Aupair scam

Hello.
My name’s Lena, I’m 20, and I’m from Russia.
I’ve been scammed one month ago.
I registered at (on )the site www.aupair.com in the autumn 2007.
And now I have a big problem.
One day I was seeking out a family which would be interested in my candidature. In such a way I found Kerry Bullock, I wrote her, and she answered, she said that she needed an aupair urgently. Then we started to correspond with her. She wrote about her family, sent me her pictures and a scaned page of pasport, and then Kerry gave me the e-mail address of one agency which could allegedly help me to work out with all papers.
I know I should not have believed them, but it was some kind of mind dimness, I trusted them.
They asked for all their services 650 $, as they made it clear to cover all needs such as a visa, an insurance, etc. I was in some doubt about all this deal, I asked them for their address and phone number. They gave it to me; however they said that usually they don’t answer the phone.
I forgot to mention, the lady who was corresponding with me named Mrs. Mary Cole.
Then I trusted them, it was very silly from my side, now I understand it very clear. At the end of December I sent this money to Mrs. Mary Cole to London. One week passed and Mary Cole sent me a letter of congratulation where she reported that everything worked out, and now it remained only to pay another 350 $.
“You are however required to send to us the sum of $150 so that we can send all the documentations to you via courier since these are sensitive documents and are not supposed to be handled carelessly.

Also you will have to pay the sum of $200 for the registered members annual subscription so that we can secure for you your membership ID card as this is one of the things that will be required from you at the point of entry into UK.

Please send the sum of $350 via Western Union Money Transfer as you did before to Mrs. Mary Cole as soon as possible so that we can get your documentations very fast and proceed down here.”

We were very confused, I wrote to Kerry Bullock, and she said that I must sort out everything with the agency on my own because she is presently in Canada and she can’t help me.

I had no choice but pay. After that they didn’t answer me, neither Mrs. Mary Cole nor Kerry Bullock, nobody. No money, no hope, and only disappointment in my heart.

So, I know it’s only my fault. I was too naïf, it serves me right, but if there is any chance somehow to show them up. I would be very happy. Moreover I fear that I’m not the only one victim, as I remember the Kerry Bullock’s profile was added by many people.

So this is my sad story.



Thank you.

So, I know it’s only my fault. I was too naïf, it serves me right

This is NOT your fault, Tais. These scammers are very good at what they do, and the stories they use to con people can be very convincing. They troll through job sites, intentionally targeting honest people who are just trying to improve their lives, and offer them what seems like a perfect opportunity to do so. The au pair scam is one of the easiest to fall for, because it doesn't offer unrealistic millions of dollars for no effort, it simply seems like an honest job.

As for showing them up, you did exactly the right thing by posting your story here, and I thank you for that. Google spiders this site, and potential victims who get suspicious and do a search may well be spared what you have gone through. That said, please post the email addresses these scammers were using and the first email they sent, if you still have it. Doing so will make it easier for potential victims to find this thread before the scammers get their money. The best thing that you can do is to help spread the word about these scams. The more people we make aware of them, the fewer victims there will be.

I would also like to warn you about recovery scams, as it is not uncommon for same scammers to email a victim pretending to be with law enforcement and say that the scammers have been arrested and/or that they can get your money back. Please be aware that this is just another scam. They will tell you that there are fees to be paid in order for your money to be returned to you, then they will take your money and disappear. It is the scammers' way of trying to get every last cent out of a victim that they possibly can.

Of course I can post their emails, but it won’t help, because it so easy to change it (for them ).
Kerry Bullock [email protected]
Mary Cole [email protected]
So, is it possible to find justice to (on) these bastards? Is there any kind of law? Or all their actions are unpunished?
By the way, how do you think? Is the scanned passport (she sent to me) a fake one? Could it be another victim, which was before me?
So as I understood it is impossible to address to the UK police? Even if it was possible how I could do it, I live in Russia.
I was thinking, could it be that the person, who used the name Cole in my case, was the same one who scamed one lady who was looking for a new husbend ( i found her topic on your site).
any way, it was a good lesson for me. now I' ll never ever give any money to somebody I don't know!

