Am I being scammed by the guy who bought my Macbook pro?

[Fred Zed]

When you went back , did you sniff the laptop for coffee smells ?

 

[tinygoblin]

Buyer may have tried to scam you this way: he would bind your Mac to his iCloud, get money back and lock your Mac as soon as he gets money back. He may have also set a firmware password only he knows and so similar thing. He'd contact you later on for ransom. It's quite a popular type of scam in Fascist Federation of Russia, often happens when people are selling iPhones via local Craigslist alternative, scammers usually just set up pass code or iCloud during "inspection" and then real fun begins. Apple items are too inexpensive for police to investigate so anything is possible. Take care, sales are final.

 

[AppliedMicro]

Buyer may have tried to scam you this way: he would bind your Mac to his iCloud, get money back and lock your Mac as soon as he gets money back. He may have also set a firmware password only he knows and so similar thing. He'd contact you later on for ransom.

Please explain:

I examine the device and it's indeed my laptop but it is now showing a black screen, keyboard light is on, the device seems on but the screen is black , i try everything (brightness, hard reset) nothing works

You don't "black out" a MacBook screen (through restarts and resets) by activating iCloud activation lock or setting a firmware password. You just can't.

 

[Fred Zed]

Please explain:

You don't "black out" a MacBook screen (through restarts and resets) by activating iCloud activation lock or setting a firmware password. You just can't.

They seems to be talking some real sense 💩🤪

 

[tinygoblin]

Please explain:

Like this+this perhaps. OP never stated she tried booting to macOS Recovery (or checked if APFS partitions were sealed). I believe hard reset won't touch scripts, however I never tried it. OP never stated she reset/reinstalled macOS at coffee shop. So malicious scripts should be fine.

 

[AppliedMicro]

Like this+this perhaps.

These are scripts that are running on a booted kernel and operating system. It won‘t reach such state without showing an image on the internal display (especially not through even the simplest „reset“ troubleshooting procedures that had been tried by OP). You will see things on the screen before such scripts can run.

Don‘t get me wrong, I can imagine scams such as the one with the iCloud lock you described above.

There’s just no indication of it in the case described by OP. He accepted and took the laptop after an an „hour“ of troubleshooting. And OP didn’t indicate any strong push from the buyer to reverse the transaction then.

 

[tinygoblin]

You're correct regarding kernel, however I wonder if attacker could've used NVRAM to prevent screen displaying anything even on boot (and some scheduled task to set NVRAM back in an hour). OP never stated buyer ask for discount, so to me it's likely no scam attempt was made, just bad luck (maybe kid has heart pacemaker that affects MBP or something).