How to deal with potential scams?

Question

This is inspired by @RichardHorrocks' comment regarding a post offering to help recover private keys by running a script (not provided) by sending an e-mail to the poster (who also happens to be a new poster).

Just to flag this to the OP: #1: Be wary of anyone pointing you to a tool they've written to recover a private key. Unless you can read the code, you have no way of knowing what it's doing. #2: Be even more wary of anyone giving you their email address instead of just pointing you to the tool. If you send this person your malformed/incorrect private key, and their tool actually works, then they have your correct private key, and therefore your money.

There's a flag for "spam", but not for "scam". Even if the post is not a scam, it's hard for us to know that for this, and future, cases. Also, I think that when we leave a post up without a clear warning sign to people that it's taken as an implicit endorsement by members of the community; I've seen several posts which refer to other posts in a way that suggests they think this is The Ethereum Support Line run by The Ethereum High Council.

I'm thus firmly of the belief that something should be done about these posts. I see three main candidates for courses of action:

• Edit the message and add a clear warning to it. I'm not sure how easy it is for OP to undo the edit if they have low rep. Definitely re-editable with more rep. Benefits: immediate effect and obvious that there may be a problem. Lets readers draw their own conclusions. Downside: edit wars may ensue.

• Add a new message flagging policy for such a message so that the community or moderators can delete the post. Benefits: message can be removed entirely from system. Downside: Takes a while for message to get deleted.

• Add a comment like @RichardHorrocks did. Benefits: message remains unadulterated. Immediate visibility. Lets readers draw their own conclusions. Downside: May not be seen. Requires more typing for a thoughtful comment like @RichardHorrocks'.

What should our policy be? I've posted a couple of links to scripts I've written (shared publicly on GitHub) and I've included disclaimers about the programs both here and in the programs themselves about their fitness for purpose. I always add disclaimers about third-services' trustworthiness (I think I've even done that for MEW -- no disrespect to @tayvano or anyone else who've put countless hours into that fantastic work), but I feel like I should start adding disclaimers about running code you don't understand, even when it's my code (especially? if users are working with cryptocurrencies) in the interests of keeping everyone safe.

Answer 1

I think:

1. downvote (if enough people downvote, the post will get autodeleted: everyone gets their reputation back). This is 1 click.

2. flag as spam. If enough people do this, the post will also get autodeleted. Stack Exchange doesn't give much room to add more "off-topic" reasons and spam is close enough to scam.

Adding a comment and editing the post, as OP suggested, also seems reasonable after the above.