help! girlfriend embroiled in scam.

Hi Kirsty

I hope this is not coming too late,but you better contact to polis ,and if it´s possible,
you can show to polis this side and these conversations.

Hi.

Relating to the same scam. I posted a message a while ago about recieving the same job advert; to basically process payments and documents and provide admin. support in return for a percentage of the money. After recieving message from scam forums, I replied to the scammer (Mark Brown) and basically told him I was not interested and that I will not be processing anything on his behalf. However I had already given my address and email details so I was a little anxious about getting a door step visit however reading further messages, one of the messages saying that "it would be unlikely that someone from abroad would come to see someone about not doing a job and for not actually processing or touching that money" and taking that risk themselves of being caught.

Only in the last couple of days, I've recieved travellers cheques of upto $2000 and have recieved mail from him immediately afterwards to basically return the money to him by replying to the email, confirming I've recieved the cheques and to ask him for return address details, which he has not actually provided in his initial email, given that that is his intention, I find that odd.

How should I proceed. I'm a little reluctant in approaching police however could do if I have to...not sure what would happen at that stage..although I've got nothing to worry about. I would appreciate any advice on what I should do.

Should I reply, send back the cheques or wait a while. I have family here so I don't really want to take too much of a risk. Any help would be greatly appreciated.

Many thanks for your help so far.

Ahmed

Mod edit: removed last name -Jillian

Hi Ahmed

First - if you mentioned your real name at the end of your last message press the 'edit' button and change it or delete it. We don't need to know your name and no one here gives out their real names. There is no need to do it - so we don't.

Don't try to pay the cheques into a bank or pass them to friends or anyone else. You can either destroy them or mark them clearly with a marker pen 'fake' and file them away.

The scammer will pester you for a while as he has put in some work and is deperate to get something out of it - your money, and he doesn't care that it could put you in court, maybe in prison.

Tell him a lie, and say that the bank have told you that they are clear fakes and taken them off you. That way he knows he cannot get money from you because the cheques are gone, and this puts the blame on the bank.

I bait these scammers, and if they chased after people they sent cheques to there'd be long queues on the roads of Hampshire comprising of scammers looking for my fake address there. They only want other people's money, and calling on you will get them nothing, and it is most likely they live in West Africa anyway.

You've done well to avoid being scammed.

Our friends in Nigeria have started a new scam and I was luckily not tricked into it. Here is their new deal... I found a house for rent on Craiglist and sent a message to the creator of the posting looking for more info and a possible showing of the house. The reply was was in very broken English but contained the familiar desire for name address etc. They claim to own the house but are in Nigeria working and do not trust a Realtor to take care of the house. Before I got the reply I went to the house and looked at it myself and also got the name of the Realtor selling it (yes it is a real house with a real address and a real Realtor, heck even the name on the email was the same as the Realtor!).

Once I received the reply from Nigeria, I decided to do a little reverse IP check and guess who's name popped up?? NAVNEET SINGH!! So watch out, they have found a new game and luckily I did not fall for it! I did email the real Realtor with the original email and all the info that I got from the IP address of the message I received! Hopefully he will do something about it if anything can even be done.

41.219.243.9 - Whois Information

% This is the AfriNIC Whois server.

% Note: this output has been filtered.

% Information related to '41.219.243.0 - 41.219.243.255'

inetnum: 41.219.243.0 - 41.219.243.255
netname: ORG-SA57-AFRINIC-20050513
descr: Assigned to Lagos dial-pool customers
country: NG
admin-c: NS4-AFRINIC
tech-c: CM9-AFRINIC
status: Assigned PA
mnt-by: STARCOMMS-MNT
mnt-lower: STARCOMMS-MNT
source: AFRINIC # Filtered
parent: 41.219.192.0 - 41.219.255.255

person: NAVNEET SINGH
address: Plot 1261, Bishop Kale Close, off Saka Tinubu
address: Victoria Island, Lagos, Nigeria
phone: +234-1-804-1234
fax-no: +234-1-811-0301
e-mail: [email protected]
nic-hdl: NS4-AFRINIC
source: AFRINIC # Filtered

person: Catalin Miclaus
address: Plot 1261C, Bishop Kale Close, off Saka Tinubu
phone: +234-1-8041234
fax-no: +234-1-8110301
e-mail: [email protected]
nic-hdl: CM9-AFRINIC
source: AFRINIC # Filtered

Yes, some of them have gotten a little more creative, and they have started finding properties for rent or sale from realty websites or other internet sites, and then posting them in their scams--sometimes they even include all of the photos from the realtor's website. Ultimately, the victim will still be asked to send money, most likely via WU or Moneygram, in advance of "receiving keys" to the place.

