www.escrow.com/solutions/escrow/process.asp

Hi there everyone

I can't do the fancy stuff some of you can. I'd like to find out if this site is fraudulent. -www.escrow.com/solutions/escrow/process.asp. The escrow.com sites posted on the fake escrow list do not appear to have the same screen.

It's a link sent on a Romanian style scam reply I received last week.

Can anyone out there do their checking thingo?

Also, if it is a fraud, should I try to post it on the fake escrow list?

Any help would be appreciated.

Thanks

Welcome to Scamwarners.

I've looked it up and find it was created as long ago as 23 August 1994, which didn't surprise me. An address such as http://www.escrow.com would have been snapped up long ago. So definitely legitimate.

This doesn't mean the email is genuine though. It's quite possible that the link in the email takes you somewhere else than the one shown.

Can you quote the email plus headers?

Thanks for helping out Mr Tambourine Man.

I am pretty dumb when it comes to this kinda stuff. This is the first time I've used gmail and so far I hate it. I pressed everything looking for something that looks like what you guys post. Anyway I have copied this below,
_______________________________________________________________________
Re: Reply to your "2006 Ford Focus LS LX 2.0 litre manual 23,670 km" Ad on Gumtree

fromFrancisco Striati <[email protected]>
[email protected]

to [email protected]

dateThu, Jan 8, 2009 at 10:41 PM
subjectRe: Reply to your "2006 Ford Focus LS LX 2.0 litre manual 23,670 km" Ad on Gumtree
signed-byrocketmail.com

hide details Jan 8 (1 day ago) Reply


Hello,
The vehicle is in excelent condition as it's presented in the add.
I have it for sale since June and i had all kinds of enquiries and but i couldn't find a serious buyer .
Everybody asked me for the vehicle vin and engine numbers and then i've never heard from them again or worse they advertise it for more money.
Please reply only if you are interested and if you ask me for numbers or vehicle papers before the purchase i will not respond !!!
The price includes freight tax !!
I've worked in Australia for the last 2 years and I've purchased it there. My company wanted me back home, so currently I'm in Milano,Italy. I've brought the vehicle home with me and it's now located in Italy since Jan 2008 and still has Australian Rego !
I always kept it in my garage,away from bad weather and it looks gorgeous.
It's my personal vehicle.No money owning ,no finance !!!!
I've decided that it's better to sell it because I don`t use it anymore (the steering wheel is on the right side and it' very difficult for me to drive it), it `s a pity to keep such a vehicle and not to use it.
Now I'm trying to sell it back for such a low price because next week I have a deadline term for paying those taxes.
I tried to sell it in Italy , but nobody want to buy a right side steering wheel car.
We can use an escrow agreement to facilitate payment so that we both can be 100 % protected.
http://www.escrow.com/solutions/escrow/process.asp
I will also supply some more pictures as soon as i get home from work.
If you are interested , please reply with the following information's in order to arrange shipping at DAS airfreight department:
-Your full name ;
-FULL delivery address(with postal code);

Regards ,
_______________________________________________________________________________________

If this isn't what you asked for, can you please point me in the right direction. I'm going to be pretty useless if I can't find the simplest info to give to you guys and gals.

Thanks again

Mod edit: removed your email address. -Jillian

There is nothing fraudulent about escrow.com and it is one of the very few that are recommended to be used because of the vast amount of escrow fraud out there.

However, it doesn't mean that you're not dealing with a scammer of some sort. The email you posted is in the typical format of a Romanian auction scammer. He may have another trick up his sleeve that he may try as soon as you agree to do an escrow of some sort.

There certainly are bogus escrow sites, but that link takes you to a genuine one. Scammers do sometimes quote legitimate businesses to make their scams look genuine, but this one certainly won't be using http://www.escrow.com.
Googling "I always kept it in my garage,away from bad weather and it looks gorgeous" comes up with seven hits
click here
So it's certainly a scam.

EDIT: rocketmail.com may sound impressive, but it's still a free Yahoo email service.

@ Mazzy999, if you're using Gmail and want to see the headers, go to the top of the email, move over to the right, to where there's the word "reply." Next to that is a down arrow. Click on the down arrow and then on "Show details." The entire email will come up in a new window (at least it does for me), including the headers.

Hope that helps.

Thanks for the replies.

Holly, a special thankyou to you. Just what I needed!!

