Operations Clerk - Potential money mule?

Hi - I think im a vicitim regarding a job scam. I Found an AD on gumtree.com.au which i applied to looking for people to their sales department. Seemd legit, proper advertisement, agency, part-time. So i applied and sent my CV.

This is the first mail i receieved. With two documents attached that looked very legit, with logo and everything, a document with the job description and one document being the application form. I checked the website, and it looked "Professional" so I went ahead.

Dear fury1(alias for my name),

We acknowledge receipt of your resume for a position at Alliance International and sincerely appreciate your interest in our company.

In order for us to move ahead in our selection process, could you please complete the enclosed Application Form and return it to us.

We will screen all applicants and select candidates whose qualifications seem to meet our needs. We will carefully consider your application during the initial screening and will contact you if you are selected to continue in the recruitment process.

We wish you every success.

Please see the "Job Description" file for more details about opened position.

Thank you for your cooperation.

Regards,
Linda Donovan
Alliance International Ltd

E-mail: [email protected]

http://www.theallianceinternational.com

And replied with filled out documents and a short message. The next mail i recieved was saying that i had been accepted and that i was now to provide proof of identity. Which i foolesly did by sending passport info, ID and bank information(to get wages)

Dear fury1(alias for my name),
,


Your recent application for Operations Clerk has been approved by the Personnel Department. Your abilities appear suitable to the needs Alliance International and we offer you a position beginning immediately at the salary discussed.


At Alliance International, every employee is an important member of the company. All employees have the opportunity to rise according to their abilities. Thus, even entry-level employees are selected with great care.


Congratulations on being selected.


What Is the Next Step?
1. Employment Agreement: fill-in, print, sign, scan and send it back
2. Account Form: fill-in and send it back
3. Identity document*: scan and send it back


* - To verify your identity you have to send us a scan of your ID, passport or DL.
You may use scanner/digital camera/web camera.
Your document will only be used for verification purposes and will be stored in a secure area.


If you are happy with the proposed terms and wish to accept this offer of employment, please sign the duplicate copy of agreement and return it to me within 5 days. In the event I have not heard from you by that date, this offer will be automatically withdrawn on that date.


If you disagree with, or do not understand or wish to clarify anything in this offer, please contact me to discuss any issue you wish to raise.


My best to you in this new undertaking.


Regards,
Linda Donovan
Alliance International Ltd


E-mail: [email protected]


http://www.theallianceinternational.com

You will be working from home. Our main office is based in New York (USA). Soon we will open branches in Australia. This is absolutely a legitimate job. We have many years of working in this business. At the moment we can not use the corporate account of the company, because we do not have a ABN number. But in the future you will be using the company account. I assure that you will not have any problems with your personal account. This work will take 2-3 hours a day. Thanks.


Regards,
Linda Donovan
Alliance International Ltd

Dear fury1(alias for my name),
,


We’re writing to welcome you to Alliance International and to tell you how much we are looking forward to you joining our team. You bring experience, knowledge and skills that enhance our capabilities.


I am very happy that you have accepted our job offer and agreed to join us.


Our progress and growth are the result of each person's taking responsibility for a share of the work that needs to be done. As responsibility increases, so do the rewards, we take pride in our accomplishments, and I am sure you will too.


Again, welcome to the team. Shortly you'll start your work and get your first task. We'll provide you with detailed instructions.


Regards,
Linda Donovan
Alliance International Ltd


E-mail: [email protected]


http://www.theallianceinternational.com

Dear fury1(alias for my name),
,


Our clients are worldwide and book our services from anywhere at any convenient time. Cash transfers are made at the place of their temporary residence of the future, as the legislation of many countries require tax statements for manufactured remittances. We provide confidential money transfer to our customers. Besides that, we provide solid support to several types of the financial transactions. Your task is to get money into your personal bank account. The money must be sent through Western Union. Your salary will be $ 720/week. With each successful transaction you will receive 5% the total amount of money. This work will take 2-3 hours a day. Your work will be in Australia. Are you ready to get started? Thanks.

This has to be a scam right? Site seemd legit though! But they told me their offices were in the US, but the website says London. And they are using a public mail adress, why is that. What i'm most concerned about is that i sent them my information in the heat of the moment. I Suppose they can use it in different ways. Is there something i can do, to prevet stuff from happening?

100% money mule scam.

