|
Beware of Fraud: "MUSHIN, LAGOS 23401"
The following exmples illustrate typical credit card fraud cases perpetrated by individuals in Nigeria. These cases follow distinct patterns. Often they start with very unspecific sales inquiries. Then goods worth several thousands dollars are ordered. Often the charge is to be split between two cards. Some business are asked to locally purchase a notebook computer as a favour and ship that along with their regular merchandise. Sometimes the buyer will claim to live in the United States or Europe but wants the goods shipped to a customer in Nigeria.
Here is an example of an unspecific initial email to begin a business transaction which, if one is not careful, can turn out to be a case of credit card fraud.
Posted by mark mccallister <angiesmithstore@yahoo.com> on February 19, 2004 at 05:39:41: Dear sales, Am here to place an order with you ,also to know the shipping rate to lagos,nigeria along with your carrier via UPS EXPRESS OR USPS AIR MAIL. before i process to select items i will like to know the shipping cost, Here is my shipping address: 1/3,Alaba street mushin lagos,23401 Nigeria. Get to me back soonest MARK McCALLISTER It's not really possible to quote shipping costs without knowing the weight of the goods ordered, so why the above request for a shipping cost quote before selecting goods for an order? The answer is that this message went out to addresses gathered at random, most of which probably do not belong to commercial companies but to private individuals or other non-commercial entities. People who don't just discard the message but respond are highly likely to operate businesses. Through their responses the scammers get access to addresses of commercial websites that will accept mail order business. "Dr Ade" was using email address (no, I'm not making this up!) honestintlpurchasesorder@yahoo.com.Dear sales, Subject: ORDER INQ... Good daysales, I am Dr Ade the director of addes store i browsed through your site and found some products in you rstore on seeing them i had interest into purchasing some of your products and i wantyou to mail me the cost of shipping international to my store in lagos nigeria via USPS air mail And i will also like you to pls send me a link to your web site and i would also be paying with mycredit card please i would also need your feedback concerning my enquiry. Thanks. Dr Ade If "Dr Ade" was already browsing the store's site, why did he still need to get a "link to your website"? Again, it's because he was just fishing for businesses amongst the numerous recipients of his spam. Notice that both mails are addressed to "Dear sales". "Dr Ade" seems unable to spell his own name, because he spells it with two "D"s when referring to his own store. People tend to be very attached to their own name. Misspelling it is somewhat unusual, even for someone with such poor typing skills as "Dr Ade". He did it because it probably wasn't his real name. It's a common surname in Nigeria. "Dr Ade" later selected some goods, which with shipping came to US$2190. Then he also asked the merchant to also get ahold of a notebook computer to be shipped to his address and to be paid by credit card. He would pay another US$200 on top of costs. The merchant declined. The initial inquiry did not include any address or telephone/fax number or even a first name. Later on in the correspondence he claimed not to have a fax number at all. This was the eventual shipping address given by "Dr Ade": The phone number is a Nigerian mobile phone number.HERE IS MY SHIPPING ADDRESS: 52 ALABA STREET MUSHINLAGOS NIGERIA 23401. PHONE NUMBER : 234 80 33254789 COMPANY'S NAME : ADE'S INC
Credit card scammer using TTY relay (Telecommunications Relay Service for Hearing Impaired)
HELLO Firstname. The following order started off with an inquiry for a specific item, with the familiar "HELLO SALES" address: From: alan smith [mailto:securityalarmstorez@atlas.cz] Sent: Thursday, November 25, 2004 3:49 AM To: emailaddress Subject: QUOTATION HELLO SALES, I AM MR ALAN,I WILL WANT U TO QUOTE ME THE TOTAL COST + SHIPPING COST OF THIS ITEM VIA UPS PRIORITY TO MY ADDRESS IN NIGERIA AND I WILL BE MAKING PAYMENT BY CREDIT CARD. 2-Wire Photoelectric Smoke Detector ...qty...80pcs THE SHIPPING ADDRESS 5 PALM AVNUE MUSHIN LAGOS NIGERIA 23401 SO SEND ME THE TOTAL COST SO THAT I CAN FORWARD MY CREDIT CARD INFORMATION TO YOU. YOUR FAST RESPONSE IS HIGHLY ANTICIPATED. REGARDS. ALAN SMITH To which the business replied: I can sell you the 80 2-wire smoke detectors you requested for US$37.75 ea. I do not have the shipping info yet as it is Thanksgiving week. It may take until Monday morning to get an accurate shipping cost. Please let me know if I should get that info for you. Thanks, name name of business, location The customer placed an order, which the business confirmed: Thanks for your order. I am checking to make sure the quantity is available. I need an exact shipping address. Your zip code comes up to a city here in the States. I will contact you on Monday with an exact shipping time and arrival time. Thanks, name The customer supplied two credit cards and asked the charge to be split between them: From: alan smith [mailto:securityalarmstorez@atlas.cz] Sent: Friday, November 26, 2004 1:19 PM To: emailaddress Subject: PAYMENT AND GET THE SHIPPING INFORMATION Hello, Thanks for ur prompt response,so split this card for the payment of the goods mastercard name on card: alan smith cvv: 456 account number: 5466xxxxxxxxxxxx exp date: mm/yy mastercard name on card: alan smith cvv: 547 account number: 5466xxxxxxxxxxxx exp date: mm/yy so get the shipping information and get the order shipped on monday regards Finally the customer gave a shipping address, notice how it's different from the initial one, without that being pointed out: From: alan smith [mailto:securityalarmstorez@atlas.cz] Sent: Saturday, November 27, 2004 12:19 PM To: emailaddress Subject: SHIPPING INFORMATION AND ATTACH THE INVOICE TO MY MAIL BOX Hello name, Thanks for ur prompt response,this is the shipping address 28 palm avnue mushin lagos nigeria 23401 the zip code is also the zip code of my state over here in Nigeria.so i expect u with the tracking deatails of the goods on monday and i will want u to send me the invoice as an attach file to my mail box cos i will need the invoice for some accounting transaction. so i expect the shipping details and the attached invoice Regards.
