”Keep it safe, simple and fun!” with www.TheWiredLion.com Email Scam 20080926 ID: Anne Baker Money Laundering Employment Scam Imagine suddenly finding a bank check for $5000 in your mailbox with a scheme for making money from home that now seems all so easy, safe and real! The job offer scam is becoming quite common and many fall for it due to the fast pace and the seemingly real check that arrives. Things go sour just as quickly. Here is the original email: From: ANNE BAKER [mailto:email@example.com] Subject: ONLINE JOB OFFER BAKER ARTS CREATIONS 10 Newport ave, Scoffford Area, Oxford, L349HA, 44(0)7031821746 Hello, Due to the resent expansion in our Gallaria and the large demand for it in your country,we will be glad to employ your services, I need a representative who can be working for our company in The UNITED STATES; I have finalized now for us to move on, at all I want is a representative. The job does not entail much. Your percentage will be 10% ok? All i want is an honest representative over there. All you would be doing is receiving these payments in form of MONEY ORDERS, which would be coming from some clients I want to let you know that this is not a scam at all ok? All I want is an honest representative that will be my representative over there, but you must have to assure me that you are going to be very honest in this transaction with our company ok? In the United States via the mail. So when you get these Money Orders all you have to do is have them cashed and deduct your share (10%) and wire the rest down to me here in England via (Western Union Money Transfer). the wire expenses will be from my share. I would also need some proof of Identity. So I have attached an Employment form for you to fill and send back to me via email. BAKER ARTS AND CRAFT APPLICATION FORM FIRST NAME...................... LAST NAME................................................. ADDRESS...................................................................... CITY STATE.......................................................... ZIP CODE.. COUNTRY.................. PHONE NUMBER (S) ..................................... GENDER.. MARITAL STATUS.. OCCUPATION....................................................................................... AGE. ATTESTATION According to how you have been briefed earlier by me. You are required and mandated to receive payment on behalf of the above-mentioned firm. You are to deduct 10% of all funds processed on a particular Transaction and forward the balance payment via Western Union Money Transfer. You will notify me a week ahead if eventually you want to discontinue this job so as to terminate all payment coming your way to avoid conflict. In agreement to this kindly append signature below BAKER ARTS CREATIONS ANNE BAKER ”Keep it safe, simple and fun!” with www.TheWiredLion.com The email is loaded with strange aspects. The bad English grammar is made worse by the request for a signature in an email transmitted form. The format becomes understandable when you learn of the West African connection. It is obvious the scammer (s) is not really familiar with the language and forms that he has chosen for this scam. The addition of “ok?” at the end of sentences is very common with Nigerian/West African 419 communications. You will also see the closing “and remain blessed” which is also common to that area. I respond with my alias as a retired/disabled widower whose wife died of cancer years ago and get a quick response accepting me as an employee. Please note a “Received” line I have added for each email received. This is a listing of the IP address line for each email. This helps me see how many locations are involved in the scam. From: Anne Baker <firstname.lastname@example.org> Received: from [126.96.36.199] by web45712.mail.sp1.yahoo.com via HTTP Subject: ACKNOWLEDGEMENT.. Dear Robert, Thanks for getting back and sorry for the delayed response, you are highly welcomed as our payment agent in America, With all due respect, I quite appreciate your mail and interest to work with us, presently we have a lot of customers in the states that owe us and are ready to make payments, all we need from you is honesty and sincerity. This is to notify you that your information was received by us and as a matter of fact you have been employed to work as our payment