help! girlfriend embroiled in scam.

hi,

i'm new here and need advice on something that has happened over the past few days.

me and my girlfriend are both students, she is an international student and does not receive a standard loan like most UK based students, so making ends meet and living costs prove hard for us.

she has been looking for work lately, with very little success.

one day she decided to scour the internet to find work, and used Gumtree, applied to various forms of work.

around 3 days ago, a letter arrived, with a badly scrawled on name and address for her.

she opened it and 3 $500 US travellers cheques were enclosed!

I asked her what they were for, and she said she applied to some ad from this guy, thinking hardly any of it.

the alarm bells went off in my head! a complete scam if I ever seen one.

the email instructions were to go and cash the cheques, take a 10% cut and put the rest of the cash in a Western Union account.

she went and cashed them, with a £925 exchange rate.

the next day, another email stating that $5000 will be arriving via recorded delivery, and she must immediately cash this and follow the same instructions as before.

I read the email and it was very amateurish, with terrible spelling and grammar.

she has not given any account details to this person, and has not put the money into an account yet.

we are currently apart for the Christmas holidays visiting people, but the cheques are still in our house, along with the £925.

today she suggested just keeping hold of the money to "see what happens" which I think is a completely crazy idea!

has this scam been heard of before?

who are the people who are behind it?

what is the law's take on situations like this?

and what would happen if the money was kept? can they send people to our house to get it back?

she has emailed them saying a matter of family emergency has came around and will not be there for the next few days.
this is so we can figure out how to end this situation.

how can we stop them from sending the cheques over?

i'm very worried about this, if someone can answer these questions and give me some advice, then i'd be very grateful!

Hi Massive,

I've already seen your post over at 419eater and most of the replies

http://forum.419eater.com/forum/viewtopic.php?t=154531

Most of their advise is sound, but this is the main thing for you as soon as possible.

.......................

The clues you give are that you are in the UK .... so all you need to do in the first instance is go and talk to the police before they come and talk to you and your girlfriend.

If they come to you first, you may have some very difficult questions to answer. You may not have considered the words "Accomplice to Fraud" but the police will have. So by getting your side of the story in first is going to give you a lot of credence.

Hi massive,

I agree with Michelle in that most of the advice you recieved at 419eater is sound, and I'd echo what Michelle has said here, and what I said there... make early contact with the Police and the banks. Get your story in with them, and any subsequent action will be deflated somewhat by that.

For any other responders to this thread: As I'm UK, I've offered phone support to Massive should he need it, just so you're aware.

Re-reading Massive's post it sounds very much like a Representative or even a Mystery Shopper Scam. Both work in similar ways, where someone is sent cheques, for whatever reason, and asked to cash them and then send them onto a third party by Western Union or Moneygram.

The cheques will eventually be found out to be fakes and the cashing agent will take steps to recover the whole amount. Unless the Police are convinced that the girlfriend (who has already cashed some of the cheques) is a victim of a scam they will decide to prosecute. This is why it is important to get the victims side of the story in first.


..... it would be interesting to see the scammers e-mail address and if possible the full headers.

Mr "Mark Smith"'s email in full technocolor - [email protected]

enjoy

Please be carefull- go to the police.

When you send money with western union your adress is on the western union transfer ticket!!!

And when you send more then 1000 € you must show your passport!!!

with kind regards

Angel

thankfully nothing has been put to Western Union... to my knowledge anyway!

Hi Massive,


Welcome to Scamwarners
The good advice has already been given so no point in giving it agian

What I am interested in is the header from the emails from Mark Smith, I have been dealing with a scammer who uses that name and I would love to know if it is the same person.

If you need some help with finding and analysing headers, let us know the email providor that your GF uses and we can give you specific instructions

BTW Gumtree is becoming quite popular for scammers

nice.... thanks

yep... gmail... thankfully she was wise enough to make a separate email account to the one she normally uses.

I have one email she forwarded to me, although if needed, i'm sure she can send me the full corresponance between them.

I've asked a friend of mine at 419eater to drop the scammer a quick line just to see if he could do with another applicant.

The Gumtree listing is here http://lancs.gumtree.com/lancs/26/31973526.html

Hi Massive. You've already received a lot of great advice. If you'd like to read more about check scams and how they work, please do follow this link: http://www.scam-info-links.info/fake_check_scams.html

Obviously, your girlfriend should notify her bank immediately that the checks are fraudulent and NOT wire any money to anyone. I'm glad you took the time to investigate this! Let us know if the two of you need any further advice.

This seems to be the standard reply from [email protected]

IP - 41.219.213.202 - Lagos Nigeria

from mark Smith <[email protected]>
reply-to [email protected]
to xxxxxxxxxxxxx
date 27 December 2008 18:29
subject job offer
mailed-by yahoo.com
Signed by yahoo.com


SOLID FOUNDATION MICRO FINANCE LTD
30 mulberry court, lovelace gardens,
surbiton, surrey, kt6 6sp
UNITED KINGDOM.

