An introduction into the world of internet scams
How I got Scammed on eBay
I’ve been studying classical saxophone since I was 10 years old.
When I moved to Los Angeles at 16, my father bought my dream Alto Saxophone as a parting gift–– Selmer Paris Series III–– the orthodox brand in Saxophone craftsmanship, made and assembled in Paris, France.
I was mesmerized by this upgrade, and she accompanied me for the next seven years to many concerts, recitals and tours. She saw the world with me, whether it was the practice room near Piazza di Trevi in Rome or the Britten Theatre at the Royal College of Music in London. I never scratched her and I took her to the repair shop for checkups every year. She was a true companion on my musical path.
Although I improved a lot during those years, her responsiveness eventually declined. Before my senior recital in April 2017, I had a rare chance to purchase a silver Selmer limited edition saxophone for a bargain at a conference in New Mexico. Only 400 of them were made, as tribute to the inventor, Adolphe Sax, and mine was engraved the 321st. She was perfect for classical saxophonists, designed with a mellow tone, a soft touch, and a much faster mechanism. As a result, she did not disappoint, and my senior recital was a success.
When graduate school began, I decided to sell my Series III on eBay for $4,000, hoping that another musician would value her and care for her. I told myself if another music student showed interest, I would lower the price to $3,500. It was my first time selling an item online. My introduction to cybercrime was about to begin.
I waited several months. There were a few bids around $1,500 and someone offered $2,500. All of them were too low to accept, and I didn’t think they understood the value of a Selmer Series III as mine was the only one on eBay at the time. I almost gave up, but in mid-November I received a bid matching my price from a user named “calvitone_9.”
“Great News, your item sold,” I read from eBay’s email. I sent the buyer the invoice as eBay instructed and waited. A few days later, in an eBay message, a Calvin Toney, of Bassett, Virginia, asked me for the email address I use for my PayPal account so that he could forward me the money. I did as he said. Then I received two emails simultaneously–– one from eBay and the other from PayPal, both confirmed the payment had been received and that I should mail the item within 24 hours to secure the funds. The emails had the right corporate logos, and their grammar was correct. They seemed legitimate.
I mailed my saxophone the next day. I asked the FedEx staff to pack it well, requested a signature upon delivery and bid her a final farewell. They told me it would be delivered on Oct 18.
That day, I received a delivery confirmation from FedEx and a disturbing email from eBay titled “Suspicious buyer for item.” It informed me that the bid by Calvin Toney had been cancelled, that he had unregistered on eBay, and that I should call back my item right away. It had just been delivered and signed a few hours earlier. No money had been deposited into my PayPal account.
I checked my eBay and PayPal accounts repeatedly. I called customer services multiple times. Yet each time they told me, “I’m sorry, but there’s nothing we can do.”
The emails were phishing emails, they said. eBay never directly emails sellers, they said. I should have waited for my PayPal account to show funds before shipment, they said. Scammers liked to target rookie sellers, they said. I should file a complaint on the FBI’s Internet Crime Complaint Center (IC3)’s website, which deals with internet scammers, they said. All the Do’s and Don’ts aside, it was clear that I was on my own.
On the eBay phishing email, I clicked on “email@example.com” in the header and an “firstname.lastname@example.org” came up. The same thing happened with the PayPal email, where “email@example.com” became “firstname.lastname@example.org.”
The idea that I had been scammed finally sunk in and, in shock, I sat on my university campus lawn to absorb what had happened. I held my phone in my hands tightly, as if seven years of memories were slipping through my fingers, but I wasn’t ready to give up.
I ran to the FedEx office across from campus and demanded to see the acceptance signature, trying to find some clue before heading to the nearest police station. The staff showed me the receipt. “R. Richard” signed it. It should have been Calvin Toney. The staff suggested that he might have used a fake name.
I rushed to the New York Police Department (NYPD) precinct on 82nd street between Broadway and Amsterdam. I demanded to see an officer. I was referred to an elderly lady to file a complaint. She heard my story and walked out to get the officer I had spoken to earlier. By that point, I was very impatient and upset.
