Fake Job Offer (Metcon Ltd.)

Likely a money laundering/fake bank draft scam.
Posted for informational purposes.

ExMet Ltd. Job Position for (Name Removed) Monday, February 1, 2010 10:41 AMFrom HR manager of Metcon Ltd. Mon Feb 1 15:41:34 2010
X-Apparently-To: (email removed) via 68.142.199.146; Mon, 01 Feb 2010 07:41:35 -0800
Return-Path: <[email protected]>
X-YMailISG: 6FFCs5gWLDvs7QXEjBkBDkuB3yY3bgs6sGWkyimlO41GuP6O9kHEw9K8m5vr3CR9kTH_E7B8l_f_Icn9PSyqBPZDxXpFxy4QY6b.2VOSjmsddmkHMnGSh2b7wgdCZd9HmNz1xAW93KBul74aFfJ2BAJWe.sv_KxwBKIyRoyAJ7fstYXISF0mZohoUiMRG_3j_xrGTqhkOWKc51aBzm.IVwUOotMmOPpHeEqSx15VNB1BHvh8y2SAlwHz0fDXVjbhFpK_uwCFg.YUB3H2IBK_vMFbJPOWZY4OTzrWoZK1k9ok6Mn7L9JXH159YcsIVfR8GilpZP7aftzlYP7dNPOE.21ubix9l0DdYY1CnH7ywooCC2kfTx13Oz53PXYCSdP98PWsq209W8mu1bOCNYEmOQ9068PwaUzm8XQ1iwPloIVuLzvopQmdZsH7XnPpXA--
X-Originating-IP: [72.14.220.158]
Authentication-Results: mta122.sbc.mail.re3.yahoo.com from=gmail.com; domainkeys=pass (ok); from=gmail.com; dkim=pass (ok)
Received: from 207.115.36.165 (EHLO nlpi151.prodigy.net) (207.115.36.165) by mta122.sbc.mail.re3.yahoo.com with SMTP; Mon, 01 Feb 2010 07:41:35 -0800
X-Originating-IP: [72.14.220.158]
Received: from fg-out-1718.google.com (fg-out-1718.google.com [72.14.220.158]) by nlpi151.prodigy.net (8.13.8 inb ipv6 jeff0203/8.13.8) with ESMTP id o11FfYN6025497 for <(email removed)>; Mon, 1 Feb 2010 09:41:35 -0600
Received: by fg-out-1718.google.com with SMTP id 16so13120fgg.16 for <(email removed)>; Mon, 01 Feb 2010 07:41:34 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:reply-to:date:message-id :subject:from:to:content-type; bh=bEoxkEjf36XTjG8FnSE7QyL/SYKdN0CPfIEAx/SmYzk=; b=qLCcTrw+WThO0ecFmLGGq5IHVn6g9Oq/uc3ctuNNj5h7Sm6scDPUmCwgTiF9x07j4P nVLsOBXox4IHsYcB7KhmUM0L5b5PGMT7e5keIgMN9jzdr6X7qo7aundgi/9e2sSprBH/ 7xZjzrrBj2Cp1y3MtqFmXslfyY5/kuFjou1TM=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:reply-to:date:message-id:subject:from:to:content-type; b=Urukl+gr62vzkT9WJJsuSY8qXElFWkrP92FkV+06eTeKZ23OoKdVMk6HoUnVKmXU6B 7MTWhYv/snOif0sqEYs5zawAWh9Crzub4U7G7DzI8WMuWFotCTtuetRJ45L4KMv71jYG ADkXQA8yo0ypRuTtLMHmWgR68JRWl/7RyO4IA=
MIME-Version: 1.0
Received: by 10.239.185.19 with SMTP id a19mr611850hbh.159.1265038894403; Mon, 01 Feb 2010 07:41:34 -0800 (PST)
Reply-To: [email protected]
Date: Mon, 1 Feb 2010 10:41:34 -0500
Message-ID: <[email protected]>
Subject: ExMet Ltd. Job Position for (Name Removed)
From: This sender is DomainKeys verified "HR manager of Metcon Ltd." <[email protected]> Add sender to Contacts
To: (email removed)
Content-Type: multipart/alternative; boundary=001485f7d820ed924c047e8bd117
Content-Length: 3253

Dear (Name Removed)

Metcon Company - Metal industry dealers support and consulting
Metcon Company is partnered with profitable metal industry companies of United States and European Union in a search for a Regional Executive Manager. This job will be a hands on role responsible for managing the client's financial resources and payment functions.

