Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Could you have fallen for this scam?


  • Total voters
    25

kraZEe.eyez

macrumors newbie
Original poster
Apr 17, 2019
3
6
This story is a warning to all prospective buyers of second hand Apple laptops...

I own a mid-2015 MacBook Pro and use it for high-end photo and video editing. It’s got a great spec but was lacking the space/ram and power to grade 4K footage, so I decided upon an upgrade. I aimed high - for the i9, 32GB ram, 1TB HDD Mid-2018 MBP. To buy new I’d be looking at around £3500-£4K, and second hand, around £2800.

For this, as with many gadgets I go for Gumtree (risky but occasionally rewarding). Of course I spotted plenty of scams and I looked out for any that looked like a genuinely good deal.

A while later I came across an ad that seemed almost too good to be true - the specs were what I needed - at almost half the price of a brand new machine: £2000 - and it looked almost new. What made it seem all the more genuine was the fact that I could meet the seller in person, see the Mac and decide for myself...

I managed to get to see it first and even secured a further discount. Feeling pretty happy with myself I met the guy, who told me he was also a graphic designer who had been given a work computer and no longer needed his Mac. He seemed pretty gutted to sell it.

Nothing seemed out of the ordinary, the Mac looked legit - he changed the login password for me and I paid cash. When I got home I set about starting fresh. He’d done a clean install but out of respect for his privacy I didn’t want any of his files remaining. So I put it straight into recovery mode.

That’s when things went dark. Firmware lock. Until this happened to me, I had no idea about this type of lock outside of iPhones and iPads. I've purchased a number of second hand Macs in my past and never had an issue. Had I known about the firmware lock, I could have requested putting it into recovery mode and either retrieved the password from a legitimate seller -or- watched them panic. I tried calling the seller immediately, his number was dead (sim probably tossed in a bin).

Tip 1 - ask to reboot in recovery mode.

Upon Googling about the FW password it became apparent that this was very bad news. Of course Apple won’t reset it without a receipt. What this meant was that I could never fully wipe the computer, use recovery mode or use target disk mode. Annoying... but not the end of the world maybe?

I noted down the serial number and called Apple for advice. They didn't offer much insight other than checking if the machine was stolen. At that point I noticed that the serial number in the system profiler didn’t match the serial number on the bottom of the machine. Again, Apple couldn't figure out why, but put this down to the idea that perhaps the seller had scratched or dented the original and bought a spare part to give it that shiny new look - again - not the end of the world, but very suspicious...

Tip number 2 - check the serial numbers match.

Then it dawned on me - if this machine is in fact stolen, then upon connecting to the internet, it could be remotely locked and would become a very expensive paper weight. I checked the serial number on a few online databases for stolen devices and it came up clean. At least I would have no luck contacting the owner through the police. I was determined not to become the second person to lose out from this machine.

But what if the guy who sold it to me was waiting for me to go online, lock it, then act like he’d had it stolen and take it back? They’d even get a location of my house and maybe break in and take it? I hadn't connected to the internet yet and I didn't plan to.

Suddenly I had a powerful i9 machine that had no internet connection. Not a good thing at all, especially in my industry... it's pretty much useless. I didn’t tell my wife that I’d lost almost £2K and hid it, hoping to think of something soon. I didn’t get any sleep for a few nights and was fuming at the idea of being scammed.

I came up with a list of options: ask Apple if they could take it as part of their recycle scheme and get a discount on a new mac (not likely), sell it for parts, use it side-by-side with my Macbook Pro and keep it offline. Every option sucked. Especially as Adobe need me to be online in order to validate my account.

Every now and again I'd take it out from hiding and look at it. I noticed a few more things that were strange. From the finder preferences, I could only show the Mac Hard Drive icon on the desktop when I had ‘Show CDs, DVDs and iPods’ ticked... Also the 1TB hard drive in system profiler was only showing up as 250gb in Finder.

Tip 3 - check disk space in Finder matches what you're being sold.

I took the Mac to a friend who could poke around a bit more. He managed to reset some things in Finder and sent me a screen grab of the About This Mac. I could see the system profile serial number now matched the one on the bottom of the machine... A lot of the details had also changed: 16gb ram instead of 32, i7 instead of i9...

I had been scammed alright. I’d purchased a 2016 laptop disguised as a 2018 machine. The system info had been carefully manipulated and then the computer was FW locked (in hope I’d never find out)?... With a simple Google search it's easy to find out how to manipulate the system info. This should be permanently locked - please take note Apple.

I feel annoyed that I was duped and it cost me sleepless nights and heartache, but I should only be annoyed at myself. If I’d followed even one of the three tips above, I would have been suspicious enough to walk away.

I hope this post will warn anyone out there who could make the same mistake as I did.

