fighting spam and scams on the Internet
|
|
Joe Wein fighting spam and scams on the Internet |
 Try our spam filter! Free 30-day trial version! |
"419" scam FAQ |
...or use a good spam filter. The choice is yours! |
The following actual email exchange is an example of how counterfeit cashier's checks are used by scammers from Nigeria to defraud sellers of goods.
Here is how the scam works: Someone poses as a buyer, forwards a large cashier's check to the seller (more than the amount of the purchase), giving some lame excuse and asks him to wire the excess amount back to the buyer by Western Union. The cashier's check will eventually bounce, but this could take a number of days. If the buyer has already wired the cash by then, the money will be lost and remains untraceable. This scam may involve goods other than cars (for example, motor bikes or motor scooters, boats, horses, pieces of art) and sometimes the buyers claim to be based in the United Kingdom, the Netherlands or in Spain (the same countries used for Lottery frauds).
(Note: There is also a reverse scam, where the buyer is defrauded and the seller is the crook. That version of the scam involves fraudulent escrow services.)
Free webmail accounts (for example, wcreed00@yahoo.com) are used for most communications. Often phone numbers in the UK (0044/+44) or the Netherlands (0031/+31) are used. These will then be anonymous cell phones (for example, 0031 648 088 432).
|
To protect the identity of the seller in this actual case, we've called him Dave, which is not his real name. He lives in Canada and he was trying to sell his truck. "phill brown [mailto:autoflash@fastermail.com]" however was the real identity used by the buyer.
"Phill" contacts Dave about wanting to buy his truck:
From: autoflash@fastermail.com [mailto:autoflash@fastermail.com]If you are familiar with Nigerian "419" emails, the "I AM SHOUTING AT YOU" all-caps typing above will look familiar to you. A lookup of the IP address listed at the bottom confirms that the buyer is indeed contacting Dave from Nigeria. Here is the network of the ISP the posting came from:
Sent: Monday, November 22, 2004 12:28 PM
To: ########@#########
Subject: About your ad...1994 GMC Jimmy SLE 4x4
Hello ########@#########
Classified ad these comments concern:
http://www.buyandsell.ca/classifieds.php?a=2&b=xxxxx
Below is an inquiry about your classified ad
I AM INTERESTED IN YOUR CAR , WHERE IS IT LOCATED , LET ME
KNOW IF ITS STILL AVAILABLE .
HOPE TO HEAR FROM YOU SOON ,
KIND REGARDS .
66.178.82.204 : 66.178.82.204
|
Turner Technologies TURNER-CHNOLOGIES (NET-66-178-82-192-1)
66.178.82.192 - 66.178.82.255
OrgName: Turner Technologies
OrgID: TURNE-4
Address: 8 Lateef Salami St
City: Ajao
StateProv: Lagos
PostalCode:
Country: NG
NetRange: 66.178.82.192 - 66.178.82.255
CIDR: 66.178.82.192/26
NetName: TURNER-CHNOLOGIES
NetHandle: NET-66-178-82-192-1
Parent: NET-66-178-0-0-1
NetType: Reassigned
Comment:
RegDate: 2004-09-20
Updated: 2004-09-20
OrgTechHandle: KAD3-ARIN
OrgTechName: Adejuyigbe, Kenn
OrgTechPhone: 234 1 816 1185
OrgTechEmail: kenn@turner-tehcnologies.com
|
Next Dave contacts the would-be buyer:
From: "##########" <########@#########>
To: autoflash@fastermail.com
Subject: RE: About your ad...1994 GMC Jimmy SLE 4x4
Date: Mon, 22 Nov 2004 21:34:46 -0800
Hello,
It is still available. It is in the ############ area.
Below are more details of the vehicle.
