[email protected] [email protected]

I believe they got my address through me answering an e-mail about mystery shopper employment. Yeah! I know.
So today I get a priority mail envelope in the mail with WOO "$2500.00 in American Express Travelers Cheques" It also had a funky copy of a note with instructions on how to proceed. This is my first "red flag". The cheques sure look real but the note is NOT written well with miss spelled words. So I bite because when I first opened the envelope it's like OMG (I am currently unemployed). Okay I am sending the instructions and the header of the emails I got because I know how to get the header but don't know how to read it.

I first write that I have received the package to [email protected]
I have received a priority package from Justin Dale of Casa Grande,Arizona with a note to contact this e-mail address.

I get back:

YOU ARE TO CONTACT YOUR ASSIGNMENT OFFICER MR. SHANE HALEY FOR FURTHER DETAILS AND INSTRUCTION TO CARRY OUT YOUR FIRST ASSIGNMENT.

I HAVE INFORMED HIM..AND HE SAID HE SENT YOU AN EMAIL AND HE IS WAITING FOR YOUR REPLY.


Mr.Shane Haley
[email protected]
(904) 257-3768 ( Text Only )


TOM ELLIS

Next e-mail received:

I have just been informed by Mr.Tom Ellis that you have received payment for your first assignment.
The payment is for you to carry out your first assignment as Customer Service Research without any delay...mistake or misplacement of funds in your assignment...you are to follow the instruction.

FOLLOW THE INSTRUCTION TO AVOID MISTAKE OR MISPLACEMENT OF FUNDS
You are to proceed immediately by taking the payment to your financial institute/Bank to have it cashed funds would be available...it is an instant cashing payment which is as good as cash or deposit for 24 hours clearance...funds would be available 24 hours upon deposit.

You will then make withdraw leaving your pay $400 behind in other to carry out your first assignment.

You will then deduct your pay $400 and proceed to follow the instruction for your 1st assignment

1ST ASSIGNMENT:
Assignment (A) Proceed To Bank With The Payment:- ( Cashed/Deposit )
Assignment (B) Wal-Mart Evaluation:-
Assignment (C) 1st Money Gram Money Transfer Evaluation:-
Assignment (D) 2nd Money Gram Union Money Transfer Evaluation:-

IMPORTANT NOTE:-
You need to acknowledge the receipt of this package via email as soon
as you receive it. Also send reports via email as soon as you complete
your first assignment today. You will be evaluating a Wal-Mart store
and two Money Gram Money Transfer outlet's in your City. {EVALUATE THE
NEAREST STORES}.

Below is the breakdown of your first assignment and how the funds will
be spent and you are to take note of the following activities:

1. You are to deduct $400 for your commission from the total payment
received, after you have cashed the check at your bank.

2. You are to make a purchase of any electronic items worth $50 from
any Wal-Mart location in your area and tax included (to be kept by
you) and is now your duty to take note of the following activities at
the Wal-Mart location

i) How long it took you to complete the shopping and report on service
and quality of product
ii) Name of the agent and his or her attitude towards customers
iii) Poor working skills and customer relations
iv) Slow services and cleanliness of the establishment

Remember: Any item you purchase from the Wal-Mart store should be kept
by you for your personal use since we are only interested in the
accurate information from your survey.

3. You are required to proceed to two different Money Gram out lets
in your area with the remaining balance to perform your transfer
assignment after you have deducted your $400 commission and $50 for
the Wal-Mart duty. You are advised to send the rest of the funds
through any money gram locations close to Mrs.Wanda Tompkins your
Tagged MS Service partner in order for her to complete other
assignments there.

