Evidence Provided 76561198026342583 (Froll) Using stolen Paypal

Victim (potential approached by him)
| steamname: ZakMcRofl
| steamID32: STEAM_0:0:460230
| steamID64: http://steamcommunity.com/profiles/76561197961186188
| customURL: http://steamcommunity.com/id/zakmcrofl
| steamrep: http://steamrep.com/profiles/76561197961186188

Victim (actual, will file steamrep report tomorrow)
| steamname: Pandoracle
| steamID32: STEAM_0:1:38115707
| steamID64: http://steamcommunity.com/profiles/76561198036497143
| customURL:
| steamrep: http://steamrep.com/profiles/76561198036497143

Scammer:
| steamname: Froll
| steamID32: STEAM_0:1:33038427
| steamID64: http://steamcommunity.com/profiles/76561198026342583
| customURL:
| steamrep: http://steamrep.com/profiles/76561198026342583

Screenshots:
Uploading soon
Description:
Approached me wanting to buy 3 Unusuals from me.
I went through my vetting process (see below) and a lot of red flags came up:
- He pointed out his 20 games yet he played only 3 of them
- He was willing to go first with no discussions or question for rep
- He was willing to pay my overpriced B/O and buy 3 random unusuals from one trade
- He had an empty backpack
- He claimed to have bought 3 buds but also said that he sold them for webmoney again to a friend
- He gave me a wrong IP
- He gave me a wrong country
- When called out, he claimed that the IP was not actually his but a dedicated server

So I added the last guy who repped him on the profile, Pandoracle, he had sold him 3 buds BUT Paypal is investigating the payment. Pandoracle will post his own report tomorrow, I just wanted to make sure that something shows up when people search for that guy.
Also he is currently still buying stuff, so quick action was needed.
Note that the email mentioned in the chat is most likely a stolen Paypal account, I decided to leave it here so the owner gets an idea on who hacked his paypal.


Transcripts:
Talk with scammer:

Code:

 Never tell your password to anyone.
Sonntag, 15. September 2013
00:19 - ZakMcRofl: hi
00:20 - Froll: Hello
00:20 - Froll: sel unusual for paypal?
00:20 - ZakMcRofl: yes, which one are you interested in
00:21 - Froll: Bubbling Ol' Geezer 1.5 buds / $50
Stormy Storm Hetman's Headpiece: epic effect 1.5 buds / $50
Steaming Pencil Pusher 1.5 buds / $50
00:21 - ZakMcRofl: let me just play my match, then i can take the time for it
00:21 - Froll: ok
00:26 - Froll: hey
00:53 - ZakMcRofl: allright
00:54 - ZakMcRofl: done with the match
00:54 - ZakMcRofl: soooo
00:54 - Froll: 3 unusual
00:54 - ZakMcRofl: you are using paypal
00:54 - Froll: 150 usd
00:54 - ZakMcRofl: do you have rep?
00:54 - Froll: I'm new, I do not have a reputation, but I want to make it
00:54 - Froll: rep profile
00:54 - ZakMcRofl: i see
00:54 - Froll: 20+games
00:54 - ZakMcRofl: so you would go first
00:54 - Froll: i can go first
00:55 - Froll: e mail?
00:55 - Froll: notes?
00:55 - ZakMcRofl: not so fast
00:55 - ZakMcRofl: since you are new, i have to make some security questions first
00:56 - Froll: ok
00:56 - ZakMcRofl: where are you from
00:56 - ZakMcRofl: (i am <nationality>)
00:56 - Froll: united states
00:56 - ZakMcRofl: ok will you be using a verified paypal account
00:57 - Froll: verified paypal
00:57 - ZakMcRofl: who does it belong to
00:57 - Froll: im
00:58 - ZakMcRofl: how long have you been playing tf2
00:58 - Froll: 5+ hours
00:58 - ZakMcRofl: have you ever bought via paypal
00:59 - Froll: yes
00:59 - Froll: e bay
00:59 - ZakMcRofl: i meant tf2 items :)
00:59 - Froll: yes
00:59 - Froll: 3 buds
00:59 - ZakMcRofl: oh cool
00:59 - ZakMcRofl: where are they
01:00 - Froll: sold for webmoney
01:00 - ZakMcRofl: to whom
01:01 - Froll: sidekick
01:01 - ZakMcRofl: ?
01:01 - ZakMcRofl: profile url
01:01 - Froll: friend
01:01 - Froll: http://steamcommunity.com/profiles/76561198093200774/
01:03 - ZakMcRofl: ok last question now is a tough one, a scammer would not answer correctly to this one
01:03 - ZakMcRofl: what's you ip?
01:03 - ZakMcRofl: mine is
01:03 - ZakMcRofl: xxx.xxx.xxx.xxx
01:03 - Froll: what
01:03 - ZakMcRofl: you can use a site like http://www.whatismyip.com/ or google for one, if you dont trust my link
01:03 - ZakMcRofl: it can be used to track you down if you scam somebody
01:04 - ZakMcRofl: cause it links you to your ISP account
01:04 - Froll: Microsoft Windows 8 Microsoft Windows 8
Chrome 29.0.
01:05 - ZakMcRofl: not that, your IP address
01:05 - ZakMcRofl: looks like mine
01:05 - ZakMcRofl: 4 blocks of 3 digits
01:05 - ZakMcRofl: (up to 3)
01:05 - Froll: 86.184.48.96
01:06 - ZakMcRofl: that's in the UK, how comes?
01:06 - Froll: oh
01:06 - Froll: bay
01:06 - ZakMcRofl: what?
01:06 - ZakMcRofl: why would you give me a fake ip?
01:06 - Froll: You have a lot of questions
01:06 - ZakMcRofl: yes
01:07 - ZakMcRofl: i am not doing this for the first time you know
01:07 - Froll: I will not give my ip
01:07 - ZakMcRofl: why not, just curious
01:07 - ZakMcRofl: can we talk?
01:07 - Froll has ended the call.
01:08 - Froll: Sell yes or no?
01:09 - ZakMcRofl: 1 sec
01:11 - ZakMcRofl: 83.149.48.69
01:11 - ZakMcRofl: Novosibirsk, , Russian Federation
01:11 - ZakMcRofl: so not only did you give me a wrong IP, you lied about your country as well
01:12 - Froll: ahahah
01:12 - Froll: Dedikated server
01:12 - ZakMcRofl: for gaming?
01:12 - ZakMcRofl: (I know what a dedicated server is, but who would use it for legitimate trading?)
01:13 - ZakMcRofl: i talked to pandoracle
01:13 - ZakMcRofl: he has some problems with your paypal transaction
01:14 - ZakMcRofl: care to comment?
01:28 - ZakMcRofl: allright, writing a steamrep report now