"mckarly animashaun" <mrsmckarlystores@yahoo.com>
From: "mckarly animashaun" <mrsmckarlystores@yahoo.com>Here is the header line that identifies the sender IP: Received: from [81.199.6.83] by web90109.mail.scd.yahoo.com via HTTP; Thu, 30 Dec 2004 11:21:33 PSTHere is the sending network: inetnum: 81.199.6.0 - 81.199.6.255 netname: BEST-1 descr: Best Communications, Nigeria country: NG admin-c: CN574-RIPE tech-c: CN574-RIPE status: ASSIGNED PA notify: lir@ipplanet.net mnt-by: AS12491-MNT mnt-routes: AS12491-MNT changed: lir@ipplanet.net 20040429 source: RIPE person: Chukwudi Nweke address: 8 Lawason Road, Surulere address: Lagos address: Nigeria phone: +234 1288 5178 e-mail: chukwuditc@yahoo.co.uk nic-hdl: CN574-RIPE notify: lir@ipplanet.net changed: lir@ipplanet.net 20040429 source: RIPE
"Linda Robert" shopping for audio equipment Here is another exchange involving a buyer in Lagos and a store in Canada, which we'll call "SoundSystem Inc." We've renamed the salesperson "Dave Jones", which is only fair, considering that "linda robert" is unlikely to be the real name of the fraudulent customer. From: "linda robert" This sales inquiry is better than most, in that it lists a postal address. Names composed of two western first names such as "Linda Robert" are quite common in Nigerian fraud. The name of the business is kept generic, so that the same enquiry can be sent to any kind of supplyer.
From: Dave <emailaddr>
From: LINDA ROBERT <lindarobertenterprises2@yahoo.com>
From: Dave <emailaddr>
From: LINDA ROBERT <lindarobertenterprises2@yahoo.com>
From: Dave <emailaddr>Dave sent an Excel file with the quote.
From: LINDA ROBERT <lindarobertenterprises2@yahoo.com>
From: LINDA ROBERT <lindarobertenterprises2@yahoo.com>
From: Dave <emailaddr>
From: LINDA ROBERT <lindarobertenterprises2@yahoo.com>
From: Dave <emailaddr>
From: LINDA ROBERT <lindarobertenterprises2@yahoo.com>
From: Dave Jones <emailaddr>
From: LINDA ROBERT <lindarobertenterprises2@yahoo.com>
From: Dave <emailaddr>
From: LINDA ROBERT <lindarobertenterprises2@yahoo.com>
From: Dave <emailaddr>
From: LINDA ROBERT <lindarobertenterprises2@yahoo.com>
From: Dave <emailaddr>
From: Dave <emailaddr>
From: LINDA ROBERT <lindarobertenterprises2@yahoo.com>
From: Dave <emailaddr>
From: LINDA ROBERT <lindarobertenterprises2@yahoo.com>
From: Dave <emailaddr>
From: LINDA ROBERT <lindarobertenterprises2@yahoo.com>
Posted by Tony Lurel <globalultimateintl@yahoo.com> on September 21, 2003 at 15:09:17
This was posted in an inappropriate web forum. Somebody was fishing for contacts. There are no phone numbers, only a country and area code in the case of Nigeria. The email address matches neither the name of the sender nor the business. The deal involves shipping to a different country from the person placing the order, paid by credit card. This is a big no-no when dealing with orders involving Nigeria!