The woman officer came back, still chatting and laughing with another officer, and asked me what happened again as if I was joking. “I hope you would take this matter seriously. That saxophone is worth four-grand and has seven years of sentimental values,” I told her. She seemed a bit offended, but I didn’t care. She walked away again, this time to get a detective. A young man wearing gym shirt and shorts came in with her and asked me yet again what happened. I started tearing up halfway through my explanation. I told them that I knew exactly where the saxophone was and I just needed the police to go to this man’s house and retrieve it. He calmly explained that they couldn’t do anything across state borders. He suggested I try calling the police department in Virginia but added that based on previous cases, the saxophone was probably gone.
“Talk to eBay and PayPal again and get a note from them stating that you’re the victim in this case,” he told me. “Then come back and give the evidence to a detective. If it’s a pattern, we might catch him in the future.”
I thanked them and left feeling hopeless. I called eBay again. A supervisor named Kean sent me an email as proof that I was the victim in this case. “I’ve checked your account and can assure you there’s nothing wrong with your account at this time. The email you received was not sent by eBay and, therefore, its fake,” the note said. “It’s sad to hear that the item you sold was sent to the buyer who sent the fake email. Please read thru the email to know what you can do about this situation.” There were some tips for scam prevention, all too late for me.
When I returned home, I decided to at least file a complaint on the FBI’s IC3’s website. While writing about seeking help from the NYPD, I thought that it wouldn’t hurt to try one last time and call the local police in Bassett, Virginia. I researched quickly and found the number for crime prevention on the website of the Henry County Sheriff’s Department.
A woman picked up the phone and after I gave her Calvin Toney’s name and address, she put me on hold. Then, Investigator Everett Harper came to the phone. He said that another investigator in the office mentioned that he had worked on a similar case involving Toney at this address. “It was delivered this morning, you said?” Harper asked. “Give me 30 minutes and I’ll call you back. We’re going to drive to his place and see if your saxophone is still there.”
It was the longest 30 minutes I’ve ever experienced. The phone finally rang. “Yep, we have it,” Harper told me. “You wouldn’t believe it, it was sitting in a shed.” A few days later, I sent him the shipping label and he dropped it off at FedEx. I got my saxophone back a few days later in a large cardboard box with tapes that read “Evidence.”
Because I was a cross-state victim and Virginia is a commonwealth state, Toney could only be prosecuted if I went to court in Virginia. However, there was another reason that I decided not to prosecute him.
About a month after the incident, I received another call from Harper. He wanted to make sure that I had received my saxophone. Harper had told me earlier that Toney was instructed by his long-distance girlfriend to receive and re-ship packages, which were scammed items on different virtual marketplaces such as eBay. Harper said he had recently received another call from a victim in Michigan and had visited Toney again.
Although Toney didn’t respond to my Facebook messages, I obtained permission from the Sheriff, Lane Perry, of Henry County to talk to the investigators and was sent a copy of the police report on my case through a FOIA request. Through a series of interviews and research, the complexity of this case gradually emerged.
“He thinks that he’s got this supermodel girlfriend that lives in London,” Harper said. “But it’s probably just some guy sitting in front of a computer in a basement.”
Who’s Calvin Toney?
Toney told the police that it started in an online chat room. The conversations fostered a two-year-long relationship, according to their Facebook relationship status. Even though Toney never skyped, telephoned, or met the woman, or man posing as a woman, Harper said Toney believed that he was special to her. They only communicated through Kik–– a messenger app. She told him her name was Teresa Roland, according to her Facebook profile, that she lived in London and, eventually, that she loved him very much. This beautiful woman seemed real to Toney, except that her Facebook profile picture, based on Google reverse image search, was a stolen one from porn star Danielle Delaunay. Toney didn’t know, according to the police.
Born and raised in Rocky Mount, Virginia, Toney is now 30 years old, according to his Facebook profile. He moved to Bassett and now works for a local landscape company called Around the House. Toney never went to college. Instead, he describes his higher education as “College of Life and Hard Knocks” on his profile.
