Here’s a scam I encountered selling my beloved copy of Frozen:¹

1. I listed the Blu-ray for sale on Facebook Marketplace.
2. “Ernesto” asked to buy it. He was out of town until Monday, but he kindly offered to pay upfront if I promised to hold it for him.
3. I agreed.² Within minutes I received an e-transfer email.
4. I clicked the link to deposit the cash, chose my bank, and entered my account details in the login form.
5. I lost all my money.

I stopped before step 4, but I can see how people fall for this. Here’s the email:

If you’re Canadian you’ll have received e-transfer emails like this. There are a few oddities, like the position of ™ at the front of the subject line and the dubious shine@twce.org.tw sender, but otherwise this looks genuine.

Ditto for the bank website that opened when I clicked “Receive Money”; it was a dead ringer for the real deal. The only giveaways were the e-interac-88416061.1842904.icu domain name (I was unaware .icu is a valid TLD), my browser’s refusal to autofill my credentials, and style differences that only those with a photographic memory of their bank’s website will notice. Oh, and the unavailability of auto-deposit that forced me to login in the first place. Ernesto explained:

Hmm.

I’m curious what would happen if I entered my username and password. Does Ernesto sign in immediately and withdraw my life savings, or does he collect credentials from a bunch of suckers to sell in bulk? I assume (hope) my bank triggers a 2FA challenge the moment it sees a login attempt from a new IP. Ernesto, if you’re reading this, enlighten me.

I gather this is a common racket, because when I listed another item for sale, I received the same offer. At this rate I’m never going to offload my physical media collection.