Send through Money Gram to the follow information below...without
making any mistake in the spellings to avoid misplacement of funds

1ST MONEY GRAM OUT-LET
RECEIVERS NAME : Wanda Tompkins
RECEIVERS LOCATION : 995 post oak road, Vidor, Texas 77662
AMOUNT: $1200

2ND MONEY GRAM OUT-LET
RECEIVERS NAME : Wanda Tompkins
RECEIVERS LOCATION : 995 post oak road, Vidor, Texas 77662
AMOUNT: Send the rest of the money

Also, to further finalize this assignment, you have to get back to me
with the two Money Gram Transfer information or scan copy of the
receipts for the money sent to your Tagged MS Service partner:

1st Money Gram information or a scan copy of the receipt
1. Sender’s Name and Address
2. 8 Digit Money Transfer Reference/Control Number
3. Amount : $1200

2nd Money Gram information or a scan copy of the receipt
1. Sender’s Name and Address
2. 8 Digit Money Transfer Reference/Control Number
3. The actual amount transferred after deducting Money gram charges


You are advised to take note of the following: (Do not let the
Wal-Mart/Money Gram location know you are taking note of the
activities).

i) How long it took you to complete the Wal-Mart/ Money Gram location services
ii) Name of the agent and his or her attitude towards customers
iii) Poor working skills and customer relations
iv) Slow services and cleanliness of the establishment

The reason for this survey is that some Wal-Mart and Money Gram
locations have been reported several times for slow services, funds
missing, and unbalanced exchange rate. It is now your duty to carry
out the fund transfer at any various location of your choice and
balance the reports in order to curtail these lapses and please note,
the Money Gram charges should be deducted from the remaining funds and
not deducted from your $400 commission.

Please note that your assignment should be kept secret, you do not
need to let the agent at the Wal-Mart/Money Gram location know you are
taking note of the activities, because our aim is to established and
help customers obtain a better understanding of their positioning and
their right in the market place.

Get back with your first assignment report here as soon as you have
finished your evaluation.

IMPORTANT INFORMATION : There are 9 more assignment lined up,waiting
for you to carry out...so complete your first assignment and get back
to me with the evaluation details and the two money gram information
or a scan copy of the receipt ...without delay or making mistake and
to avoid misplacement of funds or mistake in the spellings while
filling the money gram form to send the money to Wanda Tompkins.

WAITING FOR YOUR REPLY TO HAVE THE EVALUATION DETAILS AND THE TWO MONEY GRAM INFORMATION.


I will be for your reply to know you understand the content of my mail.


Shane Haley
9042573768 ( Text Only )

Headers in respective order; 1st to last:

From Tom Ellis Mon Oct 7 14:55:45 2013
X-Apparently-To: via 98.139.221.31; Mon, 07 Oct 2013 21:55:47 +0000
Return-Path: <[email protected]>
Received-SPF: pass (domain of aol.com designates 64.12.143.82 as permitted sender)

X-Originating-IP: [64.12.143.82]
Authentication-Results: mta1004.sbc.mail.ne1.yahoo.com from=aol.com; domainkeys=neutral (no sig); from=mx.aol.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO omr-m09.mx.aol.com) (64.12.143.82)
by mta1004.sbc.mail.ne1.yahoo.com with SMTP; Mon, 07 Oct 2013 21:55:46 +0000
Received: from mtaomg-mb03.r1000.mx.aol.com (mtaomg-mb03.r1000.mx.aol.com [172.29.41.74])
by omr-m09.mx.aol.com (Outbound Mail Relay) with ESMTP id 60862700000AA
for ; Mon, 7 Oct 2013 17:55:46 -0400 (EDT)
Received: from core-mba003b.r1000.mail.aol.com (core-mba003.r1000.mail.aol.com [172.29.30.143])
by mtaomg-mb03.r1000.mx.aol.com (OMAG/Core Interface) with ESMTP id C5C5BE000082
for <; Mon, 7 Oct 2013 17:55:45 -0400 (EDT)
References: <[email protected]>
To:
Subject: Re: CONTACT MR.SHANE HALEY AT [email protected]
In-Reply-To: <[email protected]>
X-MB-Message-Source: WebUI
MIME-Version: 1.0
From: Tom Ellis <[email protected]>
X-MB-Message-Type: User
Content-Type: multipart/alternative;
boundary="--------MB_8D091BF1C2E3BE8_20B4_16F8A6_webmail-m135.sysops.aol.com"
X-Mailer: AOL Webmail 38079-STANDARD
Received: from 41.190.3.20 by webmail-m135.sysops.aol.com (149.174.9.24) with HTTP (WebMailUI); Mon, 07 Oct 2013 17:55:45 -0400
Message-Id: <[email protected]>
X-Originating-IP: [41.190.3.20]
Date: Mon, 7 Oct 2013 17:55:45 -0400 (EDT)

