Job scam from Poland - domain mh-a.org

From Russia, with fraudulent intent.

This may sound, to some like a simple job offer but I can guarantee that its intention is to fraudulently obtain money from the victims (applicants). Firstly, it sounds far too good to be true. Earning $72,000 for just a couple of hours of work a day!! Here's how the scam will probably work. The criminals (employer) will tell the victims that their work entails processing customer payments for a commission and sending the balance of the funds to the scammer or his associates. The "payments" will be in the form of a fake check or a fund transfer through a compromised bank account. Again this is far too easy a job to be earning that kind of money; another red flag. When the victims' bank discovers the fraudulent payment they will come after the victim to cover the loss, which may be substantial. Depending on the severity of the fraud involved the victim may expect a visit from the police as well. The scammer will be long gone and uncontactable.

Do not accept any job offer that involves processing payments for a commission. It is a scam!

Delivered-To: *****@yahoo.com.au
Received: by 10.90.31.15 with SMTP id e15cs414752age;
Sun, 22 Nov 2009 12:46:11 -0800 (PST)
Received: by 10.224.36.89 with SMTP id s25mr2082309qad.5.1258922770784;
Sun, 22 Nov 2009 12:46:10 -0800 (PST)
Return-Path: <[email protected]>
Received: from col0-omc3-s11.col0.hotmail.com (col0-omc3-s11.col0.hotmail.com [65.55.34.149])
by mx.google.com with ESMTP id 7si8634717qwb.22.2009.11.22.12.46.10;
Sun, 22 Nov 2009 12:46:10 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 65.55.34.149 as permitted sender) client-ip=65.55.34.149;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 65.55.34.149 as permitted sender) [email protected]
Received: from COL103-W15 ([65.55.34.137]) by col0-omc3-s11.col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Sun, 22 Nov 2009 12:43:26 -0800
Message-ID: <[email protected]>
Return-Path: [email protected]
Content-Type: multipart/alternative;
boundary="_21a52b38-613e-4997-be45-7929e8f8ab41_"
X-Originating-IP: [92.100.41.140] <- Points to Saint Petersburg, Russian Federation
From: Talisha BECKELHIMER <[email protected]>
To: <*****@yahoo.com.au>
Subject: Job opportunity. (590).
Date: Sun, 22 Nov 2009 22:43:25 +0200
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 22 Nov 2009 20:43:26.0014 (UTC) FILETIME=[708E4DE0:01CA6BB4]



Job Location: Australia, New Zealand
Salary: 72,000/year
Bonus: Yes
Education: High School/College
Citizenship or Work-Visa: Yes

Hello.

We have a vacant position "Independent Contractor" for anyone who has a few spare hours a day.
For more information, please forward your contact details back to our e-mail : [email protected].

We will contact you with further job details.

Thank you and have a wonderful day !

I decided to bait this scam using completely fake personal information. My baiting name, which I won't mention here, is something that a native English speaker would immediately spot as being fake.

The first email I received after expressing interest in the "job offer";

Delivered-To: *****@gmail.com
Received: by 10.239.149.11 with SMTP id h11cs503535hbb;
Tue, 1 Dec 2009 06:10:26 -0800 (PST)
Received: by 10.91.21.6 with SMTP id y6mr483916agi.11.1259676624424;
Tue, 01 Dec 2009 06:10:24 -0800 (PST)
Return-Path: <[email protected]>
Received: from qmail-wm-norm-0.netfirms.com ([70.35.18.226])
by mx.google.com with SMTP id 31si177741iwn.107.2009.12.01.06.10.20;
Tue, 01 Dec 2009 06:10:24 -0800 (PST)
Received-SPF: error (google.com: error in processing during lookup of [email protected]: DNS timeout) client-ip=70.35.18.226;
Authentication-Results: mx.google.com; spf=temperror (google.com: error in processing during lookup of [email protected]: DNS timeout) [email protected]
Received: (qmail 22596 invoked from network); 1 Dec 2009 14:10:20 -0000
Received: from unknown (10.8.7.0)
by TCPLOCALHOST with QMQP; 1 Dec 2009 14:10:20 -0000
Received: from 98.228.162.11
(SquirrelMail authenticated user [email protected])
by webmail.mh-a.org with HTTP;
Wed, 2 Dec 2009 01:10:19 +1100 (EST)
Message-ID: <[email protected]>
Date: Wed, 2 Dec 2009 01:10:19 +1100 (EST)
Subject: *****@gmail.com
From: "Agata Symanski" <[email protected]>
To: *****@gmail.com
Reply-To: [email protected]
User-Agent: SquirrelMail/1.4.4
MIME-Version: 1.0
Content-Type: multipart/mixed;boundary="----=_20091202011019_51100"
X-Priority: 3 (Normal)
Importance: Normal


