Scammed into buying iTunes gift cards

Hi,

I was a victim of a work at home type scam. I was told to purchase iTunes gift cards with my credit cards and the scammers gave me bank account numbers (wells fargo) to pay off the credit cards for more than the cost of the iTunes cards ( my "commission). I was then to scan the claim codes on the cards and email it to the scammers.

This was all fine until today I get an email that the first posted payment to the credit card was returned to the bank as it was not authorized.

I have not sent the last batch of iTunes cards to them so I can probably get at least some of that money back, but assuming all of the payments reverse I will owe over $10k that I cannot pay. I contacted my card issuer and they filed a dispute for the transactions where I bought the iTunes cards, but I assume since I did buy them, the dispute will be decided in the merchant's favor.

I don't know what to do, but I cannot pay off these charges as I no longer even have the majority of the iTunes cards (the claim codes were used).

Here is the info of the scammers.

Contact person: Anita Shultz
Company name: ABD Gruppe AG
Company website: abd-gruppe.net
email: [email protected]
Phone numbers given: +41.44-586-9488
USA Toll Free number: +1.800-958-1768

Signature line:

Anita Shultz
Consultant of Financial Department "ABD Gruppe AG"

ABD Gruppe AG
Steinwiesenstrasse 1
8952 Schlieren
Zurich - Switzerland
Phone No: +41.44-586-9488
USA Toll Free number: +1.800-958-1768

Orignial email with headers:


Delivered-To: my email
Received: by
Sat, 13 Feb 2016 10:39:52 -0800 (PST)
X-Received: by
Sat, 13 Feb 2016 10:39:52 -0800 (PST)
Return-Path: <bounce-md_30852398.56bf7878.v1-06ab5d8c02a34805b03482612faeeab6@mandrillapp.com>
Received: from mail135-29.atl141.mandrillapp.com (mail135-29.atl141.mandrillapp.com. [198.2.135.29])
by mx.google.com with ESMTPS id u10si8565553ywa.418.2016.02.13.10.39.52
for <>
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Sat, 13 Feb 2016 10:39:52 -0800 (PST)
Received-SPF: pass (google.com: domain of bounce-md_30852398.56bf7878.v1-06ab5d8c ... illapp.com designates 198.2.135.29 as permitted sender) client-ip=198.2.135.29;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of bounce-md_30852398.56bf7878.v1-06ab5d8c ... illapp.com designates 198.2.135.29 as permitted sender) smtp.mailfrom=bounce-md_30852398.56bf78 ... illapp.com;
dkim=pass [email protected];
dkim=pass [email protected]
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=mandrill; d=abd-gruppe.net;
h=From:Subject:Message-Id:To:Date:MIME-Version:Content-Type; [email protected];
bh=BuscmHhgCeshQvHhl0I2sdoujGU=;
b=GZsmrW5DuOPhT31Lc+wF6NFNlM79UrUy4oxYX7z8hnJV1bvHGnumodfwAp2/L54zF0eUgiq7IRf3
/HREIhyLpU0J8rtovD6N5X0EFHHvEcAC9eO/0MJWdpmXOqjjxEkOMPykzWHrFCj+/BmvGsVdXr82
uFvZ/mKqw/gxbcsLepg=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=mandrill; d=abd-gruppe.net;
b=aEVjeZThQkSN8Gggp2esGH4raletd1qYmyGywPLKdnrNL2ZNCkA++aTrJdoExffTzmZTL9TTU28K
1wATcmQjN5IJf6x5TJQf1e6Nt3r2yvkVQRQHKsiQINQWw7ekXInH77elJ7l7US966GiBvYnHP/qL
idY7fuHhigabYqTRjpo=;
Received: from pmta03.mandrill.prod.atl01.rsglab.com (127.0.0.1) by mail135-29.atl141.mandrillapp.com id hnts7g1sau8h for <my email>; Sat, 13 Feb 2016 18:39:52 +0000 (envelope-from <bounce-md_30852398.56bf7878.v1-06ab5d8c02a34805b03482612faeeab6@mandrillapp.com>)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandrillapp.com;
[email protected]; q=dns/txt; s=mandrill; t=1455388792; h=From :
Subject : Message-Id : To : Date : MIME-Version : Content-Type : From :
Subject : Date : X-Mandrill-User : List-Unsubscribe;
bh=KEjgclPUIJwHKRjNGfpy9MgxY2E+9J2EvIfLvQYFM18=;
b=jT0vFrEGfqbvBMDM1UbaUNHrZlviTOKc45X3lSfJlDdXyLTnM6AuELLj9ctN8w53n6nJhI
jNXg3raiNdM034i/kePV39iIqkV5woaeniC7y2XVc5D/6YSizmyjT1ryVRAPlArxOC07U4yo
Ue6uM4TwT8EriNJBQoo20K222eRss=
From: Anita Shultz <[email protected]>
Subject: {me}, How to begin our collaboration
Return-Path: <bounce-md_30852398.56bf7878.v1-06ab5d8c02a34805b03482612faeeab6@mandrillapp.com>
Received: from [76.180.40.61] by mandrillapp.com id 06ab5d8c02a34805b03482612faeeab6; Sat, 13 Feb 2016 18:39:52 +0000
Message-Id: <[email protected]>
To: me
X-Report-Abuse: Please forward a copy of this message, including all headers, to [email protected]
X-Report-Abuse: You can also report abuse here: http://mandrillapp.com/contact/abuse?id ... 612faeeab6
X-Mandrill-User: md_30852398
Date: Sat, 13 Feb 2016 18:39:52 +0000
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="_av-lCEriNk0ZFopvcTX0fAC2g"