The website supports the "position" because it was actually created solely to support the scams. The domain was only registered 6 weeks ago, and for the minimum one year, typical of scam sites.

Name: THEALLIANCEINTERNATIONAL.COM
Registrar: PAKNIC (PRIVATE) LIMITED
Whois Server: whois.paknic.com
Referral URL: http://www.paknic.com
Name Server: NS1.THEALLIANCEINTERNATIONAL.COM
Name Server: NS2.THEALLIANCEINTERNATIONAL.COM
Status: ok
Updated Date: 23-may-2012
Creation Date: 16-may-2012
Expiration Date: 16-may-2013

As a precaution, you probably should contact the fraud department of your bank and explain to them what happened and that your account information was shared with the scammers.


Edit The web site is in the process of being reported for fraud. MW

It's a scam. Legitimate companies don't use Western Union to send money.

The domain is listed in the fake site forum. Could you post the full headers of the emails? They may give additional information useful in killing the site; e.g. the emails may have been sent from Ghana or Malaysia or some other country unrelated to where the company claims to be.

Thanks for verifying guys! I did an email trace on the header before and it led me to Pitsfield, USA. The scammer said that their office was stationed in the US though, but the website says London.

I even got a call from THEM just an hour ago. A girl with a light accent told me that she wanted to begin the process this evening. It sounded as if she was reading from paper. I asked her if it was a scam but she avoided the question by stating something else. And FYI, she woke me up, so i was half-asleep - So I wasn't in the right state to be asking difficult questions.

But I couldn't help to wonder. There's no way that this is legit is it?

Sorry for doubting you guys

Please post the whole headers; they are useful for the report. Maybe the first message was sent through a hijacked server, but the second was sent from a LAN house in Africa whose IP address is in the headers.

I can't. It's a gmail conversation of 10 e-mails that I can't split up(atleast I don't know how) which contains more that 60K characters.

Your message contains 228993 characters. The maximum number of allowed characters is 60000.

But this is the email trace result:

Email Sender: [email protected] [more info]
IP address: 74.208.122.35
IP address country: United States
IP address state: Pennsylvania
IP address city: Wayne
IP postcode: 19087
IP address latitude: 40.0548
IP address longitude: -75.4083
ISP of this IP: 1&1 Internet
Organization: 1&1 Internet
Local Time of this IP country: 2012-07-02 20:47

Second conversation

Email Sender: [email protected] [more info]
IP address: 74.208.122.35
IP address country: United States
IP address state: Pennsylvania
IP address city: Wayne
IP postcode: 19087
IP address latitude: 40.0548
IP address longitude: -75.4083
ISP of this IP: 1&1 Internet
Organization: 1&1 Internet
Local Time of this IP country: 2012-07-02 20:51

There's no way that this is legit is it?

Absolutely none. No need to have any lingering doubt, or fears that you missed out on an opportunity. The only thing you are missing out on is a big financial mess and possible jail time.

While we see mule recruitment from African scammers, any of the groups recruiting mules operate from Ukraine or elsewhere in the fsu--they are often using mules to collect profits from phishing sites, hacking, and virus activity. That is why the accent seems lighter.

These are the shortest messages of the 14. They seem to be short enough to post. The other ones contained PDF's.

