Employment scam: Executive Assistant-Lukas Svensson

Thank you - can you post the body of the email that the header came from as well?

Hello XXXXXX! How are you? So today is your first day! Allow me to congratulate you once again to the position of my assistant! I hope that this will be a very valuable experience for both of us! Sorry, I'm in my way on business trip, but have some time for writing this letter. Please start today. All your future questions please write to me in the evening in your DAILY report.

Well .. The main aim now is the office space, a workplace where we all will work.

So you start to search the office. Just an office space with some storage for the product.

XXXXXX, you need to make a list of the major real estate companies. List send to me, please.

In the list, specify: names of the real estate companies, phone numbers, address of location, time they work from the beginning of the opening.

Further. Select three most appropriate companies from this list in your opinion,

You need to call these three companies and explain them our wishes in finding office space.

Making POA (power of attorney) remotely in the international format is very difficult and takes a lot of time. So when you talk with realtors, please make the deal. The purpose of deal: reserve office for us. We'll give part of money to office owners. When I'll arrive in the United States, we, together with the lawyers make all the documents.

Options for the future office:

- I want the lease term at least 3 years.

- A space size - about 2,000 square feet. No matter how many rooms will be in the office. It may even be loft style of room. There will be 7 members of team with you and me.

You know, no matter how many rooms will be in the office and on what floor it will. This is not so important. It may be even one big loft style room. Besides idea of loft style room I like very much, if truth. You know all this Hollywood movies like: The Intern, 2015. They just rent big room in some old factory building and do their business there. very simple without any modern business centers. Do you understand what I'm talking about?

I'm adding you pics of examples how I see the future office space.

- Estimated date of the lease: as soon as possible. I hope that we will rent office in March already.

- Please find the price for loft style office space.

- Location of the building is in the middle of the city. It should not be the center (the high price of rent) and not remote areas.

- Our goods are small: watches, jewelry. Therefore, we do not need to have a separate output for the entrance of freight transport.

- The main thing that it was a clean room with plenty of natural light. In one part we will arrange the racks with goods. In the other - will be employees work places. I prefer the office space to be empty shell to be decorated out by our team.

You will need to view all proposed options.

- you should take a pictures of the rooms, the building in which they are located. Please pay particular attention to this.
- Look at the documents on these rooms.
- Also write down the contact numbers of urban services, which are responsible for each of these objects.

All reports are sending me. We need 3-4 options to be able to select.

The quality of renovation is also important! Mark all details: the quality of flooring, paint on the walls, cracks in window frames, door handles. All details.

I will send you money on travel expenses, phone calls, and so on.

IMPORTANT! Let's agree. At the end of each day you're writing a report about the work done. By hours. So what do you do every hour in working time. This report send me in a letter. Unfortunately, we have a great difference in time. So I can not be available in real time. Practice with reports every day will help us. I'll prepare your tasks so specifically that you have been busy all day. If you have questions, please write them at the end of each report. I'll correct tasks with these questions.

I hope that everything will be fine!

Can you post, with complete headers, the email you sent, to which the above is the reply? If not, please post any message to thune.us or thune.ca to which you received a reply, and the reply, both with complete headers.

This was not a reply, but a brand new email sent from them this morning after emailing a signed employment contract last night. Email included a bunch of pictures of example office spaces.

I'll have to get the headers from the other emails later today.

Three emails:

To: xxxxx xxxx
Original-Recipient: rfc822;[email protected]
In-Reply-To: <[email protected]>
Return-Path: <[email protected]>
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2016-03-26_06:,, signatures=0
Organization: Thune Norway
Mime-Version: 1.0
Authentication-Results: pv33p00im-smtpin036.me.com; spf=pass (pv33p00im-smtpin036.me.com: domain of [email protected] designates 91.224.22.6 as permitted sender) [email protected];
X-Icloud-Spam-Score: 33002230 f=thune.ca;e=thune.ca;is=yes;ir=no;pp=ham;spf=pass;dkim=?;dmarc=?;wl=absent;pwl=absent;clxs=ham;clxl=absent
X-Proofpoint-Spam-Details: rule=notspam policy=default score=2 spamscore=2 clxscore=1005 suspectscore=82 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1510270003 definitions=main-1603260275
X-Mantsh: 1TEIXWlwZGVoaGkNHB0tNT0ReQ0QeHxoYEQpMQxcbHQQbHhgEGxMTBBMdEBseGh8 aEQpMWRcbGhofEQpZTRdkRV5gX0RBEQpfWRcTHxEKWUkXHR9xGwYbHxp3BgccHAYaBhoGHxwGG nEaEBp3BhoGGgYZGgYaBhoGGnEaEBp3BhoRClleF2hjeREKQ04XZhldZR4bBVJ+HAV4cx5oG21 AZ1t8aUBgSB9zZGR7cwURClhcFxkEGgQYEgdNThIcTBNOTwUbHQQbHhgEGxMTBBMdEBseGh8aE QpeWRdlZmJiXREKTVwXGxsZEQpMWhdCa01raxEKRVgXaBEKTEYXYmtrEQpDWhcTGwQYGB4EGBg EHBEKQl4XGxEKQkUXb1MTcBlgRFJvU3IRCkJOF3pbE2FbUHNnTn5eEQpCTBdhWh98cHxpfEQff BEKQmwXY0ZFE20dX3Bze3wRCkJAF2tkeEIfHRlyQ10FEQpCWBdofV9CY2ZwXBMFbBEKQngXbXB MS2NIZV4dWUkRCk1eFwcbEQpwaBdreE14R0l8SGZPGBAHGRoRCnBoF2tnSRIFSFBNE0BuEAcZG hEKcGgXYmEcbV1rHVphQH8QBxkaEQpwaBdiUntwbBxIbxp9UhAHGRoRCnBoF2BoAWlcQRwYYVJ bEAcZGhEKcGwXY0JjXmlcGUdMS0UQBxkaEQpwQxdtRxJ8fBxtZQFHWBAHGRoRCm1+FwcbEQpYT RdLEQ==
X-Priority: 3 (Normal)
X-Clx-Spam: false
Content-Transfer-Encoding: quoted-printable
Message-Id: <[email protected]>
X-Clx-Unspecialscore: 95
References: <[email protected]> <[email protected]> <[email protected]> <[email protected]>
X-Clx-Score: 1005
X-Clx-Shades: NotJunk
X-No-Relay: not in my network
Content-Type: text/html; charset=utf-8
X-Dmarc-Info: pass=?; dmarc-policy=(noPolicy); s=; d=
Received-Spf: pass (pv33p00im-smtpin036.me.com: domain of [email protected] designates 91.224.22.6 as permitted sender) receiver=pv33p00im-smtpin028.me.com; client-ip=91.224.22.6; helo=msk-cx.193.komtet.ru; [email protected];
Received: from pv33p00im-smtpin036.me.com ([17.142.180.62]) by ms06562.mac.com (Oracle Communications Messaging Server 7.0.5.36.0 64bit (built Sep 8 2015)) with ESMTP id <[email protected]> for [email protected]; Sat, 26 Mar 2016 17:56:38 +0000 (GMT)
Received: from msk-cx.193.komtet.ru (msk-cx.193.komtet.ru [91.224.22.6]) by pv33p00im-smtpin036.me.com (Oracle Communications Messaging Server 7.0.5.36.0 64bit (built Sep 8 2015)) with ESMTP id <[email protected]> for [email protected] (ORCPT [email protected]); Sat, 26 Mar 2016 17:56:37 +0000 (GMT)
Received: from localhost.localdomain (host105-188-static.85-94-b.business.telecomitalia.it [94.85.188.105]) by msk-c15.193.komtet.ru (Postfix) with ESMTPSA id 480A711E2AD for <[email protected]>; Sat, 26 Mar 2016 20:56:32 +0300 (MSK)
wish you good luck


Hello xxxxx! How are you today? Well.. I added your contacts in list. Next step is call from our Boss. His name Sven Larsson and he will call you directly and talk about position, ask the questions.

He asked don't tell exact time of calls to candidates. As I said the important thing for this opportunity - to be in contact anytime. He want to check who from candidates on 100% is good for him.

So I wish you good luck in the interview. All I know is that he will call in the beginning of next week.

My duties end on this and we will meet with you in Canada if he like your candidacy.

Have a great day!

P.S. Also please send your photo to add in file to ID how the candidate looks like.

