take your word on the hacking without providing any evidence.

So you are justifying your lack of vigilence by saying other people do it as well. Solid, that makes you free of blaim I suppose!
And if can't verify the identity or the legitimacy of anyone in a $10,000 trade, MAYBE you shouldn't take it....?

Regarding the evidences of being hacked, I mentionned it a few times already in private: I'm happy to provide anything that could help... but what do you want exactly? You haven't requested anything besides Skype logs, which I sent in full details.
How else do you prove you got hacked? Anybody reading this having ideas I'm happy to oblige. KING, what did you provide that I haven't?
The hacker did need to chat on my account bc it was just the HV. Only after a few hours, when you guys started to get worried, you made a Skype group chat (cf. screenshot below) where you were asking 'me = the hacker at that time' what was going on. I showed up myserlf in that convo on the 13th.
That's the only chat I could find the hacker did in my name.


And I promise I won't share any of my outstanding wisdom with you anymore if you don't fancy it.

I'm pretty sure this is me openly admitting some degree of fault here.

And yes you did send me the skype logs, 11 days after the hack and after my post in the public forum.

I think it's reasonably easy to prove you have been hacked. You show a series of logins from your usual IP and location and then show successful "unusual activity" logins from your skype logs. Which I believe you now have, but why it took this long to do so is a bit bemusing to me. But really the onus is on you. Of course, I have to accept the evidence in this scenario but presumably, this will go to some sort of arbitration, and then you will need to prove you have been hacked to a reasonable standard.

Your answer to my question above is zero, which seems insane to me. Both parties clearly erred so at some level, both should share in the losses. If we're comparing the two, I'd contend failing to secure your account/putting the community at risk is a greater mistake, but at the very least it's worth some blame.

My 2 cents is that from what I have seen, people who are friends (or at least closely affiliated with) either side have been defending strongly their affiliated party. Imo while that is fine, it should be disclosed, to not otherwise appear to be an impartial opinion. To be clear, I am talking about both sides, i.e. I have seen friends of the hacked people, or scammed victims argue hard for their friend/s.

I know Thomas from live scene and am reasonably friendly but we are not "friends" and never had even a coffee or discussion with each other. I do not know any of the others (asides from maybe a trade).

I think 0 is a bit harsh but almost certainly what would be ruled in court of law. As we know, court of law is not always the "morally correct" answer.
I think to some level of degree it is hard to have "zero" risk especially if sending first, although you can (and should) do your best to make it as close to zero as possible. In this regard I think there is some level of EV paid (ideally very small/negligible) for the convenience of fast p2p trades.

In an ideal world everyone has top level security but in reality this is just not realistic nor enforceable by punishment, especially in a 600 person group.
Obviously poker players tend to be young and reasonable with computers but there are plenty of people who are not. Of course laziness can be a reason too, but I'm sure there are people in there who can barely use a computer etc.
You also have to factor in that people have different financial situations, where do you draw the line - if the hacker vouches for 500k which the hacked person doesn't even have, what do you expect to happen there etc?

As a community everyone should do their part, video calling where possible, securing e-mails/accounts 2FA properly etc.

Unfortunately people (including Thomas and King) learnt the hard way here, but I don't think they are liable. It would be nice to offer something, as some people have in the past.
I do think it is irresponsible to not have accounts secure and so on but realistically you can't expect everyone to.

I also think posting on 2p2 is pretty meh, people not in those trading groups do not know how it works etc, although I also understand/empathise that posting in the groups wasn't really getting somewhere. I agree 11 days for response is unreasonable.

1) more than 0 does "feel" right but at the same time a fixed absolute $ amount can't really make sense, and a % is clearly wrong since the liability can just be infinite then

2) if you don't know the trader or person/people vouching i'd strongly consider not doing the trade or trying to get a vouch myself - not victim blaming here, i also understand this is can be very difficult for people who are not that well networked and/or don't know many people in the poker community (and wouldn't recognise them in a vid call etc)

3) ideally yes but not too realistic to enforce. plus some issues like does that mean if they had 2fa they are certainly not liable but if they don't they are etc? what if people didn't have it but claim they had etc, all hard to prove enforce etc

4) yes it has happened before. not ideal but yes i think there is a non 0 (but you can minimise) risk.

