Declined 76561198046628063 (DoMKe*!)

Victim:

|steamID: BluexQuantum
|steamID32: STEAM_0:0:53353578
|steamID64: http://steamcommunity.com/profiles/76561198066972884
|customURL: http://steamcommunity.com/id/bluexquantum
|steamrepURL: http://steamrep.com/profiles/76561198066972884


Scammer:
|steamID: DoMKe*!
|steamID32: STEAM_0:1:43181167
|steamID64: http://steamcommunity.com/profiles/76561198046628063
|customURL:
|steamrepURL: http://steamrep.com/profiles/76561198046628063


Scammer's alternate account:

|steamID: WhiteBear.
|steamID32: STEAM_0:1:38403076
|steamID64: http://steamcommunity.com/profiles/76561198037071881
|customURL: http://steamcommunity.com/id/WhiteBearrro
|steamrepURL: http://steamrep.com/profiles/76561198037071881


Screenshots:
None available at the moment, unfortunately.

Description:
I am posting this report on behalf of my friend, who unfortunately cannot post it himself at this point in time. His Steam information has been provided above.


One of my Steam friend's was recently looking to trade away his Unusual Orbiting Fire Prussian Pickelhaube (valued at approximately 58.00 USD) for real-world money via PayPal. Today, just before 4:00PM PST, he was contacted by a Steam user by the name of [WTF]YellowBear. The user sent my friend a link to the website of TeamViewer, a piece of software used to monitor the desktop of a seperate PC user, which he claimed he would use to monitor my friend's desktop, so that he would have proof in case my friend tried to scam him.

The link was completely identical to that of the actual TeamViewer website (http://www.teamviewer.com). However, upon clicking on the link, my friend was unknowingly redirected to a different, fake website. The scammer asked my friend to type in the "TeamViewer username and password" (a string of random numbers) that was displayed on the website into chat. Upon doing so, my friend's PC received a black screen, their chat window was closed, the Unusual was immediately removed from his backpack, and the scammer unfriended him, all without the use of the trade-window. The scammer has since changed his username, profile picture and biography.


Today, my friend informed me that the scammer appears to have transferred his unusual hat, along with 2 other unusuals that were already in his backpack, to a primary account, the information of which I have provided above. Unfortunately, as I have mentioned, whatever script was used by the hacker would appear to have closed my friend's chat window, and therefore my friend was unable to take a screenshot of his conversation with the scammer.

Please let me know if there is any additional information I can possibly provide that would assist in this case.

Thank you in advance to whoever is reading over this; any help you can provide would be greatly appreciated.

Hello, do you have anything to back up your claims?

As I said before, the script that was used by the scammer automatically closed the chat window between him and my friend, so my friend was unable to take a screenshot of their conversation. My friend has the Steam mobile app on his phone, and it says there is view-able chat history there, however it will not allow him to read it unless he re-friends the scammer.

Here are some additional screenshots:

- The scammer's primary account page: http://i.imgur.com/oJWl3iA.png
- The scammer's primary backpack, where my friend's unusual is: http://i.imgur.com/PE7KBHP.png
- The scammer's secondary account page (the original account he used to hijack my friend's unusual): http://i.imgur.com/dcgD0Lk.png
- The bottom of the scammer's primary account page, where his friend's list is. He is friends with his secondary account: http://i.imgur.com/vWTGnDo.png
- A page from TF2 Outpost, where the scammer's alternate account has been banned: http://i.imgur.com/prJM9LK.png
- The trade history of my friend's unusual, as displayed on Outpost: http://i.imgur.com/AjmfERA.png

Are there any more specific screenshots/sources of information that you would suggest I post?

EDIT: Here's a slightly better picture of his backpack: http://i.imgur.com/gIdrCky.png

Well without screenshot to back up your claims I can only forward this as alt, so stay tuned.

My friend managed to re-add the scammer by using a different username (Bobafeticious), profile picture and bio, and took a screenshot of the chat window. However, the scammer appears to have deleted the line that includes the link to the website that was used to hijack my friend's unusual: http://i.imgur.com/lrAT104.png

EDIT: The second caption should say "6-digit number" instead of 4, my bad.