Arrow Financial Group - Australia - FRAUD

These scammers are really active! And I'm glad they didn't succeed with all you new members.

I'm going to have a close look at their website and will come back with the results.

As to their intent: They want to use you for money laundering. The money would go through your account, and they would stay anonymous. As soon as this illegal traffic is discovered the police will ask you some very serious questions - money laundering is a major crime.

EDIT: Scammers are often piggybacking on a legitimate company's name.

I picked a sentence from their "About us" page which is here:

http://arrowfg.com/about.htm

represents and advises more than 60 companies ranging in turnover from $12 million to $500 million,

and look what I found by a Google search:

http://www.axisfg.com.au/about.htm

The fraudulent site is the clone of a legitimate company's site.

Case closed.

Hello,

I received the same offer a couple of days ago. The fact that they are using EURES made them look legitimate, at the beginning.

But...
I asked EURES about this job offer. They say they don't know this employer and consider this practice to be an abuse:
"We have checked the details you supplied us with and can inform you that this employer is not registered on the EURES CV online database.
We therefore consider this practice to be an abuse of our service and we can inform you that this employer will be contacted. "

The IPs from where the e-mails are sent are from USA, although they claim they are from Australia.

It seems that there is a company called Arrow Financial Group registered with that ABN number since 2009. But the website was only created on the 15.08.2011: http://whois.domaintools.com/arrowfg.com. Also, the IP of the website is from USA.

Ricky Morgan, the Hiring Manger and Steven Philip, CEO don't even have a Facebook profile.

Well, they are pretty good. It would have been nice to be true... what a life!

Well, they are pretty good. It would have been nice to be true... what a life!

Yea! I thought that I'll be rich and earn 10 000 euro per month!!

Update :

For sure this scammer uses a proxy (to hide his ip) but next to this :

I was able to decifer the notification receipt that my email was displayed on the scammers computer screen. This notification happens in just a few milli-seconds and is very accurate. (if you have the option enabled in your mail program) (which I have )

Result :
So my message was displayed at 10.30 pm exactly at the scammers screen, while it was 14.30 pm in my time(GMT+1) So it is 8 hours time difference.

I do live in GMT+1, add 8 hours difference, and you know the scammer operates from GMT+9 timezone
GMT+9 = SEOUL, SOUTH KOREA

Hello!!!
Thank God I found this forum! I received the same e-mail and I was searching for an official website of the company because I thought "It is too good to be true". And of course nothing is so good and true at the same time...
Thank you for your help!

Hi!

I am fin UK at the moment, the same thing happened to me yesterday. The first thought - too good to be true, but the fact that it came through EURES made me think that maaaaaybe it's true. But then it was impossible to find more info about them on google.
Great job, guys! your research saved us:) they even faked the website... professional scam:)
Let's search for more realistic employment opportunities

Good luck!

I did some more digging:

On the fraudulent website, they refer to their company's registration number - and it's a link which leads you to the Australian registration authority here:
http://www.abr.business.gov.au/SearchBy ... 0135929092

However, this is a legitimate business, and the scammers use their good name.

The scammers' address seems to be a vacant lot under development.

To all those who posted here:

I'd like to get your help.
Could you please post the email you got from the scammers complete with the header?

How to get an email header:
http://www.abika.com/Reports/Samples/em ... rguide.htm

Thank you!

- The IP address is probably spoofed .. so I like to know what can we learn from the header ?

Find below the header of the 1st email

:

Authentication-Results: hotmail.com; sender-id=temperror (sender IP is 64.85.161.214) [email protected]; dkim=none header.d=recruitarrowfg.com; x-hmca=none
X-Message-Status: n:0:n
X-SID-PRA: Arrow Financial Group <[email protected]>
X-DKIM-Result: None
X-AUTH-Result: NONE
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtTQ0w9NA==
X-Message-Info: 6sSXyD95QpU4kPK0UzVxX9FyCFyF07W9ChujToYuGhN1Q/JzCsh5zAENRfw9TumzGi+EP6cuLLzE4/+EVrJAPKRq2kkSkeZaof5CrXPYbgtcXIQKJ1i08fTT4g8PMnBr
Received: from vs2075.corenetworks.net ([64.85.161.214]) by col0-mc1-f21.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Mon, 15 Aug 2011 16:58:01 -0700
Received: from ThunderBird (localhost [127.0.0.1])
by vs2075.corenetworks.net (8.13.8/8.13. with ESMTP id p7G00CJV021486
for [email protected]; Mon, 15 Aug 2011 20:00:13 -0400
Date: Mon, 15 Aug 2011 20:00:12 -0400
Message-Id: <[email protected]>
From: "Arrow Financial Group" <[email protected]>
To: "" <[email protected]>
Subject: Eures Employment Offer
Mime-Version: 1.0;
Content-Type: text/html; charset="ISO-8859-1";
Content-Transfer-Encoding: 7bit;
Return-Path: [email protected]
X-OriginalArrivalTime: 15 Aug 2011 23:58:01.0128 (UTC) FILETIME=[2A1F9280:01CC5BA7]

These headers provide us with more proof that the domain is being used in the scam itself, and all additional evidence helps to get the site suspended. Well, in most cases. What we have here is yet another domain the scammers set up - recruitarrowfg.com - which we wouldn't have found without them.

By posting the headers you just uncovered a second site they own which is used for email only, AND provided the evidence we need to get it offline. There's much more information in a header than just the location of the sender

Thanks for posting!

I am from Greece and I got the very same e-mail as all of you did again through EURES.

I have made a bit of a research and listen to the funny part! The domain arrowfg.com has been registered on 15 Aug 2011!! That's 4 days ago when the e-mails started coming in! Haha!!!
See the proof in this link: http://www.networksolutions.com/whois-s ... rrowfg.com

Also, their mentioned address DOES really exist, but looking in Google maps the building at this address doesn't look at all to the building they show in their website at the "contact" section.
See the Google map image:
http://maps.google.com/maps?client=oper ... CBwQ8gEwAA

Last but not least they DO have an Australian phone number to contact them on their website but this can be a simple call forwarding service you can purchase from a company like this and forward your call to the Australian number anywhere!: http://www.tollfreeforwarding.com/?cid=7944

So in short, they have registered the domain on 15 August, Published a fake website, got an Australian phonenumber which forwards the call to I don't know where, got the list of e-mail addresses from EURES and started sending out that mail trying to pick up any potential victims!

I picked a sentence from their "About us" page which is here:

http://arrowfg.com/about.htm

represents and advises more than 60 companies ranging in turnover from $12 million to $500 million,

and look what I found by a Google search:

http://www.axisfg.com.au/about.htm

The fraudulent site is the clone of a legitimate company's site.

Case closed.

Good work Katharina!!!

It is not uncommon for scammers to use the name of a legitimate company. The real company may exist but may not have a web presence. In other cases, it may be recently dissolved. The scammers just use their name.

I'm from Poland. I got these same e-mails Five days ago on Tue, Aug 16, I looked for details about this company - nothing. This topic started by dutchess on Wed Aug 17 - 4:40 pm...I just written about this topic on Polish social site.

Dear vlad, welcome to scamwarners.

Could you please specify what email you have received and from whom.