"Nick Adamu, 6, Alaba street, Mushin, Lagos, Nigeria, 23401" DEAR SALES, AM HERE TO PLACE AN ORDER WITH YOU, ALSO TO KNOW THE SHIPPING RATE TO LAGOS (NIGERIA) ALONG WITH YOUR CARRIER SERVICES TO NIGERIA; ALSO TO KNOW THE KIND OF CREDIT CARD YOU ACCEPT. TILL I READ FROM YOU SOONEST, SO THAT I CAN FORWARD YOU THE LIST OF ITEMS THAT I WISH TO PURCHASE, THEN YOU GET BACK TO ME WITH THE TOTAL COST PLUS SHIPPING CHARGES. HOPING TO READ FROM YOU SOONEST. CHEERS!!! This person used two fake credit card numbers. He tried to get a merchant to buy a Toshiba notebook worth about $2500 and send it to the following address in Nigeria on those cards: 6, Alaba street, Mushin, Lagos, Nigeria, 23401. Message headers: Received: from [81.18.42.115] by web80909.mail.scd.yahoo.com via HTTP; Mon, 21 Feb 2005 02:35:52 EST Date: Mon, 21 Feb 2005 02:35:52 -0500 (EST) From: Nick Adamu <nickadamu@yahoo.ca> Subject: Re: Toshiba laptop On 2005-03-05, "Nick Adamu" <nickadamu@myway.com> wrote: DEAR SALES, AM HERE TO PLACE AN ORDER WITH YOU, ALSO TO KNOW THE SHIPPING RATE TOLAGOS(NIGERIA) ALONG WITH YOUR CARRIER SERVICES TO NIGERIA; ALSO TO KNOW THE KIND OF CREDIT CARD YOU ACCEPT. TILL I READ FROM YOU SOONEST, SO THAT I CAN FORWARD YOU THE LIST OF ITEMS THAT I WISH TO PURCHASE, THEN YOU GET BACK TO ME WITH THE TOTAL COST PLUS SHIPPING CHARGES. HOPING TO READ FROM YOU SOONEST. CHEERS!!! On 2005-03-07, "Nick Adamu" <nickadamu@myway.com> wrote: From: Nick [mailto:nickadamu@myway.com] Sent: 7 March 2005 10:47 To: emailaddress Subject: Items needed Firstname, Thanks and I appreciated your response to my order enquiry, below are my company details: My name is Nick Adamu, owner of Nikad Communication stores. I will like to know if you stock the below lists of items, Linksys EtherFast Cable/DSL Firewall Router w/ 4-Port Switch/VPN Endpts Digital cameras CDMA Thanks and hope to read from you soonest. Cheers!!! NB: Also I will like you to download yahoo instant messanger, so that we can chat and finalise the order via chatting, I thing that will be okay to trasact you will enjoy that too, here is my ID (LUVDSAINT), so that you can add me after you have download it.
Nick Adamu (nick234@myway.com) Message headers:
WHOIS details for sending network (IP 81.18.42.115): inetnum: 81.18.42.0 - 81.18.42.255 netname: STE-MOD-NOC descr: Mod Engineering Operations country: NG admin-c: OD264-RIPE tech-c: OA882-RIPE tech-c: SNO2-RIPE status: ASSIGNED PA remarks: - - - - - - - - - - - - - - - - - - - - - - - - remarks: - Please send all abuse reports to admin-c - remarks: - - - - - - - - - - - - - - - - - - - - - - - -' mnt-by: STE-NOC-MNT notify: noc@steineng.com changed: fisayo@steineng.com 20030417 source: RIPE route: 81.18.32.0/20 descr: NG-STGL-20020115-ROUTE origin: AS21125 notify: noc@steineng.com mnt-by: STE-NOC-MNT changed: fisayo@steineng.com 20020116 source: RIPE role: Steineng NOC Operator address: Steineng Limited address: 14, Kudeti Avenue, address: Onireke GRA, Ibadan, address: Nigeria phone: +234 804 2117868 e-mail: noc@steineng.com trouble: fisayo@steineng.com admin-c: OA882-RIPE tech-c: OA882-RIPE tech-c: BS1045-RIPE tech-c: SA18-RIPE tech-c: CN329-RIPE nic-hdl: SNO2-RIPE notify: noc@steineng.com mnt-by: STE-NOC-MNT changed: fisayo@steineng.com 20020111 source: RIPE person: Olatunde Dabiri address: Mod Engineering Nig. Ltd. address: 24 Ekololu Street, address: Surulere, address: P. O. Box 5240 address: Shomolu, Lagos. e-mail: dabiri@earthvisionafrica.net phone: +234 803 7753380 phone: +234 1 5845535 notify: noc@steineng.com mnt-by: STE-NOC-MNT nic-hdl: OD264-RIPE changed: fisayo@steineng.com 20030417 source: RIPE person: Olufisayo Adeleke address: Steineng Limited address: 14, Kudeti Avenue, address: Onireke GRA, Ibadan, address: Nigeria phone: +234 803 3040797 phone: +234 2 8105296 fax-no: +1 603 9076184 e-mail: fisayo@steineng.com nic-hdl: OA882-RIPE notify: fisayo@steineng.com mnt-by: STE-NOC-MNT changed: fisayo@steineng.com 20020111 changed: fisayo@steineng.com 20020115 source: RIPE
