This might not count as me getting scammed, but I suspect somebody was losing out here. So...
I'd recently got an Xbox One, so I used a key reseller site (which is still active online btw) to stock up on cheap games. Rather than sell standard game codes to redeem in the store, what they sold was Microsoft accounts with a single game registered to them. Taking advantage of regional pricing, I assumed. You'd get an email and password, you'd log into this account on your Xbox, set it as the 'home' Xbox so that your normal account could share its games, and then you could safely delete the account.
I used it two or three times and forgot about it until RDR2 came out. Naturally they had it at a deep discount on launch day, so I bought another account from them. This time, though, a couple of months later I could no longer play the game - it gave an error message saying 'you will need to buy this'. I logged into the account and saw that the only activity on there was buying RDR2 - in some Asian currency at what amounted to full price - and the purchase was later refunded.
I emailed the website about it, and they said they would check with their supplier. After nagging a couple of times, they eventually sent me another account with RDR2, so I added it and completed the game. All was well.
Except... This account wasn't an empty one created specifically to sell RDR2. It had a gamerscore associated with it, so I logged in to have a look around. It hadn't been used for at least a year and had no other digital games registered, but the purchase history showed a lot of FIFA card transactions. The most recent purchase was "my" copy of RDR2, bought in US dollars at full price. There was stuff in the Onedrive folder too, including a resume for a college student and several unfinished application letters for internships.
I thought about contacting the student, but decided not to question it for fear of bringing myself to the attention of a bunch of hackers. A while later, and completely unconnected, I think I might have seen the other side of this possible scam when my wife noticed a mysterious charge on her bank account for 60 Euros spent in a German game store. Obviously it wasn't me, and the bank immediately refunded her and referred it to the police. Never heard anything else about that, and I haven't used that key site since.