According to Harper, Roland, supposedly in England, shopped online and then had the items mailed to Toney, she told him that she would pay for the shipping fees. These packages were sent from all over the United States–– Illinois, Florida, New York, and Michigan, Harper said. Roland would instruct Toney where to reship the packages, mostly overseas. Everything about their online relationship and the constant deliveries seemed normal to Toney, according to the police. Then, Investigator Michael Price first showed up at his door on Sept 27, 2017.
Price recalled it was a scammed laptop mailed by a victim in Chicago. “He was very gullible,” Price said of Toney. “I think he thought there might be a relationship, which we explained to him [that] there wouldn’t be, that it wasn’t a real person.”
On Oct 18, 2017, Price was in the office when Harper picked up my call, and Harper said Price remembered that he worked on the laptop case involving Toney.
Harper drove to Toney’s place immediately. On the side of Virginia Avenue, behind a roll of trees, a driveway of dirt on an open field led to two campers that were eight feet wide and 10 to 12 feet high. “Early 1980s models, and kind of rundown,” he recalled.
A shed built from scavenged boards stored all the scammed items. He explained to Toney that the packaged delivered by FedEx on Oct 18 was scammed and the victim had reported it. “I don’t want any trouble,” Toney told him. He also mentioned that the saxophone was likely to be shipped to Nigeria.
“Most of the stuff goes overseas,” said Harper. “It’s really untraceable [once it’s shipped].”
Harper tried to explain to Toney several times that he was involved in a scam, but Harper said Toney didn’t understand. “You’re taking people’s property that you know is not yours,” Harper told him. “If any of the victims is able to come here to prosecute you, they can do that. Your saving grace right now is that no one has said that they will come down here.”
Because none of the victims were residents of Virginia, they would have to travel to Henry County multiple times in order to prosecute Toney. Harper said he couldn’t take the other packages found in the shed because he had not received calls.
In November 2017, Harper received another call about Toney, this time a victim from Michigan. The two times he had visited Toney, he recalled, he had seen two or three other packages in the shed.
Harper said Toney apparently couldn’t comprehend the situation very well. Toney showed him a picture of his English girlfriend, a brunette in a “thousand-dollar dress,” Harper recalled. “No, you don’t have a girlfriend, that’s probably some guy in Nigeria or Iowa talking to you on the phone,’” Harper said he told Toney.
In fact, Harper said Toney still wasn’t convinced he was a victim of a scam. “He was just looking at me like I was just, talking,” Harper said.
A cat and mouse game
It is not a rare case. Just last year, the FBI’s IC3 received 298,728 complaints from internet scam victims, which amounted to a total property loss of $1.33 billion, according to the FBI’s annual report for 2016. IC3 also estimated that only 15 percent of U.S. victims report crimes to them and the top category of scams involves the virtual marketplace, such as eBay and PayPal.
Harper said he submitted the scam cases to Virginia’s Commonwealth Attorney’s Office. Because they must have a victim when prosecuting in a commonwealth state, attorney Dawn Futrell “advised prosecution declined,” according to the police report from Henry County. Multiple attempts to reach Futrell were unsuccessful.
Price also mentioned that Toney re-shipped many packages to England. “I think it was the same address [that Toney shipped to], but I don’t know the exact address,” he recalled. “Since we couldn’t solve it, we just pass on that information to the FBI.” The county police usually don’t hear back from the FBI about the progress, Price added.
However, the necessities of investigating and prosecuting scammers entail far more than state and federal jurisdictions.
“Let’s face it,” says Adam Wandt, an attorney and a digital forensics professor at John Jay College of Criminal Justice in New York City. “There are many things we can do to hide ourselves on the internet.”
Wandt says he was an eBay scam victim himself. When he sold his first iPhone to a buyer in Indonesia, the scammer used a stolen PayPal account to pay him and then claimed the item was not received. PayPal reversed the transaction and charged Wandt instead. Neither company agreed to cover him. As a result, he lost the monetary worth of two iPhones.