To: xxxxx xxxx
Original-Recipient: rfc822;[email protected]
In-Reply-To: <[email protected]>
Return-Path: <[email protected]>
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2016-03-25_06:,, signatures=0
Organization: Thune Norway
Mime-Version: 1.0
Authentication-Results: mr28p00im-smtpin018.me.com; spf=pass (mr28p00im-smtpin018.me.com: domain of [email protected] designates 91.224.22.6 as permitted sender) [email protected];
X-Icloud-Spam-Score: 33002230 f=thune.ca;e=thune.ca;is=yes;ir=no;pp=ham;spf=pass;dkim=?;dmarc=?;wl=absent;pwl=absent;clxs=ham;clxl=absent
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 clxscore=1005 suspectscore=97 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1510270003 definitions=main-1603250304
X-Mantsh: 1TEIXR1gbG1oaGkNHB0tNT0ReQ0QZGxsaEQpMQxcbHQQbGxsEGx8fBBgYGBAbHho fGhEKTFkXGxoaHxEKWU0XZEVeYF9EQREKX1kXGxgaEQpZSRcdH3EbBhsfGncGBxwbBhoGGgYdH AYacRoQGncGGgYaBhkaBhoGGgYacRoQGncGGhEKWV4XaGN5EQpDThdrZRseXWZTYwV8GWZ6eE0 SZx1ofB5aaFx4ZhxYbEtfcxEKWFwXGQQaBBgSB01OEhxME05PBRsdBBsbGwQbHx8EGBgYEBseG h8aEQpeWRdlYRpsTBEKTVwXGx8ZEQpMWhdCa01raxEKRVgXaBEKTEYXYmtrEQpDWhcTGwQYGB4 EGBgEHBEKQl4XGxEKQkUXb1MTcBlgRFJvU3IRCkJOF3pbE2FbUHNnTn5eEQpCTBdhWh98cHxpf EQffBEKQmwXY0ZFE20dX3Bze3wRCkJAF3pLenlee2NZbkV7EQpCWBdofV9CY2ZwXBMFbBEKQng XbXBMS2NIZV4dWUkRCk1eFwcbEQpwaBdnYnheeWN9QGYTUBAHGRoRCnBoF2luGUhBQnt9WmNTE AcZGhEKcGgXbGIdS2lycxteGUMQBxkaEQpwaBdoeEdsSWhhbkZ/SBAHGRoRCnBoF2F+UwFwZ1N pZ1JOEAcZGhEKcGwXY0JjXmlcGUdMS0UQBxkaEQpwQxd6UGx/WFNNQ1JcGxAHGRoRCm1+FwcbE QpYTRdLEQ==
X-Priority: 3 (Normal)
X-Clx-Spam: false
Content-Transfer-Encoding: quoted-printable
Message-Id: <[email protected]>
X-Clx-Unspecialscore: 120
References: <[email protected]> <[email protected]>
X-Clx-Score: 1005
X-Clx-Shades: NotJunk
X-No-Relay: not in my network
Content-Type: text/html; charset=utf-8
X-Dmarc-Info: pass=?; dmarc-policy=(noPolicy); s=; d=
Received-Spf: pass (mr28p00im-smtpin018.me.com: domain of [email protected] designates 91.224.22.6 as permitted sender) receiver=mr11p00im-smtpin001.me.com; client-ip=91.224.22.6; helo=msk-cx.193.komtet.ru; [email protected];
Received: from mr28p00im-smtpin018.me.com ([17.110.71.17]) by ms06562.mac.com (Oracle Communications Messaging Server 7.0.5.36.0 64bit (built Sep 8 2015)) with ESMTP id <[email protected]> for [email protected]; Fri, 25 Mar 2016 20:17:09 +0000 (GMT)
Received: from msk-cx.193.komtet.ru (msk-cx.193.komtet.ru [91.224.22.6]) by mr28p00im-smtpin018.me.com (Oracle Communications Messaging Server 7.0.5.36.0 64bit (built Sep 8 2015)) with ESMTP id <[email protected]> for [email protected] (ORCPT [email protected]); Fri, 25 Mar 2016 20:17:08 +0000 (GMT)
Received: from localhost.localdomain (bl17-197-252.dsl.telepac.pt [188.82.197.252]) by msk-c15.193.komtet.ru (Postfix) with ESMTPSA id 0B7F0AA6168 for <[email protected]>; Fri, 25 Mar 2016 23:17:04 +0300 (MSK)

Position details.


Hello xxxxx! How are you today?Thanks for your reply. I will add you in interview list if you will agree with working conditions to the end of this letter.

As I said early, the team will come in Canada approximately in a month. It is necessary finish all affairs here in Oslo and collect all goods which we will sell in Canada.

And assistant will help us in Canada this month. So first month will work remotely.

We need to find variants of the office space in your area, to rent warehouse for our goods on first time, find shops with office furniture plus it's prices, to buy computers, find places to live for the team. Anyway all important and not so difficult tasks.

You will be involved in all small but important affairs of the branch. Our boss don't want to spend time on such things when will arrive in Canada. And want that assistant already done them before arrival of the team.

Everyday you will need to perform tasks and write report in the end of each day 5 days a week. Week-end is week-end. We need to know what are you doing in a day-time. So you will write all affairs by hours: where you go, what are you doing. Is it clear? This is not so hard to do.

First month your instruments will be cell phone and email. You will receive tasks from our Boss every day directly. The company will be sending you financial resources on all your working expenses too.