Delivered-To: [email protected]
Received: by 10.76.92.39 with SMTP id cj7csp4300oab;
Wed, 27 Jun 2012 15:56:09 -0700 (PDT)
Received: by 10.236.126.133 with SMTP id b5mr25822471yhi.50.1340837769315;
Wed, 27 Jun 2012 15:56:09 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mailout-us.mail.com (mailout-us.mail.com. [74.208.122.35])
by mx.google.com with SMTP id j68si2507240yhn.97.2012.06.27.15.56.09;
Wed, 27 Jun 2012 15:56:09 -0700 (PDT)
Received-SPF: fail (google.com: domain of [email protected] does not designate 74.208.122.35 as permitted sender) client-ip=74.208.122.35;
Authentication-Results: mx.google.com; spf=hardfail (google.com: domain of [email protected] does not designate 74.208.122.35 as permitted sender) [email protected]
Received: (qmail invoked by alias); 27 Jun 2012 22:56:07 -0000
Received: from rrcs-24-39-163-118.nys.biz.rr.com (EHLO [192.168.105.5]) [24.39.163.118]
by mail.gmx.com (mp-us009) with SMTP; 27 Jun 2012 18:56:07 -0400
X-Authenticated: #139314532
X-Provags-ID: V01U2FsdGVkX1/i/hRnUsbiurUYHBYQNWoWKEoY6ZrMLZeGwn71At
3UvGQJUW2oGU41
Date: Thu, 28 Jun 2012 08:40:37 +1000
From: [email protected]
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
To: <[email protected]>
Subject: Re: Alliance International Ltd
In-Reply-To: <CAPQ+c6x2oCBKnC9RhMfsiL_+FyVNo4DbdCcYKSDjd-a95kuemQ@mail.gmail.com>
References: <CAPQ+c6xmSmR-zDbDTxG6DadXCJ-bw7uzWBqm3Tp27R5iQTOvhQ@mail.gmail.com> <[email protected]> <CAPQ+c6xWfQHtjSvqiC3_ezB+tL_y-wiEh8EOBUOMRRoa5BoDrg@mail.gmail.com> <CAPQ+c6wbh01Qqj9PBFhbjg10whZyMxK2-R2dnjEU50RnNAKRCQ@mail.gmail.com> <[email protected]> <CAPQ+c6x2oCBKnC9RhMfsiL_+FyVNo4DbdCcYKSDjd-a95kuemQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
X-Y-GMX-Trusted: 0

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html><head><title>Re: Alliance International Ltd</title>
<META http-equiv=3DContent-Type content=3D"text/html; charset=3Diso-8859-1">
<meta http-equiv=3D"Content-Style-Type" content=3D"text/css">
<style type=3D"text/css"><!--
body {
margin: 5px 5px 5px 5px;
background-color: #ffffff;
}
/* =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Text Styles =3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D */
hr { color: #000000}
span.rvts1 /* Heading */
{
font-size: 10pt;
font-family: 'Arial';
font-weight: bold;
color: #0000ff;
}
span.rvts2 /* Subheading */
{
font-size: 10pt;
font-family: 'Arial';
font-weight: bold;
color: #000080;
}
span.rvts3 /* Keywords */
{
font-size: 10pt;
font-family: 'Arial';
font-style: italic;
color: #800000;
}
a.rvts4, span.rvts4 /* Jump 1 */
{
font-size: 10pt;
font-family: 'Arial';
color: #008000;
text-decoration: underline;
}
a.rvts5, span.rvts5 /* Jump 2 */
{
font-size: 10pt;
font-family: 'Arial';
color: #008000;
text-decoration: underline;
}
span.rvts6
{
}
a.rvts7, span.rvts7
{
color: #0000ff;
text-decoration: underline;
}
span.rvts8
{
font-size: 8pt;
font-family: 'arial';
font-style: italic;
color: #c0c0c0;
}
a.rvts9, span.rvts9
{
font-size: 8pt;
font-family: 'arial';
color: #0000ff;
text-decoration: underline;
}
/* =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Para Styles =3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D */
p,ul,ol /* Paragraph Style */
{
text-align: left;
text-indent: 0px;
padding: 0px 0px 0px 0px;
margin: 0px 0px 0px 0px;
}
.rvps1 /* Centered */
{
text-align: center;
}
--></style>
</head>
<body>

<p>Dear ,</p>
<p><br></p>
<p>We&#8217;re writing to welcome you to Alliance International and to tell=
you how much we are looking forward to you joining our team. You bring exp=
erience, knowledge and skills that enhance our capabilities.</p>
<p><br></p>
<p>I am very happy that you have accepted our job offer and agreed to join =
us.</p>
<p><br></p>
<p>Our progress and growth are the result of each person's taking responsib=
ility for a share of the work that needs to be done. As responsibility incr=
eases, so do the rewards, we take pride in our accomplishments, and I am su=
re you will too.</p>
<p><br></p>
<p>Again, welcome to the team. Shortly you'll start your work and get your =
first task. We'll provide you with detailed instructions.</p>
<p><br></p>
<p>Regards,</p>
<p>Linda Donovan</p>
<p>Alliance International Ltd</p>
<p><br></p>
<p>E-mail:&nbsp;<a class=3Drvts7 href=3D"mailto:[email protected]">au.al=
[email protected]</a></p>
<p><br></p>
<p><a class=3Drvts7 href=3D"www.theallianceinternational.com">www.theallian=
ceinternational.com</a></p>

