A fathers cautionary tale, and help request

My daughter lives in Washington DC. She is looking for an apartment, she replied to an ad on Craig's list, and recieved the following e mail:Thank you for you email,

My name is Michelle Morgan, you emailed me for the 2 br 2 baths
apartment located on :

777 7th St NW Washington, DC

Here is a video of the apartment so you can see exactly what it looks like :

http://www.youtube.com/watch?v=ifXH_JIAjeA

It is located in a very select downtown neighborhood, The area is very
nice, very quiet and safe, it is lose to all the best attractions,
easy access to public transportation. Great Restaurants, Bars, Pubs
and shopping abound in the immediate area, within walking distance.
The apartment is very spacious, very modern and bright, has a washer
and dryer, lots of closet space, fully furnished, all new
bedding/linens, cookware, dishes etc . Stainless Steel Appliances:
range/oven, microwave, dishwasher & refrigerator. Air Conditioning,
nice bathrooms. Sound System. Comes with a gated parking space
included,a storage unit where you can deposit my furniture (if you
want to rent it unfurnished and you want use your own furniture) Any
maintenance is done by a specialized company and i will be billed for
any work that gets done. Pets are allowed! The apartment is
unoccupied, you can move in right-away or you can secure it now and
move-in later.

PLEASE READ CAREFULL:

Rental Terms:
The lease is flexible, month to month ok, min 1 months - max 2 years.
Rent is US $1090.00 / Month
The rent is for the entire apartment, it is not a share or sublet.
Water,electricity, Internet,cable, parking, All the utilities and
amenities fees are included in the monthly rent.

1st month rent in advance.
+
US $1090.00 Deposit that you will get back when you move out.

The rental process will be done online via ING Real Estate UK.
I am the apartment landlord. I want to find someone serious and
reliable that will take care of my property. Please tell me about
yourself, your occupation, income.

All the best wishes,

She asked me what to do. She responded that she was a student,

Next e mail from 'her'

Happy to hear that,
Once you email me something that shows your financial situation: your income, your savings, or anything else you want + id or passport i can set up the transaction with ING Real Estate and link you to ING Real Estate.

All the best wishes,
Regards.

This crazy father sent his financial information over. Then recieved this link:

Hello,
Thank you for your reply,
The rental with ING Realestate UK has been set up, click the link, to go the page to complete the rental process:

http://ingrealestate.co.uk/ingwu9875843 ... n/8365372/

Send the funds in 2 transfers one for the first month's rent + one for the security deposit that you will get back when you move out, keep the receipts from Western Union because i will refund you the fees.
Regards

I went to Western Union and actually sent the money. As I was driving home, my daughter called me and said Dad this is to good to be true, is it a scam? My heart dropped. I was so excited that she was getting an apartment that I didn't even think scam. I managed to get my money back from Western Union, I never sent them the MTCN number. I have put fraud alerts on all the credit bureau's. What else should I do? They have my Date of birth, SS# and a copy of my passport. Please advise......

The ING domain looks legit, but I see no reason why a real estate company in the UK, based in the Netherlands, would be handling an apartment in Washington. The URL looks like someone stuck a directory on ING's webserver without ING's knowledge. The request for Western Union shows it's a scam.

Could you post the headers of the emails? Often potential victims search the Web for email addresses in scam letters.

Wow, here is the header. I ran it thru the search and it says that the IP address originates at Moffet Federal airfield in Mountain View. Is that Google? So confusing.