--_av-lCEriNk0ZFopvcTX0fAC2g
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


We are happy to welcome you Mr my name,
Thank you for the interest shown! You have recently forwarded the answering letter to our job offer which was sent out to you from the e-mail address of recruitment company by our order. My name is Anita Shultz and I am your personal consultant. From this moment we will communicate with you by this e-mail which is our financial department address.
Please excuse we are late with the reply. There were some technical difficulties and it took some time to eliminate them.
You can find the detailed description of our employment offer in the attachment called Good income.pdf. If you have some problems to open this attached file please write me and we will convert it for you in other format at your convenience.

If you want to work with us, please send us all the required information on this e-mail.

__________________________________________________

Best regards,

Anita Shultz
Consultant of Financial Department "ABD Gruppe AG"

ABD Gruppe AG
Steinwiesenstrasse 1
8952 Schlieren
Zurich - Switzerland
Phone No: +41.44-586-9488
USA Toll Free number: +1.800-958-1768



--_av-lCEriNk0ZFopvcTX0fAC2g
Content-Type: application/pdf
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="Good income.pdf"


The attachment says "Our trade register number in the Unified Swiss Commercial Register is CH-170.3.029.812-3, commercial Registry Office is Canton of Zurich." among other things.

Sorry to hear that. We can try to get the website shut down, but we need more info. The domain was registered a month ago for only one year with a Chinese registrar.

The headers show a return address at abd-gruppe.net, but the mail was not sent through abd-gruppe's mailserver, but through Mandrill. Could you post an email you sent to abd-gruppe.net, with complete headers, and the reply, with complete headers? Also post the text of the job description.

Should I remove my email address from the headers or leave it in?

Remove you name and email address before posting.

Headers from email I sent:

MIME-Version: 1.0
Received: by 10.76.102.137 with HTTP; Wed, 24 Feb 2016 12:00:12 -0800 (PST)
In-Reply-To: <[email protected]>
References: <[email protected]>
<CACubMJ9TiBLHEaGa1xHCqFZm2HAU7UnMUtY5kVG2YsttjKuzzw@mail.gmail.com>
<[email protected]>
<CACubMJ84gwcTP91hqYMePsnijEs5pnYOhGnQPL_YJgkUjy=stw@mail.gmail.com>
<[email protected]>
<[email protected]>
<[email protected]>
<CACubMJ9YJzB-b3JSaGSO6hTHsiT6hHNaHosDVsFg2aXxmtEzCA@mail.gmail.com>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<CACubMJ91TW=CFZW8DrTsJOLaUu18MKfesZx9DuvwPcwbBVLk8Q@mail.gmail.com>
<[email protected]>
<[email protected]>
<[email protected]>
<CACubMJ8sTzsYsyv-dUcLjxgsqDpM=UrNQjRtHyxoSPkMuf6Dtg@mail.gmail.com>
<CACubMJ-USmMZC8DNx5cgH+JCuw6XyxyCkj35CwdCKTHX6XFYmA@mail.gmail.com>
<[email protected]>
<CACubMJ_tBUxAT9WyNF0oT_Si1txXxsXAeUsxhh0M4DB47cH3VA@mail.gmail.com>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<CACubMJ9=6VTeLAvQW7wPavBdsYBBEvWsZYoFjHteF5tnQjiWfg@mail.gmail.com>
<[email protected]>
<CACubMJ8R2waoN+FNZzTFKi01k2AZ_Ljo8xOgU4acS+6Y3Ug9kg@mail.gmail.com>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<CACubMJ8=JLWO=T33=0oh-qCUbf=RumN=SaeGV1ce_j4az4gOKQ@mail.gmail.com>
<[email protected]>
<CACubMJ-uM7-A-5sj+i1mXBS7YmYjaKCZp6V5AcPD9B-TAUKXLQ@mail.gmail.com>
<CACubMJ_0DXz3EPhKMF=Z-7_kZgeYXrCG7U22o-Lzn82PEfd3PA@mail.gmail.com>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<CACubMJ8=tDGKpx1meVR=g_2e9Rrb41YtQV8aDQ83Y6MV8y0Ymg@mail.gmail.com>
<CACubMJ_O-YnQq4THWZ0xs39mNP8FpGC-AH9nQPSFcrvgE6VpbQ@mail.gmail.com>
<[email protected]>
<CACubMJ-1NLo5=nO3yx3toUJa+BZgOB6qTVUfOxj8QY=E-7aF5g@mail.gmail.com>
<[email protected]>
<[email protected]>
<CACubMJ-XhH8FdOzGmovhVs+W9SS+xtdT4NCbGLKP4aJtQoYGJA@mail.gmail.com>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<CACubMJ_KoHyCWgqqncp7eOmNF4hgccNB5k1mdqY8a1Mh72xAag@mail.gmail.com>
<[email protected]>
Date: Wed, 24 Feb 2016 15:00:12 -0500
Delivered-To:
Message-ID: <CACubMJ9KZiyY6WFSM=ybtAFmbM=Brn0z2=tOrQBu8_b4q9Pcpg@mail.gmail.com>
Subject: Re: , How to begin our collaboration
From:
To: Anita Shultz <[email protected]>
Content-Type: multipart/alternative; boundary=001a11c22ff28f982e052c8983ae

--001a11c22ff28f982e052c8983ae
Content-Type: text/plain; charset=UTF-8

Headers from reply:

