I’m sorry to make a significantly more serious post so soon after my art post, but I got pinged by a scam bot that I’d never seen before, and so I wanted to make a more detailed post so people know what to avoid. So!
Right after posting this art, I get this notification:
Which is a scary notification to get, certainly. If you click on the post that you’re mentioned in, it looks like this:
This post will tell you that you are in “Lurker Mode”, and that your posts are fully visible to you, but hidden from the dashboard and search results. This isn’t true— I checked one of the tags that I had put on my art piece, and it showed up there just fine. And it was appearing on the dashboard of one of my other accounts.
This post will tell you that you need to take action, and that you only have a 48-hour window to do so. This is a common tactic in scams, where they try to put a time limit on you to make you panic and act hastily.
The link— which you should NOT click on, but I did anyway just to investigate further— is disguised on the outside as a link to tumblr support. This will redirect you to a captcha, which will then redirect you to a fake Tumblr page:
You aren’t able to click off of or minimize the window that asks you for your bank details— only the chat window or the Verify button works. Also, the fake log in pop-up doesn’t play the actual animation of the frog like tumblr does when it wants you to log in— it’s just a still image.
Seeing bank details there is definitely enough to prove that it’s a scam. I know that ID laws for the internet exist, but why would tumblr be asking you for your bank account information? Especially if you have never purchased something on tumblr— which I suspect most of this website hasn’t.
If you do click the verify button— which you really shouldn’t, but I did because I wanted to make as detailed as a post as possible— it will redirect you again to a page powered by a banking platform, Stripe. And there it will ask you to input your bank account information.
Furthermore, if you click on the original post that pings you, the one with a url that’s just a string of numbers, the account is completely empty.
I assume that there are multiple of these accounts to spam ping people while dressed up as tumblr staff in order to try and maximize profits.
I’ve never seen a scam on tumblr that disguised itself as the staff before, so I don’t blame anyone who was scared for it. Hell, I was scared! Reading through the initial post I was pinged on the first time was scary! It was only when I got to the first mention that it wanted my bank account that I realized it was a scam. I may not be the most computer literate, but I’ve fallen for a Discord scam before (luckily at no financial loss to me) and I now know how to recognize the signs.
I hope you find this post helpful and informative, and I hope if you do that you guys reblog it so more people can be made aware of this scam. I really, really don’t want people falling for something as predatory and vicious as this. And, if you are pinged by one of these bots, block and report BOTH of them— the one that pinged you, and the blog that has this post.
Thank you and have a safe day :)
@staff @support