Dear *****!
We are glad to inform you that after we had reviewed your resume we decided to offer you employment with Milk & Honey LTD. Our company offers you the position of Outside Support Representative.
Now, we’d like you to read carefully the terms of your work and if you happen to have any questions after reading all the information below - please do not hesitate to contact me.
You will begin working from December 8.
Your job title will be Service Manager/Sales.
You are hired as a part-time employee.
Your salary will be from $3,000 base pay + commission.
As for your salary, basically, you will be paid from $3,000.00 for the duties you will be supposed to fulfill. In addition, you will be able to get bonuses as a reward for hard work. You will be able to get 5% per order.
Here is the more distinct definition of the employee plan you may be interested in:
Personal account plan. You will represent personal interests of our company on the territory of your location. You will work with our clients and partners, you will process orders and perform simple online office duties using your own personal checking account for these purposes. For that you will be paid $3,000.00 monthly plus a 5% bonus per order completed.
Business account plan. You will represent our company's business interests on the territory of your location. You will work with dedicated and personal clients only. You will process orders from our business clients and private investors. You will use your business bank account for these purposes. This plan is very important for us and you will receive $4,500.00 monthly plus a 9% bonus per order completed.
As for the benefits, we are free to cancel or modify any of our employee benefit plans at any time.
As for your duties, you will be responsible for building long-term relationships with advertising companies and marketing agents/agencies from around the world. If you happen to have a certain experience concerning this kind of job, then we appreciate this. Our company specializes in buying/selling/exchanging online ad places, creating marketing plans for Internet-oriented projects. We decided to enlarge the territory of accepting sales orders, that’s why we are hiring you for helping us in this. According to the local and international law we cannot accept direct payments and orders from foreign companies or persons. That is why we are offering you to be our official representative with full rights and powers. You will receive orders/payments/billing records/payment invoices/transactions from our clients, customers and/or investors and you will also receive a transaction invoice before every order you have to process or ensure. You are sure to like the job we are offering you as it doesn’t take a lot time but it is paid for very well.

If you decide to accept our offer you will be in such relationship with our company when the employment relationship can be terminated by either one of us at any time for any reason.
This offer will remain open until December, 2009.
Now, as you have read all the information about your duties, terms and your salary carefully, complete APPLICATION FORM.DOC & EMPLOYMENT AGREEMENT and wait for the response in 2-3 days
We are glad that you decided to join our organization. We are looking forward to working with you.


--
Sincerely yours,
Agata Symanski.
HR/Managment Group.



The information contained in this message may be privileged and confidential and protected from disclosure. If you are not the original intended recipient you are hereby notified that any review,
retransmission, dissemination, or other use of, or taking of any action in reliance upon, this information is prohibited. If you have received this communication in error, please notify the sender immediately by replying to this message and deleting it from your computer. Thank you for your cooperation.

Notice that the scammer has replied with a completely different email address and a different name. He also mentions that my resume has been reviewed. That would be impossible as I never submitted a resume. The documentation provided was quite a clever prop. It certainly does make them seem much more professional than other fake job scammers.