Received: from fwd1i.spamh.com (208.43.201.130) by server.trafficnet.ca
(10.10.1.55) with Microsoft SMTP Server (TLS) id 14.1.355.2; Sun, 22 Jul 2012
08:13:10 -0500
Received: from a31.spamh.com (a31.spamh.com [38.105.35.83]) by fwd1i.spamh.com
(8.14.2/8.14.2) with ESMTP id q6MDDwXI009957 (version=TLSv1/SSLv3
cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) Sun, 22 Jul 2012 09:13:58 -0400
Received: from mail-bk0-f44.google.com (lbc.spamh.com [75.126.136.140]) by
a31.spamh.com (8.14.2/8.14.2) with ESMTP id q6MDDrtX018212 for
Sun, 22 Jul 2012 09:13:53 -0400
Received: by bkty7 with SMTP id y7sf4202057bkt.31 for
Sun, 22 Jul 2012 06:13:52 -0700 (PDT)
Received: by 10.204.130.211 with SMTP id u19mr2453918bks.24.1342962832868;
Sun, 22 Jul 2012 06:13:52 -0700 (PDT)
Received: by 10.204.130.211 with SMTP id u19mr2453896bks.24.1342962831907;
Sun, 22 Jul 2012 06:13:51 -0700 (PDT)
Received: from mail-bk0-f49.google.com (mail-bk0-f49.google.com
[209.85.214.49]) by mx.google.com with ESMTPS id
hw3si9158063bkc.149.2012.07.22.06.13.50 (version=TLSv1/SSLv3
cipher=OTHER); Sun, 22 Jul 2012 06:13:51 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 209.85.214.49 as permitted sender) client-ip=209.85.214.49;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 209.85.214.49 as permitted sender) [email protected]
Received: by bkcji2 with SMTP id ji2so4518181bkc.8 for
; Sun, 22 Jul 2012 06:13:50 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=google.com; s=20120113;
h=mime-version:x-originating-ip:in-reply-to:references:date
:message-id:subject:from:to:content-type:x-gm-message-state;
bh=pkgwpljJuoYSKsvBMJ26aBehHFJjzokK4nVBwF676pc=;
b=I0V2voPxPnsv7ls5cWXPMI/BS4wegYtvSRBWMnyT1DTxVsf9RzZGl2a9MDhTbv8tEt
iDvKw6PqOTJWUMwbY3PEm0oH/2MqDIaccY9YblLTG3zy0LylmBbJacrjMHNuVYWeyecu
NTS6MfBWr18ZlaB/fmfTKUOv/oyfNXIO+2fCXXYSjzwP7UP+SohZfWtmZjse+YbLQIa7
SXXJsbkf+3VnVugxJaj6iD42Ah/gqEfq3J3rZP7mFbELUcMuQNFI61zXat0dFIveP1TV
DxbDzQVKHmQo0UAdliXZUq12PR1sEYXOv8R9+w7tuD/Y1iSJ5kunQe3yqY9cNQrqX9gG
vyoQ==
MIME-Version: 1.0
Received: by 10.204.148.72 with SMTP id o8mr5945507bkv.103.1342962830044; Sun,
22 Jul 2012 06:13:50 -0700 (PDT)
Received: by 10.204.182.5 with HTTP; Sun, 22 Jul 2012 06:13:49 -0700 (PDT)
X-Originating-IP: [172.190.185.120]
In-Reply-To: <6222CA36F5A42B48B01D29894B4B8BAF101710@GTN-EXCH1.TrafficNet.local>
References: <6222CA36F5A42B48B01D29894B4B8BAF101153@GTN-EXCH1.TrafficNet.local>
<CAFFftzVrDoxAXOiEsqvcrH47Eu5VvTnXTOi5MJr=necR-pQ7iA@mail.gmail.com>
<6222CA36F5A42B48B01D29894B4B8BAF101710@GTN-EXCH1.TrafficNet.local>
Date: Sun, 22 Jul 2012 06:13:49 -0700
Message-ID: <CAFFftzVww0_p1A-8OQS7ZQ6e=8hM+od3Ye_zD_Sct34gfu1czQ@mail.gmail.com>
Subject: Re: The Apartment
From: Michelle Morgan <[email protected]>
To
Content-Type: multipart/related; boundary="0015175cab326e6de404c56ae67a"
X-Gm-Message-State: ALoCoQldkm4d2pqsTGDLXHvz1usqZoMNg61pLqMuSXnrPFuOnVBTMNewzRaqs/XBjiPZKzwUr0AU
X-SpamH-CheckIP: 209.85.214.44
X-SpamH-ID: a31.spamh.com-q6MDDrtX018212
Return-Path: [email protected]
X-MS-Exchange-Organization-AuthSource: GTN-EXCH1.TrafficNet.local
X-MS-Exchange-Organization-AuthAs: Anonymous
X-TM-AS-Product-Ver: SMEX-10.1.0.2244-7.000.1014-19056.004
X-TM-AS-Result: No--21.558100-5.000000-31
X-TM-AS-User-Approved-Sender: No
X-TM-AS-User-Blocked-Sender: No
X-MS-Exchange-Organization-AVStamp-Mailbox: SMEXkv@];927750;0;This mail has
been scanned by Trend Micro Messaging Security Agent;
X-MS-Exchange-Organization-SCL: 0

