by Diamond
Sun Aug 25, 2013 1:48 pm
Looking through my Spam folder today, found a scam email which seemed worth posting here. Why - because this is one of the cases where the scam nature of the "job" offered is masked by several disguises, including a fake website. So I don't want people to fall for this one, even I thought it could be a legit job for a moment, until I read the "job" description. It's called "Financial Agent" and includes processing of payments using your account, which is a 100% sign of a money laundering scam. Of course, the email about the "job" also gives the scammer away - strange email address, no phone number and no exact position of the email's author are indicated, only vague wording like "HR Support". However, as I said, they have a site to make it look creditable, and even a "license" supposedly from Western Union, which looks like a fake to me, especially as the text looks strange ("This certifies that VBK Group Inc. as an authorized partner"). By the way, the phone number given on their site (855) 712-9825, when I entered it in Google, showed up as an Indian mobile number!
So here's the email itself (it came from [email protected]), I kept the original formatting:
Here are the headers:
So watch out, this is a scam!
So here's the email itself (it came from [email protected]), I kept the original formatting:
We analyzed your resume on CareerBuilder and see you as a potential candidate of our company. We'd like to offer you the
Financial Agent position.
Our company is expanding and currently searching an optimistic, responsible and self-motivated employee to join its dynamic team.
This is a rare opportunity to obtain a unique experience of working as a part of a professional group,as well as servicing major
clients and creating strong business relationships.
Please take a few minutes and complete an online interview on our website: http://vbkgroupinterview.com/interview.php
You may also learn about company business activity on our site: http://vbkgroupinterview.com
If you have any difficulties or extra questions, feel free to contact me.
Sincerely,
Eva Walton
HR Support
Here are the headers:
Delivered-To: [email protected]
Received: by 10.76.27.233 with SMTP id w9csp144710oag;
Sun, 25 Aug 2013 08:36:04 -0700 (PDT)
X-Received: by 10.49.96.3 with SMTP id do3mr11901494qeb.15.1377444964566;
Sun, 25 Aug 2013 08:36:04 -0700 (PDT)
Return-Path: <[email protected]>
Received: from ccm183.constantcontact.com (ccm183.constantcontact.com. [208.75.123.183])
by mx.google.com with ESMTP id k1si3864828qeo.52.1969.12.31.16.00.00;
Sun, 25 Aug 2013 08:36:04 -0700 (PDT)
Received-SPF: pass (google.com: domain of ESC1114659352784_1114652662608_2471_r20 ... ontact.com designates 208.75.123.183 as permitted sender) client-ip=208.75.123.183;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of ESC1114659352784_1114652662608_2471_r20 ... ontact.com designates 208.75.123.183 as permitted sender) smtp.mail=ESC1114659352784_111465266260 ... ontact.com;
dkim=pass [email protected]
Received: from p2-jbsched06.ad.prodcc.net (p2-pen5.ad.prodcc.net [10.252.0.105])
by p2-mail204.ccm183.constantcontact.com (Postfix) with ESMTP id 38E51E2C788
for <[email protected]>; Sun, 25 Aug 2013 11:36:04 -0400 (EDT)
DKIM-Signature: v=1; q=dns/txt; a=rsa-sha256; c=relaxed/relaxed; s=1000073432; d=auth.ccsend.com; h=to:subject:mime-version:message-id:from:date:list-unsubscribe:reply-to; bh=Mu9JiBozKQ99Pj0tX6IZZ1ENC7s1eweCl4d/pNqSttQ=; b=GDIq56Y6Fd0uvLy8/8AtiS8XrSZnvXa5AvZ8YZ+4HNbPLOowHIB1I7nwFOR2nz5vJKrb+goXnr5rfChSSGLKStvo+mFASjgH6ni7cG00FV6KOK6y+S8bo+gR3grBAr+PdS9QrQRpmmnERJYOGhgbEx1ReHn1rYSy/MdBqkksmYk=
Message-ID: <1114659352784.1114652662608.2471.6.8113501@scheduler.constantcontact.com>
Date: Sun, 25 Aug 2013 11:36:04 -0400 (EDT)
From: VBK GROUP <[email protected]>
Reply-To: [email protected]
To: [email protected]
Subject: Invitation to Interview
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_Part_16570615_941629305.1377444964224"
X-Mailer: Roving Constant Contact 2009 (http://www.constantcontact.com)
List-Unsubscribe: http://visitor.constantcontact.com/do?p ... =q9wthdoab
X-Return-Path-Hint: ESC1114659352784_1114652662608_2471_r20 ... ontact.com
X-Roving-ID: 1114652662608.2471
X-Lumos-SenderID: 1114652662608
X-Roving-CampaignId: 1114659352784
X-Roving-StreamId: 0
------=_Part_16570615_941629305.1377444964224
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
So watch out, this is a scam!