Second Life scammers and their tactics: A Virtual Bloke special post

If you’ve been active in any Second Life group—especially one for mesh heads or mesh bodies—for any length of time then you’ve probably seen people saying things like this:

• I received an item earlier from “giftcatwa” that said it was an update. I didn’t think anything of it and accepted the item, thinking there was an update to my head. However, I just looked back the account “giftcatwa”, that sent it to, was just created today. Is this fake? and should I be worried thats I accepted the object?
• just got a item from “catwaOffer” is this a real catwa bot? “CatwaOffer has given you this object: CATWA HEAD (gift)”
• i just got this [16:31] Second Life: catwaupdate has given you this object: Re-delivery CATWA HEAD update
• I need to tell some one about this its called catwagifts tried to tap into my lindens it says catwagifts Resident
• hello, what happened when i got the item from eventcatwa in my inventory but not opened…so just delete or maybe save my linden to a friends?
• Hi everybody, a question. I just received an object called CATWA HEAD Update from an avi called CatwaHeadStore… is this a scam?
• is that latest CatwaHeadUpdate really from Catwa?

All of those came in to the Catwa support group over the long Easter weekend last year. Other groups for mesh heads and bodies were also being hit by these fake names, and they all had something in common: THEY’RE SCAMS. Here are a few examples of the kinds of thing we’ve seen being ‘offered’ to people:

These scams come in fits and starts—usually when school is out, or during public holidays, or times when you might expect sales and gifts, such as Black Friday—so I thought that I’d highlight some of them here as a kind of ‘buyer beware’.

For tips and tricks on how to check for legitimacy, and how to report scammers, read through to the end of the post.

I do want to just point out, before we get into this post, that there are occasionally fully legitimate free offers by big-name creators. For example, both Catwa and Lelutka have offered full-featured mesh head gifts on more than one occasion. So, I am not suggesting that every ‘free mesh head’ (for example) is a scam. But use your noddle when you spot something like this: if lots of people are blogging about it, or saying in group chats that “XYZ Store has a free mesh head; I’ve been trying to get into the sim all day but it’s packed!” then it’s pretty certain to be a legit offer.

The ones you need to be very very very careful of are when a ‘free/gift’ item just drops into your inventory or is offered to you out of the blue.

Scam #1: The ‘update’

The first kind of scam you might encounter is the one that’s an ‘update’ to your mesh head or body. This is a bit of a screwy one, since many creators do just send their updates out of the blue. It’ll usually happen the second that you wear their item, or when you log in wearing that item. For example: in the past few days Signature updated their Gianni body to include a Bakes on Mesh version, and when I logged in while wearing that body the update was immediately sent to me.

Since I’m a CSR for Catwa, I can tell you here and now: For your security Catwa doesn’t send any updates out automatically. You have to manually update at one of the store’s redelivery terminals. (You can bookmark the webpage to save you from having to visit the store each time.) Any gifts must be collected in person from the store. If in any doubt, always check the profile of the person who gave you the item. Chances are it’s a one day-old throwaway account. CATWA CLIP is the owner of Catwa store.

However, there’s one thing to look out for when rezzing or wearing these updates to unpack them, and that’s the debit warning box. It looks like this in the stock Second Life viewer:

And like this in the Firestorm viewer:

I’ve used a legitimate vendor there, which I would expect to request permission to debit my account. But if you ever see that YELLOW text pop up, READ IT. No update or mesh head or body ‘gift’ will ever ask for permission to access your L$ balance.

Also, if you’re being offered an ‘update’ to a mesh head or body that you don’t even own? Yeah, ditch that bitch.

Scam #2: The ‘free gift’

This one crops up a lot. You’re out minding your own business, shopping or clubbing, or exploring, when all of a sudden some account with a name vaguely related to a mesh head or body store offers you a ‘free gift’. It’s usually a ‘Bento mesh head’, or a ‘free mesh body’.

Guess what? The only ‘gift’ in that is for the person giving it to you, if you rez the object or wear and grant it debit permissions. Delete it with extreme prejudice.

Update: April 2020 – I recently had the chance to examine one of these scam items up close, when I went to help someone who had been scammed out of almost L$20,000 by a ‘CATWA HEAD BLACKDAY’ scam object that was handed out freely by a ‘black friday deals’-named avatar. The victim had attached the scam object—which they assumed was a free mesh head—and granted debit permissions (due to English not being their first language). The object then proceeded to make multiple debits from their account—two or three every second—and, within a very short time indeed, their balance was down to just L$53. In a horrible final twist, as their L$ balance decreased below L$100, so did the amounts being debited: ending up as just L$10 coming out once every second, until there was no more money left.