Hi Tais, the scammer may not even be in the UK, of course, there is a chance they might be located here, but this scam comes mostly from places like West Africa and Eastern Europe, and Cole is a name used by many African scammers, can you post the full headers from a couple of emails that they sent to you? We can then pinpoint which country they are mailing you from by their IP address.

I Googled the email address [email protected] and found some of their adverts on Au-pair sites:

Google Results For: [email protected]

In the advert it gives a UK phone number, which is a London landline number:

Dear Aupair, I am in need of an au pair URGENTLY. Please mail me at [email protected] if you can be my aupair to take care of my kids. Thank you.

Pay: 200 pounds weekly
Contact: [email protected]
Phone: +442076429241

That number is from this UK providor:

+442076429241
Number billable as: geographic number
Country or destination: United Kingdom
City or exchange location: London
Original network provider*: ntl Group Ltd

But that does not actually mean the scammer is in the UK, as I say, thy could be in the UK, but people can buy 0207 London numbers on the internet, which they can then divert calls to that number to their mobile phone anywhere in the world, which is a common ploy in scams, they use UK numbers to give the impression they are located here, we see it a lot in fake bank scams.

Hi.
I'm sorry but I didn't get what means Full headers? what should i post? all email? all text? or what?

Hi Tais, what email service did you have when the scammers wrote to you, Yahoo, Gmail, Hotmail?

Let us know know what email service you used to receive the scam emails and we'll tell you how to get the full headers to post here.

the headers are sent with most emails and contain valuable information about the sender. I dont know which email you use but each has it own instructions for extracting headers from an email.


I will just go and get some instructions for the more common email domains for you

How do I find an IP address?

Finding an IP address.

Hotmail
On ther upper right hand side of the screen you'll see "Options". Click on it, then go to "Mail Display Settings". Where it says "Message Headers", change the option to "Advanced". Once that's done, click on "OK" and you'll see the headers of all the emails you get sent.

Yahoo
Open your email. Scroll to the bottom of it and click on "Full headers". There they are. Nice and simple.

Gmail
Open your email. Look for "More Options" next to the date the email was received. In the new set of options that pop up, look for "Show Original" and click on it. Your email will open up in a new page complete with headers.

Fastmail
On the same line as the subject, to the right of the screen you'll see "Show full header". Click it.

Using an external program to send and receive emails will send your IP address to the scammer as well. Only do this if you have emails already sent to you and you need to retrieve them for posting on the forum.

Outlook Express
I don't use OE myself, so if someone can confirm the method at http://www.wurd.com/cl_email_msie_headers.php works, please let me know.

Thunderbird
Open your email, hold down the Ctrl key and (while still holding it down) press U. Up pops a window with the headers.

MSN 7.5
Open the Inbox e-mail. Press Alt and Enter together presto there's the info.

Windows Live
Open up your inbox, right click on the email you want to check, then click on "View source".

If you have the new Yahoo, then this is how you check headers. Open the email and, where you see "compact header", left click and it'll give you the option to show the full headers in a window.


Edit, beaten again by SP

hi, guys.
Thanks a lot.
I use Rambler, i quess you even didn't hear about it =) check it out. www.rambler.ru
May be i should write to rambler service and ask.

Hi Tais, I have heard of Rambler, but as it's all in Russian language, I have no ide how to advise you to get the email headers, I have asked on our sister site at 419eater to see if anyone there knows.

[edit]

Well, it looks like none of the members on our sister site know about Rambler headers, probably because of the Russian language, but one member suggested this:

I'm not familiar with Rambler but would assume that there is a header option somewhere. Suggest the user should see "Headline" option - just click that "Headline" link ("Заголовок" in Russian).

Edit: To add that in mail.ru the option for full headers is behind a little graphic which toggles between 'TXT' for the body of the email text (текст письма) and 'RFC' for the full header (Заголовок)

Hi =)
I quess I found what asked me for.


