Reverb using third party, requiring personal info, to "re-verify your identity"

[pwilson]

I received an email from Reverb asking me to "re-verify my identity". I followed the link, and pretty soon I was served a QR code by a company called Trulioo asking me to scan it on my phone and then take a selfie and upload a copy of my passport and drivers licence.

Others may disagree but imho this is an unwelcome invasion of my privacy by a business that charges high fees for a little value add.

So I sent this email to [email protected]

Hi there, ​

​

I know that whoever reads this email doesn't make policy decisions, so please pass this along to the appropriate people at Reverb.​

​

You are telling me I need to "re-verify my identity," which now involves sharing my personal information with a third party, Trulioo, and uploading images of my passport and driver's license. ​

​

With all due respect - go shag yourself; this is an overreach. I'm browsing and occasionally selling a couple of guitars on your platform, not trading options.​

​

If this is what you think you need to do to keep your platform safe, go for it. But for me it's a massive overreach and invasion of privacy not warranted by value your platform provides.​

​

Please close my accounts: xxxx​

Best, ​

​

Is this an overreaction on my part?

 

[GretschWretch]

Sounds to me like an invitation for identity theft. Or politics being even more nefarious than usual.

 

[backin82]

I received an email from Reverb asking me to "re-verify my identity". I followed the link, and pretty soon I was served a QR code by a company called Trulioo asking me to scan it on my phone and then take a selfie and upload a copy of my passport and drivers licence.

Others may disagree but imho this is an unwelcome invasion of my privacy by a business that charges high fees for a little value add.

So I sent this email to [email protected]

Hi there, ​

​

I know that whoever reads this email doesn't make policy decisions, so please pass this along to the appropriate people at Reverb.​

​

You are telling me I need to "re-verify my identity," which now involves sharing my personal information with a third party, Trulioo, and uploading images of my passport and driver's license. ​

​

With all due respect - go shag yourself; this is an overreach. I'm browsing and occasionally selling a couple of guitars on your platform, not trading options.​

​

If this is what you think you need to do to keep your platform safe, go for it. But for me it's a massive overreach and invasion of privacy not warranted by value your platform provides.​

​

Please close my accounts: xxxx​

Best, ​

​

Is this an overreaction on my part?

Your passport and diver's license????

1,000% a scam. Do NOT scan that QR code or send anyone anything. Contact Reverb support through their website and notify them of the scam.

 

[ardgedee]

I received an email from Reverb asking me to "re-verify my identity". I followed the link...

Oh man. Companies do not "re-verify your identity" ever. It just doesn't happen. Reverb did not send that mail. Neither did Trulioo.

If you had followed through with them, drop whatever you're doing right now and change the passwords on your Reverb account. Cancel any credit cards you might have linked to your Reverb account. Notify your bank if its account has been linked. Set up a credit watch.

Do this immediately because you have given some strangers access to every financial account you have. This is not a joke or a prank.

Even if you only clicked the link, your browser can still be compromised by a hostile third party.

 

[Michedelic]

I received an email from Reverb asking me to "re-verify my identity". I followed the link, and pretty soon I was served a QR code by a company called Trulioo asking me to scan it on my phone and then take a selfie and upload a copy of my passport and drivers licence.

Others may disagree but imho this is an unwelcome invasion of my privacy by a business that charges high fees for a little value add.

So I sent this email to [email protected]

Hi there, ​

​

I know that whoever reads this email doesn't make policy decisions, so please pass this along to the appropriate people at Reverb.​

​

You are telling me I need to "re-verify my identity," which now involves sharing my personal information with a third party, Trulioo, and uploading images of my passport and driver's license. ​

​

With all due respect - go shag yourself; this is an overreach. I'm browsing and occasionally selling a couple of guitars on your platform, not trading options.​

​

If this is what you think you need to do to keep your platform safe, go for it. But for me it's a massive overreach and invasion of privacy not warranted by value your platform provides.​

​

Please close my accounts: xxxx​

Best, ​

​

Is this an overreaction on my part?

Oh hell no. Any request for “verification of identity” or similar wording, or notice of impending cancellation of service, is straight up phishing/scamming, especially when it’s supposedly coming from an entity you’ve dealt with in the past.

 

[Wasnex]

Others may disagree but imho this is an unwelcome invasion of my privacy

I assume it's a phising expedition. FYI, it's not that hard to spoof an email so it looks like it's coming from a different account like Reverb. In fact, I have received several emails that spoofed my own email accounts. I.E. it appeared as if I sent myself the emails. The messages were essentially ransom attacks. The said something like, "Send me crypto currency or I will post a file of your private info on the dark web." Spoofing my email is meant as social engineering/psychological manipulation intended to shock me into believing they have compromised my account logon credentials...possibly for many of my accounts.

