Alright so I've been selling a bunch of BTC and was pmed on 2p2 by tmckendry on November 28th. I was also pmed on skype by an account named Tyler saying hey I just pmed you on 2p2.

I shipped 2k btc first as a part of a larger trade. I haven't actually heard back for about a week now from the skype account. I was not super vigilant and only checked his last posts on 2p2 to see he had very recently posted in his pg&c thread and for whatever reason in my tired mind thought that was enough proof, as there was a period where I followed that thread regularly. (I do see a post of him looking to sell BTC now around that time, but I don't recall seeing it then. The timestamps might be EU for the skype convo and EST for 2p2 in the pic?)


https://imgur.com/vorxoz4




So Tyler says he got hacked which seems probable. Very weird hack though as the guy didn't attempt to get any more funds from me, and he came on to apologize twice about the delay over the period of a couple days. He also said Tyler's real skype in the PM but then messaged me from a different account. Tyler also says he hasn't had anyone else message him about getting pmed on 2p2 and skype in the last 10 days. Maybe someone will post here if they were contacted as well?

Anyways, I thought this should be documented for future traders

Everything above is accurate.

To be clear someone sent a message from my 2+2 account(nov28), told them my skype username, then messaged from a different skype username requesting funds for a trade.

My skype is not compromised, but anyone that was in contact with this 2+2 account around Nov28 to today could have been dealing with a scammer. I have since changed my password.

The nature of the whole incident is unusual. Not sure what procedures are to be followed in this situation. It's unfortunate that my rep is going to be tarnished from this. It doesn't seem to me like I should bear any responsibility for having my account compromised.. however, I dont know whats standard.

Well, a very standard first step would be for your account to be banned, which I've done, to stop more scams from happening, as I have no way of knowing if the account is still compromised or not. You can email me at the address in my profile to discuss further.

I, um...what??

Now, I'm not saying that you should (or shouldn't) be liable for any or all of the amount scammed, but I'm not sure who else should bear responsibility for your account being compromised.

How about the person on the other side of the trade that didn't verify the scammers identity beyond knowing that he had acces to his 2+2 account?

2+2 has only 1 step verification which is not safe enough for significant amounts of money, thus a compromised account alone shouldn't make you liable for significant amounts either.

How about the criminal who compromised the account? Sheesh!

Did I really need to specify that? Of course the person who actually compromised the account (if the account was compromised at all) is the one who ultimately bears responsibility. But since tmckendry apparently has no idea how it happened or who that is, who else but him is to bear responsibility for the account compromise?

What about him? He had nothing to do with the account being compromised.

If this was meant for me as well, I wasn't suggesting it should or shouldn't.

This is unbelievable.

I should have phrased better. What I was meaning to say is that 'tmckendry' is indeed the one responsible for having his account compromised (besides the scammer ofc). But that doesn't make him responsible for everything that happens afterwards. Such a case where he morally and legally is not is when the person communicating with the compromised account doesn't take a reasonable amount of precaution. And that's what happened here: 'chickens' send a 5-figure amount to an address not known to be 'tmckendry's without any identification other than access to a single forum account with limited security, which is plain reckless knowing an average person will have multiple online accounts compromised (checking my e-mail at www.haveibeenpwned.com/ showed 7 instances i.e.). It would have been different if the money was send to an address known to be 'tmckendry's or the scammer managed to compromise a more trustworthy channel of communication than just a single forum account as well.

Sure, which is why I said:

What if tmckendry's password was "password"? What if he was terribly negligent with his security? What if he wasn't hacked at all, but is the scammer himself?

I'm not saying any of those things are true, and I have no reason to believe things didn't happen exactly as he described. But I also have no reason to believe things did happen exactly as he described.

My point being, we really don't know enough about what happened to know who should be liable for what.

Things that concern me:

• OP did a poor job of due diligence.
• The only regret expressed by tmckendry is that "It's unfortunate that my rep is going to be tarnished from this."
• tmckendry doesn't appear to have done much to determine what happened with his account.
• It's been 6 days since I banned tmckendry, and I haven't heard a word from him.

If that can be established that would make him liable for a small part of the damage imo. I say small part because however negligent with his forum account he may have been he reasonably didn't have to expect that someone would send a 5-figure sum to an anonymous address based on acces to his forum account alone, but he should have foreseen that someone might be duped for a small amount that wouldn't normally trigger the demand of additional verification.

Then he obviously is a scumbag and should cover all + compensation for emotional distress, mental anguish and time spend dealing with the issue.

Two things in specific give me reason to believe he didn't do this himself.
- At the same time the one communicating with OP was looking to buy bitcoin Tmckendry made a post about selling bitcoin in the transfer thread. That could cause suspicion with OP and the scam failing while not achieving anything for Tmckendry if he was behind the scam himself.
- The fake Skype account would have had no purpose for Tmckendry. He could have either used his real Skype account if he was OK with having his reputation tarnished for $2K or could have communicated via PM not using Skype at all as using a fake account should have been an easy indication for OP that something was wrong and thus caused a large risk of the scam to fail.

He came off a bit cold indeed. I suspect he's still having hallucinations after a weird fasting diet with watermelons he just did.


Question for OP: did you send him a PM in reply? He would have received an email of that and it would be a bit suspicious if he didn't act on that.

I did not as I got the skype and 2p2 message at the same time.

FWIW, not everyone receives emails about PMs - you can change the setting in your profile.

Given OP's response to your question, that obviously doesn't matter in this case; just wanted to clarify in case someone thought this would be a reliable confirmation for future dealings.

tmckendry's account has been restored, but Marketplace Approval and trading privileges have been revoked for the time being. We *might* consider reviewing that status in a year or two. I've also asked him to ensure he ensures he has a more secure password.

This is in no way a finding either way on the original scam.