Someone asked me to login to his bank account and make transfers to another account

Question

Someone I knew online asked me to log in to his account in Pioneerbanking.online and make a few transfers for him as he "couldn't do it by himself for a couple of reasons". I foolishly did help him made 2 transfers and he's urging me to do the 3rd which I declined.

I am now aware that it's obviously a scam but I am not sure how it works? How can he takes advantages of me for doing those transfers for him?

What I noticed is that the website he provided looks suspicious and the beneficiary is invalid ( I asked a friend of mine to transfer a small amount of money to that account and it was sent back to my friend's account)

Update: I reported it to the local police, they said I haven't lost money yet, what's there to report about? OMG

Update: Should I post link of photos of the supposed to be scammer here? Maybe someone knows who he is or his identity being stolen by the scammer.

Consider reporting this as soon as possible to the police and to the bank. If it is fraud, it might help that you came forward voluntarily before the authorities got involved. If it isn’t fraud, reporting doesn’t lose you anyth... nah, I’m pretty sure it’s fraudulent. If they are willing to post the access codes online, then they are online and have the access codes, so they can surely log in themselves to do the transfer. — Lawrence, Apr 20 '21 at 14:24
I don't think it's a valid bank since the website is pretty "weird" I'd say. I think maybe it's a phishing website built for the scamming purpose. Yes, I'll report it to the police. Thank you — Lan Anh, Apr 20 '21 at 15:29
"couldn't do it by himself" + no problem contacting you through the internet = fraud — Quora Feans, Apr 20 '21 at 19:14
The employees of this bank are impressive. They also have time to run this very similar looking bank as well as a uniform company and several non-profit groups, all while serving on a civil air patrol!. — bta, Apr 20 '21 at 22:33
With a legitimate bank, making transfers would always require 2FA, wouldn't it? — gerrit, Apr 21 '21 at 07:16
@DavidSchwartz Even the address is badly made up, there's no Queens Lane in Richmond, VA. (Though they did get one thing right, Richmond is indeed in Virginia. Kinda surprising they didn't make it Richmond, DC for added comical effect.) — TooTea, Apr 21 '21 at 12:09
Consider that this "Someone I know online" may not even be who you think it is. It may be a friend of yours who has had their online account(s) compromised (stolen password or email credentials, for example). It is hard to verify someone's identity online, even if you have an existing relationship. For example, I have gotten plenty of messages from "friends" on Facebook that are suspicious, and they later tell me their account was hacked. — Ogre Psalm33, Apr 21 '21 at 13:11
@OgrePsalm33 Working in IT, I sometimes see email chains of phishing attempts. Your comment reminds me of one I saw where the recipient was a little suspicious, so they replied to the email itself asking "Hey Boss, did you send this?" Of course they got the response back "Yes, it's me. -Boss" — Dan Henderson, Apr 21 '21 at 20:00
*CONTACT A LAWYER OR THE POLICE IMMEDIATELY*. You have likely been involved in the committing of a crime. — Brondahl, Apr 22 '21 at 13:39
"I asked a friend of mine to transfer a small amount of money to that account and it was sent back to my friend's account" Sorry being direct: are you crazy? Or your friend, at least. — EarlGrey, Apr 22 '21 at 14:49
@LanAnh well, if the account was working, you just sent money to some unknown person. What if he was Bin Laden? you would get quickly in jail :) ! Being less pessimistic, you may get in trouble because the receiving end may claim you are trying to scam him ... — EarlGrey, Apr 23 '21 at 07:33
@EarlyGrey: lol, too pessimistic I'd say, people transfer money to the wrong beneficiaries all the time. — Lan Anh, Apr 23 '21 at 07:52
@gerrit Not really. My own bank loves "security questions" and gives no options for other accepted 2FA, not even text messages. — Machavity, Apr 23 '21 at 12:37

score 53 · Answer 1 · answered Apr 20 '21 at 10:22

53

The scammer gave you login credentials to account X and had you move money to account Y.

The scammer didn't own account X. What is likely is that the person who owns account Y was told "I" will transfer $5,000 to your account, you keep $500 and send the rest as a money order to this address. The reason why account Y now appears invalid is that the owner of Y may have alerted the bank or the police.

When the authorities trace the transfer, they may track the login session to you.