This scam object was not a mesh head. It was simply a scripted invisible box that attached to their right hand. For obvious privacy reasons, I’ve pixelated their name, group and face:

And here is an example of three debits. Note the timestamps. I’ve not copied and pasted these; the scam object took L$100 out three times per second:

2020-04-16 07:30:41
Destination: blackfridaysl Resident
Object Pays
Region: [REDACTED]
Description: CATWA HEAD BLACKDAY [Basic Head] L$100 L$73

2020-04-16 07:30:41
Destination: blackfridaysl Resident
Object Pays
Region: [REDACTED]
Description: CATWA HEAD BLACKDAY [Basic Head] L$100 L$173

2020-04-16 07:30:41
Destination: blackfridaysl Resident
Object Pays
Region: [REDACTED]
Description: CATWA HEAD BLACKDAY [Basic Head] L$100 L$273

And yes, I’m quite happy to name that bastard scammer here. That’s typical of the kind of name they will use. Hopefully for the victim, a support ticket should see their money reinstated, as there is no possible way they could have voluntarily paid that much money that quickly to anyone.

Scam #3: The limited time (today only!) ‘discount’ mesh head or body, only buyable from a vendor in a sandbox (or after joining a group that costs L$)

This one is fairly recent, and it often starts at the creator’s actual store. Someone posing as a manager, an assistant, or a customer service representative (CSR) will approach you in a professional manner (sometimes in person, sometimes in IM), asking if you need any help. They will then tell you that there is a limited time discount on all the items you’re considering (mesh head or mesh body), but it’s “not at the mainstore”. They’ll then offer to teleport you to a specific vendor where you can take advantage of this amazing offer.

That vendor will—more often than not—be in a sandbox. Suspicious yet? Here’s an anonymised chat log that was reported to the Catwa group recently of just such an ‘offer’:

Scammer: Hi, how may i help you today?
Customer: just looking for a new head
Scammer: oh okay
Scammer: remember today they are only 4500 instead of 5k today only
Customer: omg i didnt know that
Customer: i love the bento one
Customer: [head name]
Scammer: okay, I’ll tp you to one in a sec
Customer: i am there
Scammer: its not here at the mainstore
Scammer: one sec
Customer: im trying [head name] on here at the main store
Scammer: do you wanna buy the [head name] head for the 4500?
Customer: i think so
Scammer: okay, I’ll tp you to a terminal
Customer: thank you

Luckily, in that case, the customer became suspicious and contacted one of the genuine CSRs. They didn’t fall for it, but it was close. And I’ve seen ‘offers’ that are ‘better’ than that. Here’s another. This one was hanging around at the Catwa store, with a full-body alpha on, and an ‘Assistant’ group tag, sending IMs to everyone in the store. This scam was a little different, because people were being told that—if they joined a specific group (for a fee, of course)—they could get deep discounts on mesh heads and bodies:

Customer: is it true that there are some discount on head 3599 instead of 5k
Customer: [14:46] Scammer: well remember when you buy through the group you will get the head for only 3599 instead of 5k
Skell Dagger: No that’s not true, [Customer].
Customer: this person has send me this IM pretend that but send me another group so was asking if this is true or a scam
Customer: oh thank you very much

When challenged, the scammer bit back, and then blocked me. Wonder why?

Scam #4: The unmissable Marketplace-only offer, at marketplace.altervista.org

It’ll be something similar to that URL: a clickable link to an absolutely unmissable offer on the Second Life Marketplace. It’ll be pasted in a group by a perfectly trustworthy-looking account (usually several years old) but just HOLD YOUR HORSES THERE. Look at that link more closely. Does that look like an official Second Life web address to you?

Thought not. That’s ’cause it ain’t. It’s a phishing attempt, and if you click it then you’ll find that—oh dear—you appear not to be logged into Marketplace. Enter your Second Life login credentials, though, and your name will be the next one to start spamming groups with those links…

Scam #5: The skimmer

Always ALWAYS ALWAYS pay close attention when purchasing anything, especially if it’s something expensive like a mesh head or body. There is a very pernicious and nasty kind of scam—known as ‘skimming’—where an avatar will stand close to a vendor while wearing an invisible ‘payable’ object. You’ll think you’re paying L$5000 to the vendor for that lovely Bento mesh head that you’ve got your heart set on, but—once the money’s left your account—no mesh head arrives in your inventory. You’ve just paid that skimmer the money instead.

Sometimes lag can cause the name on the ‘pay’ box of vendors not to show up. If that ever happens, cancel the purchase and try again. Keep trying until you see the name of the person you’re paying. It’ll be a clickable link, so—if you’re not sure who owns the store—click the link. It will take you to the profile of the person you’re about to pay. Do you see their store listed there, together with info about how to contact them, etc, as you might expect from a creator in Second Life? Or is it some rando’s account?