From: "James Robinson" <james_robin1@hotmail.com> To: <james_robin1@hotmail.com> Subject: mail order Hello Sales, I came through your site while browsing and on checking what you have on it,i was impressed so i decided to order some of the items.In this case i'll like to know how much it'll cost to ship to it's destination,Lagos,Nigeria via USPS global express.Also i'll like to inform you that i'll be paying via my american issued credit card. I'll like you to reply concerning my enquiry as soon as you can. Regards. NB:I'll also like to know if you sell in large qty _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar – get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/ Message headers: Received: from 217.194.145.179 by by12fd.bay12.hotmail.msn.com with HTTP; Wed, 16 Mar 2005 17:00:17 GMT X-Originating-IP: [217.194.145.179] X-Originating-Email: [james_robin1@hotmail.com] X-Sender: james_robin1@hotmail.com From: "James Robinson" <james_robin1@hotmail.com> To: james_robin1@hotmail.com Bcc: Subject: mail order
WHOIS details for sending network (IP 217.194.145.179): inetnum: 217.194.128.0 - 217.194.159.255 org: ORG-SGN1-RIPE netname: UK-SKYVISION-20010419 descr: PROVIDER descr: SkyVision Global Networks country: GB admin-c: SVAC-RIPE tech-c: SVNC-RIPE status: ALLOCATED PA mnt-by: RIPE-NCC-HM-MNT mnt-lower: SV-MNT mnt-routes: SV-MNT notify: noc@sky-vision.net changed: hostmaster@ripe.net 20010419 changed: hostmaster@ripe.net 20021122 source: RIPE route: 217.194.144.0/20 descr: SkyVision Network Services origin: AS25228 mnt-by: SV-MNT changed: noc@sky-vision.net 20021126 source: RIPE organisation: ORG-SGN1-RIPE org-name: SkyVision Global Networks org-type: LIR address: SkyVision Global Networks Kinetic Business Centre Theobald Street Borehamwood Hertfordshire WD6 4PJ United Kingdom phone: +44 20 8387 1750 fax-no: +44 20 8387 4004 e-mail: lir@sky-vision.net admin-c: SVAC-RIPE admin-c: SVNC-RIPE admin-c: YURI admin-c: TATA-RIPE admin-c: SB106-RIPE admin-c: DR1870-RIPE mnt-ref: SV-MNT mnt-ref: RIPE-NCC-HM-MNT mnt-by: RIPE-NCC-HM-MNT changed: hostmaster@ripe.net 20040415 changed: bitbucket@ripe.net 20040428 changed: bitbucket@ripe.net 20041229 changed: bitbucket@ripe.net 20050307 changed: bitbucket@ripe.net 20050310 changed: bitbucket@ripe.net 20050315 changed: bitbucket@ripe.net 20050315 source: RIPE role: SkyVision Network Coordination Center org: ORG-SGN1-RIPE address: SkyVision Global Networks address: Kinetic Business Centre address: Theobald Street address: Borehamwood address: Hertfordshire WD6 4PJ address: United Kingdom phone: +44 20 8387 1750 fax-no: +44 20 8387 4004 e-mail: noc@sky-vision.net admin-c: SVAC-RIPE tech-c: SVTC-RIPE nic-hdl: SVNC-RIPE mnt-by: SV-MNT notify: noc@sky-vision.net changed: noc@sky-vision.net 20011220 source: RIPE person: SkyVision Administrative Contact address: SkyVision Global Networks address: Kinetic Business Centre address: Theobald Street address: Borehamwood address: Hertfordshire WD6 4PJ address: United Kingdom org: ORG-SGN1-RIPE phone: +44 20 8387 1750 fax-no: +44 20 8387 4004 e-mail: ripeadm@sky-vision.net nic-hdl: SVAC-RIPE mnt-by: SV-MNT notify: noc@sky-vision.net changed: noc@sky-vision.net 20011220 source: RIPE Be careful when accepting orders from new customers in Nigeria and other countries that are hotbeds of fraud. Only ship to verified credit card billing addresses with a verified security code for the credit card or avoid doing such business altogether.
|