The scammer also learned that you are willing to help them, at least for a little while.

answered Apr 20 '21 at 10:22

mhoran_psprep

139,546
15
193
389

If this is the case, why did the scammer get the OP to make the transfer? It is not hard to hide your IP address these days, scammers must do it all the time. – Dave Apr 20 '21 at 14:51
The account I was asked to make transfer is an organization account (account name matches with his story) that's why I recklessly made 2 transfers to that account. Btw, can someone takes a look on that website and tell me what you think? Is it a legitimate one or a phishing website? And of course I'll report this to the police. – Lan Anh Apr 20 '21 at 15:33
20

@Dave: Misdirection is easier when you create a scapegoat. If no one held the smoking gun, they'd look more into finding who held it. If you manage to let someone else hold the smoking gun for you, it's more likely that they stop looking after they found your scapegoat. This shouldn't be the case (we'd hope), but in reality if often is - and this is often how scammers eek out their advantage. – Flater Apr 20 '21 at 15:42
3

@Lan Anh I had a quick look. It is pretty good, but A) google does not think their address exists and B) the nameserver is dns1.namecheaphosting.com and they have most data redacted on whois and C) dead links in footer. I would not give them my money. – Dave Apr 20 '21 at 15:55
4

@Lan Anh Also one of the "team" is actually this woman. – Dave Apr 20 '21 at 16:02
1

@Dave I was just looking as well, and their apply/register page is just as bad. Only validation on the fields is to make sure something is entered, but you can enter in any values you want (I entered 1 for all fields). I even registered with the exact same details twice and it let me continue without telling me the email and username were already in use, invalid DoB, too short/weak password, etc. etc. Also just a load of placeholder Lorem Ipsum text on their services page. Definite scam site. – crazyloonybin Apr 20 '21 at 16:06
1

@Dave: thank you so much – Lan Anh Apr 20 '21 at 16:06
@Dave if you search for “Belinda S. Manson”, you’ll find other “banking” website. I expect they’re fake too. – Tim Apr 20 '21 at 16:47
Are you sure you didn't mix up X and Y in this case? – Harper - Reinstate Monica Apr 20 '21 at 17:18
5

If the site is a scam, and Lan Anh used scammer provided credentials (not their own for a real site), then they cannot have done any real damage yet? – Dave Apr 20 '21 at 17:20
@Dave - I believe that lady is the stock photo used by that company's web design template. Note that the picture isn't reachable from the real website which links to a real company in Manchester, UK; http://www.ambientaccounting.co.uk/ – Valorum Apr 21 '21 at 08:14
3

This answer doesn't make sense regarding the evidence that the banking site is fake. You might want to overhaul it. – Chris Apr 22 '21 at 10:51
1

Here's the Bootstrap 4 site template from which this was ripped – wchatx Apr 22 '21 at 20:30

score 24 · Answer 2 · answered Apr 20 '21 at 14:22

This sounds like the definition of a "confidence scheme", in which the scammer does things which at the beginning seem legitimate or, even if suspicious, work out exactly as they promise they will. Naturally it starts with small amounts as 1) a way to lure you in ("it's only a few bucks, what's the harm in that?" you might think), and 2) to build up your confidence in what they're telling you.

It gradually progresses to bigger and bigger amounts, then they start changing the game, asking to use your accounts or more of your money. Then they strike, take you for what they can get (which by then is usually a much more significant amount that you would miss!), and they're gone. Or worse, they get you to somehow involve friends or acquaintances, who might be the REAL targets (you're just the unwitting dupe in the whole thing), then you're stuck dealing with the aftermath.

ANY TIME SOMEONE YOU DON'T KNOW APPROACHES YOU ASKING FOR YOUR HELP IN MOVING MONEY AROUND, RUN!!

There's a reason why they won't do it themselves - what they're getting you to do is most likely illegal, or they want to make sure it can't be traced back to them in the event it isn't criminal in nature but could open them up to civil suits.

The mere fact that you, by your own statement, know it's a scam and posted here asking questions is enough to tell you to give it a wide berth. And unless it's merely for the sake of curiosity, does it matter how the scam actually works? (grin)

I think it might be true, a "confidence scheme" to be escalated soon. Thank you for your answer. — Lan Anh, Apr 20 '21 at 15:36

score 14 · Answer 3 · answered Apr 20 '21 at 21:01

Yet another possibility is something along the lines of:

they ask you to perform an operation
they have the website display the outcome of a different operation instead
they claim you screwed something up and sent more money than you were asked to
they demand you compensate them

A recent video by Mark Rober showcases a real-life scam, primarily targeting older people, trying to guilt them into sending money in a way somewhat similar to what you describe.

Harper - Reinstate Monica · Answer 4 · 2021-04-22T22:49:23.543

Since the bank account is fake, it's practice.

The scammer is actually cultivating you. It's a confidence game, but in a form called "the long con".

For scammers, the limiting factor (the scarce resource) is the human resource: the scammer's own time. They can't afford to waste their own time working with skeptical "marks" who will ultimately refuse, or who will scam them right back to waste their time.

So they use elaborate methods to try to screen out those people.

For instance, consider Nigeria. Most people know Nigeria is associated with scams (and it's the only thing they know about Nigeria lol). So why on earth do so many scam emails mention Nigeria? There's a reason - they actually want to repel away the skeptical -- so they only deal with the gullible.