Return-Path: <kbneedsaupair>
Received: from [81.19.66.150] (HELO mx6.rambler.ru)
by mail16.rambler.ru (CommuniGate Pro SMTP 4.2.10)
with ESMTP id 113875760 for [email protected]; Wed, 12 Dec 2007 20:27:55 +0300
Received-SPF: none (mx6.rambler.ru: 217.146.176.31 is neither permitted nor denied by domain of yahoo.co.uk) client-ip=217.146.176.31; [email protected]; helo=web26407.mail.ukl.yahoo.com;
Received: from web26407.mail.ukl.yahoo.com (web26407.mail.ukl.yahoo.com [217.146.176.31])
by mx6.rambler.ru (Postfix) with SMTP id AD43448301E
for <xxxxx>; Wed, 12 Dec 2007 20:27:54 +0300 (MSK)
(envelope-from [email protected])
Received: (qmail 66285 invoked by uid 60001); 12 Dec 2007 17:27:54 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.co.uk;
h=Received:Date:From:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID;
Long domian key snipped to prevent forum blowout - SP
Received: from [217.117.7.115] by web26407.mail.ukl.yahoo.com via HTTP; Wed, 12 Dec 2007 17:27:53 GMT
Date: Wed, 12 Dec 2007 17:27:53 +0000 (GMT)
From: Kerry Bullock <kbneedsaupair>
Subject: I need an aupair URGENTLY
To: [email protected]
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-2050588200-1197480473=:60258"
Content-Transfer-Encoding: 8bit
Message-ID: <770597>

--0-2050588200-1197480473=:60258
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit

Mod edit - edited to xxxxx out your email address - SP

another header from Mary Cole .


Return-Path: <royaltravel>
Received: from [81.19.66.157] (HELO mx8.rambler.ru)
by mail16.rambler.ru (CommuniGate Pro SMTP 4.2.10)
with ESMTP id 116339705 for [email protected]; Mon, 07 Jan 2008 19:43:45 +0300
Received-SPF: none (mx8.rambler.ru: 205.158.62.120 is neither permitted nor denied by domain of keromail.com) client-ip=205.158.62.120; [email protected]; helo=fallback.us4.outblaze.com;
Received: from fallback.us4.outblaze.com (fallback.us4.outblaze.com [205.158.62.120])
by mx8.rambler.ru (Postfix) with ESMTP id 625D544198C
for <xxxxx>; Mon, 7 Jan 2008 19:43:45 +0300 (MSK)
(envelope-from [email protected])
Received: from webmail-outgoing.us4.outblaze.com (webmail-outgoing.us4.outblaze.com [205.158.62.67])
by fallback.us4.outblaze.com (Postfix) with ESMTP id 63D731C02C40
for <xxxxx>; Mon, 7 Jan 2008 16:42:55 +0000 (GMT)
Received: from unknown (unknown [192.168.8.90])
by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id DCB0F1800129
for <xxxxx>; Mon, 7 Jan 2008 16:42:46 +0000 (GMT)
X-OB-Received: from unknown (205.158.62.133)
by wfilter2.us4.outblaze.com; 7 Jan 2008 16:42:46 -0000
Received: by ws5-3.us4.outblaze.com (Postfix, from userid 1001)
id 9492523C09; Mon, 7 Jan 2008 16:42:46 +0000 (GMT)
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="windows-1251"
MIME-Version: 1.0
From: "Royal Travel Agency" <royaltravel>
To: [email protected]
Date: Tue, 8 Jan 2008 00:42:46 +0800
Subject: Re: CONGRATULATIONS
Received: from [217.117.7.115] by ws5-3.us4.outblaze.com with http for
[email protected]; Tue, 8 Jan 2008 00:42:46 +0800
X-Originating-Ip: 217.117.7.115
X-Originating-Server: ws5-3.us4.outblaze.com
Message-Id: <20080107164246>

Mod edit - edited to xxxxx out your email address - SP

Hi Tais, the first set of headers shows that the IP address is from Nigeria:

217.117.7.115 = Nigeria

The second set of headers shows the email was sent from the same Nigerian IP address:

217.117.7.115 = Nigeria

Which means both emails were sent from the same Nigerian internet cafe by the same person using 2 different personas.

Could you tell me how it's possible. If I send the money via Western union to England how could he recive it in Nigeria? for getting money he had to show the ID, the passport to the bank, hadn't he? or there is some kind of gimmick?