4.3L V6 Vortec engine- High Output option
Tranny rebuilt < 20000 km
4WD transfer case replaced < 20000 km
Cruise control
Power windows/locks
Air conditioner
Tilt steering wheel
Alloy wheels
Tinted windows
Trailer hitch
Red exterior, grey interior
One owner
Repaired or replaced in recent years
Battery - July 2004
Brakes - Sept 2003, by MIDAS - Oct 2004 rear brakes adjusted by CAN.TIRE
Drive Clean test - Sept 2003
Fuel Pump - July 2003
Upper Ball Joints - July 2003
Transmission & Transfer Case - Jan 2003
Alternator - June 2001
Fuel injector & Throttle body service - May 2001
Bodywork it needs
Needs 2 front fenders repaired or replaced due to rust around wheelwell
Few other spots of surface rust
Note - the Antilock Brake System is not working, since Nov 2002. The GM dealer told me not to bother repairing it due to the cost of the parts.
I took the vehicle to Canadian Tire recently for a Safety. The only reason it did not pass was the rust holes in the fenders. The mechanic confirmed that the ABS is not necessary as far as Safety goes, because the normal brakes are all that is required.
Regards
The Nigerian customer feigns interest:
From: phill brown [mailto:autoflash@fastermail.com]
Sent: Tuesday, November 23, 2004 1:30 AM
To: ##########
Subject: RE: About your ad...1994 GMC Jimmy SLE 4x4
my client is impressed with the feautures of the car and will be willing to buy , let me know your very last price .
hope to hear from, you soon ,
kind regards .
Dave obviously expected a specific offer price, having given "Phill" all the info about the car:
From: "##########" <########@#########>
To: "'phill brown'" <autoflash@fastermail.com>
Subject: RE: About your ad...1994 GMC Jimmy SLE 4x4
Date: Tue, 23 Nov 2004 21:45:47 -0800
Hello Phill,
Does your client have a price range in mind, or just looking for the cheapest possible? I have had people call me who are really looking for a $1500-1800 car and figured they would take a chance. I can come down a bit, but I don't want to waste your time or mine.
Regards,
Dave
"Phill" doesn't want to come up with a figure, let alone negotiate:
From: phill brown [mailto:autoflash@fastermail.com]
Sent: Wednesday, November 24, 2004 1:24 AM
To: ##########
Subject: RE: About your ad...1994 GMC Jimmy SLE 4x4
I AM NOT IN THE CATEGORY OF THOSE KIND OF BUYERS, THIS IS WHAT I DO FOR
A LIVING , LET ME KNOW YOUR BEST PRICE .
HOPE TO HEAR FROM YOU SOON ,
KIND REGARDS .
So Dave names his price:
From: "##########" <########@#########>
To: "'phill brown'" <autoflash@fastermail.com>
Subject: RE: About your ad...1994 GMC Jimmy SLE 4x4
Date: Wed, 24 Nov 2004 21:17:16 -0800
OK. The lowest I will go is $2000.
Regards,
Dave
Without trying to negotiate, "Phill" accepts Dave's asking price and then moves to his real game plan: Getting Dave to trade cash (by Western Union) for a piece of paper from Nigeria.
My client has finally accepted your price,he hopes the engine is
serviced and oil changed too .
However,My client made out a certified cashiers check of($23000) before he travelled to japan on a business trip,for a previous car and its shipment charges etc,but it was unfortunately sold.The amount on the check he deposited for the car is bigger than what should be paid to you now, so the check is now meant for the total expenses which includes the purchase of your car,the pick up of the car from its present location and the shipping charges/other necessary shipping arrangements.
However he has instructed us to carry on with this transaction. So you're required to deduct the cost of your car ($2000)and send the balance of($8000) to my client via western union money transfer to enable him offsett shipping charges/arrangements.once the transaction is concluded,My agent will be coming for the pick up of the car from its present location, on an open vehicle and then drive to a pre paid shipper for shipment,and also conclude other necessary shipping arrangements.so yo u dont have to bother yourself about the pick up and shipping arrangements,while title papers and other necessary documets will be sent by you via fedex courier to my customer.
Please Confirm this and provide name,address and phone number for check payment to be delivered to you via fedex courier ,
Thanks and God bless.