Header # 2:

From Shane Haley Mon Oct 7 14:54:14 2013
X-Apparently-To: via 98.139.221.30; Mon, 07 Oct 2013 14:54:16 -0700
Return-Path: <[email protected]>
Received-SPF: pass (domain of gmail.com designates 74.125.82.67 as permitted sender)
X-Originating-IP: [74.125.82.67]
Authentication-Results: mta1277.sbc.mail.gq1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO mail-wg0-f67.google.com) (74.125.82.67)
X-Received: by 10.180.79.163 with SMTP id k3mr20947353wix.25.1381182854579;
Mon, 07 Oct 2013 14:54:14 -0700 (PDT)
Received: by 10.194.170.194 with HTTP; Mon, 7 Oct 2013 14:54:14 -0700 (PDT)
Date: Tue, 8 Oct 2013 01:54:14 +0400
Message-ID: <CAKUzZWVCFP50w16zvTu4fWW3qtXURx1UZb+4tK=5gq8vt5TqJQ@mail.gmail.com>
Subject: Re: PAYMENT FOR YOUR FIRST ASSIGNMENT
From: Shane Haley <[email protected]>
To:


I have remove my personal information (e-mail address). I will wait to hear from you as to how I should proceed. My first thought is to go to the bank and ask them to inspect the Cheques. I would hate to think someone else will be out legitimate money if these cheques are real maybe they can handle returning the funds to the rightful owner. I am sure "these people" (the ones I e-mailed and received from) are not out any of "their" funds. I know I can't stop these people but I don't have to be one of their victims.

Warmest regards,
Juniper

Added quotations. (BW)

100% scam. Thank you for posting the headers. One of them is from a place that is known to have high number of scammers:

Originating IP: 41.190.3.20
Originating ISP: Etisalat-ng
City: Lagos
Country of Origin: Nigeria

Do not deposit the fake American Express Travelers Cheques. Please report it to the US Postal Inspector.

File a fraud report with the postal inspection service. http://ehome.uspis.gov/fcsexternal/default.aspx You can also request an envelope from them and actually send them the check since you received it via US mail.

Thank you so much for getting back to me. I have learned SO MUCH from this website. I know NOT to say anything to the sender, SCAMMERS,swindlers, etc. Yes they have my addresses but that is available on public records, so be it. I will follow-through with reporting this to the US Postal Service. They even have a commercial account set-up with the USPS so they get a special rate. That's what the world needs "professional scammers".
The sad part this is the 3rd time in a little over a year that someone has tried to scam me. DANG IT!

Love you guys!
Juniper (alias)

It's not just the money you'll lose if you try to pass these fake checks, and it will cost you money because any money you pay on will be taken from you, but the greater problem is trying to convince the bank/police that you aren't a counterfeiter/fraudster.

No matter how good the counterfeits look to you, they'll be picked up by the bank otherwise the criminal would pass them himself. He wants you to pass them and take the rap for him.

Here's a header-reading tip: If you see an IP address that begins with 41, then it is in Africa. It could be in Cape Town or Cairo, but it is certainly in Africa. (The converse is not true.)

They even have a commercial account set-up with the USPS so they get a special rate.

Actually the scammer is using a hacked/stolen Postal account. That is one reason it needs to be reported to the Postal authorities.

OMG I AM COMPLETELY FREAKING OUT!! I AM SOOOOOO STUPID AND GULLIBLE!!! i found this website a little too late! i already deposited the check into my account! i have not touched the money and am planning to call my bank in the morning. can anybody please tell me what else i need to do and exactly who else i need to contact and report this to.... i am such a retard i cant believe i fell for it... i got the exact same letter/envelope described in the post just with different contact names other than [email protected] is the same...but everything else is the same word for word!!! Please please help!!!

