Indentity theft via UPS account

A few weeks ago I got a call from my credit card company about fraudulent charges to my account. The account was canceled immediately and a new card was issued. I thought that was the end of it.

A week later a received a package from UPS with my name on it. Inside was a check made out to someone I do not know. Upon further inspection, it appears that my name and address were listed as the sender. According to the tracking information, this package was refused by the recipient and returned to my home address. A few days later, three more such packages land on my doorstep.

I eventually got in touch with a UPS security representative who has been very helpful. It appears that a fraudulent shipping account was opened in my name using my address and credit card. The account is now canceled and marked as fraudulent and the local driver has been instructed not to deliver any more of these to my house. The UPS representative explained that this is part of a multi-national check fraud ring where "mules" inside the US are hired to send these checks to "customers" of this fictional overseas company.

Looking more closely at the fraudulent credit card charges, it appears that someone opened up a "employer account" on a classifieds website for college students. This allows them to post job openings to all colleges in the US. I logged on to this website and found two very suspicious looking job postings (financial account and ebay partner for an overseas company.) I notified the website about this, but I have not heard back. It appears these job postings are to recruit more unsuspecting mules to send out more checks.

I called the local FBI office, who said if it came in the mail I should call the US Postal Inspector. The US Postal Inspector said UPS is out of their jurisdiction. I filed all of this information (with specific details) on the ic3.gov website.

I have also issued fraud alerts to all three credit reporting agencies, and I have an active subscription to a credit monitoring service.

I filed a police report with my local police department. Although it is very difficult to prove, they think my identity was stolen several days before when checked in to a hotel room while at a friends wedding. It makes perfect sense. They got my name, address, phone number, and credit card at check-in. Due to a flight delay I had to check-in at 3am when no one else was around except for one very mean lady behind the counter.

Up to this point I have not encountered any financial loss, but I have wasted countless hours on the phone and writing e-mails to clear my name.

Fortunately, the phone number listed on the return address is slightly different than my actual number. However, I do worry about a backlash when innocent people try to cash these fraudulent checks that they think I sent.

Hi Just another


Welcome to ScamWarners

Sorry to hear you have been caught up in this.

Your is a familiar strory, played out every day around the world as scammers continue to ruin people's lives.

While it may be that the Hotel has done things with your credit card details, it is more likely that it was gathered a different way. These scammers are very good at what they do and have many ways of gathering this information without you knowing.

It sounds like you have done everything right since, but perhaps have your computer checked for keyloggers, I am not the best one to explain these but in simple terms (the only ones I understand) its a virus that can be used to gather your information from your computer, if you do internet banking, there is a good chance it is the key logger that got your credit card information and if not removed it will also get your new details.

Take care, and if you have any questions please ask.

Hi justanother and welcome to ScamWarners.

Again, like Ralph said, I am sorry this happened to you and I am sorry to have met you this way. But I am glad you are here now and it seems like you have done all the right things to start to take control of the situation.

You mentioned several websites where they may have used your information to post these job scams. Might you be willing to share these sites? If they are fraudulent job scams and they are posted here, then when someone googles them, the google search would lead them here and possibly help prevent further victims of these awful check scams.

The more information that we make available to others, hopefully less people will get scammed.

Take care and check back with us often.

Ralph: Thanks for your suggestions. My computer is very much up to date with the latest anti-virus/anti-spyware with frequent scans. I'll never really know how my info was stolen. It could have been from an online merchant, one of the many corporate security breaches (Heartland processing), a keylogger that the scans didn't find, or a low-tech photocopy at some place of business (hotel/restaurant.) The police seem to favor the low-tech methods, but I don't know. Once this information gets on the internet, I understand that it can be bought and sold many times before being used.

Dora: The company with the job posting website is called uloop.com. It is a legitimate website where employers can pay $275 to post jobs ($550 was charged to my credit card.) There are several suspicious looking job postings on that web site. You'll need a .edu e-mail address to join. I've tried to contact the site administrators, but so far I am being ignored.

I hope that this information will help someone else who may be taken by these scammers, either through identity theft, through one of these job postings, or through the receipt of fraudulent checks.