Those names that appear in the whois info are in generally the name of the ISP registrant, in other words, the internet cafe owner.

That particular internet cafe is so prolific with scammers, I have seen hundres of scammers who use that cafe, it must be so popular with them, you would think easy picking for a police officer who truly wanted to prevent scams. Sadly it appears that too many people there dont care to much about the countries repuation

and then how do you find out where it really comes from? do I need a special program ir do I have to pay for this service? if free where? thanks to all..scooby please forgive me if i am not following the format of posting..i just started doing this lol

You wont need to pay anything to get information from us on any header

You will however need to provide us with a header, I see you have a few more posts so I dont know if you have found or posted it yet but if you do have it open this http://headertool.apelord.com/ and paste the header in there, the bottom IP location is correct in most cases.

There are a few reasons why the result will be incorrect such as ;
IP stripping email providor such as Gmail
Spoofing of IPs
the email being forwarded

If you are having trouble with the header let us know who your email addres is with and we can give you specific instructions

Just read one of your other posts,

You use yahoo, and have posted the header
Searching on the header I get

94.78.74.210 Turkey (Bilgi)*

Like the post above, the next information is for the owner of the domain and unlikely to be the person sending the email, it can be seen by clicking on the whois button after pasting the headers

% Information related to '94.78.64.0 - 94.78.127.255'

inetnum: 94.78.64.0 - 94.78.127.255
netname: TR-NETHOUSENETWORKS-20080825
descr: Nethouse Bilgi Islem Merkezi Ltd
country: TR
org: ORG-NBIM1-RIPE
admin-c: MA2984-RIPE
tech-c: MA2984-RIPE
status: ALLOCATED PA
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: MNT-MUST
mnt-routes: MNT-MUST
notify: ****************@gmail.com
changed: **********@ripe.net 20080825
source: RIPE

organisation: ORG-NBIM1-RIPE
org-name: Nethouse Bilgi Islem Merkezi Ltd
org-type: LIR
address: Nethouse Bilgi Islem Merkezi Ltd
Ozhan Ozberk
Sht Ibrahim Hasim Sok No: 5A Lefkosa
32000 Kibris
TURKEY
phone: +905338683200
fax-no: +903923654768
e-mail: *****@ozberk.com
mnt-ref: RIPE-NCC-HM-MNT
mnt-ref: MNT-MUST
mnt-by: RIPE-NCC-HM-MNT
changed: **********@ripe.net 20080102
changed: *********@ripe.net 20080108
changed: *********@ripe.net 20080117
source: RIPE

person: mustafa atatuzun
address: basbug street karasel apt
phone: +905338683200
nic-hdl: ma2984-RIPE
changed: ****************@gmail.com20080113 20080113
source: RIPE

This isn't 100% accurate but it seems to be where the email originated from

As to yur posting, it just makes it much easier for us if you post all related questions in the same place

thank you..but i am not quite sure what you mean by posting all my questions in the same space? lol sorry..please let me know what i am doing wrong and how to ask questions proeprly...i have another email from this John mason who says he is from Ontario CA...here is his header..(see i learned something new,..i know how to find a header lol)

From John Mason Tue Jun 16 09:16:34 2009
Return-Path: <[email protected]>
Authentication-Results: mta483.mail.re4.yahoo.com from=inbox.com; domainkeys=neutral (no sig); from=inbox.com; dkim=neutral (no sig)
Received: from 64.135.83.51 (HELO WM51.inbox.com) (64.135.83.51)
by mta483.mail.re4.yahoo.com with SMTP; Tue, 16 Jun 2009 09:14:37 -0700
Received: from inbox.com (127.0.0.1:25)
by inbox.com with [InBox.Com SMTP Server]
id <906160008139.WM51> for <[email protected]> from <[email protected]>;
Tue, 16 Jun 2009 8:16:34 AM -0800
Mime-Version: 1.0
Date: Tue, 16 Jun 2009 08:16:34 -0800
Message-ID: <[email protected]>
From: John Mason <[email protected]>
Subject: Re: dr cho
To: Tracey Lee <[email protected]>
In-Reply-To: <[email protected]>
References: <[email protected]>
<[email protected]>
<[email protected]>
Content-Type: text/html; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
Pi6C3bAaNwbeQBpP0LPygkSWtKhzgVeg-DEqjSjfkY99KILA5_TTtB1ucb4w
rAKdKwaTEdfUC5VzvWWXLmw@@
Content-Length: 5369

so that means the emails are coming from the country TURKEY? geez isnt that a new one? so when you click whois that doesnt mean that is the person? it might be a cafe right? thanks for being great with me ..scooby

Whats done is done, dont be too worried.