Talk with actual victim:

Code:

Never tell your password to anyone.
01:07 - Pandoracle: hello
01:07 - ZakMcRofl: hey there
01:08 - Pandoracle: you added me
01:09 - ZakMcRofl: yes
01:09 - ZakMcRofl: did you sell 3 buds to that guy
01:09 - ZakMcRofl: froll
01:09 - Pandoracle: yes
01:09 - ZakMcRofl: i am not sure if he is not a scammer
01:09 - ZakMcRofl: gave me a wrong ip
01:09 - Pandoracle: what do you mean?
01:10 - Pandoracle: and i know, it might have not been the best thing to do
01:10 - Pandoracle: paypal blocked the money for research
01:10 - ZakMcRofl: oh, already?
01:10 - Pandoracle: does it mean he chargebacked?
01:10 - ZakMcRofl: probably, he added me to buy more stuff
01:11 - ZakMcRofl: be sure to make a steamrep report and remove your rep on his profile
01:11 - Pandoracle: is there any chance for me to keep the money?
01:11 - ZakMcRofl: probably not if its a stolen account
01:12 - ZakMcRofl: i am talking to him as we speak
01:12 - Pandoracle: i provided my trade history and our chat to paypal
01:12 - Pandoracle: that's all i can do pretty much
01:12 - Pandoracle: god i feel bad now
01:13 - ZakMcRofl: steamrep.com
01:13 - ZakMcRofl: report him
01:13 - ZakMcRofl: did you re-add him
01:13 - ZakMcRofl: to talk about the paypal issue
01:13 - Pandoracle: i never deleted him
01:13 - Pandoracle: when i accused him of scamming he didn't respond
01:14 - ZakMcRofl: please file a steamrep report
01:14 - ZakMcRofl: it will stop others from selling to him
01:15 - Pandoracle: i think it's an alt anyway
01:15 - ZakMcRofl: doesn't matter
01:15 - Pandoracle: but it's really late right now, i got the screens i will see tomorrow
01:15 - ZakMcRofl: report him
01:15 - ZakMcRofl: ok
01:15 - Pandoracle: right now i want to believe that i didn't get scammed
01:16 - ZakMcRofl: you are dreaming mate
01:16 - ZakMcRofl: he had the time to talk to me
01:16 - ZakMcRofl: why would he not reply to you
01:16 - Pandoracle: now he says he can give the buds back
01:16 - ZakMcRofl: do it!
01:17 - ZakMcRofl: seriously mate
01:17 - ZakMcRofl: do it
01:17 - ZakMcRofl: i have his ip, maybe that is what convinced him
01:17 - ZakMcRofl: also screenshot anything he says
01:17 - Pandoracle: now he says he will give the buds back tomorrow..
01:18 - ZakMcRofl: tell him to give them back now
01:18 - ZakMcRofl: he just wants to have another night of scamming with this account
01:19 - Pandoracle: he says the "friend" he traded the buds too is not online
01:19 - Pandoracle: darn it lies
01:20 - ZakMcRofl: do you still have the paypal email he used
01:20 - Pandoracle: yes
01:20 - ZakMcRofl: would you share it with me, maybe we can find the owner
01:20 - ZakMcRofl: cause i am pretty sure this is stolen (or his parent's)
01:20 - Pandoracle: [email protected]
01:21 - Pandoracle: can you do anything with that?
01:21 - ZakMcRofl: https://www.facebook.com/bill.griffith.961
01:21 - ZakMcRofl: that's the owners facebook account
01:21 - ZakMcRofl: i don't use facebook
01:22 - ZakMcRofl: but you should try to contact him
01:22 - ZakMcRofl: then again could be the scammer himself
01:22 - ZakMcRofl: who knows
01:22 - Pandoracle: it doesn't look like he is very active on facebook
01:22 - ZakMcRofl: yeah and lots of privacy settings
01:22 - ZakMcRofl: you can send him an email via facebook
01:22 - ZakMcRofl: some trick
01:22 - ZakMcRofl: like [email protected]
01:22 - ZakMcRofl: google it
01:23 - ZakMcRofl: then again
01:23 - ZakMcRofl: you could just email him :)
01:23 - ZakMcRofl: chances are its compromised anyways
01:24 - ZakMcRofl: http://www.kjv1611.org.uk/hivyersay/comment.php?gb_id=1713
01:25 - ZakMcRofl: looks like it is the original owner
01:25 - ZakMcRofl: i mean
01:25 - ZakMcRofl: scammers are mostly kids
01:25 - ZakMcRofl: this guy sounds like a religious nutcase but most likely not a gamer :)
01:25 - ZakMcRofl: so stolen email
01:26 - Pandoracle: what can i do about it then?
01:26 - ZakMcRofl: nothing, you lost $100
01:26 - ZakMcRofl: what did he pay you?
01:26 - Pandoracle: 120
01:26 - ZakMcRofl: if it is stolen, there is nothing you can do
01:26 - ZakMcRofl: if it is just his parents, you might have a chance
01:26 - ZakMcRofl: unlikely though
01:27 - Pandoracle: that hurts to hear
01:27 - ZakMcRofl: I know the feeling, i lost $200 to a scammer once
01:27 - ZakMcRofl: well not really since the item was worth less than that
01:27 - ZakMcRofl: but chargeback as well
01:28 - Pandoracle: and paypal also investigated the purchase?
01:28 - ZakMcRofl: i think it just said chargeback
01:28 - ZakMcRofl: in this case they think the account was stolen
01:28 - ZakMcRofl: in your case
01:28 - ZakMcRofl: so the froze it
01:28 - ZakMcRofl: probably
01:28 - Pandoracle: i made him add a note against chargebacks
01:29 - ZakMcRofl: worthless
01:29 - ZakMcRofl: unfortunately
01:29 - Pandoracle: goddamn i'm going to sleep bad tonight
01:30 - Pandoracle: i should've been more careful
01:33 - Pandoracle: thnks for your help, i'm off now, it's late
01:34 - ZakMcRofl: ok, PLEASE file the report tomorrow
01:34 - ZakMcRofl: i will mention you in mine
01:34 - Pandoracle: i will
01:34 - ZakMcRofl: it takes some time but might protect others
01:35 - Pandoracle is now Offline.