I'm happy you realised before it was too late. Looking at ing's webpage and it says "< Unfortunately ING Direct does not accept international transfers.">
The scammer is indeed piggybacking on the website without ing's knowledge. This part of the address being the giveaway. ingwu9875843 ... n/8365372/
Try not to panic over the information you have sent. The tricksters ask because it makes the scam seem more legit and the target is less likely to ask questions. I have sent much more personal info to a scammer from a previous time and no untoward effects have followed. I'm afraid you will need to put it down to one of lifes experiences. Happily you retracted the transfer and did not lose out which is great.
Now the scammers have your email address, just be wary of future scam contacts in the coming weeks or months ahead.

And we thankyou for publishing the header. Well done.
Yes, the same happened when it came on the screen. Mountain view is google.
Because we occasionly have scammers themselves looking through the forums I won't point out the mistakes.
The header has been altered by the sender of mentioned email. No legitimate person would have need to do such actions. You would be doing yourself a huge favour by simply stopping all forms of communications with the fraudulant con artist.

Hi guys,

thanks a lot for sharing this information! You saved me from a big trouble! I found a very exciting advertisement on Craigslist, replied to it, and got even more exciting feedback. Then I did a quick google check and found your post. The advertisement was almost the same as TrafficBoss's.

Thanks to you I didn't get trapped!! Thanks!


Here are the two scam emails I got:

----------------

Thank you for you email,

My name is Michelle Morgan, you emailed me for the 2 br 2 baths
apartment located on :

942 Market St San Francisco CA

Here is a video of the apartment so you can see exactly what it looks like :

http://www.youtube.com/watch?v=ifXH_JIAjeA

It is located in a very select downtown neighborhood, The area is very
nice, very quiet and safe, it is lose to all the best attractions,
easy access to public transportation. Great Restaurants, Bars, Pubs
and shopping abound in the immediate area, within walking distance.
The apartment is very spacious, very modern and bright, has a washer
and dryer, lots of closet space, fully furnished, all new
bedding/linens, cookware, dishes etc . Stainless Steel Appliances:
range/oven, microwave, dishwasher & refrigerator. Air Conditioning,
nice bathrooms. Sound System. Comes with a gated parking space
included,a storage unit where you can deposit my furniture (if you
want to rent it unfurnished and you want use your own furniture) Any
maintenance is done by a specialized company and i will be billed for
any work that gets done. Pets are allowed! The apartment is
unoccupied, you can move in right-away or you can secure it now and
move-in later.

PLEASE READ CAREFULL:

Rental Terms:
The lease is flexible, month to month ok, min 1 months - max 2 years.
Rent is US $1100.00 / Month
The rent is for the entire apartment, it is not a share or sublet.
Water,electricity, Internet,cable, parking, All the utilities and
amenities fees are included in the monthly rent.

1st month rent in advance.
+
US $1100.00 Deposit that you will get back when you move out.

The rental process will be done online via ING Real Estate UK.
I am the apartment landlord. I want to find someone serious and
reliable that will take care of my property. Please tell me about
yourself, your occupation, income.

All the best wishes.

--------------

Happy to hear from you,
I live in Europe in the United Kingdom and work as an antiques evaluator for an auction house in London.

The rental will be done via ING Real Estate UK ( ing.com ingdirect.co.uk ) i am sure you have heard of this company, they are a very very well known Insurance Company,International Bank, Assets Management, Investment Company etc etc. They are managing the properties i have in the US. The rental process will be done online, only with ING: simple and easy. Every time we rented the property we did it via ING Real Estate, I have always used their service with every tenant. First i will have to set up a transaction with them. Everything is simple and easy, it usually takes them max 24-48 hours to have the keys and lease delivered to you.