Thanks for that information, justanother.

Since I cannot sign on to Uloop at this time (I might be able to later. ), I just wanted to check back and mention this: DId you contact Uloop through their contact form here: http://www.uloop.com/contact.php or did you send them an email here: [email protected]?

I would certainly mention in the email to them that you believe the ads violate their own TOU (Terms of Use), in particular:

USER agrees not to post, email, or otherwise make available Content:

i) that is false, deceptive, misleading, deceitful, misinformative, or constitutes "bait and switch";

And per their own TOU:

ULOOP, in its sole discretion, has the right to delete or deactivate any USERS account, block USERS email or IP address, or otherwise terminate any access to or use of the Service (or any part thereof), immediately and without notice, and remove and discard any Content within the Service, for any reason, including, without limitation, if ULOOP believes that any USER has acted inconsistently with the letter or spirit of the TOU.

So they just need to do something about it.

Hopefully, I will get a chance to take a look at this Uloop. This is the first I have heard of it and while the concept seems great, the potential for abuse, especially with some of these check scams with our young adults who might need a little bit of extra spending cash, seems ripe.

Dora,

I used the contact link, but I just sent an e-mail with the same information to [email protected]. Hopefully I'll receive a response. These things are best handled over the phone, but I cannot find a phone number anywhere on that website.

Here is one of the fake job postings (the other appears to have been deleted):

Dear,

My name is Linda. I'm looking for a business partner.

If you have an ebay account with good feedbacks or you have an ebay store, we can have a good business despite the financial crisis! You’ll get even more feedbacks.

You'll do extra 1500-3000usd per month

It's up to you.

No investments are needed!

We can do 'test'.

For more information email directly to me at [email protected]

Thank you!

L

There is no way that this can be legitimate. The remainder of the 200 or so job postings appear to be real.

I was informed by the UPS representative that they found a young college person working as a "book keeper" for an overseas company. This person got something like $1200/month just for sending out a hundred or so of these fake checks.

Here is the reply I got from this scammer:

Delivered-To: [email protected]
Received: by 10.204.68.203 with SMTP id w11cs119512bki;
Sun, 17 May 2009 05:07:59 -0700 (PDT)
Received: by 10.114.167.3 with SMTP id p3mr8892507wae.127.1242562078579;
Sun, 17 May 2009 05:07:58 -0700 (PDT)
Return-Path: <[email protected]>
Received: from web111819.mail.gq1.yahoo.com (web111819.mail.gq1.yahoo.com [67.195.22.64])
by mx.google.com with SMTP id v25si1432828wah.67.2009.05.17.05.07.56;
Sun, 17 May 2009 05:07:57 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 67.195.22.64 as permitted sender) client-ip=67.195.22.64;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 67.195.22.64 as permitted sender) [email protected]; dkim=pass (test mode) [email protected]
Received: (qmail 97640 invoked by uid 60001); 17 May 2009 12:07:56 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1242562076; bh=L5xPz6hPlo8trczCtLJYLVHqpy9SXMXBGjRTD4fqfIw=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; b=loJaWrMTrur3P0jLfNsvEfjPghpki9dTJ7TV4xZy6uiPBts3VbIvO1LLA1VGFyVATArrNVucuAf6/bO6OgFoPjwUc/Vl0F4rgeT4G8jo7K8xfS+wTgGh0eYshi++efYeWUFQYdTzZ/WiPOXhGmbC28uNTW3hL+Nsj5W9Cbq+3uA=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type;
b=OpbQpQuraWMdB/TnvlbGbh7gK8atyrIulILHoPNxYVkYqSQrxniQbd50Q3V7T4OhLl1XyvZO+UoLjSDmJ+1Oe7lloJM/MDfI6RdlQoP9kCRwnuG4c6F2N/smfc4Qv21IdGwcn7HFq7WvmK884/qlU2wHDPL1IQVeJ65/5nWbBss=;
Message-ID: <[email protected]>
X-YMail-OSG: v1BJDXUVM1maAtrayq4EVtrm1IJLEk7RpX8EVji.O0afKX.JEQX4APrwK0V9avjSmbr6w_jO7eaQ5ANtiu9x7I3cttZo5zEjutdxo9.PR4znPB16swiZt5DQdjrCkdPt8MmcdpEKdTlvI9txzN21axS.Op1ddOeyzriH5EYd6oc5R6.H.EsZ_6Jl4iPO8jVJ5164OF5ibIK3KkjB8Ox3X2qcokEnO5zKg0Eff1NAvs9cSSJZ8e3k.Qv.j6gZs3zXHb6lhKlaOdT8W8DY2m9T8enRW9DCcPQSpbQKFS.oxoeHP2KB_Q--
Received: from [196.207.9.58] by web111819.mail.gq1.yahoo.com via HTTP; Sun, 17 May 2009 05:07:56 PDT
X-Mailer: YahooMailClassic/5.3.9 YahooMailWebService/0.7.289.10
Date: Sun, 17 May 2009 05:07:56 -0700 (PDT)
From: Willy Henderson <[email protected]>
Subject: Job Details
To: Janey <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-126080846-1242562076=:96351"

