Company Representative scams, Payment Processing scams and other Employment scams.
by soju Tue Apr 16, 2013 5:38 am
Hi All.

I just recently received an email offering me a job called sales assistant (processing manager). The email is from “Global Tour and Travel inc.”, from Lakewood, WA, USA.
It requires me to track and receive domestic customer payments in bank accounts. Also send these payments to them. It sounds very fishy.
I tried to google the company but I couldn’t find anything. The link they provided for their company is http://www.globaltourtravel dot com (don’t want to reveal the link), which looks alright the other day.
I have already signed some documents and sent to them. But suddenly I realised how wired it is. Can anyone help me? Is this company real? Is it a scam? Thanks I appreciate your time.


+++++++++++Edit+++++++++

screenshot of the email and their contacts are added


Image


Fraud email from

Kevin Flores
[email protected]
[email protected]
Global Tour & Travel Inc.


The following img attachments are the actual PDF job description:
Image
Image
Image
Image
Image
Last edited by soju on Wed Apr 17, 2013 1:46 am, edited 2 times in total.
Advertisement

by Bryon Williams Tue Apr 16, 2013 5:54 am
Hello soju and welcome to Scamwarners.

No company would ask an individual over the internet to accept money and relay it to them. It is a scam.

The scammer is wanting you to be a money mule. He will be having you transfer stolen money from other victims to him or the payments you receive are fake. Just stop communicating with him. Meet all future employers face to face.

Please provide the scammer emails to you and headers of the email (See my signature). Please remove your personal information from the email when you post it.

Never wire money to someone you do not know personally.

Bryon

Please contacta moferatorstor if you have a question or information about this post.



Please do not tell the scammer he is posted here.


Please remember the fallen. https://www.odmp.org/
by soju Tue Apr 16, 2013 6:09 am
Hi Bryon

Thanks for your reply. I have updated my original post, hopefully it will help others with similar case.

Regards,

soju
Last edited by Bryon Williams on Tue Apr 16, 2013 6:20 am, edited 1 time in total. Reason: Removed quotes to a direct replyl
by Bryon Williams Tue Apr 16, 2013 6:32 am
@ soju Yes, I saw your update. Can you provide the email headers? And any additional information. I want to pass this information on to people who look into fake websites or are piggy backing a legitimate site.

Bryon

Please contacta moferatorstor if you have a question or information about this post.



Please do not tell the scammer he is posted here.


Please remember the fallen. https://www.odmp.org/
by vonpaso xlura Tue Apr 16, 2013 7:32 am
The site was registered for only one year, which is common to scam sites. The registrant's address is:

Yuanjin Yong
Email:[email protected]
8516 South Tacoma Way
98499 Lakewood
United States
Tel: +1.2062034678

That was not written by an American. (The phone number does check out as being in Washington, but Lakewood is in a different area code.)

Please post the email as text (not a screenshot, plain text can be picked up by search engines and is much easier to paste into a report) with full headers. Headers look like this:

Delivered-To: [email protected]
Received: by 10.204.9.195 with SMTP id m3csp801584bkm;
Thu, 29 Nov 2012 14:41:05 -0800 (PST)
Received: by 10.50.187.194 with SMTP id fu2mr24824728igc.63.1354228864997;
Thu, 29 Nov 2012 14:41:04 -0800 (PST)
Return-Path: <[email protected]>
Received: from smtp110.biz.mail.ne1.yahoo.com (smtp110.biz.mail.ne1.yahoo.com. [98.138.206.47])
by mx.google.com with SMTP id eg1si7493823igc.63.2012.11.29.14.41.04;
Thu, 29 Nov 2012 14:41:04 -0800 (PST)
Received-SPF: neutral (google.com: 98.138.206.47 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=98.138.206.47;
Authentication-Results: mx.google.com; spf=neutral (google.com: 98.138.206.47 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]; dkim=pass [email protected]
Received: (qmail 92799 invoked from network); 29 Nov 2012 22:41:04 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1354228864; bh=HJvhb9feZApwkPpiZx/M9RSuY58a3+Yxvd9laoPMJV4=; h=X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:Received:Date:From:Organization:To:Message-ID:Subject:MIME-Version:Content-Type:Content-Transfer-Encoding; b=aoeu
X-Yahoo-Newman-Property: ymail-3

Usually they're hidden by email programs; you have to do something to make them visible. Also include, with full headers, the email you sent to the domain, to which they replied. We need this information to kill the email-only domain. Redact your name and email address but leave the scammer's intact.