Future office will be based in your area. There will be no affairs outside your area first time. So don't worry. The typical working hours will be 9:00 a.m. - 5 p.m.

You will get your salary once in a 30 days. You will have vacation days paid and sick days paid also.

All Tax forms we will fill after team arrival. We began procedure for registering branch in Canada and wait first papers in some weeks. Now we solve article taxation at this moments. Our lawyers work with local Canadian law firm. So the process is in the middle way. It will finish till arrival of the team in Canada. And we will fix your company documents from International format to local Canadian law format. First month your salary will not use taxation scheme. You will receive check from us with your salary. No, two checks. First - for your working expenses (like rent warehouse, buy furniture, computers, rent office space and so on). And the second - your salary for the first month. Then will open business account in local bank. So you will have your card for all purposes.

If you have any questions, please write them.

Thank you for your time! Have a great day!

Please confirm that you agree with all conditions and are ready for interview. I will let you know about interview details in the next letter.

--
With best regards,
Thor Ludvig Bareksten

To: xxxxx xxxx
Original-Recipient: rfc822;[email protected]
Return-Path: <[email protected]>
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2016-03-24_08:,, signatures=0
Organization: Thune Norway
Mime-Version: 1.0
Authentication-Results: pv33p00im-smtpin002.me.com; spf=pass (pv33p00im-smtpin002.me.com: domain of [email protected] designates 91.224.22.6 as permitted sender) [email protected];
X-Icloud-Spam-Score: 33002220 f=thune.ca;e=thune.ca;is=yes;ir=no;pp=ham;spf=pass;dkim=?;dmarc=?;wl=absent;pwl=absent;clxs=spam;clxl=absent
X-Proofpoint-Spam-Details: rule=notspam policy=default score=12 spamscore=12 clxscore=-11 suspectscore=63 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1510270003 definitions=main-1603240344
X-Mantsh: 1TEIXWlwZGVoaGkNHB0tNT0ReQ0QeHxoeEQpMQxcbHQQbHhgEGxMSBBkZEBseGh8 aEQpMWRcHGxsRCllNF21YT1MRCllJFxgZcRsGHh93BgcfEwYaBhoGHRwGGnEaEBp3BhoGBx8aB hoGGgYaBhpxGhAadwYaEQpZXhdoY3kRCkNOF1hzZ257AVMdblJdXEFTeGdnTEl6AWVvGU1OS2x Tcl1ZEQpYXBcZBBoEGBIHTU4SHEwTTk8FGx0EGx4YBBsTEgQZGRAbHhofGhEKXlkXZWFCaFsRC k1cFxsfGBEKTFoXRmlNa2sRCkNaFxMbBBgYHgQYGAQcEQpCXhcbEQpCRRdvUxNwGWBEUm9TchE KQk4XelsTYVtQc2dOfl4RCkJMF2FaH3xwfGl8RB98EQpCbBdjRkUTbR1fcHN7fBEKQkAXbH9PT WdhaExQXXsRCkJYF2h9X0JjZnBcEwVsEQpCeBdtcExLY0hlXh1ZSREKTV4XBxsRCnBoF2lfb19 LAX18GVsYEAcZGhEKcGgXZR9HGQESZXleXx4QBxkaEQpwaBdiR3oaQ3t4eQEYRRAHGRoRCnBoF 2N8R1pAS0J9cHhtEAcZGhEKcGgXYntoU20dH0NpGGEQBxkaEQpwbBdjQmNeaVwZR0xLRRAHGRo RCnBDF24ZUxoTQUYBHmtjEAcZGhEKbX4XBxsRClhNF0sR
X-Clx-Unspecialscore: -11
X-Priority: 3 (Normal)
X-Clx-Spam: true
Message-Id: <[email protected]>
X-Clx-Score: -11
X-Clx-Shades: Grey
X-No-Relay: not in my network
Content-Type: multipart/alternative; boundary=----------0C606E06B1023F862
X-Dmarc-Info: pass=?; dmarc-policy=(noPolicy); s=; d=
Received-Spf: pass (pv33p00im-smtpin002.me.com: domain of [email protected] designates 91.224.22.6 as permitted sender) receiver=pv33p00im-smtpin039.me.com; client-ip=91.224.22.6; helo=msk-cx.193.komtet.ru; [email protected];
Received: from pv33p00im-smtpin002.me.com ([17.142.194.144]) by ms06562.mac.com (Oracle Communications Messaging Server 7.0.5.36.0 64bit (built Sep 8 2015)) with ESMTP id <[email protected]> for [email protected]; Thu, 24 Mar 2016 22:36:00 +0000 (GMT)
Received: from msk-cx.193.komtet.ru (msk-cx.193.komtet.ru [91.224.22.6]) by pv33p00im-smtpin002.me.com (Oracle Communications Messaging Server 7.0.5.36.0 64bit (built Sep 8 2015)) with ESMTP id <[email protected]> for [email protected] (ORCPT [email protected]); Thu, 24 Mar 2016 22:35:59 +0000 (GMT)
Received: from localhost.localdomain (217-211-242-61-no123.tbcn.telia.com [217.211.242.61]) by msk-c15.193.komtet.ru (Postfix) with ESMTPSA id 050BCABE003 for <[email protected]>; Fri, 25 Mar 2016 01:35:52 +0300 (MSK)