Good tidings to you as you read.

Please permit me to write you irrespective of the fact we have not met before. I got your contact through network online hence I decided to write you. I would be very interested in offering you a part-time paying job in which you could earn up to $5,000 a month as extra income. opening an account would have been my best choice if I was not working on a deadline that must meet a 24 hour turn around time, other options are not on my side due to time, money, and requirements.
This is why I am offering a part time opportunity to someone responsible who can supply prompt assistant and service.

JOB DESCRIPTION:

Work as my payment assistant in charge of collecting and processing the payments from the associates.

1. Receive payment (inform of money orders/checks) from my Clients/Associates.

2. Cash the Payments at your Bank

3. Deduct 10%, which will be your percentage/pay on Payment processed.

4. You will then forward the balance via Western Union Money Transfer according to my instruction.

REQUIREMENT:

18 years or older.

Responsible, Reliable and Trustworthy

Available to work a minimum 3-4 hours per week.

Able to check and respond to emails often.

Easy telephone access.

IS THIS LEGAL? YES

It is very legal, Doing this job is 100% safe and legal. I would be glad if you accept my proposal for an opportunity to make up 10% of each transaction completed.

Please reply via email with complete information as requested:

A. NAME:________________________________
B. STREET ADDRESS (NOT P.O BOX):________
C. CITY:__________________________________
D. STATE:________________________________
E. ZIP CODE:_____________________________
F. COUNTRY:_____________________________
G. MOBILE NUMBER:______________________
H. AGE:________________________________
I. SEX :________________________________
J. OCCUPATION:_______________________
K. E MAIL:________________________________

All replies should be sent to
[email protected]
Regards,
WILLY HENDERSON

I especially like this part:

IS THIS LEGAL? YES

Anyone reading this, please note, this is NOT legal!

Here is another great site that explains these check cashing scams in detail:
http://www.fakechecks.org/preventionWorkAtHome.html

Hi Justanother, Welcome to Scamwarners. I am very sorry to hear about what happened to you. I see that you found the thread on here about the woman in CA. While it is not pleasant to hear, it is better to be prepared than to have it hit you expectantly.

You wrote:

Fortunately, the phone number listed on the return address is slightly different than my actual number. However, I do worry about a backlash when innocent people try to cash these fraudulent checks that they think I sent.

Good thing "they" got the telephone number wrong, that saves you a bit. But if your telephone number is listed in the public telephone directory, you really should consider changing it or getting it switched to an unlisted number. The telephone number of the woman in CA is a listed number, which is how people who received the fake checks were able to contact her.

My two kids in college now, and it is really upsetting to me that these scammers are targeting that particular segment of the population. It is interesting, that my son had to switch his checking account last week, because somebody was making fraudulent charges on it. After hearing your story, I am going to check and see just what those charges were. The same thing happened to my daughter a few months ago. They both go to the same university, and I suspect that the scammers might have gotten their information from the school's computer system. Could that be a possibility in your case as well?