... ni los estafadores heredarán el reino de Dios. 1 Cor. 6:10
by soju Tue Apr 16, 2013 8:19 am
The header of the email:
Received: from xxx.xxx.xxx.xx Mon, 15 Apr 2013 08:34:04 +1000 (EST)
SBRS-Score: 4.7
X-IronPort-AV: E=Sophos;i="4.87,472,1363093200";
d="pdf'?jpg'145?scan'145,208,145";a="72020820"
Received: from mail-pb0-f46.google.com ([209.85.160.46]) by mx2.xxxxxxxx
with ESMTP; 15 Apr 2013 08:33:58 +1000
Received: by mail-pb0-f46.google.com with SMTP id rp8so2182317pbb.33
for <xx@xxxxxxxx>; Sun, 14 Apr 2013 15:33:56 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=google.com; s=20120113;
h=mime-version:x-received:x-originating-ip:in-reply-to:references
:date:message-id:subject:from:to:content-type:x-gm-message-state;
bh=dxtzXgG/72HAaHOtrGLMu2MdAdC2VAujEhqx5lXJPfA=;
b=omJJAr7f1m65GyiDomaTTUGvs+F4CMFymTl7QT3yEA5wpT9dwgurpN8K3lg/plsqdK
AnVzL0O2RUqRsje/a5aPepCG8SuYnaIAEM73D8QT8xdFkItlNufc7akSuV3keH9+GEe3
zkhwNQkJbh/Fixdb11BFaR6XrVZU+qUXuQHnS8TWQBMN9yvExys73z93NZ4G+yR4t021
Q1pVxCjbo9lJHEBmlnI2UDe4RvytqWja5yVRRxhm5pStaIMy/Y+Akw70PJVjR9DIH9Zf
sQhzK65mFyisZkDYwGHhbO1jbHmxN99R1gchlr+hHCjl3bk8TC1PLiarJRR8zmyZmlvr
V/bg==
MIME-Version: 1.0
X-Received: by 10.66.117.196 with SMTP id kg4mr26037556pab.95.1365978836292;
Sun, 14 Apr 2013 15:33:56 -0700 (PDT)
Received: by 10.70.49.195 with HTTP; Sun, 14 Apr 2013 15:33:55 -0700 (PDT)
X-Originating-IP: [71.11.208.83]
In-Reply-To: <CAM+it0ER1czArKWOczqRYV7wdsPr4ehx9WZp8wrRqQxfE_=RWw@mail.gmail.com>
References: <CAM+it0ER1czArKWOczqRYV7wdsPr4ehx9WZp8wrRqQxfE_=RWw@mail.gmail.com>
Date: Mon, 15 Apr 2013 08:33:55 +1000
Message-ID: <CAM+it0G6hKRTo5ag4CWJ1O3wvix1cJ2ae0iz66qwahqsT14dVA@mail.gmail.com>
Subject: Global Tour and Travel Employment Agreement
From: Kevin Flores <[email protected]>
To: xxxxxxxxxxxx
Content-Type: multipart/mixed; boundary="047d7bf0c1b84edc7404da59bb2e"
X-Gm-Message-State: ALoCoQkFlDJAN8AQiQlY3mqoQMMeIO+L04dVgMM1dw0XROwVk9n5bWE3JOkQ3mbMQYL+cKizysmk
Return-Path: [email protected]
X-MS-Exchange-Organization-AuthSource: xxxxxxxxxxxxxxx
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Organization-Antispam-Report: IPOnAllowList
X-MS-Exchange-Organization-SCL: 0
X-MS-Exchange-Organization-AVStamp-Mailbox: MSFTFF;1;0;0 0 0




The actual email content:

Sent: Friday, 12 April 2013 6:14:03 AM
To: xxxxx
1 attachment | Download all as zip (328.6 KB)
AU_PA_5-13.pdf (328.6 KB)
Microsoft SmartScreen marked this message as junk and we'll delete it after ten days.
Wait, it's safe!|I'm not sure. Let me check
Dear xx

SEEK determined you as an appropriate candidate for our vacancy and
forwarded us your resume.
Attached you can find brief description and job responsibilities for
offered position.
In case you are interested, please fill in the application form and
send it to [email protected]:


First name:
Last name:
Postal code:
Day-time tel.:
Mobile tel.:

Best time to call you:

Are you currently employed or studying:
If yes, please provide your current workday schedule:

Have you ever been convicted of a crime since the age of 18:
If yes, please provide date(s) and details:
(Answering "Yes" to those questions doesn't constitute an automatic
bar to employment)

----------------------------------------------------------------------------

APPLICANT STATEMENT.

I certify that answers given herein are true and complete to the best
of my knowledge.

I authorize investigation of all statements contained in this
application for employment as may be
necessary in arriving at an employment decision.

This application for employment shall be considered active for a
period of time not to exceed 45 days.
Any applicant wishing to be considered for employment beyond this time
period should inquire as to
whether or not applications are being accepted at that time.

I hereby understand and acknowledge that, unless otherwise defined by
applicable law, any employment
relationship with this organization is of an "at will" nature, which
means that the Employee may resign
at any time and the Employer may discharge Employee at any tune with
or without cause. It is further
understood that this "at will" employment relationship may not be
change by any written document or
by conduct unless such change is specifically acknowledged in writing
by an authorized executive of
this organization.

In the event of employment, I understand that false or misleading
information given in my application or
interviews may result in discharge. I understand, also, that I am
required to abide by all rules and regulations
of the employer.

I also understand that if I am hired, I will be required to provide
proof of identity.

