THEFT AND FRAUD IN SECOND LIFE-Scripts that Steal - Dean Lawson Reporting

Have you ever rezzed an object and received the message “Object wants access to take money from your Linden Dollar account. If you allow, this it can take any or all of your money from you at any time with no further warning or request.”?

The obvious response would be to deny this request but Second Life isn’t always a place where logic prevails and, for new users who learn to navigate through this virtual world by clicking to see what happens, it leaves one wondering why Linden Labs would permit Second Life vendors to use such a shady script.

When I asked about this script on the Firestorm English Support chat line I received the following responses;

Robo™ (robert0.siamendes): dean, you can find that script in the LSL wiki site

Gena

Gena S. Wilberg (genafosters): (FS64 4.7.7v os) it is a standard script Dean used by every vender I think outside of MP or at least very popular

When I asked about this script in the Builder’s Brewery chat line I received the following responses.

Pavl

Pavl Duke: sadly any script you give permission_debit to can indeed continue to take your money while the object is rezzed

Erin

Erin Rose (nonspecific): There are also bogus "gift cards" that do the same thing

Vince

Vιɳƈҽ ™ (vincestriker): Once a script has the PERMISSION_DEBIT permission it can empty an account of L$.

Fraud & theft are both LL Terms of Service violations and crimes. Misuse this function and you risk being banned and legal action. In addition LL may freeze the accounts of anyone the money is transferred to and restore it to its rightful owners. This may involve retrieving it from third party exchanges and accounts on those exchanges being frozen. The system is not designed to be friendly towards fraud.

It was also recommended by members of Builder’s Brewery that I review the following links.

http://wiki.secondlife.com/wiki/LlGiveMoney

http://wiki.secondlife.com/wiki/LlRequestPermissions

In addition to the previous chat line responses, I was also contacted for private conversations with SL Residents who had negative experiences with the script.

Whispr

 Whispr εжз (whispr.xue): Hi Dean... I did just get this script when I bought some ice skates off of Abranimations website... it was attached to a affiliate vendor rezzing

Dean Lawson (deanlawson): Did you lose lindens as a result of this script?

Whispr εжз (whispr.xue): no... I didn't rez the vendor... I had clicked to "add all" that was in the folder. It was in both the free skates:  https://marketplace.secondlife.com/p/Super-Ice-Skates-Lite-Version-Xmas-2014/7229349 and the pay version:  https://marketplace.secondlife.com/p/Super-Ice-Skates-Full-Version/6639169

When I asked if this incident was reported to linden labs I received the following response.

Whispr εжз (whispr.xue): Not yet, I am waiting to hear back from Abranimations regarding it. I know Abranimations is a reputable vendor, and that they would not put any such scripting in. If Abranimations did not put it into their affiliate Vendor... then it is likely there was a dormant script put in by whoever created the vendors, or somehow it was hijacked

When I asked Firestorm Support if it was possible that the script might be placed in an object without the vendor’s knowledge I received this reply;

Robo

Robo™ (robert0.siamendes): dean, this script has been in existence for a long time... idk how the script can be embedded in the object unless the creator foolishly did the wrong permission for that object... Also there have been in the past where scammers placed an invisible object in front of the legit objects with that script in it

SL Resident tom45434 added this to the conversation;

Tom

tom45434: I have firsthand experience with those types of malicious scripts

Dean Lawson (deanlawson): Did you lose lindens as a result of this experience?

tom45434: it’s been happening very often everywhere in SL from stores/shops/gacha places breedables everywhere....yes I did, but not as a bad as some of my other friends

Dean Lawson (deanlawson): How many lindens did you lose?

tom45434: about 5000. My friends lost nearly 200k together

Dean Lawson (deanlawson): Did you or your friends report this to linden labs?

tom45434: yes instantly, and then they got the linden back within a few hours

 Dean Lawson (deanlawson): Do you know if linden labs is doing anything to track down the creator of this script?

