|
Beware of Fraud: Bike seller uses bogus escrow service
Be careful when using escrow services to pay for expensive items from remote sellers, such as cars, motor bikes or computers. Only use well known escrow services with a proven track record. We have come across cases of attempted fraud involving high end sports bikes offered at very low prices to trick buyers into sending money to crimninals. Here is how the scam works: Someone places an online ad for a car or motorbike. The bike is supposedly low mileage and in excellent condition but offered below market price. When a person is interested in buying it, the seller suggests using an escrow account to protect the buyer's cash payment. The buyer will pay the agreed purchase price by Western Union wire transfer to an escrow company. He will then have a chance to inspect the merchandise of the seller before releasing the escrow funds to the seller and taking possession of the goods and ownership documents, or so he is told. In reality the escrow company is a scam, with its website only a few days or weeks old. The person who picks up the payment on behalf of the fake company is the seller or an accomplice of him.
See also: Free webmail accounts (for example, wcreed00@yahoo.com) are used for most communications. Often phone numbers in the UK (0044/+44) or the Netherlands (0031/+31) are used. These will then be anonymous cell phones (for example, 0031 648 088 432). (Note: There is also a reverse scam, where the seller is defrauded and the buyer is the crook. This version of the scam involves fraudulent cashier's checks with a face value exceeding the purchase amount.)
"alliancedelivers.com" fake escrow scam
When contacted, the seller confirmed the bike was still available: I still have it for sale The person interested in buying found this story odd, particularly that a person claiming to be in the UK was using a Dutch mobile phone number (0031 6xx xxx xxx). We investigated and found that other bike buyers had come across this scam a few weeks before. One of them quoted the following response by the seller as follows: I want to let you know that i just married and i decided to follow my wife in Rotterdam, Netherlands.Same story, same words, same quirky capitalisation and punctuation. Only the countries and the phone number (0031 622 049 716) are different, but both phones are Dutch cell phones. The seller in that thread suggested to the buyer to use an escrow company, that the seller had never heard of before. The prospective buyer was smart enough to decline: "alliancedelivers.com", suggested in an email dated 2004-10-31, was only registered as a domain on 2004-10-26, i.e. five days earlier. Its website no longer exists now. It was probably shut down after it was discovered that it was a fraud. The trick was to get people to wire their payment there because they trusted the company when they wouldn't have trusted the seller, even though they know as little about one as the other.
Domain name: alliancedelivers.com Registrant: william childers (73998) alexmm1920@yahoo.com 10920 W Bee Bee Ln Casa Grande, AZ 85222 United States Phone: (520)8888880 x Administrative Contact: william childers (PVYED) alexmm1920@yahoo.com 10920 W Bee Bee Ln Casa Grande, AZ 85222 United States Phone: (520)8888880 x Technical Contact: william childers (73998) alexmm1920@yahoo.com 10920 W Bee Bee Ln Casa Grande, AZ 85222 United States Phone: (520)8888880 x Billing Contact: william childers (N5R33) alexmm1920@yahoo.com 10920 W Bee Bee Ln Casa Grande, AZ 85222 United States Phone: (520)8888880 x Record last updated on 2004-10-26 00:00:00 Record created on 2004-10-26 00:00:00 Record expires on 2005-10-26 00:00:00 Domain servers in listed order: ns1.abac.com 216.55.128.4 ns2.abac.com Registrar: NAMES4EVER, http://www.names4ever.com This scammer has been pulling off the same trick for quite some time. For example, in a thread on socalsvriders.org someone reported a case from September 2003: From: j k [mailto:eshop2324@blaiteng.net] The person received the offer reported the case to the police. However, since all the domains mentioned in that scam were registered with bogus postal addresses and this person is actually based in the Netherlands, he has not been caught yet. Here is a response, one year later, that in some places matches the old one word for word: From: R I <detotmarfa@yahoo.com> Proposing a bogus escrow service, which is really the scammer, is not the only way to cheat would-be buyers. Read this hare-brained proposal: From: "wendy creed" <wcreed00@yahoo.com>The scammer is hoping to find someone who doesn't understand (and doesn't bother to find out) how Western Union works: As soon the payment has been sent, it's available to the recipient. It can be picked up by anyone who knows the Transfer Control Number. You can not "change the name and address" later any more than you can change the name and address on a letter you mailed a week ago. Once it's gone, it's gone.
Fake escrow: europebetterbusinessprotector.com The domain was registered on 2005-04-13 using a proxy service to hide the identity of the registrant. When we checked on 2005-07-12 it didn't have a working website. The domain was brought to our attention by a buyer to whom it was recommended by a foreign seller of a motorbike that was quite cheap. Never use an escrow service recommended by the seller, unless it is escrow.com.