Also I believe QR codes can be used to direct you phone to download malicious logic. Your phone may be compromised.

IMHO never click on links in emails. If something needs to be done, close and reopen you browser, then go to the normal page you use to log on to the account. If you can't find any relevant info and you still think it's legit, call or text customer service to confirm.

 

[tb-player]

That's not Reverb.

 

[sleddogn]

yeah....a big no no on that maneuver lol

 

[Aric Bjorn]

I received an email from Reverb

Was it, in fact, from Reverb?

Emails from Reverb will come from the following domains. Anything being sent from a different domain is not our team.

• @reverb.com
• @info.reverb.com

Scam or phishing emails and messages

Scam and phishing emails, messages, or SMS texts"Phishing" is when scammers send emails or text messages to trick you into giving them your personal information. These emails and messages can imper...

help.reverb.com

 

[pwilson]

Yeah, my inital thought was it's a scam, but:

• email was from [email protected] (I know you can spoof email from addresses)
• the link in the email address was to https://email.reverb.com/ls/click?...
• most convincing - there was UI for this verification both on the website (URL is Reverb) *and* in the Android Reverb app.

I hope is this is a phishing because I didn't give them any info, but I don't think so.

FWIW: I was VP Engineering with a crypto company, we used european version of Trulioo to do id verification and KYC but that's only because governments made us.

Meanwhile everyone's an expert...

Was it, in fact, from Reverb?

That's not Reverb.

I assume it's a phising expedition

is straight up phishing/scamming

etc etc

 

[pwilson]

Also this - Why do I need to verify my identity on Reverb?

So back to my original question - does anyone else think this is ? I'm guessing the aggregate value of all the data that Reverb (aka Etsy) collects is more valuable (to them and to third parties) if they "validate" the users' data like this.

 

[maverick49]

It’s legit. Reverb started doing this over a year ago. I agree with the sentiment of overreach and potential phishing. This is the world we live in these days, always bad actors trying separate good people from their money. Reverb is trying to mitigate that.

 

[planetdrumz]

Its definitely a scammer, I'm sure the real Reverb has no idea someone is posing as them. At least you sent an email to them, so if they don't know about it, they do now!

 

[jbl71004]

The facts according to AI

 

[tekhna]

Obviously check, but businesses are getting much stricter about KYC. Possible it’s real.

 

[maverick49]

Folks - this is legit. It’s not scamming. I trade regularly on Reverb.

Why do I need to verify my identity on Reverb?

Quick answer Verifying your identity helps protect our entire community and shows buyers that you’re trustworthy. To securely verify your info, Reverb partners with Trulioo—a leading identity verif...

help.reverb.com

 

[jbl71004]

It’s legit. Reverb started doing this over a year ago. I agree with the sentiment of overreach and potential phishing. This is the world we live in these days, always bad actors trying separate good people from their money. Reverb is trying to mitigate that.

This.

 

[Wannabass]

Others may disagree but imho this is an unwelcome invasion of my privacy by a business that charges high fees for a little value add.

Appreciate the heads up. I will not be doing that.

 

[sleddogn]

I sell a dozen or so instruments a year on reverb, i've never had to do this verification yet.... i guess yet is the key word, lol

 

[Thunderthumbs73]

I received an email from Reverb asking me to "re-verify my identity". I followed the link, and pretty soon I was served a QR code by a company called Trulioo asking me to scan it on my phone and then take a selfie and upload a copy of my passport and drivers licence.

Others may disagree but imho this is an unwelcome invasion of my privacy by a business that charges high fees for a little value add.

So I sent this email to [email protected]

Hi there, ​

​

I know that whoever reads this email doesn't make policy decisions, so please pass this along to the appropriate people at Reverb.​

​

You are telling me I need to "re-verify my identity," which now involves sharing my personal information with a third party, Trulioo, and uploading images of my passport and driver's license. ​

​

With all due respect - go shag yourself; this is an overreach. I'm browsing and occasionally selling a couple of guitars on your platform, not trading options.​

​

If this is what you think you need to do to keep your platform safe, go for it. But for me it's a massive overreach and invasion of privacy not warranted by value your platform provides.​

​

Please close my accounts: xxxx​

Best, ​

​

Is this an overreaction on my part?

That was very likely a scam/spam/ID theft or whatever attempt. Check with (actual) Reverb FIRST. Or maybe check here like you did, but BEFORE engaging with that to see if ANYONE had any experience like that. Anyway... I'm not sure you helped yourself on this one now that these nefarious hackers or whoever has response from you and who knows how that interaction will be used now or in the future. Best of luck with this.