5) people can and do sometimes remind about getting 2fa, people as a default should be aware and more aware that e-mails should have secure unique passwords, have 2fa, as well as skype etc. i guess reminding people about this as much as possible and general rules like verifying who you are trading with, verifying who vouches are, reporting suspicious activity asap etc. and people do the above to a large degree, some of these scammers try doing this all year long and maybe succeed one or two times, there are no doubt some who do not get any etc.

just use some common sense too. are big names randomly going to msg relatively unknowns and offer huge vig for random transfers. theres obv more but i dont want to give too many ideas to the scammers

[QUOTE=martom;57326570]
I’ll also add that I consider myself as a man of honor, and I believe that, to the people that know me, my Word is worth a lot.

I have over 100 trades in which I sent first is under 15 times and there wasn't more than 5-10 videocalls, so vouch from your real account should mean something.
Of course your friends will tell u you are innocent.
If u think u are man of honor u will take arbitrate from unbiased well known 3rd person, saying u are man of honor doesn't make u one, actions does!

This is what we're trying to address. Over the years not having 2FA has been the most common way people have been getting hacked leading to lost funds. You say that everyone should do their part to protect everyone else but don’t think there is any liability for those who fail to do so?

Right now the "hard lesson" Thomas Boivin and Sam Horrocks are learning, unless their actions have repercussions, seems to be that if you’re lazy about account security and get compromised, the worst that happens is people will get upset with you after getting scammed.

The idea to post on 2P2 was brought September 14th, 3+ days in advance of posting and already after a period of time where there was no movement from Thomas. To which Thomas replied “will get back at you ASAP guys. I’m moving out of my palace this week so I’m terribly busy. will think about the 2+2 option and get back to you”. See below.



Accepting the defense (below) as 0% liable, seems to set a pretty dangerous precedent. It would mean that anytime there isn't a video recording with the parties involved with proof it's the real people, just say you got hacked and don’t pay anything.



In all the trades I've Hard Vouched for nobody has ever video called me to confirm. AFAIK, that is the case for most people as well. That's because people in these chats trust that they have recourse when there is a Hard Vouch.

You can’t say other people are lazy for not adding 2fa but the reason they don’t video call is because they expect recourse.
In fairness the reason is often they don’t know the HVer but of course they should be tighter with who they accept then (as I acknowledged before I understand this is hard for people who aren’t that connected in the community).

regarding the "hard lesson" - obviously losing actual money is worse in most cases but getting hacked and having someone/people read up to all of your msgs and identity theft etc is a serious violation as well, unfair to have zero empathy too. plus some people (wrongly or rightfully) will think less of them in a world where rep is everything. it's not a contest of who is a bigger victim though, that wasn't my point obviously

2fa is of course helpful but a strong unique password is the first line of defence. If Thomas had a weak password and used it on multiple sites so a hack on any site he used the same password on opens the door for his skype to be hacked he has for more liability than he seems to think imo.

When i got scammed by a hacked skype account in 2016 luckily it was only for $2k and the person whos account was hacked sent me 50% which i was pretty happy with. I made mistakes and so did the person who failed to secure his account it felt like a fair resolution. In hindsight it probably saved me money down the line as my awareness of account security increased 10 fold due to this incident.

I have noticed loads of attempted logins to my skype account in the past from russia, panama, india etc none of them got past my password. GL breaking a 40 digit string of randomness that no one in the world knows not even myself. Password manager and unique passwords on every single website/poker site is the way to go.

Yes sorry to be clear strong unique password, secure email/account attached to the Skype (ideally also with 2fa) with strong unique password also highly recommended.

Imo the voucher, even if hacked, pays 100%.

It's his reponsibility to secure his account and if somebody doesn't like taking responsibility let such people not use trade groups like that...

People should put more effort into verifying other side (even if it's friend). With bigger trades you may want to split it up into smaller parts or get more vouchers.

have to say I disagree with what I bolded. Out in the real world, a person is almost always absolved and indemnified from blame when they are hacked, and not expected to cover financial losses incurred, regardless of the circumstances of the hack, the size of the loss, or the amount (or lack) of care they take to protect their personal details.

For instance I lost a bank card a while back and whoever found it tapped it for a surprising number of small purchases in the hour or so before I realised it was gone and froze it. Yet I was fully refunded, despite the stupidity of leaving it on a counter after I used it.