Here is the the header:
______________________________________________________________
Delivered-To: [email protected]
Received: by 10.210.78.17 with SMTP id a17cs1083233ebb;
Thu, 8 Jan 2009 08:27:47 -0800 (PST)
Received: by 10.150.217.14 with SMTP id p14mr2264158ybg.46.1231432065725;
Thu, 08 Jan 2009 08:27:45 -0800 (PST)
Return-Path: <[email protected]>
Received: from n1.bullet.mail.re4.yahoo.com (n1.bullet.mail.re4.yahoo.com [206.190.56.20])
by mx.google.com with SMTP id 9si1659999gxk.44.2009.01.08.08.27.44;
Thu, 08 Jan 2009 08:27:44 -0800 (PST)
Received-SPF: neutral (google.com: 206.190.56.20 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=206.190.56.20;
DomainKey-Status: good (test mode)
Authentication-Results: mx.google.com; spf=neutral (google.com: 206.190.56.20 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]; domainkeys=pass (test mode) [email protected]
Received: from [68.142.237.88] by n1.bullet.re4.yahoo.com with NNFMP; 08 Jan 2009 16:27:44 -0000
Received: from [67.195.9.83] by t4.bullet.re3.yahoo.com with NNFMP; 08 Jan 2009 16:27:43 -0000
Received: from [67.195.9.104] by t3.bullet.mail.gq1.yahoo.com with NNFMP; 08 Jan 2009 16:27:43 -0000
Received: from [127.0.0.1] by omp108.mail.gq1.yahoo.com with NNFMP; 08 Jan 2009 16:27:43 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 98120 invoked by uid 60001); 8 Jan 2009 11:42:00 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=rocketmail.com;
h=X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type:Message-ID;
b=0dNeTQM0wzA+Bk1LlijUUOMr7GLwCIgU/rpGl/6t3IE/mx0GBvnUW6JNwHFY+OH5eGQFMhVN9mfja2ddfKlGS08xwwy66d94daQI7/CPhwlaa6wChNUdJJmz/7Bj8tuq1o40YC1fV+LxST5q8TizteQCXutcppwxeewHakAMgBM=;
X-YMail-OSG: yI1OxaIVM1lmAwHpoKgJqHuXrHNZS75xrQgAsq1lE.tuNygklClVb3bBoRfjKp5gE9ljC.H047y.Hu25jIVec92BhSq_2gL0KvbeKKnHJX61C52jj_sv6mwyenYJW5XcuIgtcuWNQPQfOYKxMaSk3m6iJzIuLIfzDTOkiuG0HfXtBo6FNDTllJ_8kigvOnc-
Received: from [172.130.220.101] by web112211.mail.gq1.yahoo.com via HTTP; Thu, 08 Jan 2009 03:41:59 PST
X-Mailer: YahooMailWebService/0.7.260.1
Date: Thu, 8 Jan 2009 03:41:59 -0800 (PST)
From: Francisco Striati <[email protected]>
Reply-To: [email protected]
Subject: Re: Reply to your "2006 Ford Focus LS LX 2.0 litre manual 23,670 km" Ad on Gumtree
To: [email protected]
In-Reply-To: <457579334.1231389796364.JavaMail.v3intl@ph-v3class023>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1408991078-1231414919=:92846"
Message-ID: <[email protected]>

--0-1408991078-1231414919=:92846
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
________________________________________________________________________________
Cooool. There you go Tambourine Man!!

Which bit of all this mumbo says where it comes from? What info do the smart folk get from this?

I know this is simple stuff but I'd really like to know. So far the info I've looked up on the net is another language.

I expected that the link in the email from took the victim to a fake site (uncle Laddy) that would confirm the deal etc. So far I have not led the lad past this stage. The emails stop. I use gmail now, but still No replies after I send my details. So I am not sure what happens next. Thanks heaps for checking out the escrow site. I hope to be able to do it for myself someday!!!

Have a good weekend!

It's usually the last IP address in the headers

Received: from [172.130.220.101] by web112211.mail.gq1.yahoo.com via HTTP; Thu, 08 Jan 2009 03:41:59 PST

It belongs to AOL which doesn't help. A rocketmail email shouldn't show as coming from AOL. There are ways of faking email headers to conceal where the email came from and some lads seem to be using them lately.

http://www.nextwebsecurity.com/HeaderTool2-pub.asp is useful for analysing email headers. Paste them in and it does all the work for you.

Thanks so much for all your help.

I did find a tool that checks headers. The emails are coming from the USA where these lads ought not to be.