WHOIS details for domain "europebetterbusinessprotector.com": Request: europebetterbusinessprotector.com connected to whois.crsnic.net [198.41.3.54:43] ... connected to whois.aaaq.com [204.174.223.143:43] ... Hostway Whois Server Version 1.0 Domain Name: europebetterbusinessprotector.com Registrar: AAAQ.COM Whois Server: whois.aaaq.com Referral URL: http://www.aaaq.com Name Server: a.dns.hostway.net Name Server: b.dns.hostway.net Status: ACTIVE Updated Date 2005-04-13 Creation Date: 2005-04-13 Expiration Date: 2006-04-13 Registrant: WhoisProtector Inc. europebetterbusinessprotector.com@whoisprotector.com 1 N. State, Suite 1250 Chicago, IL 60602 US 312-994-7654 Fax: Administrative Contact: WhoisProtector Inc. europebetterbusinessprotector.com@whoisprotector.com 1 N. State, Suite 1250 Chicago, IL 60602 US 312-994-7654 Fax: Technical Contact: WhoisProtector Inc. techadmin@whoisprotector.com 1 N. State, Suite 1250 Chicago, IL 60602 US 312-994-7654 Fax: Billing Contact: WhoisProtector Inc. europebetterbusinessprotector.com@whoisprotector.com 1 N. State, Suite 1250 Chicago, IL 60602 US 312-994-7654 Fax:
Fake escrow service: great-britain-cargo.com
WHOIS details for domain "great-britain-cargo.com": Request: great-britain-cargo.com connected to whois.enom.com [66.151.151.170:43] ... Registration Service Provided By: Registerfly.com Contact: support@registerflysupport.com Visit: http://www.RegisterFly.com Domain name: great-britain-cargo.com Registrant Contact: RegisterFly.com - Ref# 16850077 Whois Protection Service - ProtectFly.com (16850077.fly@spamfly.com) +1.8458183604 Fax: +1.8456984014 P.O. Box 969 Margaretville, NY 12455 US Administrative Contact: RegisterFly.com - Ref# 16850077 Whois Protection Service - ProtectFly.com (16850077.fly@spamfly.com) +1.8458183604 Fax: +1.8456984014 P.O. Box 969 Margaretville, NY 12455 US Technical Contact: RegisterFly.com - Ref# 16850077 Whois Protection Service - ProtectFly.com (16850077.fly@spamfly.com) +1.8458183604 Fax: +1.8456984014 P.O. Box 969 Margaretville, NY 12455 US Billing Contact: RegisterFly.com - Ref# 16850077 Whois Protection Service - ProtectFly.com (16850077.fly@spamfly.com) +1.8458183604 Fax: +1.8456984014 P.O. Box 969 Margaretville, NY 12455 US Status: Active Name Servers: ns17.hostingfly.com ns18.hostingfly.com Creation date: 04 Mar 2005 04:31:45 Expiration date: 04 Mar 2006 04:31:45
"European Deal (european-deal.org, 2005-05-13) We received this inquiry from a car buyer: I am buying a car, and wanted to know if you have heared anything about european-deal.org is a fraud. The domain was registered in May 2005, despite a 2000 copyright note on the site. The company claims to be based in the UK with offices in London and Madrid, yet WHOIS lists a US postal address. Text on the website matches "Trading-Safe.net", another fake escrow.
WHOIS details for domain "european-deal.org": Request: european-deal.org whois server for *.org is whois.publicinterestregistry.net ... from whois.publicinterestregistry.net:43 [cached Wed Jul 20 23:59:08 2005 UTC] Domain ID:D106303800-LROR Domain Name:EUROPEAN-DEAL.ORG Created On:13-May-2005 02:22:34 UTC Last Updated On:12-Jul-2005 04:00:06 UTC Expiration Date:13-May-2006 02:22:34 UTC Sponsoring Registrar:DSTR Holdings, Inc. (R34-LROR) Status:OK Registrant ID:DOT-H267XSL2U150 Registrant Name:Mark Burchfield Registrant Organization:Mark Burchfield Registrant Street1:903 Edmondson pk Registrant Street2: Registrant Street3: Registrant City:Brentwood Registrant State/Province:TN Registrant Postal Code:37027 Registrant Country:US Registrant Phone:+1.6153320229 Registrant Phone Ext.: Registrant FAX: Registrant FAX Ext.: Registrant Email:mark.b@wire2mail.com Admin ID:DOT-XG5JVIEFXDXL Admin Name:Mark Burchfield Admin Organization:Mark Burchfield Admin Street1:903 Edmondson pk Admin Street2: Admin Street3: Admin City:Brentwood Admin State/Province:TN Admin Postal Code:37027 Admin Country:US Admin Phone:+1.6153320229 Admin Phone Ext.: Admin FAX: Admin FAX Ext.: Admin Email:mark.b@wire2mail.com Tech ID:DOT-RWMWFCSBNUTV Tech Name:Mark Burchfield Tech Organization:Mark Burchfield Tech Street1:903 Edmondson pk Tech Street2: Tech Street3: Tech City:Brentwood Tech State/Province:TN Tech Postal Code:37027 Tech Country:US Tech Phone:+1.6153320229 Tech Phone Ext.: Tech FAX: Tech FAX Ext.: Tech Email:mark.b@wire2mail.com Name Server:NS1.NAMERESOLVE.COM Name Server:NS2.NAMERESOLVE.COM Name Server:NS3.NAMERESOLVE.COM Name Server:NS4.NAMERESOLVE.COM
|