Also, a confidence game is about building confidence. For instance:

In some money-transfer scams, they sign victims up "as employees" and give them simple, zero-risk, zero-harm tasks like finding a low-price airline flight. To the victim that feels like real work done, and makes the victim more confident in the legitimacy of the work. Next they send money to the victim to buy common office supplies to be mail-ordered "to the scammer", and they make sure that transaction goes smoothly. *This makes the victim more comfortable with money transactions. Or alternately, the victim has said "Heck no, won't do it" - they are screened out.
Next, they know Bitcoin ATMs are alien to the victim, so they have them do more "harmless tasks" - such as finding local ATMs or taking photos of the ATMs. After that, they have the user step up to the ATMs and navigate the menus, with some excuse like wanting to see the software version used. Again a zero-risk, zero-harm activity, but the victim's confidence is rising that this is a real job, and their reluctance to interact with Bitcoin ATMs is falling.
Then, with the victim well-groomed, they start wiring money to the victim's bank account and having them deposit the cash in the Bitcoin ATM. That victim would have never agreed to that if that'd been their first request! But since all of this feels like "old hat", their guard is down.

The above is how the "long con" works.

The scammer's ultimate goal is to wire you (stolen or fake) money, and then have you wire that onward to them in a different method (Western Union, Bitcoin) which is irreversible. Then, when the stolen/fake money is exposed, you are left holding the bag.

As with the Bitcoin example, they know you'd never agree to that until you gained some confidence. So they have set up this fake banking site to let you play with fake money, so you gain confidence in their legitimacy. Eventually, after this type of thing "feels like old hat" and your guard is down, they will ask you to do the actually dangerous thing.

Note that this works best when the scammers can "automate" all this screening and confidence-building, so that each victim being groomed will take the least amount of their time. Controlling the bank website makes that easy for them.

Once they have manipulated your confidence, it'll become this.

"couldn't do it by himself for a couple of reasons".

The legitimate account holder will claw back the money after detecting the theft
they would follow the money to me, and I'd go to jail

Those are the reasons. Better plan:

Find a (second) victim.
Have victim 2 transfer money from victim 1's account to victim 2's own account
Have victim 2 transfer money from own account to mine
except, use a different transfer method that is irreversible
I have the money. Woot!
Victim 1 detects fraud and claws back money. Victim 2 sees account go negative.
Victim 2 tries to claw back money sent to me. Can't, because I chose an irreversible method
Victim 2 left holding the bag. #notmyproblem

careful there! You might be giving some idiot an idea they might actually try! (grin) — RiverNet, Apr 20 '21 at 19:42
This answer doesn't make sense regarding the evidence that the banking site is fake. You might want to overhaul it. — Chris, Apr 22 '21 at 10:53

score 1 · Answer 5 · answered Apr 22 '21 at 13:39

1

YOU NEED TO CONTACT A LAWYER IMMEDIATELY!!!

They will recommend whether or not you should contact the police, and (if not) will advise you if (when?) the police come looking for you.

All the other answers explain possible details of the scam, but none of them spell this conclusion out explicitly!

You have almost certainly logged into an account and transferred money out of it, without the knowledge of the owner of that account. Depending on the jurisdiction, it seems likely that this is a criminal action. Some jurisdictions may not take into account that you didn't understand/know what you were doing.

Either way you need to get professional legal advice IMMEDIATELY!

answered Apr 22 '21 at 13:39

Brondahl

2,395
2
14
24

1

I wouldn't say "almost certainly". While this could in theory be a money laundering scheme, there'd be almost no reason for a scammer who has login credentials for a real account to have someone else use them. I would think it far more likely that the scammer was using completely fictitious accounts to soften up the intended victim enough that the victim would later be willing to do something that involved one of his own (real) accounts. On the other hand, it's also possible that even if the accounts are fictitious the scammer might still try to extort money with empty blackmail threats. – supercat Apr 22 '21 at 17:32
@supercat almost no reason for a scammer who has login credentials for a real account to have someone else use them Nonsense. If the scammer does the login and the transfer then it's far easier for that to be traced back to their, e.g. IP address. If they get someone else to do it, then there's an extra layer of separation; just like cartels using drug mules. – Brondahl Apr 23 '21 at 09:44
The fact that many scammers don't bother to hide their IP addresses doesn't mean that doing so would be particularly difficult or expensive. When dealing with physical assets such as drugs or cash, there will be some risk at the physical location where they change hands, and so it's worth paying a human to shoulder such risk, but why go through the effort of paying or marinating a human to do a task that an open wifi and a device with a configurable MAC address can take care of for free? – supercat Apr 23 '21 at 11:32

Someone asked me to login to his bank account and make transfers to another account

5 Answers5

Since the bank account is fake, it's practice.

Once they have manipulated your confidence, it'll become this.