“In my case, digital forensics could track back emails to show where they were from,” he says. “But it requires the correct manpower and talent to do it, and [they] will only be used on major cases.”
Wandt also says that the FBI’s IC3 is a complaint center, not an investigative one. Its purpose is to keep track of incidents in order to improve national policies, not to solve cases.
Most scammers reside in foreign countries, which makes scams even more difficult to investigate. Dr. Steven Bellovin, professor and researcher of internet security and privacy at Columbia University explains the complexity of “tracing” in details.
“It’s a cat and mouse game,” says Bellovin. “Sophisticated cop vs. sophisticated bad guy, take your choice.”
Assume that the scammer is not as sophisticated, and eBay actually wants to do something about it. eBay would know the IP address the scammer logged in from, which will lead the investigators to a certain Internet Server Provider (ISP) in another country, says Bellovin.
“For privacy reasons, most ISPs won’t cooperate with requests to unmask somebody’s IP address unless there’s legal process involved,” he says. “Then you’re dealing with international legal issues.”
Mutual Legal Assistance Treaties (MLATs) are agreements among countries that help authorities request and obtain evidence for criminal investigations and prosecutions. According to Bellovin, the process is slow and it could take close to a year to get the assistance you need, “and you’re not going to do this for a $100 fraud.”
Not to mention that MLATs are not signed or in force among all countries. According to the website FindLaw, a part of Thomson Reuters that provides legal information, 15 countries have signed MLATs with the U.S. but have not yet entered into force, including Nigeria, Belgium, Hong Kong and Columbia. Sometimes scammers reside in such places to better hide themselves from authorities, says Bellovin.
If you do have the legal documents to get to the correct ISP, the records might not be accurate. Bellovin says that IP addresses are transient because they are reusable. If you don’t have the exact time in the correct time zone matching the IP address you’re tracing, you wouldn’t find the right person.
Then suppose you have all the correct information, the IP address might come from an internet café or a hotspot. “These [places] generally don’t keep records,” says Bellovin. “It would be extraordinarily difficult [to find your scammer.]”
Therefore, unless it’s a major crime, the average internet scam victim will not have access to the investigative and technical resources required.
“Companies like eBay and PayPal are definitely trying to improve, it’s in their best interest,” says Wandt. “We’re entering an era of artificial intelligence and machine learning, but we’re still pretty far from where we need to be.”
Virtual marketplaces are essentially listing sites that are automated, which means the functions are executed without human involvement, according to Bellovin. Since geography is irrelevant to the internet, he explains, scammers can reach a large audience at little cost. Eventually, someone will fall for their trick and they will make some money.
Companies such as eBay and PayPal do impose a kind of filtering. Bellovin says that they keep a black list of suspicious IP addresses and fraudulent credit cards, and they look for spam-ish elements in item listings. However, it’s still very difficult to be effective.
Multiple attempts to speak with representatives of eBay, PayPal, and FBI’s IC3 for this project were unsuccessful.
“In the U.S., we’re reactive for the most part [in legislations],” says Wandt. “It’s a legitimate question on how proactive our laws should be [in regards to] technology. If we regulate it more, it’s possible that progress will be stifled.” There are also privacy concerns.
Instead, Wandt emphasizes that education on internet safety is crucial. Every family should teach their children to protect themselves online, and everybody should learn about the various forms of frauds.
Furthermore, as an attorney, Wandt says that he believes speed and efficiency are not critically important for victims unless their lives are in danger.
“People should never look for a resolution or quick satisfaction,” he says. “Their expectation should be that as a society, we’re moving forward in a positive way. And I think we are.”
Fool me once, shame on you. Fool me twice, I’m going to find you
The funny thing is, I’m still receiving scam emails through the same mailbox.
Although accessing information about the source of the phishing emails legally with subpoenas is beyond the scope of this project, I decided to find out as much as I could.
