No, the forum has not been hacked

So far, 3 people have been scammed in the last day or so.

The scam has originated via cellular text message - not, I repeat, not through the Conversation system on the forum. Phone numbers are not asked for when signing up for the forum, and there is no place or reason to store phone numbers on the website.

2 of the victims had posted their phone numbers on the forum in threads that are publicly viewable. Another had posted it in a profile comment on their profile page. It's important to understand that, with the exception of the Members Only subforum and other leadership & committee sub-forums, most threads on this site are publicly viewable (as are most threads on just about every other forum...like Reef2Reef, ReefCentral, etc)

All a scammer had to do was see a potential buyer comment on a buy/sell/trade post about something for sale, then search the buyer's posts and look for a phone number and then send them a text message, posing as the seller. That's it. There has been no hack of the forum or of anyone's account.

Conversation messages (I am referring to Private Messages, not posts in forum threads) cannot be "hidden" from one person in the conversation and "deleted" from only one side of the discussion. So there is no way that User A's account would get "hacked" and some scammer would send a message to User B and then "cover their tracks". The software simply doesn't work that way. A "conversation participant" can only "leave" the conversation - which would remove that conversation from their list, but the other participants (because there can be multiple) would still see every message. Conversations are only removed from the database after all participants leave the conversation. All of this however is irrelevant, because the scammer used text messages from phone to phone. I just thought it was appropriate to explain a bit about how the system works.

 

As stated in my original post above, your phone number is not a piece of information that is stored anywhere in your user profile. However, it's not uncommon to see someone post their phone number or address in a post.

Due to these recent incidents, I am going to attempt to "scrub" the database of phone numbers using one of the database search tools, but that's not a foolproof process. For instance, I can search for a 10 digit number string, then search for the format ###-###-####, then (###) ###-#### but every character matters (spaces, dashes, periods, commas, etc)...so that won't catch every variation - especially when someone inserts a written word instead of a number like "5one5 555 - 123 four". I can't effectively scrub addresses.

Here is a guide showing you one way to help locate your publicly-viewable posts that might contain your information.

These screenshots are on desktop, but mobile is very similar.

First, locate the search bar at the top right corner, below the toolbar. (1) Tap or click the entry area box (it doesn't matter if you type anything) and then
(2) select the "More..." button

This brings you to the advanced search screen.

(3) select "Search Threads and Posts" (this eliminates conversations from the results)

(4) Enter your search term. There is a 4 character minimum, so search the last 4 numbers of your phone number.

(5) type your username. You only need to start typing it, and then select your name from the pop up list

(6 & 7) You can leave the selection on "all forums" but if you only want to search the public areas, (6) select "public forums" and then scroll down and (7) select "regional forums"

Click "search"

At this point, you can go to each post that comes up in the search and look for your info. If you find it and want it removed, simply "report" the post and we will scrub your info from the post

You can repeat this process for "Search Profile Posts" or just "search everything". Note that searching "everything" will search all of your conversation messages, so if you sent someone your phone number or address in a PM, that will show up in the search, but only you and the other participants in that conversation can actually see that (so it's not public)

You can also repeat this using keyword that might be related to your home address, such as your house number, street name, or your city. Remember, the system will look for the exact term you type, or a portion of it. If you search for "cedar rapids" will will only look for that - but searching for "cedar" will find anything with the word "cedar". So try multiple terms, fractions of words, etc.

If you don't have very may posts (maybe only 100 or less) you can just go to your profile

Then select the "Information" tab, and click "Find all content"

This will find anything you posted, anywhere, but you have to look at each post so it can take some time. Also, this will only return a few pages of your posts. Anything that is more than about 4-5 years old or over about 100 posts will still be searchable, but you have to go to the last page and then select "find more posts" (and repeat as you get to the last page). If you're like me and have 8741 posts, this is not a feasible option.

While you are on your profile, it's a good idea to look at your Profile Posts. This isn't a widely used feature (and not an effective way of getting in contact with someone) but people will sometimes post phone numbers on these, and some of these might be viewable publicly. You can also report these and they will be scrubbed.

You may also report any post that you see with someone's phone number or other personal information and we will remove it (regardless of who posted it)

I myself had posted my phone number about half a dozen times over the years.

 

I just initiated a Bulk Mail message to all active users of the forum with a link to this thread. If you were contacted by the scammer, please send me a PM. I'm gathering information to forward to the AG to see if there is any recourse. Time to get some use out of those tax dollars.