Dear Applicant,
We are offering a temporary part time job which really do not require any professional skills and you will work outrightly from your home.You really don't need to have any professional skills for this job. All we are looking for right now are applicants based in UK,Ireland,USA and other parts of Europe who are trustworthy, honest, and loyal individuals with a work permit to handle PAPER WORK,FILE DOCUMENT and HANDLE PAYROLL ADMINISTRATION to our clients in there location.
All we require from you is few hours a day and also to pay very close attention to all instructions given to you.Your Job will be Handling all applications of new clients that will be interested in registering a company in the UK,USA,Ireland and other parts of the Europe... And what you will be doing is Filing all papers from these individual companies which will be sent over to you under that companies name and also processing the registration deposit fee and each client will contact you via email/phone.Salary is 100pounds or $200 each work week .
Kindly get back to us if you are interested in the job offered so that we can let you know how to start.

Regards
Mr. Mark
B.Sc, MBA, CPA(Member of AICPA

The "Mark Smith" I have dealt with has this IP X-Originating-Ip: 41.221.167.16 which leads me to the below information

% This is the AfriNIC Whois server.

% Note: this output has been filtered.

% Information related to '41.221.167.0 - 41.221.167.127'

inetnum: 41.221.167.0 - 41.221.167.127
netname: SWIFTNETWORKS-AMUWO-DHCP
descr: SWIFT NETWORKS IP RANGE FOR AMUWO DHCP CLIENTS
country: NG
admin-c: GO5-AFRINIC
tech-c: GO5-AFRINIC
status: ASSIGNED PA
mnt-by: SWIFT-MNT
source: AFRINIC # Filtered
parent: 41.221.160.0 - 41.221.175.255

person: Gabriel Oyeyemi
address: Swift Networks Ltd.
31B Saka Tinubu Street,
Victoria Island, Lagos.
Nigeria.
phone: +23417738138
fax-no: +23412700197
e-mail: ********@swiftng.com
nic-hdl: GO5-AFRINIC
source: AFRINIC # Filtered

The IP posted by Michelle comes up with this

% This is the AfriNIC Whois server.

% Note: this output has been filtered.

% Information related to '41.219.213.0 - 41.219.213.255'

inetnum: 41.219.213.0 - 41.219.213.255
netname: ORG-SA57-AFRINIC-20050513
descr: Assigned to Lagos dial-pool customers
country: NG
admin-c: NS4-AFRINIC
tech-c: CM9-AFRINIC
status: Assigned PA
mnt-by: STARCOMMS-MNT
mnt-lower: STARCOMMS-MNT
source: AFRINIC # Filtered
parent: 41.219.192.0 - 41.219.255.255

person: NAVNEET SINGH
address: Plot 1261, Bishop Kale Close, off Saka Tinubu
address: Victoria Island, Lagos, Nigeria
phone: +234-1-804-9370
fax-no: +234-1-811-0301
e-mail: ********@starcomms.com
nic-hdl: NS4-AFRINIC
source: AFRINIC # Filtered

person: Catalin Miclaus
address: Plot 1261C, Bishop Kale Close, off Saka Tinubu
phone: +234-7028000733
fax-no: +234-1-8110301
e-mail: *******@starcomms.com
nic-hdl: CM9-AFRINIC
source: AFRINIC # Filtered

This gives me no proof that it is the same person but it certainly is the same neighbourhood

Just to show you what the next step is after the victim shows some interest:-

from mark Smith <[email protected]>
reply-to [email protected]
to xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
date 29 December 2008 08:20
subject job role
mailed-by yahoo.com
Signed by yahoo.com


SOLID FOUNDATION MICRO FINANCE LTD
30 mulberry court, lovelace gardens,
surbiton, surrey, kt6 6sp
UNITED KINGDOM.

Dear Applicant,
Thanks for your response.you will need to fill in your contact details below so that you will start working with our client in your location and we can have your details stored in our database as our staff and once we are through with this process, we shall notify our clients in your location to send their applications document to you and also their registration deposit fee via check or cash payment which you will have to process through your financial institution on our behalf and keep all records.we will always send you instructions daily on how to carry out your job duties.

NOTE: its compulsory to fill the details below that are asterisk(*)
Ensure all the information supplied by you is correct and valid at the time of entry.

Contact Name:*
Contact Address:*
Post code/zip code*
Contact Phone/mobile #:*
State work experience(optional):
Qualification(optional):
Nationality:*
DOB:*
Gender:*
Email address*

Regards
B.Sc, MBA, CPA(Member of AICPA)

My friend at 419eater has provided some good looking personal details

Hi
I have just done the same thing as your girlfriend and applied to some jobs over the internet. As i live in spain and the job situation is very bad at the moment so i went on to http://www.eujobsly.com and applied for a job which said ''Work from home, no experience needed, just space to file documents etc'' and so i applied to an Anthonio Mark (solid foundation micro finance ltd) just thinking it was a normal job applicaction. But then he replied saying i had got the job but didnt ask any questions or give me information. So i found this strange and went on to to google and typed in the buisiness address but nothing came up so my daughter typed in the address and found this and i have recieved the same e-mail as that posted above by Michelle. This man now has my address, phone number and e-mail address.
WHAT DO I DO NOW?????
as he has said i will be recieving cheques next week.
please reply
thanks
Kirsty