|
Beware of Fraud: Car buyer with large cashier's check
The following actual email exchange is an example of how counterfeit cashier's checks are used by scammers from Nigeria to defraud sellers of goods. Here is how the scam works: Someone poses as a buyer, forwards a large cashier's check to the seller (more than the amount of the purchase), giving some lame excuse and asks him to wire the excess amount back to the buyer by Western Union. The cashier's check will eventually bounce, but this could take a number of days. If the buyer has already wired the cash by then, the money will be lost and remains untraceable. This scam may involve goods other than cars (for example, motor bikes or motor scooters, boats, horses, pieces of art) and sometimes the buyers claim to be based in the United Kingdom, the Netherlands or in Spain (the same countries used for Lottery frauds). (Note: There is also a reverse scam, where the buyer is defrauded and the seller is the crook. That version of the scam involves fraudulent escrow services.) Free webmail accounts (for example, wcreed00@yahoo.com) are used for most communications. Often phone numbers in the UK (0044/+44) or the Netherlands (0031/+31) are used. These will then be anonymous cell phones (for example, 0031 648 088 432).
To protect the identity of the seller in this actual case, we've called him Dave, which is not his real name. He lives in Canada and he was trying to sell his truck. "phill brown [mailto:autoflash@fastermail.com]" however was the real identity used by the buyer.
"Phill" contacts Dave about wanting to buy his truck: From: autoflash@fastermail.com [mailto:autoflash@fastermail.com]If you are familiar with Nigerian "419" emails, the "I AM SHOUTING AT YOU" all-caps typing above will look familiar to you. A lookup of the IP address listed at the bottom confirms that the buyer is indeed contacting Dave from Nigeria. Here is the network of the ISP the posting came from:
Next Dave contacts the would-be buyer: From: "##########" <########@#########>
The Nigerian customer feigns interest: From: phill brown [mailto:autoflash@fastermail.com]
Dave obviously expected a specific offer price, having given "Phill" all the info about the car: From: "##########" <########@#########>
"Phill" doesn't want to come up with a figure, let alone negotiate: From: phill brown [mailto:autoflash@fastermail.com]
So Dave names his price: From: "##########" <########@#########>
Without trying to negotiate, "Phill" accepts Dave's asking price and then moves to his real game plan: Getting Dave to trade cash (by Western Union) for a piece of paper from Nigeria. My client has finally accepted your price,he hopes the engine is
At this point, Dave smelled a rat and reported the incident to us.
"david jeff (davidjeff02@yahoo.com / IP 213.185.113.52)" buying a car with an fake oversize check The "buyer" made an offer for a car in Maine, USA that was advertised for sale, but told the seller that he had a cashier's check made out to a larger amount than the sticker price. The seller was to deposit the check in his bank account and wire the excess to a recipient in Nigeria, supposedly the shipping agent who would take care of picking up the car. The fake cashier's check was supposedly issued by "PatriotBank, Fredericksburg, VA 22407". The remitter's name on the check did not match the buyer's name. The check was actually mailed from the UK (Royal Mail, 49 pence stamp). The check was dated two days after the postmark on the letter, i.e. it was dated ahead to compansate for the international shipping time. The field office of the United States Secret Service said it was powerless, because the criminal was based in another country (so was cocaine baron Pablo Escobar, I might add...). Here are the wire transfer details:
From: david jeff <davidjeff02@yahoo.com> To: Firstname Lastname <emailaddress> Subject: SHIPPER'S INFORMATION.......................................... Date: Sun, 27 Feb 2005 10:16:51 -0800 (PST) Hello Firstname Lastname , I really appreciate your full effort toward this transaction i will like you to highly send the excess funds to the shipper's today so that by Monday they may be at your location for the picking up of the car i will like you to do that asap today, The shipping agent Name is Shipping Links Agency Name .... MR Dayo Lewis Address.. 24B WALTERCARENTON ROAD, OBALENDE,LAGOS. NIGERIA,23401. You will have to deduct the western union transfer charges from the amount you want to transfer,I want everything to get clear to you As soon as you get transfer done ,you will have to get back to me with the following transfer information , MTCN CONTROL NUMBER (10 DIGIT NUMBER) SENDER'S FULL NAME & ADDRESS RECIEVR'S FULL NAME & ADDRESS AMOUNT SENT AFTER TRANSFER CHARGES TRANSFER CHARGES TEST QUESTION & ANSWER Do get back to me immediately you got this email and the shipper's need to get paid today asap , so that they can leave to the state for pick up of the CAR and other goods that am buyinging in the state,More also i will be looking forward to read the information you use to send the excess funds to the shipper's today. Best Regards. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com Here's another email: From: "david jeff" <davidjeff02@yahoo.com> To: Firstname Lastname <emailaddress> Sent: Saturday, 05 March, 2005 10:12 Subject: Re: check for the car hi Firstname thanks for the mail ,i appriciate your effort on these transaction .i think by now you would have recieve the payment ,so if you have recieve it please mail me back as soo as possible,because my shippers are complaining about the payment ,they are waiting for the payment. thanks david Message headers: Received: from [213.185.113.52] by web31110.mail.mud.yahoo.com via HTTP; Fri, 04 Mar 2005 17:12:53 PST Date: Fri, 4 Mar 2005 17:12:53 -0800 (PST) From: david jeff <davidjeff02@yahoo.com> Subject: Re: check for the car
WHOIS details for sending network (IP 213.185.113.52): inetnum: 213.185.113.0 - 213.185.113.63 netname: INTELSAT-CUST-Global-_Meridian-NG descr: Reassignment to Global Meridian customer, Nigiria country: EC admin-c: JS3451-RIPE tech-c: DG1143-RIPE status: ASSIGNED PA remarks: ************************************************************* remarks: * * remarks: * For issues of abuse related to this IP address block, * remarks: * including spam, please send email to: * remarks: * * remarks: * wolesho@yahoo.com * remarks: * * remarks: ************************************************************* mnt-by: AS22351-MNT mnt-lower: AS22351-MNT mnt-routes: AS22351-MNT changed: tac.ops@Intelsat.com 20030902 source: RIPE person: JONATHAN SHODIMU address: 251 HERBERT MACAULEY ROAD, YABA Lagos, Nigeria phone: +234-8034547494 e-mail: wolesho@yahoo.com nic-hdl: JS3451-RIPE mnt-by: AS22351-MNT changed: tac.ops@Intelsat.com 20030902 source: RIPE person: DELE GBADAMOSI address: 251 HERBERT MACAULEY ROAD, YABA Lagos, Nigeria phone: +234-8023038734 e-mail: delue2000@yahoo.co.uk nic-hdl: DG1143-RIPE mnt-by: AS22351-MNT changed: tac.ops@Intelsat.com 20030902 source: RIPE European car for 3,800 Euros Somebody trying to sell her car (let's call her "Jane Smith") received the following email: From: PETER TURNER <pet_turner@netexecutive.com> Jane replied:
From: "Jane Smith" <janes_email_address> Dear Jane,Here are email headers for a mail from "Peter": Return-Path:
Fred Robert (fredrobert@usa.com, IP 80.88.154.43)
DEAR FIRSTNAME, Message headers: Received: from [80.88.154.43] by ws3-2.us4.outblaze.com with http for fredrobert@usa.com; Sat, 09 Jul 2005 13:50:20 -0500 X-Message-Info: JGTYoYF78jFXwhqY+zO5vxSc57lIzxnvSIHlbPFTxYQ= X-OB-Received: from unknown (205.158.62.92) by wfilter.us4.outblaze.com; 9 Jul 2005 18:50:20 -0000 X-Originating-Server: ws3-2.us4.outblaze.com Return-Path: fredrobert@usa.com
WHOIS details for sending network (IP 80.88.154.43): netname: EMP-SYL01 inetnum: 80.88.154.40 - 80.88.154.47 netname: EMP-SYL01 descr: Network at EMP-SYL01 descr: Please report all abuse to the network admin-c country: NG admin-c: SI310-RIPE tech-c: EMP5-RIPE status: ASSIGNED PA remarks: - - - - - - - - - - - - - - - - - - remarks: Abuse address: abuse@emperion.net remarks: - or the admin-c of the network remarks: - - - - - - - - - - - - - - - - - - mnt-by: EMP-NOC-MNT source: RIPE # Filtered role: Emperion NOC Operator address: Emperion A/S address: Middelfartgade 7 address: 2100 Koebenhavn Oe address: DK phone: +45 3929 3530 e-mail: noc@emperion.net remarks: trouble: kmw@emperion.net admin-c: KW6968-RIPE tech-c: KW6968-RIPE tech-c: SRL7-RIPE tech-c: AJ163-RIPE tech-c: GB1283-RIPE tech-c: FL497-RIPE nic-hdl: EMP5-RIPE mnt-by: EMP-NOC-MNT source: RIPE # Filtered person: Sylvia Ikeji address: 47, Modele street, Surulere, Lagos Nigeria e-mail: Sylvia@infoweb.abs.net phone: +234 158 512 55 fax-no: +234 158 512 55 mnt-by: EMP-NOC-MNT nic-hdl: SI310-RIPE source: RIPE # Filtered % Information related to 'EMP5-RIPE' route: 80.88.144.0/20 descr: DK-EMPERION-20021031-ROUTE origin: AS21125 mnt-by: EMP-NOC-MNT source: RIPE # Filtered
