QNX Group Employment Scam (money laundering)

Received this email after I replied to an ad for a job with the company:

Hello ****,


My name is Erika Levski. I am hiring manager of QNX Group Ltd.

Recently you have applied for a Regional Agent vacancy through Careerbuilder system. Please see the detailed description of the position in response to your request about the job (Attached Job_Description.doc). Please read it carefully.

If you are interested in this vacancy, fill out an application form (attached file Employment_Application_Form.doc), then e-mail it back to me. While filling out the form, please, provide the correct information to avoid delays by checking your data.

Best regards,

Erika Levski
HR manager
QNX Group Ltd
Web: qnx-ltd.com

**Did all the paperwork, checked the website, seems legit, then got this last email from this person:

Hello ******,

Thank you. I have received your bank account details. Now we're ready
to assign you to one of our financial managers. Mr. Mark Fischer will
contact you soon via e-mail ([email protected]) with all
necessary information.

Let me wish you more customers and more transactions. Don't hesitate
to contact us with any concerns you might have in process. Have a
great day.

Best regards,
Erika Levski
HR manager

QNX Group Ltd
Web: qnx-ltd.com

I never was contacted by Mark Fischer through email, however he did call me a few times.

Then last night I was checking my bank account, and saw a deposit on there for $9,740.00 from a company I have never heard of before. Then this morning at 8:00AM 'Mark Fischer' calls me and asks about the deposit, saying that I need to 'be ready' to go to the bank and withdraw the money, to send to someone else of coarse.

BUT before he called I spoke with an online rep from Bank of America about this, she referred me to their customer service dept over the phone, I was informed NOT to touch that money since I had no idea who the company was that made the deposit to my account...

And here I am now.

Very well done - you called the bank, they will know how to deal with it! They will block the money and contact the police.

I'd like to have a look at their website, please post the url.

The scammers tried to involve you in money laundering, and the transfer is ultimately money stolen from victims. Actually, you helped
- future victims who will find your post
- the police in uncovering a fraud
- and victims who just might get their money back if the police can track them down.



Thank you for posting this warning.

@ Katherina

Here's the site they sent me in the email(s)

http://qnx-ltd.com/

It seems, and looks legit, even in the 'careers' section it describes the position I was applying for.

http://qnx-ltd.com/EN/article/Details/43.html

Thank you for the reply. I hope nobody else gets scammed by them and has to PAY all that money back that they took from someone else.

Also here's that person's phone number (Mark Fischer) 443-203-9292 email = [email protected]
That supposedly works for QNX Group. Maybe IF that's a real company they should investigate him.

If it describes the job they wanted you to do, then the site is a fake, because there is no such thing as a legitimate job performing those activities.

Sure enough,

Domain Name: QNX-LTD.COM
Registrar: ONLINENIC, INC.
Whois Server: whois.onlinenic.com
Referral URL: http://www.OnlineNIC.com
Name Server: NS1.DNS-DIY.NET
Name Server: NS2.DNS-DIY.NET
Status: clientTransferProhibited
Updated Date: 04-aug-2011
Creation Date: 22-jul-2011
Expiration Date: 22-jul-2012

Please post the headers of an email they sent you--they will help our site killers.

I'm back.

Details on the website:

Address lookup
canonical name
qnx-ltd.com.
aliases

addresses
217.116.198.23
Domain Whois record
Queried whois.internic.net with "dom qnx-ltd.com"...
Domain Name: QNX-LTD.COM
Registrar: ONLINENIC, INC.
Whois Server: whois.onlinenic.com
Referral URL: http://www.OnlineNIC.com
Name Server: NS1.DNS-DIY.NET
Name Server: NS2.DNS-DIY.NET
Status: clientTransferProhibited
Updated Date: 04-aug-2011
Creation Date: 22-jul-2011
Expiration Date: 22-jul-2012

>>> Last update of whois database: Wed, 17 Aug 2011 13:16:11 UTC <<<
Queried whois.onlinenic.com with "qnx-ltd.com"...
Registrant:
Terens Jessquv [email protected] +1.38489247773
Jarenshinc inc
32 Avenu
New York,NY,US 32131


Domain Name:qnx-ltd.com
Record last updated at 2011-08-04 08:59:15
Record created on 2011/7/22
Record expired on 2012/7/22