Hi Tais, scammers often tell victims to send money to them in another country, in your case, the UK, as that fits with the scam they were pulling on you, the problem is that people should only be able to collect money in the country it was sent to, unfortunately, this is not the case, money sent via Western Union can be picked up just about anywhere if a scammer has the right contacts at Western Union, when Nigerian scammers are involved, they will pay bribes to people who work at Western Union outlets in Nigeria for them to cash the payment for them.

The scammer will not need to have shown any ID if they bribed someone, also, the scammers usually ask the victim to send them the money transfer control number (MTCN), and at the same time, they ask for the security test question and answer, the question and answer is supposed to be a security feature of Western Union, it is only supposed to be used in certain circumstances, for example, say you are on holiday in a foreign country and you have your bag stolen, and inside the bag is all of your money and all of your ID's, that leaves you with no money and no ID, that's where the security test question and answer comes in.

You can get a friend or relative to send you money via Western Union, you would normally need ID to collect it, but when they send they payment to you, they can tell you the test question and answer over the phone, this allows you to collect your money from Western Union without having to show any ID, unfortunately, scammers abuse this flaw in the Western Union rules for fraudlent purposes, they never have to show ID once they have the MTCN and test question and answer.

Hi, lads!
I think, that it's going to be another scam. I recieved an offering from aupair.com again.
here the text.

Dear Aupair ,...
I'm offering £600 .Send me some of your Photos.I
hope you do have a valid Visa and working permit in the Uk? and I will
make arrangements for your ticket
...For your visa and
working permit, I would recommend to you a travel agency which I would
like you to contact the agency They are fast,secured and reliable in
terms of service. This will facilitate your visa process
Here's the travel agent details:
COMPANY NAME: GLOBAL TRAVELLING AGENCY
EMAIL :[email protected]
TEL: +447045776286
CONTACT PERSON: MR.ALLYSON
I hope to hear from you soon and say hello to your family... My kids awaits your
arrival.
Reply soon.


and here the header

Delivered-To: [email protected]
Received: by 10.142.134.13 with SMTP id h13cs542826wfd;
Tue, 4 Mar 2008 16:28:07 -0800 (PST)
Received: by 10.78.147.6 with SMTP id u6mr5045417hud.13.1204676885740;
Tue, 04 Mar 2008 16:28:05 -0800 (PST)
Return-Path: <mary>
Received: from n4b.bullet.ukl.yahoo.com (n4b.bullet.ukl.yahoo.com [217.146.183.158])
by mx.google.com with SMTP id c5si931097nfi.31.2008.03.04.16.28.04;
Tue, 04 Mar 2008 16:28:05 -0800 (PST)
Received-SPF: neutral (google.com: 217.146.183.158 is neither permitted nor denied by domain of [email protected]) client-ip=217.146.183.158;
DomainKey-Status: good (test mode)
Authentication-Results: mx.google.com; spf=neutral (google.com: 217.146.183.158 is neither permitted nor denied by domain of [email protected]) [email protected]; domainkeys=pass (test mode) [email protected]
Received: from [217.12.4.214] by n4.bullet.ukl.yahoo.com with NNFMP; 05 Mar 2008 00:28:04 -0000
Received: from [87.248.110.119] by t1.bullet.ukl.yahoo.com with NNFMP; 05 Mar 2008 00:28:04 -0000
Received: from [127.0.0.1] by omp224.mail.ukl.yahoo.com with NNFMP; 05 Mar 2008 00:28:04 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 43553 invoked by uid 60001); 5 Mar 2008 00:28:04 -0000
Long domian key snipped to prevent forum blowout - SP
Received: from [41.219.195.106] by web28310.mail.ukl.yahoo.com via HTTP; Wed, 05 Mar 2008 00:28:04 GMT
Date: Wed, 5 Mar 2008 00:28:04 +0000 (GMT)
From: Mary Linda <mary>
Reply-To: [email protected]
Subject: Re: Aupair
To: =?iso-8859-1?q?=E5=CC=C5=CE=C1=20=EB=CF=C2=DA=C5=D7=C1?= <xxxxx>
In-Reply-To: <d87554030803030638w5d64329ama575c1c65dc257f4>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-64250296-1204676884=:40912"
Content-Transfer-Encoding: 8bit
Message-ID: <612725>


is it again some bastard from Nigeria?

Mod edit - edited to xxxxx out your email address - SP