Got Scammed and lost $1500 on Gumtree -_-"

I thought I was being careful, but sadly not careful enough to account for the failures in lose implementation of JB Hifi's gift card policies.

  1. Had 3 x $500 gift cards from JB Hifi, from the promo in Dec last year
  2. Listed it here for a couple of weeks, no takers.
  3. So then I listed it on Gumtree.
  4. "James" contacts me, from ACT.
  5. Asks me "Do you have proof of balance picture? or receipts?"
  6. Not knowing any better, and assuming that a hidden "PIN" code is required to actually redeem these cards.
  7. I provided the card numbers, to allow him to check the balance on the cards.
  8. James says he'll pay at the end of the day.
  9. I get messaged here on Ozbargain, snowymatthew, so I decide to allow them to pay instead.
  10. I receive payment, via PayId.
  11. I send copies of the unscratched cards, and then again with the card numbers and PIN codes revealed.
  12. Following day, snowymatthew tells me there's issues with the card.
  13. Since the PIN codes are all revealed now, I confirm the balance on the cards.
  14. Discover they've been redeemed in ACT.
  15. Blah blah … I'm %^&*
  16. Returned the money back to snowymatthew.

So, it looks like James has been able to convince someone at JB HiFi to redeem the cards, with the PIN codes, and without the physical cards. I checked the terms and conditions: https://www.jbhifi.com.au/pages/how-do-i-use-a-gift-card-to-…. "Redeeming in-store at JB Hi-Fi … The actual gift card MUST be presented.". From responses from various stores, staff are not "meant to" accept anything by the physical cards … there lies the issue.

The presence of the PIN code in this instance gives a false sense of security.

Even retracing all the steps taken, I don't think I could have foreseen this - other than "don't use Gumtree". So, I guess this is a warning to others, that the card numbers only are enough to redeem a gift card. Meaning there's no real way for a buyer to validate available credit, or for sellers to have any form of security over the gift cards. This to me, is easier than counterfeiting money and JB accepting it, at another customer's expense.

Expensive lesson, and usually careful with these things. But, aw well, not expecting such a positive outcome. If anything, it just ruined my day.

Since then;

  1. Left my details with the store to follow up
  2. Filed a report with ACSC
  3. Emailed JB Hifi, asking how and why cards can be redeemed by the card number only, without the physical card which is contrary to their terms.
  4. Contacted Gumtree seeking assistance.
  5. I asked James to pay, as agreed and I would cease the police report.

So yeah, great first day back at work. -_-" And now have to deal with the missus.

And not that it means much, but this is the lovely guy that benefited from this all. https://www.gumtree.com.au/s-seller/1170622367193

I really didn't like the idea of having $1.5K in gift cards lying around, just didn't feel secure. And it really had to happen.

Update: So, it would seem kinda useless at this point. But because of the way that I shared the photo with James, it shows an account of his.

(Mod: removed personal information - please see commenting guideline)

Key updates:
* By RNDM on 07/01/2020 - 14:35
https://www.ozbargain.com.au/comment/8208345/redir
* By snowymatthew on 08/01/2020 - 16:47
https://www.ozbargain.com.au/comment/8213127/redir
* By RNDM on 14/01/2020 - 13:30
https://www.ozbargain.com.au/comment/8235494/redir
* By RNDM latest
https://www.ozbargain.com.au/comment/8239312/redir

Related Stores

Gumtree
Gumtree
JB Hi-Fi
JB Hi-Fi

Comments

  • +16

    Thanks for sharing. In the past if I need to share a serial/card #, I have shown a screen shot confirming it with the last bunch of numbers blurred or edited out.

    • +1

      I only shared, allowing buyers the ability to confirm their value instore. As I said, without this confirmation, then the buyer runs the risk of being scammed, from their perspective.

      • yeah I guess it's preferred they allow you to show the confirmation from your end. If that's not good enough then can find another buyer.

        • +3

          Still from a buyers' perspective, with photoshop and HTML editing in browsers, it's all too easy to fake.

          Confirmation in-store is really the only reliable way of confirming.

          But that wouldn't protect against a seller redeeming the card themselves right after receiving payment either.