tom45434: yes they are, but it seems rather impossible as it’s a new avatar each time it’s done I counted about 400 different alts so far each getting banned rather quickly, also the script itself is a rather easy script to make and a lot of people could make it within 15-20 minutes

Dean Lawson (deanlawson): Would it be futile to publish the name of the creator of this script to try and warn other SL Residents?

tom45434: yes as the creators of the script only last in second life for a matter of hours or sometimes 10 hours at max

Dean Lawson (deanlawson): If the creator of the script has their account deleted, where does the money go when it is extracted from someone's account?

tom45434: the money is frozen in the database till linden labs investigates where it all came from then it’s returned to the rightful owners

Dean

Dean Lawson (deanlawson): It doesn't seem like a very lucrative scam for the creator of this script, why do they create new accounts?

tom45434: they create new accounts to get past the bans that people do when they are found out, most people when the money is stolen from them don't report it so this is how they get the money and sometimes it’s never investigated till someone does report it. Also, they target any place that has products like "gift cards" and things that actually do require debit permissions and they copy the exact product down to the script name. But the only true way to prevent this type of malicious scripts is to "ALWAYS" check the creator of the object ""BEFORE"" clicking accept on the debit permissions it will not take the money till its accepted, some objects require debit permissions in order to work, but always verify the creator is the true creator first, even if it does look exactly like a true product

Dean Lawson (deanlawson): Is it possible that the creator of this script uses an account that is paid by the alt accounts that are being used to create the script? In other words, I create account 1 then I create account 2 and use account 2 to perform this scam until I get caught, while transferring the stolen lindens to account 1 which I use to convert lindens into real dollars. Do you think this might be the manner by which the creator of the script extracts money from SL, if so, what can Linden Labs do to track down this person?

tom45434: yes its possible they are doing this im pretty sure they are using this tactic right now, but the way linden lab prevents this issue is there’s a 3 day delay on Linden$ to real life money but in order for them to prevent this from happening always, check the creator first before accepting debit permissions, and if it does happen by accident then file a abuse report ASAP under Help/Report Abuse/ Select category "Fraud > L$ Or USD$ and remember to put the name of that creator of that malicious script into the "Abuser name:" and give as much details as possible. If it can be caught (Abuse Report Filed) before the 3 days are up then it can be reversed. Linden labs can track it down through all of the Alt accounts they send it to

Dean Lawson (deanlawson): thanks for answering my questions Tom, is there anything else you would like the readers of this article to know regarding this issue?

tom45434: yes one more thing to state, this is for large companies here in SL, if these scammers want to target those companies they will create a chain of these scams to steal the linden then they "Gift" those funds that were stolen to that main business account of the company that they are targeting, when someone reports the stolen linden along the way all accounts get put on Admin Hold including that innocent business account simply because that scammer didn't like them, the best thing for these business owners to do if they receive a Error logging in "Your Account has been put on Admin hold" Call Linden Labs ASAP and also log into a Alt of theirs and file a Abuse Report to Appeal this Admin Hold as they had nothing to do with it

When I asked Firestorm Support how to report such an incident I received this reply;

Jeanie

 Jeanie Jupiter: (FS 4.7.7f) Help>Report abuse...  include the transaction details https://accounts.secondlife.com/transaction_history/?lang=en-US

While it seems to be common sense to refuse access to any script that seems untrustworthy it might also be prudent for Linden Labs to show more than just a “buyer beware” attitude and to crack down on fraudulent scripts and SL Residents who use the virtual world to grift a living. Allowing untrustworthy scripts to victimize Second Life shoppers might discourage commerce and trade, just as street criminals can discourage tourism. As someone who is relatively new to Second Life there is a lot about scripts and the business of Linden transactions that I may have overlooked, so I encourage anyone who reads this article to share their opinion and experiences on this subject by leaving your comments or contacting me directly.

Dean Lawson

SL Enquirer