Online Business has become increasingly common. Greater numbers of people have started exploring the Internet for business transactions. Metcon Company breaks you free from the old business model and offers a brand new opportunity for implementation of home based online business.

Regional Executive Manager Requirements and responsibilities:
Responsibility and accuracy in the assigned operations and dealing. Law obedience; integrity and swift decision-making.
Operating and accounting client's finances. Consolidating work documentation paperwork and records.
Preparing invoices; submitting bills, cobr /mpiling itemized charges.

Benefits:
$700-$800/ week + bonuses. A lot of free time. Short and gainful probation period.

To apply for the opportunity please send back this invitation #09011208605709709713212810610609408712307610213612208415615612915111416112415910516215612312112332 text and provide your name and area you live to this email [email protected]

Human Resources dpt.
Messogion Ave.2
16th floor, 167 GR115 27
Athens, Greece
Metcon Company

These scammers are getting good. No way to trace IP locations with G-mail.
Yes, there actually is a company by the name of Metcon; however, they're located in Arizona, not Greece.

Likely a money laundering/fake bank draft scam.

I agree.

These scammers are getting good. No way to trace IP locations with G-mail.

I don't think many scammers know or care about IP addresses. And if a recipient of a scam email is suspicious enough to check the IP address, he/she isn't likely to fall for it.

Hello- this is actually my gmail account that has been hijacked. Is there a way for me to make it stop? I've changed my password as of this morning once I realized what was happening and I haven't seen anything come back to me as of yet (I was getting a number of 'failed deliver' notifications).

SoSorry,

Was your email hijacked, or was the return address spoofed? We have seen angry lads spoof baiter addresses pretty regularly, and spammers just spoof random addresses from time to time, so it could be as simple as that, unless you know your email has been compromised. Both will result in delivery failure notices to your box, but only one is a security risk to you.

Essentially you have two choices--ride this out, or change email addresses. If you have good reason to believe that your password was cracked or phished, and the scammer has actually gotten into your box, you might be better off opening a new email address and moving on, as he can reset your password and get in again if he has gotten hold of the right information. If it is spoofed, you might want to ride it out (if you know you have seriously angered a lad, you'll have to weigh the pros and cons of this, as it could be a long ride)--set up a filter to send those delivery failures to trash, and if people are actually sending reponses to your email address, you can always set up an autoresponder explaining the situation.

If your email has been accessed, you can choose to ride it out also, but as I said before, if he has the right information to reset your password, you could have an ongoing problem.

How do I know if it was spoofed versus hijacked? I am not a technical person so I need help. Thanks.

SoSorry-
According to your earlier post, I see that you were able to access your Gmail...
Is there anything in your "Sent Mail" folder that you don't recognize?
If there isn't, the odds are somewhat against having a hijacked account. Not saying that the lad didn't cover his tracks, but a bit less likely.
Interesting, though, is the "return path" addy, which I take to be yours, SoSorry.
Once again, it's something that can be - and often is - spoofed. The lads don't want to waste time trawling through all the bounce notices to find an actual reply, so they pass them off to some other working (has to be, or is flagged as spam by some ISPs) addy. (Just my theory, but it seems workable)
What I would do is change all of your info inside of Gmail that is used for password retreival, in case you were actually hijacked, and change your password to something that can't be dictionary-hacked (upper&lower case, numbers, AND special characters - @,&,*,etc. - if allowed).
You should be safe in keeping your current addy. The bounce notices should slow down fairly quickly.
Though, if you have any doubt whatsoever, open a new addy up and have Gmail close your old one down. You'll feel safer, and it should help the lad's mail end up where it belongs - in the spam file

Let me know if you need any further help on this... I'll try to walk you through it.