According to the Internet Corporation for Assigned Names and Numbers (ICANN)’s WHOIS service, a nonprofit organization that allows you to search the registrant and registrar of a domain, the fraudulent eBay email address “email@example.com” belongs to Contact Privacy, Inc. registered at Tucows, Inc. This domain was created on Jun 06, 2017, according to ICANN, about three months before Investigator Michael Price received the call regarding the scammed laptop.
Contact Privacy, Inc. is essentially a paid service provided by Tucows, Inc., a Canadian hosting company that keeps your online identity discreet. With this service, people could only contact you through an online form provided by Contact Privacy, Inc. Your name and actual email addresses won’t come up either when someone searches your domain name on WHOIS.
The website auctione-bay.com actually exists, but it’s incomplete, and I wonder if it’s meant to be that way.
The email address “firstname.lastname@example.org” also comes up in some online discussions on Reddit. A user named Heyitsakexx described similar encounters with this address as I, except he or she was cautious enough to ask around before mailing the item.
The email address “email@example.com” works in a similar way. It belongs to AOL. Inc. registered at CSC Corporation Domains, Inc. since October 1998. According to their website, you can enjoy online privacy and email protection from spams with an annual fee of $36.96 or $49.95. Perhaps they didn’t foresee that one of their clients would be the one spamming.
Although many internet users enjoy having the option to keep their online contact information private, some criminals take advantage of such services. Sometimes, the victims would sue the hosting companies instead.
Tucows, Inc. has been sued four times in the last decade, according to court documents retrieved from PACER. In November 2009, Daniel Balsam of San Francisco, California, sued Tucows because he had been constantly spammed by adultactioncam.com which was registered with Contact Privacy, Inc. Tucows refused to provide the identity of the licensee or to pay Balsam for the damages. He sued based on the ICANN Agreement that “a Registered Name Holder that allows third parties to use its Internet domain names shall accept all liability for wrongful use of the domain names, unless the Registered Name Holder promptly discloses the identity of the licensee upon presentation of reasonable evidence of actionable harm,” according to Balsam’s complaint. The District Court and the Ninth Circuit (appeal court) ruled against him because Balsam wasn’t a third-party beneficiary.
“Now, anyone can do bad things on the Internet – not just spamming – and hide behind a privately-registered domain name,” Balsam wrote on his website Dan Hates Spam. “The privacy service does not have to identify its customer, and the privacy service is not liable for the harm either.”
More recently, Michael Smith of Mobile, Alabama, sued Tucows along with Google, Facebook, Amazon, and several other companies in February 2016 for theft of intellectual property, cyber bullying, defamation of characters and more, according to court documents. Smith’s complaint against Tucows was similar. Tucows refused to disclose the identities of the individuals who stole and redistributed Smith’s self-published book on Amazon Kindle, which invited personal attacks online and, Tucows refused to stop their activities. “They invoke the Internet Omertà,” Smith’s complaint stated.
However, the court dismissed the case for failure to state a claim that the relief could be granted and “in part, as frivolous,” according to court documents. Smith appealed but he didn’t win either.
Private domain companies usually have a sector where you can report domain abuse, but it’s likely that the criminals can just register for another domain. Several attempts to speak to the representatives at Contact Privacy and Tucows haven’t been successful.
The takeaway is, unless you have a big enough case that will get the authorities to subpoena for you, it seems that there’s little chance of winning such cases in court.
On the other hand, I now know where my scammers are hiding. It is like a paper-thin membrane between us–– I could see the shape of their shadows, but I will need tremendous support from the legal system to break through this barrier and, without violating the privacy of law-abiding individuals.
Thinking back on Calvin Toney, the police say that they haven’t heard anything regarding Toney since the last case in November 2017. “It’s probably that he stopped,” Harper says. “He told me after the Michigan case that he won’t have any more contact with her.”
Now, Toney’s Facebook relationship status says “Single.”
“I love [Toney] and he is the father of my unborn child,” reads the “About Teresa” section on Teresa Roland’s Facebook profile. “When you see him tell him I love him so much.” It’s uncertain whether this person still talks to Toney or not.
“I think the person that used him moved on to somebody else,” says Price.