          • +106

            @RNDM: It is entirely possible that snowymatthew is the one who scammed you, since he had all the credentials to do so.

            However James's Gumtree history and location of Gungahlin (within the ACT) also make him suspicious. If it does turn out that someone has used your gift cards without their PIN codes, you could have a case to argue that JB Hi-Fi now owes you $1,500 in gift cards.

            It is also possible that James and snowymatthew are the same individual or confederates. If this is what has occurred, it provides quite an interesting case study into confidence tricks:

            1. You were "tipped off" by snowymatthew that you had been "scammed". In actual fact, you hadn't been scammed at this stage at all! You had simply sold goods for an agreed price, received payment and delivered the goods.
            2. You then reacted with an emotional response which often clouds one's best judgement. Your emotions were compassion for snowymatthew and possibly some element(s) of guilt and/or fear that you would be suspected of the fraud. Acting to relieve these uncomfortable emotions, you returned the payment to snowymatthew and that is when you fell victim to the scam.
            • +2

              @Scrooge McDuck: I agree, we need timestamps of the purchases and when OP sent messages to buyer1 and buyer2.

              • @t_c: I'll have to wait for some sort of response from Jb Hifi, their website only provides transaction dates.

                It's possible too.

                • @RNDM: So was the date of purchase the same date as you sent the codes? Cos if they were, the 2 accounts on here and Gumtree are either the same person or in cahoots together.

                  If the transactions were made prior you sending the PIN to snowymatthew, then you can dismiss that theory.

                  • @Danstar: Because the whole discussion between the two buyers was within a few hours on a single day, it makes it difficult if this were the case.

                    • +6

                      @RNDM: That makes it even more likely that they are the same person, or 2 people who are working together.

                      • +2

                        @Danstar: snowymatthew's comment history doesn't seem to raise any concerns - and intended usage matches, and has provided name, address and her phone number, and name and number of husband. So while it is entirely possible still, I'll see what comes back from JB.

                        And they've proceeded to buy other gift cards from another user here … To continue the scam??? O.O

                        • +2

                          @RNDM:

                          And they've proceeded to buy other gift cards from another user here … To continue the scam??? O.O

                          Yes. Most scammers are sophisticated, you only usually hear about the stupid ones cos they're the ones people easily identify.

            • +1

              @Scrooge McDuck: Why is Gungahlin a suspicious location?

              • -1

                @GrueHunter: because the gift cards were redeemed in ACT, and James location says hes in the ACT

            • +2

              @Scrooge McDuck:

              Acting to relieve these uncomfortable emotions, you returned the payment to snowymatthew and that is when you fell victim to the scam.

              This would be a very risky scam. The seller would be fairly likely to just say "nah, I gave you the PINs, I don't believe you, I'm keeping your money".

              • +7

                @abb: It's not all that risky though, they still have $1500 worth of gift cards for a popular store that they probably payed under face value for even if the scam fails.

            • +1

              @Scrooge McDuck: yeah, seems kinda sketchy that after so long without an offer on ozb that someone happens to offer him right after he made communication with a user on gumtree

            • +5

              @Scrooge McDuck: Why would the scammer come back and give $1500 to OP then? They could just walk away with the gift cards.

              • +1

                @Autonomic: To avoid suspicion ?

                To not be a “suspect”

                Plenty of reasons.

              • +10

                @Autonomic: because he didnt have the pin required to make the purchase.

            • -2

              @Scrooge McDuck: Wow, I admire your intelligence Scrooge. I always wanted to see the inside of your brain someday.

            • @Scrooge McDuck: It is possible that code has been resold, so who ever claimed it in store may not have a clue about this whole thing….

              • @Sigiriya: How could the code me legitimately be onsold by James without a PIN?

                Or are you assuming the scenario of James and Snowy being the same person/in collusion.

      • +4

        Hello, I saw your post, and I decided to make a login just to see if I can help. I've read posts from….. page 1. So if what I say is a repeat from pages 2-5, my bad.

        1. Snowymatthew is from Sydney, and if the purchase is from ACT, then he is not the person. Like you said, you need the PIN to make a purchase if its online or via phone call. I've checked snowymatthew's previous posts/comments it looks like he purchased/commented things that I know belonged in Sydney only. I went through a few pages for that. I can safely say snowymatthew is not suspicious in anyway.