The next email:

Delivered-To: *****@gmail.com
Received: by 10.239.149.11 with SMTP id h11cs94133hbb;
Fri, 11 Dec 2009 05:33:51 -0800 (PST)
Received: by 10.101.165.21 with SMTP id s21mr2012057ano.176.1260538430848;
Fri, 11 Dec 2009 05:33:50 -0800 (PST)
Return-Path: <[email protected]>
Received: from qmail-wm-norm-0.netfirms.com ([70.35.18.227])
by mx.google.com with SMTP id 42si3060033iwn.111.2009.12.11.05.33.49;
Fri, 11 Dec 2009 05:33:50 -0800 (PST)
Received-SPF: error (google.com: error in processing during lookup of [email protected]: DNS timeout) client-ip=70.35.18.227;
Authentication-Results: mx.google.com; spf=temperror (google.com: error in processing during lookup of [email protected]: DNS timeout) [email protected]
Received: (qmail 82647 invoked from network); 11 Dec 2009 13:33:49 -0000
Received: from unknown (10.8.7.4)
by TCPLOCALHOST with QMQP; 11 Dec 2009 13:33:49 -0000
Received: from 71.82.126.28
(SquirrelMail authenticated user [email protected])
by webmail.mh-a.org with HTTP;
Sat, 12 Dec 2009 00:33:48 +1100 (EST)
Message-ID: <[email protected]>
In-Reply-To: <[email protected]>
References: <[email protected]>
<[email protected]>
Date: Sat, 12 Dec 2009 00:33:48 +1100 (EST)
Subject: Re: *****@gmail.com
From: "Agata Symanski" <[email protected]>
To: <*****@gmail.com>
Reply-To: [email protected]
User-Agent: SquirrelMail/1.4.4
MIME-Version: 1.0
Content-Type: text/html;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal



Dear *****,

Thank you for your e-mail. Yes, the position is sill available. Please visit our home page http://www.mh-a.org there you can find information about our company and much more. You will be responsible for building long-term relationships with advertising companies and marketing agents/agencies from around the world. You will receive orders/payments/billing records/payment invoices/transactions from our clients, customers and/or investors and you will also receive a transaction invoice before every order you have to process or ensure. You are sure to like the job we are offering you as it doesn’t take a lot time but it is paid for very well.

First time you will receive all needed information from your supervisor who will also answer to all of your questions. You will be paid monthly(international bank transfer to your bank account) except 5% bonus(cash) you will receive it instantly. If you have any additional questions please don't hesitate to contact me.

I need to receive from you all filled documents(Application Form & Employment Agreement) so we can proceed to the next step. Please print all foms fill them out after that scan or picture completed forms and send to me via e-mail.

I have asked the talented website killers on our sister site 419eater to euthanasia the fraudulent website http://www.mh-a.org



The next email:

Delivered-To: *****@gmail.com
Received: by 10.239.149.11 with SMTP id h11cs19068hbb;
Sat, 12 Dec 2009 02:50:16 -0800 (PST)
Received: by 10.91.52.20 with SMTP id e20mr1334376agk.47.1260615014257;
Sat, 12 Dec 2009 02:50:14 -0800 (PST)
Return-Path: <[email protected]>
Received: from qmail-wm-norm-0.netfirms.com ([70.35.18.230])
by mx.google.com with SMTP id 29si3961596iwn.103.2009.12.12.02.50.13;
Sat, 12 Dec 2009 02:50:14 -0800 (PST)
Received-SPF: error (google.com: error in processing during lookup of [email protected]: DNS timeout) client-ip=70.35.18.230;
Authentication-Results: mx.google.com; spf=temperror (google.com: error in processing during lookup of [email protected]: DNS timeout) [email protected]
Received: (qmail 17324 invoked from network); 12 Dec 2009 10:50:12 -0000
Received: from unknown (10.8.7.2)
by TCPLOCALHOST with QMQP; 12 Dec 2009 10:50:12 -0000
Received: from 76.98.138.11
(SquirrelMail authenticated user [email protected])
by webmail.mh-a.org with HTTP;
Sat, 12 Dec 2009 21:50:11 +1100 (EST)
Message-ID: <[email protected]>
In-Reply-To: <[email protected]>
References: <[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
Date: Sat, 12 Dec 2009 21:50:11 +1100 (EST)
Subject: Re: *****@gmail.com
From: "Agata Symanski" <[email protected]>
To: <*****@gmail.com>
Reply-To: [email protected]
User-Agent: SquirrelMail/1.4.4
MIME-Version: 1.0
Content-Type: multipart/mixed;boundary="----=_20091212215011_53683"
X-Priority: 3 (Normal)
Importance: Normal