Wow! I can't believe I did that for myself. There IS hope for the hopelessly IT challenged thanks to you all! HOORAY!

Cheers

Mazzy,

Another way to check some of these out is to google some of the more unique writing in the response. I did just for the heck of it, and check out what I found--your letter, word for word, tied to a different car ad.

http://adelaide.gumtree.com.au/c-Cars-for-Sale-cars-5K-Please-Read-re-scam-artists-amp-their-phony-cheap-cars-W0QQAdIdZ97755259

Since the escrow site appears to be legit, the best way to find out what these people are up to is probably a short (but safe, with absolutely no identifying information) bait. My guess is they probably offer to handle all of the escrow details for you, and they will swap out their fake escrow site for the real one.

Thanks all for the replies.

Dotti, I am stuck on progressing the bait further to see what happens. I can only waste their time up to this point. I still have lots of fun manipulating these boofheads that repond to just about everything you tell them.

I still have to learn how to make the lad believe I have sent the payment through WU.

I would go to a real WU office and pay cash. So this must be real. I guess that the lad produces ID and gets the money via cash or cheque at the other end. Then I'd expect more requests for fees. Eventually I'll start chasing my money only to find that the details given to WU are fake.

I'm trying to think of a cunning plan that leads to some real account info or ID to get a bust... that's my holy grail. All ideas and clever plots welcome!!!

Thanks all.

Who are they asking you to WU the money to? Escrow.com allows you to process payments online, so if they are asking you to WU money, then it is already obvious where they are going--standard advance fee with fake escrow.

Have you joined 419 eater? If you haven't, I would suggest you pop in over there, as there are some wonderful tutorials over there on how to deal with WU.

my scam from gumtree.com.au

its FULL os scammers there.

-------------------------------
Hello ,

Thank you for your enquiry regarding my vehicle.
The vehicle is in perfect working condition i'm the only owner and it has 2009 Rego so you will have no problem registering and licensing the vehicle.
I've worked in Australia for the past 3 years and since the birth of my son in January 2009 i came home to Italy.
The vehicle is in Australia at DAS freight department and i have full access(i can deliver the vehicle anywhere in Australia).
I will arrange delivery on my cost to your home address and you will have a 5 days period for inspection.
The total price includes (stamp duty, registration, transfer fee, and insurance).
We can use an escrow agreement to facilitate payment so that we both can be 100 % protected.
http://www.escrow.com/solutions/escrow/process.asp
I will also supply some more pictures as soon as i get home from work.
If you are interested,please reply with the following information's in order to arrange shipping at DAS freight department:
-Your full name ;
-Full delivery address(with postal code);

Regards ,

Maurizio Valtena <[email protected]> (scammer)
--------------------

Hi Beaks,

One of my neighbours fell for the same scam and lost a little under $10,000 because of it.

I found out about it a day too late, I immediately asked them to contact Western Union and the money had been picked up litterally hours before.

A continuation of the scam is to contact you telling you there are addoinal unforseen taxes to be paid and if you dont pay these taxes you wont be able to get the car, lucky for my neighbours I had advised them of that and the yignored all future emails.

You have mentioned but i hope you realised before sending money.

Thanks for postin, the details you have posted may prevent somebody else from being scammed.

I should also point out that all auction sites have their problems so beware of all of them.

We do have an auction scam section, if you are going to do any buying from auction sites, take a look through them so you can pick them up without losing money, some of them look quite convincing

In response to a query about a car on gumtree.com.au :

Hello ,

Thank you for your enquiry regarding my vehicle.
The vehicle is in perfect working condition i'm the only owner and it has 2009 Rego so you will have no problem registering and licensing the vehicle.
I've worked in Australia for the past 3 years and since the birth of my son in January 2009 i came home to Italy.
The vehicle is in Australia at DAS freight department and i have full access(i can deliver the vehicle anywhere in Australia).
I will arrange delivery on my cost to your home address and you will have a 5 days period for inspection.
The total price includes (stamp duty, registration, transfer fee, and insurance).
We can use an escrow agreement to facilitate payment so that we both can be 100 % protected.
http://www.escrow.com/solutions/escrow/process.asp
I will also supply some more pictures as soon as i get home from work.
If you are interested,please reply with the following information's in order to arrange shipping at DAS freight department:
-Your full name ;
-Full delivery address(with postal code);

Regards ,
Biagio Norine

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Sound surprisingly similar?