Caroline

my email address is <removed-dotti> if anybody can help me get out of this mess.

edit by dotti: removed email address s othat it won't be picked up by scammers/spammers.

how do i post headers?? like juniper did...the emails i got are almost word for word the same.

Carolinesong ~ These fine folks on this website will teach you how to post headers, they taught me. If you want to give it a try from your e-mail,( I use Yahoo) you can view the full header from the drop down tab called "actions" I then drag it to get the full screen print to "word" then I remove my addresses from it then cut/paste to this website. My clue was the manner that they wrote and this is the third time I have experienced scamming of some type. Also my "gut feeling" saying "Really?!".

Scamwarners team ~ I filed a fraud mailing report with the post office (the website you gave me) but never heard back. I even went to my local bank and they said the travelers checks were real (I doubt it). I still have everything set aside that was sent to me. When I see the envelope I just chuckle to myself. Got a couple more e-mails instructing me in what I was suppose to do, then nothing. They don't have anymore information on me that you can't get from public records via the internet.

It's really sad that this works on some people but you should not be embarrassed or a shame. Trust your gut feelings. I have learned so much from Scamwarners and am indeed grateful they are available to us.

I am still unemployed but I am able to get by financially for a little while.

Warmest regards,
Juniper

Look at the "abika" link in Bryon's sig. That should help you with headers.

Don't tell the scammers you know they're scammers. Say nothing at all to them, making them think you absconded with the money, while you wait for the bank to return it to its rightful owner. You will probably get some very angry rants out of the scammers, possibly threatening to call the FBI. Ignore them.