        2. The card that you showed, was it a barcode or was it a swiper type JB giftcard? I just wanted to know for my own curiousity, if it's a barcode, does that mean that the JB employee is willing to scan the card, without a pin, or does "James" have an JB insider.

        3. $1,500 is a lot of money for anyone - There's not that many JB's in ACT, I'd call up, even calling up JB Hifi headoffice to see what branch the transaction occurred. As you said earlier, it felt like there is not proper procedure to mitigate the issue of a photo of a giftcard can be redeemed in-store. This feels like a company security issue, you should get your giftcard back and the company should put it down as theft. Either way, if you have successfully put this down as theft. JB would be able to pinpoint the transaction date and time stamp and see who came to the register to perform the purchase. If he's dumb, he might just register a docket and put his address on it. I don't know.

        Anyways, if this is helpful in anyway, I'm glad, if not, I'm sorry. If you want to ask/talk you can just PM me. I literally made the account just cause I saw your post.

        • +2

          The card that you showed, was it a barcode or was it a swiper type JB giftcard? I just wanted to know for my own curiousity, if it's a barcode, does that mean that the JB employee is willing to scan the card, without a pin, or does "James" have an JB insider.

          eGift cards can easily be forged… just get a barcode generator, a valid barcode number and an old eGift card email, type a random PIN on it, print it out..

          The concern here is the barcode method (without a PIN) is very insecure (you could potentially brute force the JBHifi system), a PIN would add 10000 more possibilities to each barcode before successful redemption, however it looks like the JBHifi system doesn't require a PIN code to redeem a gift card?

        • Based on the above, it's clear that GoodSam is in on it with Snowymatthew.*

          *not based on any evidence or actual beliefs.

  • +25

    Looks like he does it a bit, has had a few bits and pieces for sale. Wouldn't be hard to get his address when he lists something else for sale and pay him a visit.

  • +1

    Just saying, I wouldn't trust scumTree OR dealing gift card from any third party :)

  • +32

    $1500, why wouldn't you deal in person only?

    • +6

      Agreed. Posts like this is exactly why I only deal with selling anything on gumtree face to face and cash only.

      Never once had any issues. Might take slightly longer to find a local buyer, but it beats having problems after posting stuff.

      • Why all eggs in one basket too? I'd at least try in 3 lots, instead of all in one go

        • People like me are in a rush to get it over with sometimes.

          • @cheapCheepCheap: yeah i understand me too, but that's where mistakes happen,

            same as car salesmen pressuring you to make a decision and buy, or any buyers in general rushing you to sell GC's to them…

            i've learnt to take my sweet ass time (maybe enjoy a bit too much)

            • @capslock janitor: I see what you mean. I feel like I've gotten better with time, learned from previous mistakes but can't be sure because it's when you think you've gotten better, you go back to doing it.

              • +1

                @cheapCheepCheap:

                sweet ass time (maybe enjoy a bit too much)

                I should elaborate i've fallen into the other shitty end of taking TOO much time currently.

                Need to find a balance between time and money. We learn and grow from our failures/experiences
                But beats having to kick myself over losing that amount of money then putting in the time and effort to 'make it right' again

      • How do you verify gift card amount in person? I guess look it up in front of them? Can you do it online?

        • +2

          So there is only one way I would do this as either seller or buyer, in a JB store with someone who can verify that the cards work and with something to buy straight away.

          • +1

            @Bottle-thief: Good idea. That would indeed be the safest way. Just list it up and wait for someone local that can make the transaction/exchange at a nearby JB.

    • +1

      Yes and cash only.

    • +1

      Exactly, just search gumtree on here and you'll have never ending list of scam stories.

    • +8

      I know I made a mistake, obviously it was a very bad time to have a moment of weakness and have my guard down.

      But this thread really is to work out how this kind of situation can be prevented in the future.

      Bad apples will exist on all platforms, gumtree may have a greater portion of them.

      • Have you tried getting in touch with gumtree?