Domain servers in listed order:
ns1.dns-diy.net ns2.dns-diy.net

Administrator:
name: Terens Jessquv
mail: [email protected] tel: +1.38489247773
org: Jarenshinc inc

address: 32 Avenu
city: New York
,province: NY
,country: US
postcode: 32131

Technical Contactor:
name: Terens Jessquv
mail: [email protected] tel: +1.38489247773
org: Jarenshinc inc

address: 32 Avenu
city: New York
,province: NY
,country: US
postcode: 32131

Billing Contactor:
name: Terens Jessquv
mail: [email protected] tel: +1.38489247773
org: Jarenshinc inc

address: 32 Avenu
city: New York
,province: NY
,country: US
postcode: 32131


Registration Service Provider:
name: Robert Haise
tel: +1.38489249898
fax: +1.38489249898
web:
Network Whois record
Queried whois.ripe.net with "-B 217.116.198.23"...
% Information related to '217.116.192.0 - 217.116.199.255'

inetnum: 217.116.192.0 - 217.116.199.255
netname: HOSTHANE
descr: ISIK Bilgisayar Internet ve Yayincilik Hizmetleri
country: TR
org: ORG-IBIv1-RIPE
admin-c: DI421-RIPE
tech-c: DI421-RIPE
status: ASSIGNED PA
mnt-by: HOSTHANE-MNT
changed: [email protected] 20091002
source: RIPE

organisation: ORG-IBIv1-RIPE
org-name: ISIK Bilgisayar Internet ve Yayincilik Hizmetleri
org-type: LIR
address: ISIK Bilgisayar Internet ve Yayincilik Hizmetleri
Dincer ISIK
Arama Sokak 14/4
06130 Ankara
TURKEY
phone: +903123188963
fax-no: +903123188963
e-mail: [email protected]
admin-c: DI421-RIPE
mnt-ref: HOSTHANE-MNT
mnt-ref: RIPE-NCC-HM-MNT
mnt-by: RIPE-NCC-HM-MNT
changed: [email protected] 20090929
changed: [email protected] 20091001
source: RIPE

person: Dincer ISIK
address: Hosthane Network Datacenter
address: Aydinlikevler ANKARA
remarks: ******************ENGLISH*******************
remarks: **** Abuse Reports to : [email protected] ****
remarks: *** This IP block is used for web hosting,***
remarks: *** dedicated and co-located servers. In ***
remarks: *** case of spam, please only deal with ***
remarks: *** originator IP only. ***
remarks: *** DO NOT DEAL WITH THE WHOLE IP BLOCK ***
remarks: *********************************************
remarks: ******************TURKISH********************
remarks: **** Sikayetler icin : [email protected] ***
remarks: *** Bu ip blogu web hosting,kiralik sunucu***
remarks: *** ve sunucu barindirma hizmetleri icin ***
remarks: *** kullanilmaktadir. Eger iplerimizden ***
remarks: *** spam gonderilirse lutfen sadece ***
remarks: *** gonderen ip ile ilgili islem yapiniz. ***
remarks: **TUM IP BLOGU ILE ILGILI ISLEM YAPMAYINIZ **
remarks: *********************************************
mnt-by: HOSTHANE-MNT
e-mail: [email protected]
phone: +90-312-3188963
fax-no: +90-312-3188963
nic-hdl: DI421-RIPE
changed: [email protected] 20061214
source: RIPE

% Information related to '217.116.192.0/21AS49879'

route: 217.116.192.0/21
descr: ISIK Bilgisayar
origin: AS49879
mnt-by: HOSTHANE-MNT
changed: [email protected] 20091002
source: RIPE
DNS records
DNS query for 23.198.116.217.in-addr.arpa returned an error from the server: NameError
name
class
type
data
time to live
qnx-ltd.com
IN
SOA
server:

email:
hostmaster.nameserver
serial:
3
refresh:
28800
retry:
7200
expire:
604800
minimum ttl:
5
3600s
(01:00:00)
qnx-ltd.com
IN
A
217.116.198.23
3600s
(01:00:00)
-- end --?URL for this output  |  return to CentralOps.net, a service of Hexillion

Look at this bit:

Updated Date: 04-aug-2011
Creation Date: 22-jul-2011
Expiration Date: 22-jul-2012

The site has been registered 12 days ago, for one year only - a big red flag! It ususally means that the registrant already knows that sooner or later it will be closed for fraud. Moreover, their site says: "Copyright 2009" - it didn't even exist at that time.

But here comes the worst part:
There is a nearly identical site called
http://www.brightconsulting.bg

and it's legitimate.

