[strixee]

I have always been a happy Moneybookers customer until last week.
I became a victim of a phishing email (my mistake, I know) and didn't realize it until few days later my money was gone. I reported that using the ticket support system in less than 2 hours after the first transaction and didn't receive any response within the following 20-24 hours, so I wrote to their VIP address and this time they replied.
The reply was some kind of automated reply about investigation along with "great" advices like change your password and primary email address.

One day later I received an email containing the following:

Although we have made every effort to retrieve the funds, we regret to inform you that they have now left the system. Our security team have informed the relevant authorities here in the UK and we advise you to do the same in your country of residence.

Because all the transactions were deducted by a merchant account mbeur@paybycash.com, I contacted this company and provided them 3 transaction IDs. They replied quickly providing such info:

Order ID: 445323274 (Transaction ID: 643747283) worth 131.77 EUR via Moneybookers for the account “120653” associated with the email address jxkcpxau8037@yahoo.com at TQ Digital Entertainment on 2012-05-10
Order ID: 445335646 (Transaction ID: 643755714) worth 131.77 EUR via Moneybookers for the account “120661” associated with the email address fzqfsrub2080@yahoo.com at TQ Digital Entertainment on 2012-05-10

As stated previously, please know that the accounts “120653” and “120661” have been blocked due to fraudulent activity and any new payment submitted towards these accounts will not be processed. You may want to contact Moneybookers to avoid any future unauthorized transactions on your account.
If you need any further assistance, please feel free to contact us by simply replying to this email.

There are at least 2 big problems on MB side:

1. because I reported what happened in less than 2 hours after the first transaction using the ticket system, I don't really understand the argument that the money has already left the system.
2. When I searched for the "mbeur@paybycash.com" address, I found many forum links about the same problem. One of them is dating back to 2010!
   Below are the links I found:
   http://foroapuestas.forobet.com/mone...-cuenta-3.html
   http://www.escrocs.net/forum/3933-ar...neybookers.htm
   http://www.bet2bonus.com/forum/moneybookers-11-29.html
   http://www.dadinheiro.com/forum/inde...4632;topicseen
   http://www.coteur.com/forum/viewtopic.php?f=1&t=4598
   http://forum.metododinheiro.pt/index.php?topic=42373.10

The 2nd point has two possible consequences. Either the Pay By Cash company are scamers and they don't care because of the 2% commission or MB have some serious security issues. How the hell can money be stolen for years via this merchant account?!

[lukahh]

scary indeed.
- what was the phishing mail about (took you to website claimed to be skrill)?
- what company is mbeur? Mybet? Matchbook? can they lock the funds or have the funds already left their system as well? (this would be hard to believe due to short time frame).

i think joint complaint with SBR assistance is due for skrill and merchant.

do use those security tokens. it is crucial as employees at some books will try to get the money by using your passwords.

[zebras99]

If this happens, I think you got to call them right, this makes things faster (at least I think so).
I had a similar case when my funds were transfered to some forex website. I noticed it <10 min and gave a call to them right away. The amount was 600-700$. MB locked my account right that minute and my funds were back in my account in ~6 hours. My sec. token was being mailed so I don't think they had any other choise but to give all my $ back due to their 100% funds guarantee for VIPs with tokens.

[strixee]

- what was the phishing mail about (took you to website claimed to be skrill)?

Right, it took me to some website, this is a part of the email:

We would like to inform you that your account has been temporarily locked for incoming and outgoing transactions because you failed to accept the new Skrill (Moneybookers) Account Terms of Use and the Privacy Policy until the 15th of May, 2012.

- what company is mbeur? Mybet? Matchbook? can they lock the funds or have the funds already left their system as well? (this would be hard to believe due to short time frame).

It looks it's some online payment system paybycash.com, the website looks weird

[shari91]

I got that email too or at least something like it recently. The funny thing is my MB account is closed so whomever scammed you must've bought an older email list.

I think the part about the money leaving the system would be if whomever stole your cash withdrew it from their own account before MB went to investigate. Although you'd think they could try to cancel that payment or file a dispute with whichever bank is attached to the scammers account to retrieve that money.

[fabulous]

That's indeed a real problem at the moment, crooks try to steal MB customers's money by sending them an email which is supposed to come from MB. The content of that email is approximatively always the same: you're informed that your MB account has been closed and to unblock it you've got to follow instructions...
This is very simple to identify if an email really comes from MB or not, so read carefully if you don't want to be scammed:
when MB sends you an email, they always start with " Dear mr...(+your first name and last name)". On the contrary, the crooks ignore your name, i suppose they only have an email list of MB customers, so the crooks emails start that way: "Dear ...(+email address)

Example: for Mr John Smith whose email address is John52@hotmail.com, a real MB email will start that way :"dear mr John Smith" whereas the crooks email will start with "dear john52@hotmail.com"

Of course, i can't guarantee it at 100% coz crooks may find a way to discover your real name.