      • Hit them up on twitter in case you haven't already. https://twitter.com/gumtreeau

        edit: they don't seem that active on twitter, use another means but I'd recommend you take a screenshot of all public details of james (in case he deletes his account and gumtree has to abide by some privacy laws regarding data retention) and then try to follow up with gumtree.

  • +1

    So for those buying gift cards on here / Gumtree, what would you do to protect both sides?
    (Aside from meeting up in person, verifying the amount online, and then instantly redeeming it as soon as possible after that exchange?)

    I thought that the pin was required to redeem anyway (for all other gift cards I've used).

    • -5

      Gift cards are DESIGNED to be transferable easily without authentication of the bearer; think about their purpose. They should be treated as cash for security purposes. You'd see how ridiculous it is to buy and sell $100 notes on Gumtree online - its just as ridiculous to trade gift cards.

      • +3

        If I took a photo of a $100 note as proof that I had it, then the receiver of the photo couldn't go and spend the photo at the store. In this circumstance, the gift card was significantly less secure than cash because it didn't even require possession to spend it.

        This is why gift cards are a huge scam unless you're getting them at a significant discount. You're trading cash for something worse than cash. They're not a gift, they're an obligation to the recipient.

    • +5

      Aside from meeting up in person, verifying the amount online, and then instantly redeeming it as soon as possible after that exchange?

      there is no ASIDE FROM, this is the only way. Gumtree has probably the highest scammer to legitimate ratio next to facebook. In person, cash in hand, verify in store and immediately use, is the ONLY way.

      • Fair enough certainly will keep in mind, as I'm looking to buy gift cards when the next iPhone comes out.
        Will be a pain for both sides if I'm going to ask to meet inside JB Hifi with likely more than one seller for gift cards…

        Hoping someone will have 1.5k in gift cards, but doesn't seem likely haha.
        Figure it out when the iPhone comes out - thanks for the advice!

        • +3

          I once bought maybe 2k of $100 gift cards from someone here (don't remember exact amount). Met him in person, and we painstakingly scratched each card and checked the balance on each before transacting.

          Guess we were both prepared to put in the effort to protect ourselves and as a result, a happy transaction.

          Always better to be extra careful and miss a buy/sale, than lose out altogether

          • +2

            @CheapskateQueen: Yeah definitely agree with you there.
            I didn't realise cards could be redeemed without pin / the physical card so this thread was insanely useful

            Would have thought buying online would have been safe (provided they don't use it in the meantime for C&C between posting and you receiving it and I know that's a pretty big "provided").

  • +21

    Judging by this guys sell history looks like he's scammed heaps of people…

    • +3

      Or a big time scalper

  • -8

    You knew the value of the gift cards, why would it matter if the buyer can confirm the balance ?
    Why would you provide that info, it makes no sense, even if jbhifi has a policy that the gift cards must be presented, always expect human error, if the guy tried hard enough he will find someone to accept the gift cards without the physical cards from a jbhifi employee at one of their stores, its not like jbhifi employees are paid big bucks to stop this kind of thing from happening.

    You should change scammed in the title to i scammed myself by providing information i shouldn't have provided.

    • +14

      "Why would you provide that info, it makes no sense … " Without me knowing that their systems permit redemption without PIN numbers, it's unreasonable to expect otherwise. Gift cards are not something I usually deal with, for these types of reasons.

      For any usual customer, a PIN code exists for a reason, which is usually security.

      "why would it matter if the buyer can confirm the balance?" From a buyers' perspective, they could be donating money for no value in return. I could've been selling a $50 for all they know.

      Again, this is really just to highlight the issues of PIN codes being meaningless for Jb Hifi gift cards.

      • -7

        For all you know, the person could of been a jbhifi employee, and could of easily bypassed those security features, anytime you buy something on gumtree, you are taking a risk you will be scammed, so if they could confirm the balance or not is irrelevant, a buyer can always be scammed, but a seller can take certain steps to be 100% safe.

        • +1

          the person could of been a jbhifi employee

          If that was the case, they will soon be an ex employee if the OP jumps up and down loud enough for JB to look into it.

          • +4

            @JimmyF: Worth my 1.5K if that plays out.

            • +30

              @RNDM: Honestly I would be jumping up and down at JB until they investigate and respond to how $1500 worth of gift cards was redeemed without the pin number. It goes 100% against the T&Cs etc, you can't even redeem them online without the pin number, so why should instore be any different.