Overseas Horse Buyer Scam Here is an example of the same scam but using a classified ad for a horse as a starter:
Hello,
See also:
Nigerian Bicycle Buyer Here is an example of the exact same scam using a classified ad for a bicycle:
Hello,
"terry campell" (IP 81.199.84.185): From: terry campell <terrycampell_200002@yahoo.com> Date: Tuesday, May 17, 2005 9:27 am Subject: range rover hello, iam interested in your range rover, if it is still available for sale.pls get back to me with the last asking price, current pictures and present condition. thanks thanks The seller replied: The rover is in good condition. The description is still the same. The price is $4500 firm Thanks Firstname The scammer replied: From: terry campell <terrycampell_200002@yahoo.com> Date: Tuesday, May 17, 2005 2:45 pm Subject: payment terms Thank you for your response,after discussing with my client who really commended your rover has instructed to move on with the deal at the price of $4,500 ,he said he will be going on a vacation soon and will rest virtually all the transaction on my shoulder and assign a shipper like wise that i will work with and stressed that he will be issuing out a cashier check of ($9,500) which was a refund payment of a cancelled order earlier made by him but will be filed in your name,you are only required to deduct the cost of your rover ($4,500) and send the differece ($5,000) when payment gets to you to a shipping agent whoose information will be given to you as at when due, he will be needing the fund to offset shipping charges, taxes and other cosmetic repairs/touches,the agent will be responsible for signing and transfering of title paper and also pickup. So i require of you to send me your NAME,ADDRESS AND PHONE NUMBER for payment to be delivered to you via fedex courier services .All other information needed in completion of this transaction will be given to you in due time. thanks The seller wrote: If only this were legit........................ The scammer replied: From: "terry campell" <terrycampell_200002@yahoo.com> To: <emailaddress> Sent: Wednesday, 18 May, 2005 19:24 Subject: payment terms hello, the business is legit, my name is terry campell.iam the purchase manger for the globe motors inc. 517 Westwood Drive, London, HL 45. 3FE UK. Business license number location of origin: The Forge Garage A32 Droxford,Hampshire,England. Direct Phone: + 447708896793 VAT Registration No: 704603271 we specialise in sales and purchase of cars for customers around the globe and we get paid in commision after payment has been confirmed by seller to buyer and this is one of such transactions.pls send your name, address,and phone number so that the check will be issued in your name.when it clears you send the refund to the agent that will be coming for the pickup.Please confirm the reciept of this mail and get back so that we will know your stand.if you are not interested.let me know terrycampell sales/procurement officer. Message headers: Received: from [81.199.84.185] by web32513.mail.mud.yahoo.com via HTTP; Wed, 18 May 2005 03:24:15 -0700 (PDT) Date: Wed, 18 May 2005 03:24:15 -0700 (PDT) From: terry campell <terrycampell_200002@yahoo.com> Subject: payment terms
WHOIS details for sending network (IP 81.199.84.185): inetnum: 81.199.84.0 - 81.199.87.255 netname: CIDR-COMMUNICATION-01 descr: Internet service provider country: NG admin-c: TECH7-RIPE tech-c: TECH7-RIPE status: ASSIGNED PA mnt-by: AS12491-MNT source: RIPE # Filtered person: Tech Supernet300 address: 21 Mobolaji Bank address: Anthony Way Ikeja address: Lagos address: Nigeria phone: + 234 1 4976493 e-mail: admin@supernet300.com nic-hdl: TECH7-RIPE source: RIPE # Filtered
From: brenda terrie <brenda_terrie@yahoo.com> If a total stranger wants to send you a check much larger than the amount asked for, it's an almost sure sign that the check is fraudulent. Nobody with any sense entrusts his own money to a perfect stranger. If someone appears to do so, it's because there is no money - the check will bounce! Be careful when dealing with overseas customers, particularly in high risk countries such as West Africa, Indonesia, Romania or the former Soviet Union. When accepting credit cards, only ship to verified billing addresses with a verified security code for the credit card or avoid doing such business altogether.
|