And QNX didn't only copy the text, it is stealing the layout, pages, pictures - everything, and I suspect not by copying, but by directly pulling their content online.

Wow!!! That's crazy, they basically cloned that legitimate site and changed the text!!!

Thank you all so much for the help in this matter. BTW that guy 'Mark Fischer' never called me back about the money in the bank, said he was going to call at 9AM. Probably found out that I reported him to you, and another scam warning site also.

I am attempting to contact the company that sent the money and let them know what is going on. I have to wait a little while though they are in Nevada and aren't open yet.

Just got a call from the guy Mark Fischer, he sent me this email with 'instructions' on what to do....

from Mark Fischer [email protected]
to (my email address)
date Wed, Aug 17, 2011 at 9:57 AM
subject Transaction 1 details
Important mainly because it was sent directly to you.

hide details 9:57 AM (3 minutes ago)

Hello ******,

You have received a transaction from our client HAWS & CO
Go to the bank and withdraw transaction you have received.
you have received $9,740.00-

to pay for Money Gram deduct transaction fee from this amount


go to Money Gram office and buy transfer
Send Amount - 3,176.47 USD
Receive Amount - 3,176.47 USD
Fee - 63.53 USD
Total Cost - 3,240.00
first name: OLEKSANDR
last name: LYCHMAN
country:Ukraine
city:Sevastopol
in Money Gram transfer information write "best regards"

go to Western Union office and buy transfer
total amount:$3250
amount to be received:$3250 deducting fees
Western Union Fee: around $130
first name: OLEKSANDR
last name: LYCHMAN
country:Ukraine
city:Sevastopol
in Western Union transfer information write "best regards"

go to ANOTHER Money Gram office and buy transfer
Send Amount - 3,137.25 USD
Receive Amount - 3,137.25 USD
Fee - 62.75 USD
Total Cost - 3,200.00
first name: MARIYA
last name: DZYGIR
country: Ukraine
city:Sevastopol
in Money Gram transfer information write "best regards"


Money Gram system was created only for personal transactions.
When Money Gram manager asks you whether you know person you are
sending money to you must answer that you know him in person, face to
face. Don't forget to take your ID with you, it could be necessary to show it.
In case Money Gram location has a sending limit of $ 1,000 just go to
another location.
After you transfer money you must send me:
money transfer reference number
exact sent amount deducting fees
and email me copy of Money Gram receipt, that is for our archive.

Do everything as soon as possible.
reply me shortly with exact time you need to finish this deal
Give me a call as soon as you finish reading the instructions.
Visit Moneygram website
http://www.moneygram.com/eFindUs/findUs ... ageCode=en
to find close locations.
Visit www.westernunion.com and use agent locator.

Best regards,
Mark Fischer.

***Notice how he says 'Do everything as soon as possible' obviously wants it done before the company that sent me the money finds out about it!!!

Wow!!! That's crazy, they basically cloned that legitimate site and changed the text!!!

That happens a lot. And sometimes they just quote a genuine site in their emails and ask you to reply to a free email address such as Gmail.

I am attempting to contact the company that sent the money and let them know what is going on. I have to wait a little while though they are in Nevada and aren't open yet.

It quite likely their online banking details have been phished. And rather than leave a money trail to their bank account, trick people into laundering it.

Just spoke with Kevin that works in accounting for the company that the money was 'taken' from and he is investigating it as I type this.

This is better than watching a movie - please keep us updated!

Ha Ha! I will Katharina.

The guy has called me twice more and keeps asking 'if' I'm at the bank getting the money...
I said 'yea they got me in an office and I'm waiting on the bank's representative to come back'...

I hope they catch these people, I really do.

I need a job doing this, because I seem to have a knack for finding the scams people put out there!

OK now it's 2:54PM EST (same day as my other posts) the 'Mark Fischer' guy keeps calling me, but I'm not answering...he doesn't know, that I know it's a scam.

However I just contacted my bank again, and reported it to their claims department, they are to have the deposit cancelled and returned to the sender. He he! AND I am going to give them all the details, emails, and everything to go with it in the morning!

I informed them (Bank Of America) what was going on, and explained it all to them, and they are going to take care of it!!!

My bank called me today, the fraud department and they are investigating this and I gave them the link to this as well for the information on the fake website. They also instructed me to contact the FBI and their ic3.gov site and file with them as well. I did.

This is quite a story and I am very glad that you spotted the scam.
Thank you very much for sharing all the updated with us - very interesting