              Its also interesting that JB staff can 'redeem' the gift cards without the pin number, seems a massive flaw in the system.

              • @JimmyF: Given the value of the transaction (assuming the whole $1500 was used in one go) that would provide further fuel for the OP.

                $1500 is not a small amount for GCs and it would be reasonable to expect them to exercise some scrutiny on such a transaction. Accepting a transaction of this value without a physical card and no pin is asking for trouble at a corporate level quite frankly. If these circumstances are accurate, OP should have a pretty good case.

            • @garetz:

              You really think jbhifi gives a shit about small potatoes like this ?

              Unlike your iPod scam which is not the same thing as this. Which BTW someone did care, they investigated and charged the person.

              JB will care about this issue, maybe not charging the person but more the loop hole they used.

              What happened is fraud of the giftcard system and they have a weakness in their gift card system that is exploitable to bypass the pin number to redeem the card balance. So they should investigate and find out how this was done and close the loop hole.

              Otherwise I could go to my local store, record all the gift numbers on the rack and wait for a few sales of them, and then redeem those cards before someone else gets a chance to.

              • -2

                @JimmyF: I know its not the same thing, im just giving a relevant example of how little is done even when the person is charged and found guilty.

                They have had this flaw in their system for at least 15 years, if not longer, and it still hasnt been fixed, pretty sure the flaw exists in all gift cards that use this exact same pin system.

                • @garetz:

                  They have had this flaw in their system for at least 15 years, if not longer, and it still hasnt been fixed, pretty sure the flaw exists in all gift cards that use this exact same pin system.

                  Whats the flaw then? Are you saying you can redeem coles and woolies giftcards without the pin number or presenting the card?

                  I've had to get the staff to enter the egift card number in manually on a egiftcard that wouldn't scan, it still asks for the pin number.

                  • -3

                    @JimmyF: When i was younger i worked at woolies for many years, all i am going to say is it is possible for an employee, and no i am not going to say how it can be done.

                    • +1

                      @garetz:

                      all i am going to say is it is possible for an employee

                      So back to the original comment, JB will be interested, as if this was done by an employee using the special wink wink way to redeem a gift card without the pin number, then JB will be interested in 'resolving' the issue they have with a certain employee committing gift card fraud.

                    • @garetz: Hopefully those loopholes have been closed since?

          • @JimmyF: Just the fact that an employee is often redeeming gift cards for the store they work at should be a red flag.

      • Don't know why this is being upvoted. Basic opsec is to only provide as little information as possible, not the maximum you think is safe. Otherwise you'd be giving out your full CC number because you think withholding the CVC will keep you safe.

        Literally everything else would've been a better option than to provide the whole number, e.g. provide some of the numbers plus screenshot of balance with those same card numbers.

        You're too caught up in thinking you have to prove to the buyer 100% that you're legit. There's no such thing and most buyers know and accept this too.

  • +1

    OP sorry to hear, hope something good comes of it.

    So does anyone know how this was done without the pin number? Just tried a online order, and you need the pin number as well as the card number.

    The T&Cs say you need the physical card and from memory you have to swipe the card and enter the pin number as well.

    So little perplex at how they did it, unless there is some 'generic' pin number loop hole that can be used

    • +7

      Yep I really do not understand how they could have pulled this off unless there is a fault/loophole with jbhifi gift cards specifically.

      I work at Officeworks and it's literally impossible in our POS terminal to take payment from any giftcard without a pin, even our own Officeworks giftcards. No workaround to it or anything.

      • it's literally impossible in our POS terminal to take payment from any giftcard without a pin, even our own Officeworks giftcards. No workaround to it or anything.

        Which is how it should be done!

        Clearly JB went 'cheap' and has some lose rules/pin bypass processing option.

        Some other comments here, have said they have had the barcode on the card scanned and the pin number wasn't needed. Thats just crazy to have a pin number and not validate it.

      • Yep I really do not understand how they could have pulled this off unless there is a fault/loophole with jbhifi gift cards specifically.