At this point, Dave smelled a rat and reported the incident to us.
"david jeff (davidjeff02@yahoo.com / IP 213.185.113.52)" buying a car with an fake oversize check
The "buyer" made an offer for a car in Maine, USA that was advertised for sale, but told the seller that he had a cashier's check made out to a larger amount than the sticker price. The seller was to deposit the check in his bank account and wire the excess to a recipient in Nigeria, supposedly the shipping agent who would take care of picking up the car.
The fake cashier's check was supposedly issued by "PatriotBank, Fredericksburg, VA 22407". The remitter's name on the check did not match the buyer's name. The check was actually mailed from the UK (Royal Mail, 49 pence stamp). The check was dated two days after the postmark on the letter, i.e. it was dated ahead to compansate for the international shipping time.
The field office of the United States Secret Service said it was powerless, because the criminal was based in another country (so was cocaine baron Pablo Escobar, I might add...).
Here are the wire transfer details:
From: david jeff <davidjeff02@yahoo.com>
To: Firstname Lastname <emailaddress>
Subject: SHIPPER'S INFORMATION..........................................
Date: Sun, 27 Feb 2005 10:16:51 -0800 (PST)
Hello Firstname Lastname ,
I really appreciate your full effort toward this transaction i will like
you to highly send the
excess funds to the shipper's today so that by Monday they may be at your
location for the picking up of the car i will like you to do that asap
today,
The shipping agent Name is Shipping Links Agency
Name .... MR Dayo Lewis
Address.. 24B WALTERCARENTON ROAD,
OBALENDE,LAGOS.
NIGERIA,23401.
You will have to deduct the western union transfer charges from the amount
you want to transfer,I want everything to get clear to you As soon as you
get transfer done ,you will have to get back to me with the following
transfer information ,
MTCN CONTROL NUMBER (10 DIGIT NUMBER)
SENDER'S FULL NAME & ADDRESS
RECIEVR'S FULL NAME & ADDRESS
AMOUNT SENT AFTER TRANSFER CHARGES
TRANSFER CHARGES
TEST QUESTION & ANSWER
Do get back to me immediately you got this email and the shipper's need to
get paid today asap , so that they can leave to the state for pick up of
the CAR and other goods that am buyinging in the state,More also i will be
looking forward to read the information
you use to send the excess funds to the shipper's today.
Best Regards.
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
Here's another email:
From: "david jeff" <davidjeff02@yahoo.com>
To: Firstname Lastname <emailaddress>
Sent: Saturday, 05 March, 2005 10:12
Subject: Re: check for the car
hi Firstname
thanks for the mail ,i appriciate your effort on these
transaction .i think by now you would have recieve the payment ,so
if you have recieve it please mail me back as soo as possible,because
my shippers are complaining about the payment ,they are waiting for
the payment.
thanks
david
Message headers:
Received: from [213.185.113.52] by web31110.mail.mud.yahoo.com via HTTP; Fri, 04 Mar 2005 17:12:53 PST Date: Fri, 4 Mar 2005 17:12:53 -0800 (PST) From: david jeff <davidjeff02@yahoo.com> Subject: Re: check for the car
WHOIS details for sending network (IP 213.185.113.52):
Another IP in this range (213.185.113.42) was listed in a thread on credit card fraud.