representatives in the states ,furthermore you are entitled to 10% commision of the total sum for every transaction processed. We have already informed some of our customers in AMERICA about this new development and they have also agreed to work with you so they will be sending our payment through you. I will alert you as soon as any of my customer confirms to me that they have sent payment to you and i will let you know when to expect payment and what to do. Finally i want to assure you that this is 100% legal, tax free, risk free and highly rewarding. So therefore, we need your maximum co-operation and comittment, you shall be earning at least $2000 to $3000.00 or more every month as commission WHICH DEPENDS ON HOW TRANSPARENT AND FAST YOU ARE IN SENDING DOWN OUR MONEY TO US. Please get back me as soon as you receive this mail reconfirming your interest . Thank you once again for your assitance. Regards, Anne Baker. I don’t even get a chance to respond to the first email before a 2nd one comes in. Things are moving VERY quickly; From: Anne Baker <email@example.com> Received: from [188.8.131.52] by web45715.mail.sp1.yahoo.com via HTTP Subject: All necessary processes for the check payment has been perfected Hello Robert Perlot, All necessary processes for the check payment has been perfected and delivery in your name.I expect you to keep me informed when you receive the check payment.please get back to me via email once you receive this mail to confirm that you got the email. Thanks. ”Keep it safe, simple and fun!” with www.TheWiredLion.com The scammer then disappears for 2 weeks. I thought the contact was gone due to my lack of response. Then, they reappear; From: Anne Baker <firstname.lastname@example.org> Received: from [184.108.40.206] by web45710.mail.sp1.yahoo.com via HTTP Subject: PAYMENT UPDATE................... Attention:Robert Perlot, How are you and how is work? I am very sorry for the delay in delivery of your payment and wish to inform you that your payment will get to you tomorrow or next. Please bear with us and do get back to me as soon as you have recieved your payment. Do not hesitate to keep us informed as a confirmation that you have recieved your payment. Kindly check your mail box for your payment.Your payment was sent to your below address:PO Box 1096 Easthampton, MA 01027 USA Kindly get back to me as a confirmation that you got this mail. HAVE A WONDERFUL DAY. I send a very short email saying I had not seen the payment and ask where I should send the balance of the money (after my “pay” I deducted). They are more than happy to push things along as time is NOT on their side. From: Anne Baker <email@example.com> Received: from [220.127.116.11] by web45712.mail.sp1.yahoo.com via HTTP Subject: FOLLOW MY INSTRUCTIONS AND GET BACK TO ME WITH THE TRANSFER DETAILS ASAP..... HELLO Robert Perlot, YOU ARE TO DEDUCT THE AGREED $500 AND WIRE THE REST MONEY THROUGH WESTERN UNION MONEY TRANSFER TO OUR RAW MATERIALS SUPPLIERS IN AFRICA WITH THE BELOW INFORMATION . WIRE $2,250 MINUS TRANSFER CHARGES TO, NAME........MR DANIEL STRIKER ADDRESS.....LAGOS NIGERIA. WIRE $2,250 MINUS TRANSFER CHARGES TO, RECEIVERS NAME...... VALENTINE AMADI LOCATION.......LAGOS NIGERIA AS SOON AS THE TRANSFER IS MADE, YOU ARE TO FORWARD THE BELOW DETAILS OF MONEY TRANSFER TO ( .. ) AND CC COPY TO ME AS WELL FOR CONFIRMATION THAT THE FUNDS HAS BEEN SENT AS INSTRUCTED. 1,MTCN ( money transfer control numbers ) 2, Senders Name and Address 3,Receivers Names and Address 4,Exact amount sent . 5,Test Questions .........MONEY FOR ? 6, Answer.......RAW MATERIAL I WILL BE WAITING FOR YOUR EMAIL WITH ALL DETAILS OF MONEY TRANSFER. THANKS AND REMAIN BLESSED, ”Keep it safe, simple and fun!” with www.TheWiredLion.com So there you have it; the Nigerian connection and the presentation of the black hole of Western Union Money Grams. To make it even more fun… A $5,000 Bank Check from the Bank of Missouri shows up in my Wired Lion PO Box made out to my alias! The check is actually quite unimpressive yet acceptable and the postmark says Missouri. Fortunately, I have enlisted two allies, the United States Postal Service and its fraud division. You see, by attempting to commit a crime, fraud, involving the USPS postal system, the bad guys have committed a FEDERAL OFFENSE and I now have the Feds in my corner! The bad guys start to get frantic about the status of their scam; From: Anne Baker <firstname.lastname@example.org> Received: from [18.104.22.168] by web45703.mail.sp1.yahoo.com via HTTP subjectCONFIRM RECIEPT OF THE CHECK TO AVOID MISSING................ HELLO Robert Perlot, KINDLY CONFIRM THE RECIEPT OF MY CUSTOMER'S CHECK TO AVOID MISSING.CHECK YOUR MAIL BOX AND GET BACK TO ME RIGHT AWAY.THEY HAD SOME LOGISTICS PROBLEM THAT RESULTED TO THE LATE DELIVERY. I AWAIT YOUR CONFIRMTION OF THE DELIVERY OF THE CHECK AS SOON AS POSSIBLE. THANKS AND NICE DOING BUSINESS WITH YOU. The IP address of the email has changed again. I also immediately receive another email that appears to be a frantic and incomplete message from another IP address: From: Anne Baker <email@example.com> Received: from [22.214.171.124] by web45715.mail.sp1.yahoo.com via HTTP Subject: KINDLY GET BACK TO ME ASAP.... THANKS FOR YOUR MAIL.KINDLY CONFIRM THE RECEIPT OF MY CUSTOMER'S CHECK TO AVIOD MISSING. When they don’t hear from me immediately, they send out an email identical to one shown above but return to the “82” IP address that has been used in 3 out of the 6 emails received: From: Anne Baker <firstname.lastname@example.org> Received: from [126.96.36.199] by web45704.mail.sp1.yahoo.com via HTTP Subject: CONFIRM RECIEPT OF THE CHECK TO AVOID MISSING................ HELLO Robert Perlot, KINDLY CONFIRM THE RECIEPT OF MY CUSTOMER'S CHECK TO AVOID MISSING.CHECK YOUR MAIL BOX AND GET BACK TO ME RIGHT AWAY.THEY HAD SOME LOGISTICS PROBLEM THAT RESULTED TO THE LATE DELIVERY. I AWAIT YOUR CONFIRMTION OF THE DELIVERY OF THE CHECK AS SOON AS POSSIBLE. THANKS AND NICE DOING BUSINESS WITH YOU. ”Keep it safe, simple and fun!” with www.TheWiredLion.com Finally they take one last shot of desperation (still using the 82 IP address) when I remain silent, threatening to call the FBI if I don’t respond. The bright pink lettering is their idea; From:: Anne Baker <email@example.com> Received: from [188.8.131.52] by web45801.mail.sp1.yahoo.com via HTTP Subject: YOU MUST GET BACK TO ME OR FBI AT YOUR DOOR........................ KINDLY GET BACK TO ME SO THAT I WILL KNOW THAT YOU HAVE SEND THE FUNDS TO MY RAW MATERIAL SUPPLIERS AND GET BACK TO ME WITH THE TRANSFER DETAILS ASAP OR I WILL CALL FBI FOR YOU........... And the final part of the puzzle……..the check is a fake! Time to put the puzzle together; 1) Despite the introduction of this “company” as being in Oxford, England, the scams origin is from Nigeria with a connection, probably an immigrated relative, in Missouri. 2) The scammers are definitely having troubles at their end. They had time-consuming problems getting the fake check sent out. This made them frantic at the thought that they might loose the $4500 in scam money they hoped to steal. 3) They also don’t trust their computer set up. That is why they started contacting me from different locations. They presumed my lack of response was because their emails weren’t coming through. 4) Time was their enemy. The idea was for me to deposit the fake check immediately and, just as immediately, use my own money to send out money grams to the addresses listed and to provide the money transfer control numbers for the wired funds to the scammers. A few days later, my bank would tell me the fake check had bounced and $4,500 would have disappeared into the Western Union black hole of Nigeria. To: Anne Baker <firstname.lastname@example.org> Subject: RE; CONFIRM RECIEPT OF THE CHECK TO AVOID MISSING................ My Dearest Anne, Thank you so much for the bank check. Thanks even more for sending it through the United States Postal System. We have proven that the check is a fake and that you have, therefore, used a US Federal Department to attempt to commit a crime. This is a federal offense and will be turned over for investigation by the US government criminal investigators. I am sure Nigeria officials will be happy to co-operate with my government. I hope they meet with you soon. TWL WL Jay Keep it safe, simple and fun! PS: We are flattered when you tell your friends about the services of The Wired Lion! But PLEASE remember that our modest fees help us keep this effort alive. Resist the urge to photo these helpful articles and hand them out to your friends. Instead, please encourage them to Join Us with their own membership!