Scam #6: “Having trouble buying? Give me the money and I’ll buy it as a gift for you”

This can happen as a run-on from the skimmer, only in this case the skimmer’s invisible object is blocking you from paying, so that nothing happens. They then ‘helpfully’ offer to purchase the item as a gift for you, if you pay them the money.

Think you’re gonna get that gift? Ha! Nope.

Scam #7: “I only need a few more store credits to buy the XYZ add-on. If you give me the money to buy the item you want I can get it as a gift for you, and I’ll get the credits I need.”

Um, no. They’ll get the credits and your money, and you’ll get a big fat nothing.

Scam #8: “Want to buy a gift certificate from me? I just broke up with my gf/bf and it was going to be a gift for them”

No. Just no. Even if that is an actual gift card item, there’ll be no money left on it. And you don’t want someone else’s sloppy seconds gift card, right?

Scam #9: You’re struggling to get your avatar sorted out, and someone offers to do it all for you if you allow them access to your account

This is a huge risk, and it’s recommended that you do not do this. Here’s what Linden Lab have to say about allowing someone else to have access to your account by giving them your login details:

You are solely responsible for all activities conducted through your Account whether or not you authorize the activity (except to the extent that activities occur because someone gains access to our system without using your identifiers and password).

You are solely responsible for maintaining the confidentiality of your password and for restricting access to your Internet Device. You are solely responsible for any harm resulting from your disclosure, or authorization of the disclosure, of your password or from any person’s use of your password to gain access to your Account or Account Name. You will immediately notify us of any unauthorized use of your Account, password or username, or any other breach of security related to the Service. At no time should you respond to an online request for a password other than in connection with the log-on process to the Service. Your disclosure of your password to any other person is at your own risk.

We will not be liable for any loss or damage (of any kind and under any legal theory) to you or any third party arising from your inability or failure for any reason to comply with any of the foregoing obligations.

Your password and its confidentiality are what protects your inworld content, your account, and any information associated with your account.

 

Scam #10: “hey nice avatar…im new to this game and saved 238 of those linden things from a contest and camping…im trying to get this skin/shape combo for 700…i feel bad for asking but can you please lend me 462 so i can get it?…if not thats fine too…just seems nobody wants to help me out”

Oh bless. It’s kevin1234, or is he tony756 today? Maybe chris833, or jason761? He’s become something of a ‘pet’ to us at Catwa, but he’s an annoying pet nonetheless. Don’t fall for it. He’s got a damn sight more than 238 of ‘those linden things’ in his pocket.

So how can you beat the scammers?

By being vigilant. Ask yourself the following questions:

• Does it seem too good to be true? A Bento mesh head (usual price L$5000) completely free and out of the blue, without having to join the store’s group and no group notices of an offer? Suuure…
• Did you just request a redelivery before that ‘update’ came through? Or did you just add the mesh body or head that the update is for (or log in wearing it)?
• Does that Marketplace link look legit? The real Marketplace link is: https://marketplace.secondlife.com/
• Is the avatar giving you that ‘update’ or ‘gift’ a brand new, one day-old account?
• Are you being asked to join a group that costs L$, just to get a ‘special discount’ on a mesh head or body? While this kind of group does exist legitimately, it’s most often the official group for that store, and 99% of the time those groups are created by the store’s owner. So, when you click the group join link you’re being given, just click the name of the group’s creator (it’s at the top of the group’s main window). If that person’s profile isn’t the same as the store owner, then be very very very wary of joining that group.
• Are you being offered a teleport elsewhere—somewhere other than the mainstore—to pay for a ‘special offer’ item?
• Is the person offering the ‘discount’ or ‘special offer’ an actual CSR or manager for the store? Look up the store owner’s profile, and you’ll always see their managers and CSRs listed there, if they have any—either in the main ‘about’ section of their profile or somewhere in their picks section. Not seeing the ‘assistant’ tag-wearing person who’s making this unmissable offer listed there? Get the hell outta Dodge, pal.
• If you accepted the item, simply delete it. If you rezzed or wore it to unpack it then—as long as you didn’t click ‘allow access’ on that yellow debit warning popup—you can just delete it.
• If you did click ‘allow access’ to the debit warning popup, change your password immediately at the Second Life website, and then file a support ticket here. If your money is taken, then Linden Lab can usually manage to get it back to you after an investigation.
• Abuse report the avatar who gave you the scam item. How you do this varies from viewer to viewer, but you can usually get to it via their profile. File the AR as ‘fraud’ and explain what happened.

Stay safe out there, my sartorial darlings.