LATE FOR ME BUT NOT FOR OTHERS

My story started with some questions of how dating site running 5 months ago. I was immediately received a note after account activated, later I found guy who interested and extreamly in love with me is "Dr. Steve Berndard" who claim himself as one of Board Director at Jenny Bestway Hospital - http://www.jennybestwayhospital.com We absolutely deeply quick in love each other, it took about one month he has asked me to help him fix his problem .... by transfer money to my account. OMG!!! after known how big amout he will transfer me, we were seriously talked, money is not what I want and expected. Times pass by, with on and off fighting and loving .... and keep asking myself coz I feel something doesn't make sense while strong relationship seriously happen. How a smart guy he is? I finally lost total USD 8,000 sending money to belows account.

BANK NAME: BANK SIMPANAN NASIONAL(BSN)
ACCOUNT HOLDER NAME: FARIDAH BINTI KARON
ACCOUNT NUMBER: 14175-29-00006184-6
ADDRESS BANK: NO 12A JALAN TENGAH
BANDAR BARU SRI PETALING,57000 KUALA LUMPUR
SWIFT CODE: PHBMMYKL.

Name of Receiver: Daniel Dove.
Address: #36 JALAN KEMBARA
BUKIT BINTANG, 32000,
State: KUALA LUMPUR.
Country: Malaysia.
Source: Western Union Money Transfer.

Gang of Dr. Steve Bernhard who I have contact with are:

1. Dr. Steve Bernhard ... let's have a look his photo - No. 5 on list of Board Member http://www.jennybestwayhospital.com/board_members.html
His contact no. is +447031810396
Email address: [email protected] and [email protected]

2. Bsn Merchant Bank Bhd.Malaysia
Mr.Hassan Ahmed
c/o International Remittance Dept.
[email protected]
[email protected]
(+60)122462344

3. Mr. Edward Parrish
International Claim Manager
Barclays Offshore International
Mailto: [email protected]
Tel: +44 700 596 4377 / +44 700 596 4377
Fax: 070 0596 4377

Sample ....

Sir/Madam,

Here is acknowledging the receipt of your correspondence and your details has been stored in our data base.

In continuance towards the process of your account activation,below is your account User Name and Password to Access your account, you can now transfer any amount of Money into your account.

To have a full access to your account,this is your coordinates.

User Name: xxxxx
Password: xxxxx

Go to www.bsnmerchant.com and click on the login page to login into your account with the provided account user name and password.

You are strongly advised to keep your user id and password away from any 3rd party as our institution will not be hold responsible for any loose of fund.

And you are also advise to inform us before and after making transfer, also alert us on how much you are transferring and to which destination, this is for security reasons and to make sure we are authorizing the transfer to the right person.

All verifications should be forwarded to this department only for client/bank confidentiality purposes.

Sample ...How are you doing my darling,

I really miss you a lot darling, i am looking forward to spending time with you to part no more in the nearest future. I am looking forward to the day i will hold your hand, be with you, gently touch your face and cup your cheek in my hand as I look into your beautiful eyes.

I want to snuggle and cuddle with you, to just be close to you. I want to rub your leg and stare across the couch as we talk of our feelings for one another. I want to hold your hand across the table at a restaurant. I want others in the restaurant to be jealous of our intimacy and our tender affection for one another. I want to romance you. I want you to know how beautiful you are in my eyes. I want you to know how much I cherish and adore you. I want to give my heart to you. I want your heart, I want it all.

Take good care of yourself always.

Yours ever,
Dr. Steve.

And that one is stolen from here: http://www.romanceforeveryone.com/love-letters/i-miss-you.html

Could you post the full headers from one of his emails? We may be able to tell you where he was really writing from. I'm guessing it will likely be Malaysia in this case, since one of the money transfers went to Malaysia. The writing itself suggests African--but there is a pretty large number of Nigerians scamming out of Malaysia--generally they have entered the country on student visas.

His main contact address is [email protected]

I was disconected him, change my contact no, leave the company where I worked also city where I live before.

I was very much worry coz he's know everything happen in my life, unlucky as I was trust him and I can say that he's very smart guy who well trained on Phychology and Medical Skills. He has a copy of my passport, many of my sexy pics

He was tried hard to contact me via any channel he has on hand. Well I have told myself to face and fight with him if necessary; I also have to respect my decision on whatever happen. Nothing concerned money but my reputation. To make me strong, I'm again chat with him via above address but not event let him know where I am and of course keep asking my new contact no.

I have two more fake documents which is unable to public coz is risk for me. Not sure if the Admins. here need it or not, just let me know on how I can share.

Opp!!! What you need is a full header right?