But if you want to be sure not to take any risk, that simple, add MB website in your "favourites" and every time you want to login use that url. Never login on MB by clicking on a link in an email.

But supposing you made mistake, i mean you received email from crooks, clicked on link in the email and then entered your email address and password to login on MB, this is not too late, you can quickly react :
once login, click on "my account" and on the left menu you can see "change password". Crooks are not necessarily in front of their computers at the moment you clicked on link in their email, you have time to change your password. Then, even if password has been changed, you should better change your primary address too with MB.
An other solution exist if you don't have the reflex to change your password: just after login, immediately send your whole money to the MB account of a friend you can trust in if you have one who owns a MB account too ! That way crooks will find a MB account with a 0 balance (but you may have CC informations registered...so the best thing is to change immediately password and primary email address, and once more if the email starts with "dear +email address", that doesn't come from MB !

I hope that may help you and avoid some of you to be stolen.

[DoctorGonzo]

I get these mb phishing emails about once a week. They used to look very amateur but the now look very close to the real thing. One give-away is that they start with "Dear [e-mail address]" or "Dear Customer" rather than your actual name. And the address the link points to is not on moneybookers server but some random server that's been hacked and the fake web pages uploaded.

[shari91]

These scammers are smart because they try to frighten you that you'll lose your account if you don't do what they tell you to. MB will always put disclaimers in the bottom of their emails:

"Moneybookers and its representatives will NEVER ask you to reveal your password. There are NO EXCEPTIONS to this policy. If anyone asks for your password by phone or by email, or on any website other than moneybookers.com, refuse and immediately report this to security@moneybookers.com.

Please be advised that Moneybookers and its representatives will NEVER send you an email asking you to provide your login details within a form provided or to click on a hyperlink to access your account! Immediately report any incident to security@moneybookers.com."

[DitKent]

These phishing emails look so real these days, all you used to have to do was look at the email address and know its fake, but these days it actually ends in info.moneybookers.com and I had a look at the other legit MB emails I've received and it aswell ends in info.moneybookers.com, anyone know how they do this?
is there some program out there that can mask your email address. A little scary, but obviously I also look at where the links take you and know its a scam.

but yeah, the ability they have to mask and alter email addresses is kind of worrying.

[HeeeHAWWWW]

But if you want to be sure not to take any risk, that simple, add MB website in your "favourites" and every time you want to login use that url. Never login on MB by clicking on a link in an email.

Worth repeating that. Same is true for paypal, bank stuff, facebook, email, everything. Never click on an email link, it might be fake. Always enter the address manually into a browser.


I had that same moneybookers phishing email by the way, although iirc yahoo auto spam-binned it.

Wouldn't work for my skrill account anyway, because I have the keygen security keyfobs on mine.

[lukahh]

it is possibly a lot of money involved, so they have the incentive to reproduce the exact site and email style. if website looks like info.moneybookers.com, i would be inclined to trust it (no?).

[shari91]

it is possibly a lot of money involved, so they have the incentive to reproduce the exact site and email style. if website looks like info.moneybookers.com, i would be inclined to trust it (no?).

No, never trust them lukahh. If you believe the email might be legit, go directly to MB and log on there or even contact their CS. Don't click links just like MB warns in the part I quoted above. They'll never include them in their emails to you.

[Border Gadgie]

I would echo some of the comments about being cautious and never logging into any skrill/moneybookers emails, only ever log directly on to their website at anytime, more importantly if you dont have one get a security key fob before you use the site, they are simple to use, no bother and could potentially save you alot of money/hassle for no or little outlay. I am happy to use moneybookers but wouldnt trust having funds here without the extra layer of security provided by the key fob.

[xxx]

i got a email saying it was from skrill and had to log in to update my info....., but the funny thing was it landed in my junk folder mail. Usually an email from them lands in my inbox directly.

[the sink]

Ye, I keep getting them now evey week, the same mail, dear blabla account locked

[pjesnik24]

I get those too and it is my old email, from my US$ account

[moneydude911]

I got that same email as the original poster. I also clicked on the link my virus protection stopped the page from loading and stating it was a forged website and nothing loaded and i did not enter any account details through link. My account should be okay correct?because of my software stopping it from loading and killing the site from loading??????



thanks.