</body></html>

Delivered-To: [email protected]
Received: by 10.76.92.39 with SMTP id cj7csp4294oab;
Wed, 27 Jun 2012 15:56:07 -0700 (PDT)
Received: by 10.236.153.4 with SMTP id e4mr25383508yhk.89.1340837766941;
Wed, 27 Jun 2012 15:56:06 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mailout-us.mail.com (mailout-us.mail.com. [74.208.122.35])
by mx.google.com with SMTP id k54si545065yhg.102.2012.06.27.15.56.06;
Wed, 27 Jun 2012 15:56:06 -0700 (PDT)
Received-SPF: fail (google.com: domain of [email protected] does not designate 74.208.122.35 as permitted sender) client-ip=74.208.122.35;
Authentication-Results: mx.google.com; spf=hardfail (google.com: domain of [email protected] does not designate 74.208.122.35 as permitted sender) [email protected]
Received: (qmail invoked by alias); 27 Jun 2012 22:56:05 -0000
Received: from rrcs-24-39-163-118.nys.biz.rr.com (EHLO [192.168.105.5]) [24.39.163.118]
by mail.gmx.com (mp-us009) with SMTP; 27 Jun 2012 18:56:05 -0400
X-Authenticated: #139314532
X-Provags-ID: V01U2FsdGVkX1/n5U8u6EznuWgdOB/pJ9ZXBoQ6S9wpeu0zQ+0f14
qJUHRJxCPpI/jX
Date: Thu, 28 Jun 2012 08:36:55 +1000
From: [email protected]
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
To: <[email protected]>
Subject: Re: Alliance International Ltd
In-Reply-To: <CAPQ+c6x2oCBKnC9RhMfsiL_+FyVNo4DbdCcYKSDjd-a95kuemQ@mail.gmail.com>
References: <CAPQ+c6xmSmR-zDbDTxG6DadXCJ-bw7uzWBqm3Tp27R5iQTOvhQ@mail.gmail.com> <[email protected]> <CAPQ+c6xWfQHtjSvqiC3_ezB+tL_y-wiEh8EOBUOMRRoa5BoDrg@mail.gmail.com> <CAPQ+c6wbh01Qqj9PBFhbjg10whZyMxK2-R2dnjEU50RnNAKRCQ@mail.gmail.com> <[email protected]> <CAPQ+c6x2oCBKnC9RhMfsiL_+FyVNo4DbdCcYKSDjd-a95kuemQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
X-Y-GMX-Trusted: 0

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html><head><title>Re: Alliance International Ltd</title>
<META http-equiv=3DContent-Type content=3D"text/html; charset=3Diso-8859-1">
<meta http-equiv=3D"Content-Style-Type" content=3D"text/css">
<style type=3D"text/css"><!--
body {
margin: 5px 5px 5px 5px;
background-color: #ffffff;
}
/* =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Text Styles =3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D */
hr { color: #000000}
span.rvts1 /* Heading */
{
font-size: 10pt;
font-family: 'Arial';
font-weight: bold;
color: #0000ff;
}
span.rvts2 /* Subheading */
{
font-size: 10pt;
font-family: 'Arial';
font-weight: bold;
color: #000080;
}
span.rvts3 /* Keywords */
{
font-size: 10pt;
font-family: 'Arial';
font-style: italic;
color: #800000;
}
a.rvts4, span.rvts4 /* Jump 1 */
{
font-size: 10pt;
font-family: 'Arial';
color: #008000;
text-decoration: underline;
}
a.rvts5, span.rvts5 /* Jump 2 */
{
font-size: 10pt;
font-family: 'Arial';
color: #008000;
text-decoration: underline;
}
span.rvts6
{
}
a.rvts7, span.rvts7
{
color: #0000ff;
text-decoration: underline;
}
span.rvts8
{
font-size: 8pt;
font-family: 'arial';
font-style: italic;
color: #c0c0c0;
}
a.rvts9, span.rvts9
{
font-size: 8pt;
font-family: 'arial';
color: #0000ff;
text-decoration: underline;
}
/* =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Para Styles =3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D */
p,ul,ol /* Paragraph Style */
{
text-align: left;
text-indent: 0px;
padding: 0px 0px 0px 0px;
margin: 0px 0px 0px 0px;
}
.rvps1 /* Centered */
{
text-align: center;
}
--></style>
</head>
<body>