A transaction with ING Real Estate UK will be set up. I will then link you to ING Real Estate UK so you can see that the transaction is insured, the property has been inspected, all the details verified and that i have an excellent feedback reputation with them.

You will deposit the funds as security via Western Union to ING Real Estate. They will hold the funds unavailable in a neutral insured trust account. Funds will remain locked as security in case something is damaged or stolen.
ING Real Estate will mail you the keys and paperwork via DHL or FedEx Overnight Express, delivery 2days US, 3days international.
The apartment is unoccupied, you can move in right away or you can secure now and move in later, the lease will start from the day you move in.
If within 5 days from when you have moved in you are not satisfied with the property you can return the lease and keys to ING Real Estate and receive a full refund including any transfer fees paid.
In 6 years i have never had a tenant turn down this property, from students to doctors or lawyers.
I am sure you will rent it and you will enjoy it. You will receive the deposit back when you move out, if the property is in the same condition you found it you will get the money back the same day the lease and keys have been returned.

Can you please confirm the expected move-in date and aprox period you want to rent the apartment.

If you have decided to rent the apartment, first i will have to set up the rental process with ING Real Estate UK. You will have to email me a proof of income or source of income, savings etc something that shows your financial situation, and an id for the rental agreement and to register you with the administration, so you can be allowed to access the apt. Once i have this i can set up the rental process with ING Real Estate so you can deposit the funds to receive the paperwork and keys to move in the apartment.

Looking forward,
The very best regards.

-------------

Hi,
My husband and are travelling the world and use the internet for all our travel planning and bookings. We are going to Los Angeles for 5 weeks, so we started searching short term apartment rentals. We found an ad on Craigs List, advertising a cheap month to month rental at 7133 Hollywood Boulevard, Los Angeles.
The person I emailed was Michelle Morgan. I too was sent a lovely video link to the exact same video you viewed for Washington.
The person emailing me also claimed to be a auction house antiques valuer, working in London.

As we are cautious in regard to sending any personal details or funds via the internet, I asked further questions to verify the processes. I also expressed that I was unhappy to send online my financial details and ID, so another solution was needed.
Instead of getting back to me with solutions, I received another lengthy email, which this person would have taken sometime to compose, telling me of rental hassles they have had and why they use ING.
I asked for 6 questions to be answered before I could commit to the rental. Not one question was resolved.
Upon receiving the 2nd email I decided to put further time into scam searches incase this was one.
Well looky here! It is.
Thank goodness we have set ourselves safety criteria for internet processes. We were excited about finding this rental and could easily have complied with the instructions.
We also google mapped the address and could not find a building for it.
This of course was a question I asked, but did not get a response to.

Thank you to the person who started this scam blog. You have saved us time, money and stress.

Regards the intrepid travellers

Its not unusual for scams to use legit sites. I'm going to have to say there are several warning bells on this. Multiple grammar errors and pretty choppy english would be a major warning to me. Whats more any request to send money overseas should be a major red flag. Most landlords and owners make arrangements, such as a property manager to deal with such things if they are out of country. After all what happens if a pipe breaks or the stair railing comes off and there is no one around to deal with it. After all the landlord is suppose to take care of those kind of issues, not the tenant.

Never, ever, western union money. There are many far safer options.


As for what you should do now. Monitor your credit. Not much beyond that you can do that you haven't already done. It is likely that nothing will come off it. Identity theft schemes tend to be a bit more difficult to pull out of country.

Michelle Morgan is now operating in Honolulu. Will the police do anything?

Unfortunately, the police in Honolulu can't do anything.

The scammer's name is not Michelle Morgan, and he is not in Honolulu. He is a young African male, most likely sitting in Africa or Malaysia, who is simply googling real estate info online to find suitable addresses, descriptions, and photos to use in his scams. He just picks a property (sometimes changes the details, sometimes will just copy real info from a realtor's ads), runs his fake ads, and then sends out his scripted emails to anyone who responds--all from a computer halfway across the world. He has never been in the places he claims to be, or anywhere near the properties he is claiming to own.