Your posts relating to this scammer are in this thread but also here viewtopic.php?f=26&t=2151&p=10644#p10644 when we go to answer questions it mean we (as well as you) have to flick back and forth to make sure we have all of the information relevant at any one time, in some cases it may mean that we double up on providing information to you.

As I said, it's done and fixed now so dont worry

Yes, it does appear the emails are coming from Turkey, that isn't unheard of but Turkey is not one of the more common locations for scammers to operate from. If the scammers were smart enough to put in a fake IP they would also be smart enough to make it appear they are where they say they are so i tend to believe the result this time.

when you click whois that doesnt mean that is the person? it might be a cafe right?

Yes, that right, it wouldn't be impossible for that to be the actual scammer but it would be extremely unlikely, it could be the owner of an internet cafe or the owner of a domain who in theory also happens to scam but very unlikely and virtually impossible to prove

As to your new email header, why dont you have a go, click on the link to the header tool then copy and paste the entire header into the header tool and click check headers, let us know the result

I did notice you got the headers coming up, well done.

We are only too happy to help you with this, you might even go away and save someone from being scammed with your new knowledge, thats what makes it all worthwhile.

Click Here to see where the same question is posted elsewhere, please dont bother following up with your spam

Reported and ready for deletion

thank you for all your help...what should i do with all the emails..correspondence and even the check the scammer sent me? i want him to get caught and arrested which i know i s hard but i do ahve numbers, addresses (alleged) and many emails with a posted letter...also can a scammer put an a fake IP so it seems like it is coming from somewhere else then where it really is? happy fathers day to all the dads!

Hi Scooby

Fathers day in Australia is not until September but there is nothing wrong with 2 father's days

The likelyhood of you actually getting this scammer arrested is much the same as the chance of you winning a lotery and not having to pay fees.

You could take the cheque and the envelope it came in to your local police complete with the emails you received to your local police and see if they have any interest, the sad truth is that they most likely will have little or no interest but you never know.

The question about IPs is one I prefer not to explain and especially in the open where a scammer may be educated. It will suffice to say that making your IP appear to be somewhere you are not isn't hard to do if you have the right tools to do it.

http://www.starcomms.com/about_us/contact_us.aspx

I posted to look for a mobile phone which was hard to find.

I have some idea where the checks are coming from.

I am in Dubai. These people are in Nigeria and the poor starcomms ISP is taking the blame.

X-Originating-IP: [41.155.96.41] (found by looking at the email source)

The person claims to be in London but is sitting in Nigeria.

The email to get my money via western union is as follows :


Hello ,

Thanks for your patronage,mail and interest you developed in our product.

We have the w880 samsung (White & Black) in our stock and it's brand new, unlocked and and original which comes with the complete full accessories and sealed in it's original factory box.

Warranty & Return Policy
====================
- Our products are covered by 1 year Full International Warranty
- All defective products must be reported within 6 month after you receive your order
- Buyer is responsible to return the defective product back to us and we will repair it or exchange it accordingly
- We trade items if need be.

Sorry we don't accept local pick up in our company okay..

Order Summary
================

APPLE IPHONES
===============
w880 samsung cost .....$300USD

Shipping fees to your Doorstep cost $50USD

Total cost $350USD


Note: Buy 2 Units of w880 samsung and get 1 w880 samsung Free
Buy 4 Units of w880 samsung and get 1 Apple Ipad 3G 64GB Wifi free

We Are Located in United Kingdom (London).

London Contact Number: 447045722609
We ship via FedEx and UPS Courier service and shipping takes just 48Hours.

Payment for purchase is made through Western Union Transfer/Money Gram and Bank Transfer for bulk order.

To proceed with your order kindly reply back to us with your shipping details as listed the details below:

Full Name:
Full address:
Country:
City:
State:
Zip Code:
Telephone number:

We await your swift response.

Your urgent response will highly be appreciated,

Best Regards

Sales Manager,

Mohd Khalid

Email used : [email protected]

I guess it is a money laundering scam. Get people in Dubai to pay a person in london.
Ask the london person to send money to Nigeria which is the actual location.

Time for some action.

Khawar