Here are the screenshots.

Oh I forgot to mention, he had claimed that he had sold the 3 buds to his buddy, could be an alt (Private account).
Also he received a crate from that account today:
http://backpack.tf/item/1660786429

| steamname: Feel Good
| steamID32: STEAM_0:0:66467523
| steamID64: http://steamcommunity.com/profiles/76561198093200774
| customURL:
| steamrep: http://steamrep.com/profiles/76561198093200774

Also see http://forums.steamrep.com/threads/scammer-alt-76561198026342583.43866/

he added me to buy buds as well but never responded when i asked for rep. It was too suspicious at 1st glance, didnt want to deal with it. However sometimes i get ppl with a quite gaming profiles, i.e. 100-400 hours, very few games, v little in the bp, etc, wanted to buy buds, claiming it was for trading. I have done some of those, but it puzzles me. i have bought some qs buds from inactive gaming profiles, many of them turned out to be fine, or may be they are good at hiding things, it puzzles me as well. Paypal told u that it was a stolen paypal account, my guess is that the scammer just used a proxy to make it look like stolen.

some Qs
Is it possible to fund mulitple pp accounts with just 1 bank account, maybe he used 3 bank accounts
at the instant u received the money, u withdraw it. can pp still stop it before its confirmed by the bank
why do u think scammers are mostly kids
how can the ip address be useful, and how can a dedicated server help them
one man operation, or small scamming communities, or some big hidden networks

I had contact to a guy who was approached by the rightfull owner of one of these paypal accounts. So yeah, I am sure they are stolen not created by him. They also lead to several Facebook profiles.

As for your other questions:
The really good scammers are obviously older but the vast majority I meet are kids who really suck at it. They spycrab run or make fake raffles or claim to buy for paypal when they do not even own an account.

The IP can be helpful because site admins can check which users signed in using that IP (think outpost, backpack.tf, Steamrep). It also can help prove when somebody is intentionally misleading people about his true location which a legit trader should not do (at least not in the context of a trust based money trade).

By the way the guy is now Steamrep tagged, finally.

I'm sorry but how did you check his ip? I want to know

Wireshark. Described at my blog post here: http://zakmcrofl.blogspot.de/2012/04/tf2-scamming-through-links-cross-site.html

On-topic: The guy is finally banned, so my report can be closed or accepted or whatever. It served its purpose.