Dear *****,

Thank you for your e-mail. In order to start your work you should complete the last steps of hiring regulations at your earliest convenience.

1. Fill out the Agreement form with your data
2. Sign the agreements
3. You will find document for inserting bank data attached to this letter
4. Provide the scanned copy of your Driver’s License or Passport
5. Send everything to [email protected]


Note:

Please, fill out the forms accurately and double check the provided data. You can start your work once your manager gives the approval.

We are looking forward to your becoming the successful employee of our company and a member of our working team. We’re sure you will like working with us. We care about our cooperation a lot and we are sure to inform you about all events occurred.

I am here to provide you with all the necessary assistance so please don’t hesitate to contact me right away if you have any questions.

The scammer wants all this detailed information from the victim in order to gauge just how serious the potential victim is. The bank details though are something he definitely needs in order to proceed with the fraud. It is the scammer intention to "flash" the victims’ bank account. For more details on bank account flashing please see This Link.



The latest Email:

Delivered-To: *****@gmail.com
Received: by 10.239.149.11 with SMTP id h11cs207952hbb;
Mon, 14 Dec 2009 22:34:54 -0800 (PST)
Received: by 10.231.170.201 with SMTP id e9mr312084ibz.15.1260858892221;
Mon, 14 Dec 2009 22:34:52 -0800 (PST)
Return-Path: <[email protected]>
Received: from qmail-wm-norm-0.netfirms.com ([70.35.18.226])
by mx.google.com with SMTP id 9si7684147iwn.74.2009.12.14.22.34.51;
Mon, 14 Dec 2009 22:34:52 -0800 (PST)
Received-SPF: error (google.com: error in processing during lookup of [email protected]: DNS timeout) client-ip=70.35.18.226;
Authentication-Results: mx.google.com; spf=temperror (google.com: error in processing during lookup of [email protected]: DNS timeout) [email protected]
Received: (qmail 73384 invoked from network); 15 Dec 2009 06:34:51 -0000
Received: from unknown (10.8.7.3)
by TCPLOCALHOST with QMQP; 15 Dec 2009 06:34:51 -0000
Received: from 24.2.239.121
(SquirrelMail authenticated user [email protected])
by webmail.mh-a.org with HTTP;
Tue, 15 Dec 2009 17:34:50 +1100 (EST)
Message-ID: <[email protected]>
Date: Tue, 15 Dec 2009 17:34:50 +1100 (EST)
Subject: transfer001
From: "Marek Wysocki" <[email protected]>
To: *****@gmail.com
Reply-To: [email protected]
User-Agent: SquirrelMail/1.4.4
MIME-Version: 1.0
Content-Type: multipart/mixed;boundary="----=_20091215173450_17754"
X-Priority: 3 (Normal)
Importance: Normal


Dear *****,

At this moment I’m sending you a very important form. You will find FINANCIAL INVOICE attached to this message. Please read it attentively, make sure that everything is clear for your understanding in it and follow these simple instructions:

Check your e-mail every hour on the date specified in the invoice(16.12.2009)
Cash the transfer at your closest branch location. You must use your own bank account branch.
Go to the branch and find any available cash-window or operator.
Ask for the amount needed (whole amount deposited with your 5% salary deducted from it).
Take the cash.
If the operator asks you about the transfer, please tell him/her that money is for your personal use and it came from a person you know well (to avoid extra hassle or unnecessary fees which may take place due to the commercial nature of this transaction)


Then go to the chosen Western Union office and find a form that says “SEND MONEY” or something like this on it. Anyway you have to use the form that has “SEND MONEY” details in it.