inetnum: 213.185.113.0 - 213.185.113.63
netname: INTELSAT-CUST-Global-_Meridian-NG
descr: Reassignment to Global Meridian customer, Nigiria
country: EC
admin-c: JS3451-RIPE
tech-c: DG1143-RIPE
status: ASSIGNED PA
remarks: *************************************************************
remarks: * *
remarks: * For issues of abuse related to this IP address block, *
remarks: * including spam, please send email to: *
remarks: * *
remarks: * wolesho@yahoo.com *
remarks: * *
remarks: *************************************************************
mnt-by: AS22351-MNT
mnt-lower: AS22351-MNT
mnt-routes: AS22351-MNT
changed: tac.ops@Intelsat.com 20030902
source: RIPE
person: JONATHAN SHODIMU
address: 251 HERBERT MACAULEY ROAD,
YABA Lagos, Nigeria
phone: +234-8034547494
e-mail: wolesho@yahoo.com
nic-hdl: JS3451-RIPE
mnt-by: AS22351-MNT
changed: tac.ops@Intelsat.com 20030902
source: RIPE
person: DELE GBADAMOSI
address: 251 HERBERT MACAULEY ROAD,
YABA Lagos, Nigeria
phone: +234-8023038734
e-mail: delue2000@yahoo.co.uk
nic-hdl: DG1143-RIPE
mnt-by: AS22351-MNT
changed: tac.ops@Intelsat.com 20030902
source: RIPE
European car for 3,800 Euros
Somebody trying to sell her car (let's call her "Jane Smith") received the following email:
From: PETER TURNER <pet_turner@netexecutive.com>
Hello,
Saw the ad for the sale of your car and I am intrested in making the purchase. If true to how it was described, I will appreciate if you can send pics of it to my email. I am currently in the United States.
I had already paid an Associate of mine to help get another car but it was sold before he could meet up with the seller. I will ask him to make a cheque which will be sent to you for payment. The amount on the cheque will be more than what you are offering because the other one my Associate was to help me get was more expensive than your's.
The Amount on the check will be 8,500 Euros.
All you will need do is to remit the difference to my Shipper who will in turn come with authorisation from me for pick up.
If this is ok by you, respond to my email with the following information so the cheque can be sent to you as soon as possible.
1) FULL NAMES (as you will want it to appear on the cheque)
2) COMPLETE MAILING ADDRESS
3) CONTACT PHONE NUMBER
I will be looking forward to hear from you soon.
Regards,
Peter Turner
Jane replied:
From: "Jane Smith" <janes_email_address>
Subject: Re: Opel vectra for 3,800 Euros
Date: Fri, 10 Dec 2004 11:16:53 +0000 (GMT)
Dear Mr. Turner,
Though my e-mail address is on UK, I leave in Romania, I do not know if this detail is clear enough in the ad - honestly, I have posted this ad on several sites, with slight changes, and I do not know which one you have seen(and also honestly, I am still not sure if it is not just a joke, but this one is for now left aside)
Taking this into account, please tell me if you are still interested in my sending you all other info requested.
Best regards,
Jane
Dear Jane,Here are email headers for a mail from "Peter":
Thank you so much for your email. It was really appreciated. I will want you to know that I am still intrested in your car. Th ad I saw is on Annuntri.com, it was really nice.
Regarding the payment, I wll want to know if the check should be sent to you very soon you will remit the rest, I believe this is very important. So as to avoid any disparity in the deal.
I must not fail to let you know that I really like your car very much and would have loved to come and pick it up personally, but I cannot because my wife has been sick for sometime. She has had Cancer(Breast) for sometime now and I have to be with her in the United States where she is receiving treatment. Hope you understand?
As soon as you get the check, I will want you to take it to the bank and immediately remitt the rest to the shipper through Western Union Money Transfer in the U.K. so he can come and pick up the car as soon as possible because the shipper is prepaid and I will want the whole thing settled. The shipper will come with Authorisation from me.
I really have to get the car because my only son will be home for christmas as he is to start school in the new year and I will want the car in the U.K before then because my son's 18 Birthday is on Christmas day and I will really love to make him happy while his mother is not around. According to what you said the deal is very complicated but I do not seem to have a choice.
I tried calling my Associate but his phone but couldn't get through. I will make sure you get the check soon anyway. Even if he is not in the country. I will make sure I contact him and he sends the check to you.
Having gone through your email , I realised you did not include your information as requested Information
I will want you to please make your Complete Mailing Address very explcit, so the check can get to you early enough.
Thank you once again for all your trouble taken to send the pics . I will hope to hear from you soon.
Regards,
Peter