------------------------------------------------------------
By filling above form, I certify that I have read, fully understand and accept
all terms of the foregoing Applicant Statement.

In some cases, it may take some time to verify your application.

Please do not hesitate to contact me if you need any further information.
----------------

Sincerely,
Kevin Flores
[email protected]
[email protected]
Global Tour & Travel Inc.
www.globaltourtravel.com

>
> An appropriate candidate has been found for your job opening.
>
> Title: Sales Assistant
>
> ==================================================
>
> The details of the job seeker are:
>
>
> Resume:
> =================
> Please open the attached file to view the Resume in full.
>
>
> ----------------------------------------
>
> Check out SEEK Jobseeker Profiles. The most effective way to find more candidates for your role.
> http://advertiser.seek.com.au/Advertise ... :learnmore
>
> ----------------------------------------
by TerranceBoyce Tue Apr 16, 2013 8:36 am
From the scam website

http://www.globaltourtravel.com/booking-conditions/default.htm

The holidays featured on this website are operated by Global Tour & Travel Inc 'the Company' of 29 Portland Place, London, W1B 1QB, UK which is registered in England and Wales under company number 6648649.


From Companies House

Name & Registered Office:
QUINTESSENTIALLY TRAVEL LIMITED
29 PORTLAND PLACE
LONDON
GREATER LONDON
W1B 1QB
Company No. 06648649

Status: Active
Date of Incorporation: 16/07/2008


The scammer is using the details of a real company which is not associated with the fraud.

Quintessentially Travel Ltd have their own website.

On the 'Meet the Team' page the photos and bios have been copied from the real site but the names changed. :bondage:
Last edited by TerranceBoyce on Tue Apr 16, 2013 9:16 am, edited 1 time in total.

CAR ADVERTS - If a car seller mentions escrow - he's scamming you Never ever for any reason pay anything until you have seen and inspected the vehicle
by vonpaso xlura Tue Apr 16, 2013 8:57 am
Is there an attachment or another email that asks for your bank account or explains that you would be receiving and forwarding money?

... ni los estafadores heredarán el reino de Dios. 1 Cor. 6:10
by soju Tue Apr 16, 2013 9:08 am
vonpaso xlura wrote:Is there an attachment or another email that asks for your bank account or explains that you would be receiving and forwarding money?


Yes there are some replies of their emails. One of them ask me to sign some employment agreement form and another one for bank details for payroll. I filled them in and sent to them. I am so scared... :cry: :cry:
But I realized all these things before they send me instructions on how to transfer and etc.
by Clair Tue Apr 16, 2013 11:52 am
soju wrote:Yes there are some replies of their emails. One of them ask me to sign some employment agreement form and another one for bank details for payroll. I filled them in and sent to them. I am so scared... :cry: :cry:
But I realized all these things before they send me instructions on how to transfer and etc.


Hi Soju, Since you sent them your bank details, you should contact the fraud department of your bank and let them know what happened. You might want to close that account and open a new one.

Edit to add that it looks like the website www.globaltourtravel.com is gone.
by soju Tue Apr 16, 2013 9:16 pm
Clair wrote:
soju wrote:Yes there are some replies of their emails. One of them ask me to sign some employment agreement form and another one for bank details for payroll. I filled them in and sent to them. I am so scared... :cry: :cry:
But I realized all these things before they send me instructions on how to transfer and etc.


Hi Soju, Since you sent them your bank details, you should contact the fraud department of your bank and let them know what happened. You might want to close that account and open a new one.

Edit to add that it looks like the website http://www.globaltourtravel.com is gone.



Thanks for reminding me about the bank. I will talk to them today!
by vonpaso xlura Tue Apr 16, 2013 10:50 pm
Please post the attachments (the job description). I'm writing a report to get the site shut down and need evidence that this is a scam, not just a site registered with details that don't match. If they explain to you that you're receiving funds in your account and sending them to someone else, that would prove it.

... ni los estafadores heredarán el reino de Dios. 1 Cor. 6:10
by soju Wed Apr 17, 2013 1:21 am
vonpaso xlura wrote:Please post the attachments (the job description). I'm writing a report to get the site shut down and need evidence that this is a scam, not just a site registered with details that don't match. If they explain to you that you're receiving funds in your account and sending them to someone else, that would prove it.

Yes I have the PDF job description they sent me. How do i upload it here?
by vonpaso xlura Wed Apr 17, 2013 1:31 am
Copy and paste the text. That should be sufficient. At least in Okular, you copy a rectangular region; make sure the region includes all text on the page.

... ni los estafadores heredarán el reino de Dios. 1 Cor. 6:10
by soju Wed Apr 17, 2013 1:48 am
vonpaso xlura wrote:Copy and paste the text. That should be sufficient. At least in Okular, you copy a rectangular region; make sure the region includes all text on the page.

I made screen shot and added them in my original post! Is it ok like that? Thanks

Who is online

Users browsing this forum: ClaudeBot, Majestic-12 [Bot] and 9 guests