Mystery Shopper. Sean Ray, [email protected]

My name is Sean Ray, I would like you to become our mystery shopper. You will earn $300 by being a mystery shopper. Your employment packet includes business evaluation form, a training assignment which will be send to you after you must have receive the payment for the assignment. Paycheck would be sent to you for the assignment by Certified Check or money order. You are to deduct your $300 which will be your wages, and the rest would be used for the evaluation at the store that would be sent to you.

If you are interested and willing to work with us, Email me the below details:

First Name:
Last Name:
Residential Address:
City:
State:
Zip Code:
Home Phone:
Cell Phone:
Email:
Bank Name:
Alternative email address:
Preferred Time to Call:
Can you Check email at least twice Daily:

NB: Please forward all replies to:
[email protected]
Thanks For Your Understanding.


G3 Mystery Shopping
[email protected]
Sean Ray



Email header details;

Delivered-To: *removed*
Received: by 10.236.110.170 with SMTP id u30cs177264yhg;
Tue, 26 Jul 2011 07:34:16 -0700 (PDT)
Received: by 10.224.218.65 with SMTP id hp1mr1240709qab.89.1311690854484;
Tue, 26 Jul 2011 07:34:14 -0700 (PDT)
Return-Path: <[email protected]>
Received: from smh05.opentransfer.com (smh05.opentransfer.com [98.130.1.173])
by mx.google.com with ESMTP id fi1si918766qab.2.2011.07.26.07.34.13;
Tue, 26 Jul 2011 07:34:13 -0700 (PDT)
Received-SPF: neutral (google.com: 98.130.1.173 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=98.130.1.173;
Authentication-Results: mx.google.com; spf=neutral (google.com: 98.130.1.173 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Received: by smh05.opentransfer.com (Postfix, from userid 8 )
id 2A6268ECC0; Tue, 26 Jul 2011 10:33:12 -0400 (EDT)
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
smh05.opentransfer.com
X-Spam-Level:
X-Spam-Status: No, score=0.1 required=5.0 tests=RDNS_NONE autolearn=disabled
version=3.2.5
Received: from webmail4.opentransfer.com (unknown [69.49.230.6])
by smh05.opentransfer.com (Postfix) with ESMTP id BDCF08ECB3;
Tue, 26 Jul 2011 10:33:11 -0400 (EDT)
Received: from webmail4.opentransfer.com (localhost [127.0.0.1] (may be forged))
by webmail4.opentransfer.com (8.13.8/8.13.8 ) with ESMTP id p6QEYC9t011845;
Tue, 26 Jul 2011 09:34:12 -0500
Received: (from nobody@localhost)
by webmail4.opentransfer.com (8.13.8/8.13.8/Submit) id p6QEYArC011844;
Tue, 26 Jul 2011 09:34:10 -0500
X-Authentication-Warning: webmail4.opentransfer.com: nobody set sender to [email protected] using -f
Received: from 41.58.20.229 ([41.58.20.229]) by webmail.opentransfer.com
(Horde MIME library) with HTTP; for <[email protected]>; Tue, 26
Jul 2011 09:34:09 -0500
X-Opentransfer-Authenticated: [email protected]
Message-ID: <[email protected]>
Date: Tue, 26 Jul 2011 09:34:09 -0500
From: Sean Ray <[email protected]>
Reply-to: [email protected]
To: undisclosed-recipients:;
Subject: Mystery Shopper
MIME-Version: 1.0
Content-Type: text/plain;
charset=ISO-8859-1;
DelSp="Yes";
format="flowed"
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
User-Agent: Internet Messaging Program (IMP) H3 (4.1.4)
X-Originating-IP: 41.58.20.229

Further scam script plus details on the western union pick up contact.

Good Day,

Payment for your 1st secret survey assignment has been sent to you. As soon as you receive the package, follow survey instructions carefully and get back with the survey results.

The package contains a check for $2,150. You are to cash the Check at your bank/make a next day deposit, deduct $300 as your Salary for the 1st secret evaluation/survey, you will have $2,850 left. Make use of $250 for your transportation & Western Union Charges. You are required to send a total of $2,600 to another secret Surveyor in another location (where a customer reported her funds missing) via Western Union Money Transfer so she can carry out another survey.

Here is the name of the secret Surveyor in another location which you would be sending the funds to:
Name- Charles Uche Obi
City- Girne
Country- Turkey
zip code- 99999

===YOUR 1st SECRET SURVEY ASSIGNMENT===
You are to have the check cashed at your bank before proceeding to wire the remaining funds at any Western Union Money Transfer location in your area. You are expected to perform the following secret survey while sending the funds like a normal customer. Use your discretion and make sure you complete the survey as instructed

1. Exact time you stepped into the outlet
2. Address of the Western Union location visited
3. Ambient outlook of the outlet
4. How long does it take you to have the funds wired?
5. How Close is the Western Union Money Transfer Location to you?
6. Gender of Agent (Male or Female)

You are expected complete the secret survey and get back with the results along with the following information after you have wired the funds.

1. Name and Address of Sender
2. Money Transfer Control Number (10 digits)
3. Exact Amount Wired

I would like you to acknowledge that you have received this email. Your pay increases after every completed survey. Thanks

Sean Ray



Email header details;

Delivered-To: *removed*
Received: by 10.151.51.9 with SMTP id d9cs104681ybk;
Fri, 19 Aug 2011 10:45:39 -0700 (PDT)
Return-Path: <[email protected]>
Received-SPF: pass (google.com: domain of [email protected] designates 10.223.6.91 as permitted sender) client-ip=10.223.6.91;
Authentication-Results: mr.google.com; spf=pass (google.com: domain of [email protected] designates 10.223.6.91 as permitted sender) [email protected]; dkim=pass [email protected]
Received: from mr.google.com ([10.223.6.91])
by 10.223.6.91 with SMTP id 27mr1562295fay.146.1313775935926 (num_hops = 1);
Fri, 19 Aug 2011 10:45:35 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=gamma;
h=mime-version:date:message-id:subject:from:to:content-type;
bh=UduyhnGRwATHfX2bwH7UM2mBc71X7ZO2RK5BiMwLVsM=;
b=qsQEBakkBFn2LQqUqh/BBbWBmRb3wH1RiuGUsYTx3w0jCqFVjKQc1ksIUHaNLnvAxu
FtEIMQ/XhT56J04Vrk53dGRSRT8lNtKoTt9797s/9/HxsVjwzYhQndQSsc9ClIiA2ZAj
2QORNiDEgUIuOSRDJFnX3rK6vaDxs7bXXFmEo=
MIME-Version: 1.0
Received: by 10.223.6.91 with SMTP id 27mr1562295fay.146.1313775935919; Fri,
19 Aug 2011 10:45:35 -0700 (PDT)
Received: by 10.223.96.78 with HTTP; Fri, 19 Aug 2011 10:45:35 -0700 (PDT)
Date: Fri, 19 Aug 2011 10:45:35 -0700
Message-ID: <CAMipvoWkddPERL15ix=TRBnYd_ELA1Y5Zts0_8voT6iA2mN_Mw@mail.gmail.com>
Subject: FOLLOW INSTRUCTIONS CAREFULLY
From: Sean Ray <[email protected]>
To: *removed*
Content-Type: multipart/alternative; boundary=001517447a2ef995cb04aadf4b36