Utah Man Warns About Emerging Scam Targeting Online Classified Listings

OREM, Utah – A man was cautioning others Tuesday about an emerging scam targeting online classified listings and potentially other e-commerce sites.

Mike Johnson said he posted a small smart home device on KSL Classifieds for $20 and was initially pleased when he got a response via text just five minutes later.

“Someone said, ‘Hey is this available?’ and I said, ‘Yes,’ because I was like, ‘Sweet, I want my $20,’” Johnson said.

What initially looked like an easy sale suddenly grew more complicated.

“Then they said, ‘We want to give you a code to make sure you’re not a scammer because we don’t want to do business with scammers,’” Johnson said.

When Johnson received the code, however, something looked familiar — it was from a phone number where he had received other two-factor authentication codes from his Gmail account.

It suddenly all clicked — the person who texted him was a scammer who had seen his phone number and email address attached to his KSL Classifieds ad and was trying to gain access to his email account by alternative means without having the password.

“’I’m not going to send you a two-factor authentication to be able to take over my Google account,’” Johnson recalled exclaiming.

Johnson — who has expertise in cybersecurity and is the senior forensic examiner and litigation support for Orem-based Security Metrics — said it became clear the scammer used the Google login to send Johnson a two-factor authentication code, which the scammer then asked Johnson to reply to him in their shared text chain.

He said he fears this may become a more common way for scammers to target users of online classified and other e-commerce sites.

The potential implications, Johnson said, are worrisome as well.

“It’s got like a lateral movement to another account that has even more sensitive information — banking information,” Johnson said.

Johnson acknowledged listing a number or email or both may be common practice with many online listings and he wanted to make people aware in case they are approached in a similar manner.

“It almost got me and — you know, the red flags go off — but I wanted my $20, I wanted to be helpful to someone that’s trying to buy something from me,” Johnson said. “That’s a lesson that I didn’t have to learn the hard way and I hope no one else needs to.”