You don’t need to indicate address or middle name. Send the amounts to the person we have indicated to you. It is the easiest operation you need to do.

First name: Yelena
Last name: Kotvitskaya
City: Warszawa
Country: Poland
Amount: 952.38 AUD( -WU fee)

IMPORTAN
Please mark in WU that receiver receive money in USD this is important. It is very important to complete this transfer successfully. If an operator asks you about the reason of the transfer you have to tell him/her that this transaction is for personal purposes only and is not related with any kind of commercial and business activity (to avoid extra charges and business fees). Nobody wants to pay extra charges.

LAST STEP
Please find Western Union Form attached to this message and fill it out with the details of a transfer.


Thank you in advance for your anticipated cooperation. Should you face any problems incurred in the working process, please don’t hesitate to contact me immediately.


--
Sincerely yours,
Marek Wysocki.
AU/Managment Group.



The information contained in this message may be privileged and confidential and protected from disclosure. If you are not the original intended recipient you are hereby notified that any review,
retransmission, dissemination, or other use of, or taking of any action in reliance upon, this information is prohibited. If you have received this communication in error, please notify the sender immediately by replying to this message and deleting it from your computer. Thank you for your cooperation.

Okay I gave the scammer a fictitious bank account in order for him to "transfer" the money. He now expects me to wire 95% of those funds to one of his accomplices in Poland. That won't be happening of course. If I had been a genuine victim and gone ahead with his directions, then I would have lost the full AUD$952.38 when the bank found that the original transfer into my account was fraudulent. This criminal gang would have tried to continue sending more fraudulent transfers to my account before their crime is discovered. A genuine victim may lose much more that just the initial deposit.

I had originally entitled this scam “Job scam from Russia - [email protected]” but it seems that it is being run predominantly out of Poland, though there are also quite a few US IP’s in the header details.

Hello,

I just wanted to say that this is the same people that scammed me. You can read my story at http://iwasscammed8301.blogspot.com/. They had me send money to the same person they wanted you to send money too. That Yelena person in Poland. They really got me good because they had me work for them for a whole month before they put their scam into play. They did not ask me to transfer money right away. Now my bank account is closed and I am still currently looking for another job.

Hi tkbaby,

Sorry to hear that these criminals managed to steal some of your money. They're heartless thieving parasites and will stoop to any level to scam the innocent.

Having your blog posted and advertised is an excellent idea. The more we post this information on the net, the better chance that people will discover the scam before losing their money.

Scammers rarely ever use their real names and identity to scam, so the images in your blog have likely been stolen from another innocent victim. As you've probably guessed by now, there is no such thing as a legitimate job processing payments at home for a company. It's simply too good to be true. You will very likely receive even more of these scam offers in your inbox from now on. One particularly vicious scam to be aware of is the recovery scam. If you receive a message from a stranger offering to recover you lost money, I'm afraid that it will also be a scam. Please take a few moments to have a look at the examples of different scams we have posted on this site. Forewarned is forearmed.

Dear Peta

Thank you very much indeed for reporting this employment scam on the worldwide web.

I have recently experienced receiving fraudulent emails from the fake Milk and Honey Advertising Agency of Poland.

I bombarded them with questions but they failed to answer all of them.

I never sent them my resume but I was informed in an earlier email that they received it.

For protecting people online, please get this website shut down: http://www.milkandhoney-ad.com.

I received the link to view this trashy website concocted by those crooks.

Best regards from Sunny

Hello sunshinyone,

Could you please forward the emails you received to my email adress (it's at the bottom of this post) along with the headers? If you are unsure about how to retrieve headers - just ask. A support team member will be happy to explain you how . I'll need those mails and headers because they contain evidence needed to get the site closed down.