It looks like "Linda" has been around for a while and has several fake job postings out there. I did a google search and found:
http://www.google.com/search?hl=en&client=firefox-a&rls=org.mozilla%3Aen-US%3Aofficial&hs=jDT&q=%22My+name+is+Linda.+I%27m+looking+for+a+business+partner%22.&btnG=Search (mods please shorten the link to say click here - I don't know how to do that)

Here are some other email addresses and names "they" are using:
Linda Davis [email protected]
Linda Davis [email protected]
[email protected]
[email protected]
Linda Wright [email protected]
[email protected]

It looks like uloop pulled most of the ads that contained this scam. They now say that the listing has expired.

I'm not too worried about the phone. I don't have a land line and my cell phone number is not listed anywhere. I go out of my way to make sure no one gets my phone number unless they really need it. I try to enjoy a telemarketer free existence.

I don't think I'll ever really know how my information got stolen. Ultimately, it probably got bought and sold several times before ending up in Nigeria.

I have not heard back from uloop via e-mail, but I did mark those job postings as "inappropriate", which may have helped to get them taken down.

It is a shame that they target young people who probably need the money the most. I hope that by posting here I can help prevent someone else from getting caught up in all of this.

I think these people would scam their own grandmother if they could make a buck off of it.

I have not heard back from uloop via e-mail, but I did mark those job postings as "inappropriate", which may have helped to get them taken down.

I'm sure that helped a great deal.

It is a shame that they target young people who probably need the money the most. I hope that by posting here I can help prevent someone else from getting caught up in all of this.

In addition, college students are not very well versed in the real world. In fact, some are incredibly naive.

I think these people would scam their own grandmother if they could make a buck off of it.

Scammers are very non-discriminatory when it comes to their victims. They will certainly scam their own countrymen - I wouldn't be surprised to learn they scam their own family members.

This caught my eye as recently I've gotten 2 different emails from "UPS" claiming they have an undelivered package (gives me a shipping date) and if I want to claim the package, all I need do is print out the invoice that is in the attached zip file. Now the first one of these was from UPS with a supervisors name, etc. The second one was very laughable; it was from supervisor ABC, United States Postal Service. Then farther down it states "an undeliverable UPS package".....hello.....I work for the USPS! They're not going to send out emails about undeliverable packages! And NOT about UPS packages! My questions is what was the intent of the zip files? Is this some sort of scam to extract info from my computer as an identity theft attempt? Or was it malicious code? I trashed the 1st message and bounced the second. Has anyone else gotten any message like this? I'm curious as I was kind of thinking this was linked to a scammer I thought might be trying to destroy records I had in my computer. Maybe I'm just being paranoid, but I think he's capable of anything. I'll be glad to hear from anyone that has gotten any similar emails.

Biirrd,

These have been going around for a while. They aren't related to 419 scams.

They are malicious code, so if you have opened one, I would make sure you do a thorough scan of your system with an up-to-date antivirus program.

For more information you can check out the snopes write-up.
http://www.snopes.com/computer/virus/ups.asp

Yep,thanks. I found out through a not so fortunate friend that wasn't smart enough to just trash the darn thing. She told me it had a trojan horse virus in it. What on earth is wrong with the sick little people that do this stuff? What a small,twisted, disturbed world they must live in.

Just goes to show, the advice is sound...NEVER EVER OPEN FILES FROM SOMEONE YOU DON'T KNOW! And just use common sense....after all, this thing said it was an invoice....in a zip file? c'mon! I'm not a computer whiz....but I know darn well you don't need to put a simple invoice in a zip file. DUH!

I'm really thankful for all the people who post on this site; and the people who run it. What a tremendous service you all do.

Good advice biirrd.

Email viruses and worms are common. If you've not received one, chances are you will.

Here are steps you can use to help you decide what to do with every email message with an attachment that you receive. You should only read a message that passes all of these tests.

The Know test: Is the email from someone that you know?

The Received test: Have you received email from this sender before?

The Expect test: Were you expecting email with an attachment from this sender?

The Sense test: Does email from the sender with the contents as described in the Subject line and the name of the attachment(s) make sense? For example, would you expect the sender - let's say a frriend - to send you an email message with the Subject line "Here you have, "xxxxx" that contains a message with attachment - let's say AnnaKournikova.jpg.vbs?