Delivered-To:
Received: by 10.76.154.166 with SMTP id vp6csp2051859oab;
Wed, 24 Feb 2016 12:09:57 -0800 (PST)
X-Received: by 10.107.168.29 with SMTP id r29mr42426528ioe.12.1456344597531;
Wed, 24 Feb 2016 12:09:57 -0800 (PST)
Return-Path: <[email protected]>
Received: from p3plsmtpa08-05.prod.phx3.secureserver.net (p3plsmtpa08-05.prod.phx3.secureserver.net. [173.201.193.106])
by mx.google.com with ESMTPS id b21si5576862iod.170.2016.02.24.12.09.55
for <>
(version=TLS1_2 cipher=AES128-SHA bits=128/128);
Wed, 24 Feb 2016 12:09:56 -0800 (PST)
Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate 173.201.193.106 as permitted sender) client-ip=173.201.193.106;
Authentication-Results: mx.google.com;
spf=softfail (google.com: domain of transitioning [email protected] does not designate 173.201.193.106 as permitted sender) [email protected]
Received: from localhost ([46.140.162.154])
by p3plsmtpa08-05.prod.phx3.secureserver.net with
id NL9i1s00B3LAr6N01L9ojS; Wed, 24 Feb 2016 13:09:55 -0700
X-Sender: [email protected]
Date: Wed, 24 Feb 2016 15:09:42 -0500
From: Anita Shultz <[email protected]>
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
To:
Subject: Re: , How to begin our collaboration
In-Reply-To: <CACubMJ9KZiyY6WFSM=ybtAFmbM=Brn0z2=tOrQBu8_b4q9Pcpg@mail.gmail.com>
References: <[email protected]>
<CACubMJ9TiBLHEaGa1xHCqFZm2HAU7UnMUtY5kVG2YsttjKuzzw@mail.gmail.com>
<[email protected]>
<CACubMJ84gwcTP91hqYMePsnijEs5pnYOhGnQPL_YJgkUjy=stw@mail.gmail.com>
<[email protected]>
<[email protected]>
<[email protected]>
<CACubMJ9YJzB-b3JSaGSO6hTHsiT6hHNaHosDVsFg2aXxmtEzCA@mail.gmail.com>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<CACubMJ91TW=CFZW8DrTsJOLaUu18MKfesZx9DuvwPcwbBVLk8Q@mail.gmail.com>
<[email protected]>
<[email protected]>
<[email protected]>
<CACubMJ8sTzsYsyv-dUcLjxgsqDpM=UrNQjRtHyxoSPkMuf6Dtg@mail.gmail.com>
<CACubMJ-USmMZC8DNx5cgH+JCuw6XyxyCkj35CwdCKTHX6XFYmA@mail.gmail.com>
<[email protected]>
<CACubMJ_tBUxAT9WyNF0oT_Si1txXxsXAeUsxhh0M4DB47cH3VA@mail.gmail.com>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<CACubMJ9=6VTeLAvQW7wPavBdsYBBEvWsZYoFjHteF5tnQjiWfg@mail.gmail.com>
<[email protected]>
<CACubMJ8R2waoN+FNZzTFKi01k2AZ_Ljo8xOgU4acS+6Y3Ug9kg@mail.gmail.com>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<CACubMJ8=JLWO=T33=0oh-qCUbf=RumN=SaeGV1ce_j4az4gOKQ@mail.gmail.com>
<[email protected]>
<CACubMJ-uM7-A-5sj+i1mXBS7YmYjaKCZp6V5AcPD9B-TAUKXLQ@mail.gmail.com>
<CACubMJ_0DXz3EPhKMF=Z-7_kZgeYXrCG7U22o-Lzn82PEfd3PA@mail.gmail.com>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<CACubMJ8=tDGKpx1meVR=g_2e9Rrb41YtQV8aDQ83Y6MV8y0Ymg@mail.gmail.com>
<CACubMJ_O-YnQq4THWZ0xs39mNP8FpGC-AH9nQPSFcrvgE6VpbQ@mail.gmail.com>
<[email protected]>
<CACubMJ-1NLo5=nO3yx3toUJa+BZgOB6qTVUfOxj8QY=E-7aF5g@mail.gmail.com>
<[email protected]>
<[email protected]>
<CACubMJ-XhH8FdOzGmovhVs+W9SS+xtdT4NCbGLKP4aJtQoYGJA@mail.gmail.com>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
<CACubMJ_KoHyCWgqqncp7eOmNF4hgccNB5k1mdqY8a1Mh72xAag@mail.gmail.com>
<[email protected]>
<CACubMJ9KZiyY6WFSM=ybtAFmbM=Brn0z2=tOrQBu8_b4q9Pcpg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Original proposition

Description of our job offer
Our company “ABD Gruppe AG” greets you!
We appreciate your interest in our business offer. “ABD Gruppe AG” is a fast developing and innovation organization with more than 200 employees worldwide. We combine innovative policy and high professional competence in our activity offering a good remuneration and individual approach to each worker.
My name is Anita Shultz and I am your personal assistant.
It is a home-based work, 1099. You don’t need to pass a job interview but there will be a trial work period which can start as soon as you wish. This period will last one month and it begins the day you decide to cooperate with us. In the meantime we will see how you manage to follow all our instructions and you will have time to understand the matter. The first working day will be when you receive the first task from us. If you actually have a job we don’t ask you to quit it, you can easily combine.
Before you take a decision you can make sure that our company is absolutely legal. Please check out official websites of business registration such as www.zefix.ch, www.moneyhouse.ch and others. Please don’t forget to choose English language for some pages. On these websites you can check the legality of our company by the number in the Unified Swiss Commercial Register. The legal name of our company is “ABD Gruppe AG”. Our trade register number in the Unified Swiss Commercial Register is CH-170.3.029.812-3, commercial Registry Office is Canton of Zurich. Our company is registered from 06/09/2006 and has all the necessary permits and licenses for carrying on this activity during 10 years already. Our collaboration will be absolutely legal and transparent for the fiscal authorities as well as for your CC company. The transfers to your account will be done from our banking account of an American bank or American branch of Swiss bank.
The job we offer is very easy and doesn’t require any cash investment from you. Usually it takes not more than 1 or 2 hours a day of your free time. If you combine this activity with your daily work you can specify the convenient days to complete the operation. We always decide with you the day and the time of each operation beforehand.
To start working with us you must have a credit card with credit limit of $1,000.00 or more and be a citizen or a resident of the USA. We will never ask you for the complete information of your credit card, all we will need are the first six numerals of your card number so we could make certain that your card is a credit card and not debit one. We work only with credit card accounts, it is stipulated by the requirements of our bank through which we collaborate with our American employees. You can use several cards at the same time so you could process more operations at once and in such a way increase your income.
Detailed description of a regular operation:
1) You must have a credit card account with credit limit from $1,000.00 or above. The more is your credit limit the more you could earn by one operation.
2) We make a transaction on your credit card account to settle your balance.