Re: Executive Assistant: $90k/year | XXXXXXXXX | Calgary

Hello xxxxx! How are you today? We got your response to executive assistant position from Workopolice.

Well.. Please, let me introduce myself first. My name is Thor Ludvig Bareksten. I'm HR of Thune. We opened executive assistant vacancy for our boss to help him in Canada.

Some words about Thune.

THUNE is European company with head office in Norway. And we open startup: branch in Canada. Our jewelry house is in the top ten Norwegian brands of sales jewelry and watches. This is our official website: http://www.thune.no

We will open web store with warehouse in a month in your area. And the head of branch needs assistant.

Our team still in Europe at this moment. We have about month before our great arrival to the Canada. Final preparations.

We don't want to waste time and decided to start searching assistant already.

So we may give you a chance to make career in Thune being executive assistant with a salary $90K/year.

Do you have cell phone with on-line access to your email? Can you receive emails anytime a day and have opportunity to answer quickly too. Is it no problem for you?

Please confirm that you are interesting in this position and I'll write you other details about this job.

Sven just tried calling me and the call display shows his name as lukas.svensson6 and phone number is +46855923511. He left a voice message asking me what is happening since he hasn't heard from me. He request me to email him back.

Thanks for posting the phone number! As mentioned before, it is Swedish, not Norwegian. But the emails were sent from other countries, such as Portugal and Italy.

If Lukas did not hit the reply button, but did acknowledge an email you sent, that should be good enough. We just need to convince Caravan (the mailhost where mail sent to Thune goes) as well as Komtet (the mailserver Thune is using to send mail, which is also the nameserver) that both of their servers are being used for fraud. Post the email you sent with full headers.

Ignore any more phone calls or emails from them. Act like you just fell off the face of the Earth and leave them wondering. Don't tell them you know they're scammers or that they've been reported here. Thank you for reporting here to help warn others!

Sven just tried calling me and the call display shows his name as lukas.svensson6 and phone number is +46855923511. He left a voice message asking me what is happening since he hasn't heard from me. He request me to email him back.

I emailed Thune requesting confirmation of this job posting, and here is their response:

Thank you for your e-mail.
We have received several e-mails regarding this, and we are glad that you also are contacting us.
We do not have any plans of opening stores in Canada/US. This is fraud. We dont know Sven Larsson and Thor Ludvig Bareksten is no longer working with us.

Best regards.
http://www.thune.no
Customer service
Tlf. 810 0 1857
Fra: XXXXXXXXXXXXXX
Sendt: 30. mars 2016 17:15
Til: Kundeservice
Emne: Job Posting

Hello there,

I am emailing from Canada. Can you please confirm your company is currently expanding to the US and Canada, and looking for an executive assistant? There was a posting on the Workopilos job search website. My partner recently received a job offer from someone claiming to be from your company, a Sven Larsson. She also had emails back and forth from a person named Thor Ludvig Bareksten, claiming to be with HR. The emails were coming from the 'thune.ca' domain.

----

​Cheers ,

XXXX

I read ways they can scam you
1. They will send you cheques and ask you to cash it in...Supposedly to buy office furniture or real estate...The scammer may ask you to send the remaining money back. However, the banks will not recognize that the cheques are fraudulent until maybe a month and a half later. Then you will owe the bank the money that you spent. They don't care if you were duped.
2. Another way, is they say they need your bank information to deposit money into your account to buy office furniture, and they could possible steal your information and draw money out of your account.

These scammers are taking advantage of the poor economy in Canada/Alberta. They know some of us are hungry for work.
I hope you all protected yourself!

I just got the same job offer, except its a Swedish company saying they are relocating to Chicago. They reached out to me via Indeed. Any suggestions of next steps? Who can I report this to? Should I just let the emails go cold with no answer to him (Johan Hansson)!

Please post the job offer emails along with any other contact details these criminals are using. This will help warn other potential victims.

Thx