A message like that probably doesn't make sense. In fact, it happens to be an instance of the Anna Kournikova worm, and reading it can damage your system.

The Virus test: Does this email contain a virus? To determine this, you need to install and use an anti-virus program.

You should apply these tests to every piece of email with an attachment that you receive.

If any test fails, delete that email.

If they all pass, then you still need to exercise care and watch for unexpected results as you read it.

I had a similar thing occur to me today. I responded to a Uloop ad for a Personal Assistant.

Here are the details:

Listing Description
We are seeking Innovative, Reliable, and Responsible Person who can handle Personal and business errands at his/her spare time. Someone who can offer the following services below;
* Filing
*Billing, Purchase Orders
*Scheduling
*Telephone Correspondence.
Must have extensive skills with Microsoft Excel & Outlook. Paid Internship an option. Possibilities for Permanent and Advancement. Email resume and residential address.

Wage / Salary
$15.00

Listing provided by
CHRIS GROUPS

I was suspicious that they asked for my residential address immediately so I just replied by quickly introducing myself and asked if the position was still available.

I got this response within hours:

Subject: THANKS FOR THE PERSONAL ASSISTANT RESPONSE. {Consider the Personal Assistant job yours}..... Reply asap

Message:
Hello,

How are you doing today? I received and confirm your mail with details. I really believe and hope I am dealing with a honest person in you, responsible and unique person to work with me as my P.A. YOU CAN CONSIDER THE JOB YOURS. I would love to meet up with you to talk about the job but I am currently away on business. I am presently in Australia for a short business trip so there will be no time for oral interview for now. I hope you are trustworthy and trusted applicant? I will pre-pay you in advance to do my shopping assignment. I will also have my mails and packages forwarded to your address. If you will be unable to stay at your house to get my mails, I can have it shipped to a post office near you and then you can pick it up at your convenience. When you get my mails/packages; you are required to mail them to where I want them mailed to. You don't have to pull money out of your pocket, all you have to do is have packages shipped to your house and do my shopping. You are allowed to open the packages to reveal its content. The content of the packages are computer parts and electronics, clothing business and personal letters. All expenses and taxes will be covered by me. You will work between 15 and 20hrs a month. I will gladly pay you $350.00 per task/assignment and I do have more than two assignments weekly. That is not a bad offer is it? I need your service because I am constantly in and out of town. I work in real estate and I own an Art Gallery in Australia too. I will return to USA by early January, 2011 so this process will be going on till i get back in the month of January. If you don't mind, I will meet up with you when I return and then we can talk about the possibility of making this job a long term.

I will email you the list and pictures description of what to shop for when I am ready. No heavy packages is involved! You can do the shopping at any nearest stores. You will be shopping for Electronics and clothing's. I will provide you my personal UPS account number for Shipping. All you have to do is provide my account number to any UPS office and shipping charges will be charge on my ups account. I will provide clear set of instructions for each task I need done as well the funds to cover them. I have an important business meeting coming up soon,so i have to go now to prepare. I will mail you more or call you later and more description of the Job. The funds package payment for your 1st job assignment will get to you soon and i will keep in touch, update you with tracking #, I will contact my client right away today to make payment and issue the pay check/ funds to you right away which i will instruct you on what to do soon. Once again, I believe in honesty and trust and i will be handing my trust to you and hope you don't screw it up and i easily trust fellow workers. The pay-check will be forwarded to you as soon as possible and I will appreciate quick response from you. Thanks and please get back to me asap and confirm this mail asap.

Kindly send the below details for assessment and registration to [email protected] ;

Full Legal Name :
Address ( NO P.O BOX ):
City :
State :
Zip code :
Country :
Mobile Phone #:
Contact Phone #:
Contact e-mail address:

NOTE : I NEED FAST AND URGENT RESPONSE FROM YOU EACH TIME I SEND YOU A MAIL OK. How often do you check your mail daily???

Regards,

Dr Christopher Berry.
[email protected]

I find it very suspicious that someone would entrust me with their business without asking for my resume or for a reference, so I reported it to my local police.