This continues: Here is the latest header and e-mail is below that ~
From Bryant Lancaster Fri Nov 8 06:27:47 2013
X-Apparently-To: via 98.139.221.30; Fri, 08 Nov 2013 06:27:49 -0800
Return-Path: <[email protected]>
Received-SPF: none (domain of grimesheiout.com does not designate permitted sender hosts)
dWJtaXNzaW9uIG9mIHlvdXIgYXBwbGljYXRpb24gYXMgYSBzaG9wcGVyLiBZ
b3VyIGZpcnN0IGFzc2lnbm1lbnQgaGFzIGJlZW4gYXBwcm92ZWQgYW5kIHlv
dSBzaG91bGQgYmUgc2V0IGZvciB0aGUgc3VydmV5LiBUaGlzIGlzIHRvIGlu
Zm9ybSB5b3UgdGhhdCB0aGUgZnVuZHMgbmVlZGVkIGZvciB5b3VyIGZpcnN0
IGFzc2lnbm1lbnQgaGFzIGJlZW4gc2lnbmVkIGFuZCBXZSBvbgEwAQEBAQ--
X-YMailISG: m5p6rGQWLDtBATjrwy32AZrxFgPmlU5m6_CS_JCQwLCrr6NE
goSHNN1dz3gOv9byE.m9mlwYXf4mBxqteVuAAMF6orEI2xDenZ9wknsWAd.Z
83v9Rk.CINpqZilUbuMa93J_O2sZ6e62NnFeh4nae52SRn4XIKmKePRdVzZV
hsZVjjuht46.ODQipZ2FCpVMrge8WiIFfG652BoljQdObXjGT0y0a0wcHI6R
awwuOj0qJsT2lTWBwELEpgObkKJwCh7IKb6jIxdgQ.wTv9I6x2GEQ0KNTDsE
wyvgsHhwTiVUzfeuXGN_3RJI4vW_VFXf18fk3cWLDq8JMnFttmNMnzzY3fhN
YP0IRVtBnPNAv.CY53.9J7pKnG0V7gsHryu.HSFaX9Gi0FYo_pEDyx8TJqYn
cLM.uGBeGRBCPtjhKmdej9uI1HLMsZmqgaQ.DNupLBbyNQ0o4sh2nTPv1rsp
QDD8yrj48VQ2JMDxbbHwH1LU.J1jz2ndJB7eEOmrm8iK8YJBX7n0KR0KQRcG
cF0uzRk4QkAyTxhDZxaldBaHHZ90giTMDNSbboqQeeA_k_R9ecbhUGN6E1F_
ViadVA6hFfferB1x_KVUKwK3tsnn7K9xecnkf.oDDDqOsBrbgPcIL1JTLubk
ePbBQaoU_S0X3JIFtJqKPHyK2gsQMz7q_N6m9QsM58IawFkVesBSwLTAa_P3
QxXJrFqOhUSqp21FGeSF04Rvdvlia.hsAbxY.WVKci6yTYkTIYyjk0EUhGQn
Tkrl9AVXJ39NaJVEFNEvzeKy3Dc92On2u6YjX06yfYTVGYC7EOhMMYRYTVCl
JNfCTdUZ5LALBsYrzxprd603vBVkc.cngbRQkNnZRS2xtfniK.kRPTL3pwvE
bG3mGcIUqC3mwRjcArATfxFiMVKD_PDjiOSECTyZctbhvtT6fT2xeRSdfNdm
huGWv62IjoRY_tdp9C5EesEzR0SclLSgAZVaWnPHpVa01DhDxUv_2DsOtpTM
pdaJ2_edS6rClDlcOeaWTVau40.0y6weqo6RqqxQayzsGyQeZbnCACcNl7xS
y3YIj3TC1b6N.TNCGJIJ4ly3nt1QiY4mCG7Ux3Sd95QEIXXcnqWhfvcnTjqH
xxIhBaye4Mh_AFjBp8RZYITb11pfiZ3MkmqcHCOWYpQjseDitjHMoFEXnjCQ
yH0Ee_UXUDjyalqCZ4SdvP_RjtPghF1ptjiq6hMHbEtVoRMjVlcx5uosN338
ozUkuI_COSwIH.jAmq8XywFPVNQabiy0hBeGv8iF5GPTXKCFcEenqCSB8cUa
8QC9lQ--
X-Originating-IP: [68.178.252.47]
Authentication-Results: mta1281.sbc.mail.gq1.yahoo.com from=servicescoremysteryshopper.com; domainkeys=neutral (no sig); from=servicescoremysteryshopper.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO p3plwbeout21-01.prod.phx3.secureserver.net) (68.178.252.47)
by mta1281.sbc.mail.gq1.yahoo.com with SMTP; Fri, 08 Nov 2013 06:27:48 -0800
Received: from localhost ([68.178.252.117])
by p3plwbeout21-01.prod.phx3.secureserver.net with bizsmtp
id n2To1m0022YkKj0012Toe4; Fri, 08 Nov 2013 07:27:48 -0700
X-SID: n2To1m0022YkKj001
Received: (qmail 14978 invoked by uid 99); 8 Nov 2013 14:27:48 -0000
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="utf-8"
X-Originating-IP: 172.129.4.110
User-Agent: Workspace Webmail 5.6.43
Message-Id: <20131108072747.3e73792db712fb05abb1c0dcb390c9b2.d978231b81.wbe@email21.secureserver.net>
From: "Bryant Lancaster" <[email protected]>
X-Sender: [email protected]
To:
Subject: Follow up On Assignment (Mystery Shopper)
Date: Fri, 08 Nov 2013 07:27:47 -0700
Mime-Version: 1.0
Content-Length: 2834

E-mail:
It is important to check on you after submission of your application as a shopper.

Your first assignment has been approved and you should be set for the survey.

This is to inform you that the funds needed for your first assignment has been signed and

We only need you to Authorize the delivery of the supposed funds.


Please Re-confirm the name, address and phone number on file ASAP. You will get a UPS

Tracking number for the delivery in the next 24hrs and this will include your survey

Assignment and location.

Thank you for your co-operation.


Sincerely...

Bryant Lancaster

Hr Manager

Note from Juniper ~

This looks different and is written better. Didn't see the I/P address with a "41" in it. Looks like they will be contacting me again or this is something else like that new virus going around demanding a ransom. REALLY?! How foolish some people can be? I'll keep you posted.

The IP address is GoDaddy, which gives us no clue where he's really located. The writing shows traces that could be West African.