1. Steve BernhardFrom: [email protected]
To: xxxxxxx
Subject: xxxxxxx
Date: Mon, 6 Dec 2010 16:13:53 +0000

2. Hassan AhmedDate: Fri, 29 Oct 2010 20:51:28 +0800
Subject: RE: Money Transfer
From: [email protected]

3. Edward ParrishDate: Tue, 28 Sep 2010 09:17:17 -0400
From: [email protected]
To: xxxxxxx
Subject: xxxxxxxx

Welcome Amita, yes full headers help us determine the location of the scammer. I am sorry for you loss. The scammer is interested in getting more money from you. You are best to stop communicating with him at all.

Typically, a scammer will threaten to embarrass you with details they gain. All they are interested in gotting money form you or others. If you block and ignore him he will go away.

He may have a way of using your pictures and passport on someone else, or he may sell the information so someone else can use the information. For the most part, scammers are interested in getting money and don't spend time retaliating against victims who drop them. It happens to them all of the time.

Please do not keep in contact with this person. They will fabricate and lie to you and make you feel worse.

Know that by posting the information here, you will hurt his scamming operation. Thank you for sharing your experience.

Hi Amita and welcome to ScamWarners. I am glad you are here.

First off, I wanted to let you know that the fake hospital website, http://www.jennybestwayhospital.com/index.html has been suspended by the hoster for fraudulent activity.

Second, I see that you have another scam email domain here: [email protected]

Domain Name: MUTUALTFAM.COM
Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server: whois.PublicDomainRegistry.com
Referral URL: http://www.PublicDomainRegistry.com
Name Server: NS1.BYETHOST30.ORG
Name Server: NS2.BYETHOST30.ORG
Status: clientTransferProhibited
Updated Date: 29-apr-2010
Creation Date: 29-apr-2010
Expiration Date: 29-apr-2011

This one will also be taken care of, however because it is a domain being used for email activity only (there is no evidence of a scam on the actual website http://www.mutualtfam.com/ we need a copy of the email sent to you from that address, including the headers.

What you posted above isn't the header for the email. Usually to get the header of the email you have to click something like 'Show original' (in gmail) or 'Full Headers' (in yahoo) or with hotmail you use the little drop down menu on the right by 'Reply' and pick 'view message source'. If you need more help with finding the header, post back what email program you use and someone can help you.

Once you have the header, please post it up and the email and one of the site killers can work on getting the scam domain closed down.

Thank you Dora for that great report. Fake Site Killers have my utmost respect!

Yes, a header is much more than the email address. Here is some helpful information about Headers:

Useful links
How to read email headers
How to find the headers for your email provider

The following header is from Steve Bernhard via address [email protected] who is my romantic scammer and open the show asked my assistance for money transfer from his account into my account.

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MDtTQ0w9MA==
X-Message-Status: n
X-SID-PRA: Steve Bernhard <[email protected]>
X-SID-Result: Pass
X-AUTH-Result: PASS
X-Message-Info: JGTYoYF78jF06CIQbOmbmiIGB7uFz09/rDaO95kpwppZvvYjagvWHhjpZIbfU7zmb+7xd1R8TK0aQE+BWP5N9JBuXDqaNopBo22EMfGbHW3Y99bHH0wbBQ==
Received: from snt0-omc3-s17.snt0.hotmail.com ([65.55.90.156]) by snt0-hmmc2-f14.Snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Wed, 8 Dec 2010 06:37:29 -0800
Received: from SNT132-W63 ([65.55.90.136]) by snt0-omc3-s17.snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Wed, 8 Dec 2010 06:37:28 -0800
Message-ID: <[email protected]>
Return-Path: [email protected]
Content-Type: multipart/alternative;
boundary="_71b9e20a-5578-4650-a558-e0c0c87791a8_"
X-Originating-IP: [212.227.103.74]
From: Steve Bernhard <[email protected]>
To: xxxxxxxxx
Subject: xxxxxxxxxxxx
Date: Wed, 8 Dec 2010 14:37:28 +0000
Importance: Normal
In-Reply-To: <[email protected]>
References:
<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<BAY156-w754A0B529D3EA0,,,
,,,,,,,,,,,,B,,4,4,[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>
MIME-Version: 1.0
X-OriginalArrivalTime: 08 Dec 2010 14:37:28.0893 (UTC) FILETIME=[707A46D0:01CB96E5]

--_71b9e20a-5578-4650-a558-e0c0c87791a8_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

The following is from [email protected] who act as a bank in Malaysia and keep follow up for money, give me password & pin acces to showw me an account can activated. Last contact by him, he has sent me a bullshit warning letter from FBI and of course ask for more money.