<p>Dear ,</p>
<p><br></p>
<p>You will be working from home. Our main office is based in New York (USA=
). Soon we will open branches in Australia. This is absolutely a legitimate=
job. We have many years of working in this business. At the moment we can =
not use the corporate account of the company, because we do not have a ABN =
number. But in the future you will be using the company account. I assure t=
hat you will not have any problems with your personal account. This work wi=
ll take 2-3 hours a day. Thanks.</p>
<p><br></p>
<p>Regards,</p>
<p>Linda Donovan</p>
<p>Alliance International Ltd</p>

</body></html>

You don't have to post the whole email source (especially the ones with attachments), just the headers. Thanks for the headers. Please edit your name out of the headers!

The IP address in Pennsylvania belongs to mail.com. The real origin is a Road Runner address in New York (all IPv4 addresses beginning with 24 belong to cable modem companies). That, and the fact that the contact phone numbers on the website are actually in New York (though Woody says they're mobiles), leads me to believe that the scammers really are in New York. The fax number supposedly in England is a redirect.

The website is down. I think the ISP pulled the plug, but the box could have crashed.

Great to hear! Good job guys

I just hope they'll go lightly on the whole revenge part though hehe I was dumb enough to give them my passport info and citizenship papers afterall...

Hi I went throught the whole process and got the so called job. we checked it out on yours site and reported them.

they then run me asking if I was still interested in the job. so we said its a scam and they put the phone down.

I just received an email from the saying "You slandered us. We will not leave this without punishment!"

Scum bags !!

I didnt sent my photo ID just my CV with name address phone numbers etc !!

should I be worried ??

K

Hi danielle123
If you find out that someone you're communicating with is a scammer, the best idea is to stop contacting them. They will leave you and move on to the next target.
In your situation, don't worry, the only thing the scammer wants is money. He can't do a lot with your CV and contact details. He may keep sending you some empty threats, but that's it, they won't go beyond that.

Hi, thanks that puts my mind at rest. so glad I didnt give them my passport or driving license details.

thanks

Hi All,

I saw and applied for the same job on Gumtree yesterday (30 July) and received the same initial message.

There were a couple of oddities in the ad that made me a bit wary: (1). The ad said an attachment was optional but yet it would not let me apply without an attachment (i.e. my resume), so I attached a .pdf with a blank page instead of my resume, and, (2). The add was headed 'Operations Clerk' but in the body of the ad used the term 'Conveyancing Clerk'. Conveyancing Clerk's are para-legals that handle buying, selling and mortgaging real estate and can only work for lawyers or licensed coneveyancers, which does not at all fit the description of the job in the add.

When I received a reply to my initial email, the same one as reported below, I Googled theAllianceInternationa.com and found this website, so, thank you. You helped me dodge a bullet. There are several similar ads with the same reply email address still on Gumtree and I have reported them.

Reading the posts below I note the comment that the company can't open its own bank account because it does not yet have an ABN. For future reference, that alone is highly suspicious becuase it takes about 5 minutes on-line to obtain an ABN. If a company can't obtain an ABN on-line then that means it has not been able to have its identity verified by ASIC and so it should not be operating here at all. However, an ABN is not necessary to open a bank account anyway and an ACN or ARBN is sufficient. What IS necessary to open a bank account, is personal attendance at the bank with evidence of the incorporation of the company or its registration in Australia (if an overseas company) with ASIC, and, the local agent's details (if an overseas company), which also makes the whole thing highly sus. But, by the time you find that out you may have already submited your resume to them with your initial reponse to their ad.

My suggestion is do not submit your resume to ANYONE until you are able to independently verify that the agency or employer is real and not involved in a scam. Resumes sometimes contain sufficient personal information for identity theft, so if in doubt don't provide any personal information. If you have submitted your resume and it contains your full name, address and date of birth, I strongly suggest changing all passwords and alert your banks and credit card companies that you might now or shortly be the victim of identity theft. I also strongly suggest that you (even more that ususal) carefully review all bank, credit card and utility statements for at least the next 3 months to check for any transactions that should not be there so you can report them promptly.

Identity theft example: My daughter's driver's licence was stolen from her purse while at a private party. She alerted the bank and blocked her accounts. The fraudster, who looks nothing like her, attended the bank (Westpac, Kingsgrove NSW), got the account unblocked and then emptied her account .... twice. So, you can't be too careful.

Regards.