Of course, this is poker, so there is probably some convoluted logic tree that says that real-world practices don`t apply because reasons.

ok lets say i am open to your suggestion. what happens if a hacked acc 'vouches' for X where the real person would not vouch that much and literally has a networth above X?
do you think every acc is just liable for literally up to an infinite amount? people trade for large amounts sometimes (obviously on average the higher amounts tend to perform more due diligence, but still point stands).

*the amount doesn't even have to be "that" large. there are honest people who use the group legitimately who maybe trade for e.g. $200-500 per trade, who might have a networth of say 5k-10k. (sometimes they may have less, and are staked for example) should they be on the hook for 10k? 20k? more?

i absolutely think everyone should secure their accounts btw as i have said multiple times but it is a different question of liability for those who did not.

Man, but you cannot compare Visa/Mastercard/Other chargeback thats connected to international law to a group on skype that runs only based on people trust...

Imo the rules on such groups shall be very strict, otherwise you give huge opportunity window for fake-hack trades.

This won’t be helpful for this particular situation, but it seems to me that this trading group should require both: a strong password and 2FA of all its members. It was extremely negligent of martom to have such a vulnerable account.

That said, if he’s provided proof that he was hacked I don’t believe he’s on the hook for anything. If 2FA wasn’t required to be a part of the group, then I don’t think he’s liable.

Martom also seems to have handled things poorly after-the-fact, and his posts in this thread were a bit disingenuous. Saying that he was a victim of identity theft, while technically true, was completely tone deaf. Generally speaking, identity theft victims suffer some damages. It doesn’t seem as if martom suffered anything, and it’s wrong to equate his victimization with the guys who lost tens of thousands of dollars.

Are you aware of just how crazy some hackings are? Scammers social engineer or inside-man their way into having telephone companies send out cloned sim cards of phones and beat 2FA. It's a real thing and plenty of HS poker players have had their actual payment apps hacked and emptied this way.

Don't xfer (meaningful amounts of) money without video-calls, with people who you can visually identify and verify the identity of really. Or do xfer but pay the scam vig whatever % risk that is.

So any update on this?

I second this. I'm part of these groups myself and occasionally do trades. If the hardvouches can become null just like that it kills the whole concept of it.

I will start out with saying i dont know anyone in this thread that was involved in this trade. I know off KING SAMHOR and probably met him few times a gazillion years ago. However i dont really agree fully with all of you. I think many of you are being to hard on Thomas (Who I never even heard of before).

A case could be made that its actually your own fault to some extent.

1) It's a bad idea to ever ever send crypto someone first, if you send stars or similair its actually quite complicated if the person is hacked (or even if they arent hacked) to blame someone else. As of that it seems common sense to me that the person accepting the most legit format will always recieve first, and the most "sketchy/least realiable" (always crypto) gets it last.

By not sticking to this you are def open yourself up to getting scammed an absurd percentage compared to if you just stick with this.

2) Couldn't it been prevented if anyone of you did some kind of due dilligence? If you google king samhor you will get links of his pokerstars account. The guy is playing $1-10 tourneys lol, its def questionable why he would request a 15k trade. without some kind of obvious score. In a sense if a guy plays 1-10 dollar buyins and they request a 15k trade it should be somehow similair to i.e a 10-100 reg making a 150k trade, or a 100-1k reg making 1.5m trade.

3) Given the first two points i wouldn't be comfortable with only having ONE hv myself, i would def get more since its just the most obvious/perfect scam scenario ever.

4) If all points up to this are ignored, i think you should consider contacting Thomas outside of skype i.e messenger/video call/social medias. It seems unfair that he should take on this ammount solo when you guys were being somehow reckless in the first place.

5) What if Thomas did have a safe password and 2FA, does he lose all/some responsbility? If so he could easily just lie and make up some bs story. And then the system sort off becomes broken and pointless.

It sucks you guys got scammed, but its def up to all people involved to improve the trading system. These chats with 600 people are also terrible, would just avoid them and stick to smaller chats. There are def couple of guys in the community that run their own chats or will hook you up / help you with any kind of trade you might need.

This seems like more of an argument against the rules of the current system. And hey, I'm all for it. It's very clear that something needs to change. But up until this point, there's been nothing about 'not sending Crypto first' and getting a 'HV' was considered enough. Not two, three, or four -- just one.

Do agree that all parties share some responsibility here and all of them could have done more in terms of due diligence. But it seems that the aggrieved parties are getting raked over the coals for not video calling to confirm while the other guys who failed to secure their accounts and put the community at risk are getting a pass.