X-Message-Status: n
X-SID-PRA: [email protected]
X-AUTH-Result: NONE
X-Message-Info: JGTYoYF78jH4JYiNEEy4aIGKs5iIbh2hFhVps3/ST5ApekIF/19PYlXrkhO7mv/Wy0vh64uGK9s5QoZ4oOuj9hSAau4VV0XN
Received: from ns78.small-dns.com ([210.5.47.137]) by col0-mc3-f32.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Sun, 10 Oct 2010 22:52:21 -0700
Received: from WIN08.small-dns.com ([127.0.0.1])
by ns78.small-dns.com
with hMailServer ; Mon, 11 Oct 2010 13:52:17 +0800
Received: from webmail.bsnmerchant.com ([127.0.0.1] helo=webmail.bsnmerchant.com)
with IPv4:25 by WIN08.small-dns.com; 11 Oct 2010 13:52:17 +0800
Received: from 60.51.95.161 ([60.51.95.161])
(SquirrelMail authenticated user [email protected])
by webmail.bsnmerchant.com with HTTP;
Mon, 11 Oct 2010 13:52:17 +0800 (Malay Peninsula Standard Time)
Message-ID: <[email protected]>
In-Reply-To: <[email protected]>
References:
<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<BAY156-w25C37D20723C910E8
[email protected]> <[email protected]>
Date: Mon, 11 Oct 2010 13:52:17 +0800 (Malay Peninsula Standard Time)
Subject: xxxxxxxxxx
From: [email protected]
To: xxxxxxxxxx
User-Agent: SquirrelMail/1.4.8
MIME-Version: 1.0
Content-Type: multipart/alternative;boundary="----=_20101011135217_42444"
X-Priority: 3 (Normal)
Importance: Normal
Return-Path: [email protected]
X-OriginalArrivalTime: 11 Oct 2010 05:52:21.0745 (UTC) FILETIME=[78CB8610:01CB6908]

------=_20101011135217_42444
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit

Last header via this address [email protected] was act like Bank in UK who handle for Steve's money transfer and asked me to open new account under my name and once I refused, he has kick me to bank in Malaysia as above info.

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0wO0Q9MDtTQ0w9MQ==
X-Message-Status: n
X-SID-PRA: Barclays Offshore Bank <[email protected]>
X-AUTH-Result: NONE
X-Message-Info: +e7wKwQ9gXWJg0whE40jUhmlFH9iKJpNNdV+7f7MQSLtSswDiMEH6qc80ZcGgaX7VvRckEBeczd1ZEFbLO3xlFaR3N2bhDM5RrfL97650Ck=
Received: from sv30.byethost30.org ([173.45.82.231]) by col0-mc1-f30.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Wed, 29 Sep 2010 00:47:23 -0700
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=mutualtfam.com;
h=Received:MIME-Version:Date:From:To:Subject:In-Reply-To:References:Message-ID:X-Sender:User-Agent:Content-Type:X-Source:X-Source-Args:X-Source-Dir;
b=Gxja9/uoIeAol15Wfo+KdXjmHplSel1Cq7HT6VXVmVN33YJiR0MvCwWsgmRMFkQGlKhZJuzd5APPOFLxPFUzKJaGCilYqApddvvp0ROPJZd+voUnBXrY+oUfOpc1SBpk;
Received: from localhost ([127.0.0.1]:14498 helo=webmail.mutualtfam.com)
by sv30.byethost30.org with esmtpsa (TLSv1:AES256-SHA:256)
(Exim 4.69)
(envelope-from <[email protected]>)
id 1P0rNq-0000Q9-MO
for xxxxxxxx; Wed, 29 Sep 2010 03:47:22 -0400
MIME-Version: 1.0
Date: Wed, 29 Sep 2010 03:47:22 -0400
From: Barclays Offshore Bank <[email protected]>
To: xxxxxxxxx
Subject: xxxxxxxxxx
In-Reply-To: <[email protected]>
References: <[email protected]>, , ,
<[email protected]> <[email protected]>,
,
<[email protected]> <[email protected]>,
<[email protected]> <[email protected]>
Message-ID: <[email protected]>
X-Sender: [email protected]
User-Agent: RoundCube Webmail/0.3.1
Content-Type: multipart/alternative;
boundary="=_d7e0d6bb9904edf3e83e10bb550d1445"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - sv30.byethost30.org
X-AntiAbuse: Original Domain - hotmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - mutualtfam.com
X-Source:
X-Source-Args:
X-Source-Dir:
Return-Path: [email protected]
X-OriginalArrivalTime: 29 Sep 2010 07:47:23.0876 (UTC) FILETIME=[8DD42240:01CB5FAA]

--=_d7e0d6bb9904edf3e83e10bb550d1445
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset=UTF-8

Thanks for posting those headers Amita! Could you also post the e mails where these headers are from? Especially the e mail where the scammer is asking for money. With that information our fake website experts can start working on it.