3) As soon as the amount entered on your account you have already earned from 15% to 20% of the transferred sum. There are bonus points for fast and proficient work performance.
4) For the rest 85% or 80% of the transferred sum you purchase items in a local department store or online. At the moment we mostly need iTunes cards. However items may differ and we always let you know beforehand the type and the quantity of items to buy. We consult your interests and if you can't or don't want to purchase the item specified we could propose you the alternative.
5) You send us scans or photos of purchased iTunes cards. If you buy other required items which can’t be sent in digital form by e-mail then you send items by post, all postage at our expense.
6) We decide with you the best time for the next operation.
Please note that your commission will depend on your actual credit balance:
1) If your current credit balance is -$1,000.00 or more (close to your credit card limit): we pay off the total balance, then you go and purchase items for the 85% of the amount received on your card. Your commission will be 15 % in this case.
2) If your current credit balance is very small or at zero there are two options:
a. You make your balance -$1,000.00 or more (close to your credit card limit): as soon as the balance is posted we pay off the total balance, then you go and purchase items for the 85% of the amount received on your card. Your commission will be 15 % in this case.
b. First you buy items with your credit card for the amount of $800.00 and withdraw in cash or spend as you like $200.00. As soon as you confirm us the purchase of items we pay off your balance for $1,000.00. When $1,000.00 will come your account only then you send us items. Your commission will be 20 % in this case.
To start our collaboration as soon as possible you are to:
1) Have a credit card with credit limit of $1,000.00 or more.
2) Send us the following information:
a. Your full name and your date of birth;
b. Quantity of credit cards you want to work with;
c. Credit limit and current balance of each credit card. For your security you can send your current balance rounded down to $10.00;
d. Contact phone number (mobile and landline). During the operation you must always be available by phone in the daytime. If you can't answer the phone you are to call back in an hour.
e. Your address (house number, street, city, state, zip code).
If you accept our offer please send me a reply letter confirming your agreement with the data stated above. If you have any questions you can send me your phone number, I will call you and will answer your questions. Or you can call to our Toll Free number indicated below, I am at your disposal from 07:00 to 10:00 AM and from 13:00 to 19:00 PM (UTC-5).
Best regards,
Anita Shultz
Consultant of Financial Department “ABD Gruppe AG”
ABD Gruppe AG
Steinwiesenstrasse 1
8952 Schlieren
Zurich - Switzerland
Phone No: +41.44-586-94-88
USA Toll Free number: +1.800-958-1768
PS: Please pay attention to the change of our e-mail address
to this one: [email protected] .

Thanks! abd-gruppe.net is in the process of being reported for fraud.

There is also abd-gruppe.com, with the same registrant, registrar, and one-year term, but a different IP address at the same ISP in Ukraine. It is also fake.

1. You are the VICTIM of a clever fraud.
2. You need to report the fraud to your local law enforcement - don't leave it to your bank, they have a different motivation.
3. If you were in the US you would file a complaint with IC3 at
http://www.ic3.gov/default.aspx.
If you were in the UK you would complain to ActionFraud at
http://www.actionfraud.police.uk/report ... -questions
4. Find the equivalent authority where you live and file a complaint - you have been scammed.