        So we finally got our answer to this question. JB giftcard system is a pile of crap it seems. Physical giftcards use the same number format as egiftcards. A bit of photoshop to mockup a egiftcard using the Physical giftcard numbers, and BAM. Redeem instore as a egiftcard without the PIN number.

        https://www.ozbargain.com.au/node/510995?page=6#comment-8238…

    • -4

      unless there is some 'generic' pin number loop hole that can be used

      The PIN is 4 digits, right?

      That's 10 000 possibilities. That's about 0.1 second for a simple script to try each one until the order is accepted.

      edit: I tried for lols and got told the card was suspended for multiple failed attempts, but my trial was very unsophisticated (typing in to web form by hand), automated methods may be more successful depending on how they implement the security.

      • Your try also got me to lol too.

    • You definitely do not need the physical card in store, but you do need a pin.

    • So little perplex at how they did it, unless there is some 'generic' pin number loop hole that can be used

      The answer for anyone who wants to know how 'James' did it can be found here

      https://www.ozbargain.com.au/node/510995?page=6#comment-8238…

  • +18

    JB HiFi surely have some responsibility here?

    • +12

      I would think so, what's the point of the pin if you dont need it.

  • +14

    Just play dumb, walk into the store and buy something with the gift cards. Seeing as it's their policy that they only accept physical gift cards then they can't argue that they've already been used, because you wouldn't have them if that was the case.

    • +14

      Yah, will be doing that tomorrow.

    • +3

      they can't argue that they've already been used

      As the OP has has already scratched off the pin number, yes they could have been 'used' before.

      Just play dumb, walk into the store and buy something with the gift cards

      I would just take the card number in and see if you can 'redeem' them anyway without the physical card, that is going to give you a better idea of how it was done.

      • The stores that I've spoken to, want the "actual physical card" … So it makes even less sense.

        • +1

          Depends on how you worded the question when asking I guess to what answer you might have gotten.

          I would go instore and play dump and say I left the card at home but my other half sent a picture of the card (use the one you sent the scammer with the pin covered still), and see what they say.

          • @JimmyF: Sure, could try that and see what happens. There are three stores within walking distance from each other anyhow.

          • +1

            @JimmyF: You can't manually enter card details onto their terminals they have blocked it due to fraud issues (ex jb employee) even a manager can't do it too

          • +1

            @JimmyF: I wouldn't take a play dump in the store. You want the law to stay on your side.

        • +1

          Yeah that would be true their terminals in-store only work with cards, you can't actually manually enter a card number even a manager can't due to fraud (ex JB employee of 5 years)

      • -1

        As the OP has has already scratched off the pin number, yes they could have been 'used' before.

        But they've already admitted it was redeemed in store in the Act. The Op lives in Brisbane.

        • +4

          Are you not following your own comment you posted?

          Just play dumb, walk into the store and buy something with the gift cards. Seeing as it's their policy that they only accept physical gift cards then they can't argue that they've already been used

          OP walks into the store with a physical gift card, with the pin exposed, as its already scratched off. How can they argue they haven't been used before? You can't.

          • -3

            @JimmyF: I think you are missing the point, if they have admitted that it's been redeemed in store in the ACT then how could someone have them in their hands in Brisbane?

            I'm assuming they would take the gift card from you when you use the full amount in store.

            • +2

              @Arthur Dunger:

              it's been redeemed in store in the Act then how could someone have them in their hands in Brisbane?

              And?

              Planes, cars, bikes…. people do 'move' around you know. I could redeem the card in the morning in ACT and be at a Brisbane store only hours later on the same day.

              • -2

                @JimmyF: The point is having the gift cards in your hand, not necessarily the location. That just makes the case even stronger though.

                • +3

                  @Arthur Dunger:

                  The point is having the gift cards in your hand, not necessarily the location

                  again… and?

                  Having it in your hand means nothing…… The cards balance is now $0. Who is to say I didn't redeem the physical gift card in the morning in ACT, jumped on a plane and at a Brisbane store a few hours later on the same day, now claiming someone else used it in a different state?

                  So yeah, having the physical gift card in your hand when it was redeem a few days ago (in the OPs case) in a different state, means nothing.

                  (OP not saying you did this BTW, just an example as some don't understand air travel it seems)

Login or Join to leave a comment