It’s very easily done and a real pain in the ass. :(
 

Attachments

  • IMG_0488.jpg
    IMG_0488.jpg
    269.6 KB · Views: 559
Last edited:
I have purchased a few used MacBooks over the years but not on with a t2 chip. One of the first things I do is check for a firmware password by booting with the option key held down. If there is no password, I boot from a usb key to format the drive and install the os.

The existence of a firmware password doesn't automatically mean the laptop is stolen; however, the likelihood is high.

Here's a site I use to check the serial number: http://www.chipmunk.nl/cgi-fast/applemodel.cgi or https://www.appleserialnumberinfo.com/Desktop/index.php

Thanks for the tips. I hope you are able to get it resolved somehow.
 
Last edited:
I may buy a used system tomorrow or the next few days. It's from a shop with a 90-day warranty and it looks to be about 30% of the original cost. I have done a private sale before and everything was above board. We did both exchange identification information and I checked out his background (current local military serviceman).
 
Good luck with your purchase pshufd. Follow one of my tips. I’m sure my experience is rare but worth keeping in mind. In some ways I have to take my hat off to the scam artist. It was expertly executed.

Audit13, thanks for the links. They are useful once you get to see the serial number. (Sellers don’t always share before meeting). Unfortunately the serial number in About This Mac can be easily changed as I found out. The bottom panel can also be changed.

I suppose there’s no way of being 100% certain of what you’ve purchased until you have successfully made a clean OS install.
 
Before buying any used Mac laptop, power it down, ALL THE WAY OFF.

The press the power on button and see what happens next.

Firmware password -- no deal.
 
  • Like
Reactions: SDColorado
Hi Fishrrman... this won’t always show that the Mac is locked. My Mac can power off and on fine. It’s only when I boot into recovery mode that I can see the lock.
 
  • Like
Reactions: hobowankenobi
I always recommend taking used tech through a minimum level of checks that depend heavily on that item. The device being powered on is nice, but me seeing it powered on makes me suspect. Though that doesn't impact my need to focus on my list of checks.

If you're unsure and are lucky enough to live near Apple stores like I am being in the NE USA. I would recommend meeting at the Apple store and asking Apple employees to take a look. They should be able to augment your tests with stuff like checking if it is stolen and looking for firmware and iCloud locks. If the seller opts out then you know you got a scammer...

I know you can change your About This Mac super easily, but your "fake" one looks very much like my "real" one. I know mine is real as I purchased directly from Apple.

Screen Shot 2019-04-18 at 7.04.55 PM.png
 
Hi Fishrrman... this won’t always show that the Mac is locked. My Mac can power off and on fine. It’s only when I boot into recovery mode that I can see the lock.

Booting to safe mode is always a safe bet when checking out a used computer. Also rebooting holding down the option key. If there is no firmware password set, you should see the boot drive with an arrow underneath. If there is a firmware password, it will display a password prompt and lock icon.
 
Good tips here. Sucks that this happened to you, OP. What surprises me a bit though @OP, did you not have any of the contact information of the seller? Did he just hand over the machine to you, without any sort of contract of purchase that usually contains at the very least both of your names, usually addresses and contact information aswell? Not to mention proof of payment (especially important if you pay in cash)? If you did, then surely you‘d have ways to contact him, or could file a police report on him? If on the other hand the seller is not willing to do any of that, then that’s a giant red flag and I would not buy anything as expensive as a MacBook Pro from him, period.

I‘m not sure if just exchanging a $3000+ device without any sort of contact information or contract of purchase is the norm in the US, but in my country, setting up these things with an expense of that magnitude are pretty standard. You could also verify if his name and contact information is legit by asking for any sort of ID as proof (and present yours in return if he asks the same); I see no reason why a legit seller who has nothing to fear would back out of that.

Without a contract of purchase, he could file a police report claiming that you stole the device from him while presenting the original purchase receipt as proof that he owns the device, and you‘d have no way to proof that you bought it from him instead. At least that‘s how it would work in my country, I‘d be surprised if it‘s any different in the US. Ideally you should also always demand to get the (or a copy of the) original purchase of receipt for the device (especially on a device he claims is a 2018 MBP and therefore one that is still within original warranty).
 
Last edited:
I've recently sold my MBP 2017, almost fully loaded (1TB SSD). I met with the buyer, and could have scammed him easily, since he knows nothing about macs, this was his first one. We met at coffee shop, I've reinstalled OS for him, showed him some basic stuff, and even said that he can contact me if he is stuck on something down the line.

I buy a lot of second hand stuff, and always check everything twice. But I have to admit, I didn't know about changing configuration in About This Mac, but do know about firmware lock.

It's a shame this happened to you...
 
  • Like
Reactions: No. 44
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.