Is this a scam?

I got this message on aupair.com:

Dear Au Pair,

We are a friendly happy family of three. We live in London and there are many au pairs and English schools in the area. The area is very pretty and safe with lots of local parks, cafes, clothes shops nearby.


My son needs help with breakfast and at tea time, and also we need help with the cleaning and laundry, occasionally walking him to school, helping with reading bedtime stories. He loves swimming,
riding their bikes and going to the park. In the summer he loves splashing in the paddling pool and bouncing on the trampoline.

You will be free in the afternoons as soon as you drop him off at school, which is helpful if you are interested in language school. You will have a single bedroom, which is downstairs so your own private space with a toilet next door. Your bedroom has TV, DVD, and stereo and internet access.

The hours are 30 hours per week with up to 2 nights babysitting, Saturday and Sunday days free. If you prefer to buy your own food there will be food allowance on top but we will love you to eat with us as a family. Kindly write me through my private email [email protected] or you can call me on +447539539505.

Kindly send us your resume (CV) for perusal and we will get back to you with our contract offer. Cheers and write us soon.

Warm Regards,
Elizabeth Ayuk for the family

They also sent to me these photos:



And last time I requested something that proves that they really exist, and they sent this:

And here's the barrister's details they were talking about:
Application email: [email protected]
UK Immigration Solicitors | Immigration Lawyers | London
206 Merton High Street South Wimbledon London SW19 1AX
Sunrise Chambers

I hope somebody can help me...

Hi agoston92!
Welcome to Scamwarners!
Yes, your instincts are correct. This is a scam. The English, although it's not too badly written, is definitely sounding like a typical West African scam script. The phone number given is a 447 "redirect number". A phone number that appears to be a UK number, but actually can be answered anywhere in the world. The "barrister's" email address is a free AOL address.
Please post the headers of the email and we can probably see that it was sent from Nigeria.

I don't know if you need all these, but here's the full header:

From Elizabeth Ayuk Tue Jul 5 09:02:45 2011
X-Apparently-To: Tue, 05 Jul 2011 09:02:48 -0700
Return-Path: <[email protected]>
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
X-YMailISG: XbQE.PoWLDvY4dE78wobbBlQ.FBG3J6GyNeKy8lcGreqcuVG
5jX1Mvf56hrAnadwx34XojplwIbpEuuadDVYltdIEOTqi_7kjHKkgwyOeMSZ
l.Q0ZyM9appR_BrWlW5i7J2RXm6Xldgi9PJJQL.870Vn0QJowZXmI_XysUq0
5w4jMMcSfJJfwzV6UPaLyjNP2SbC6MaDRla4Q6tOGdnCSf.kdUI4QUop_Uq1
keBNfh8sitND4ytyEYnhyQFfJ5X1J4ua0Px4WuyCVJyksVkEThYMZ9n_EjCf
IKHhu3bq2ncMCLgWAn48EgjW_iFDD46oQzI5wOgaI_cvg7Tu4qJlJ.RCLvXk
qWL2R1hdRX6PLOmuRq4dy9pMnaEygfobgoPQuXgT2Gysd31T9jSfonOg7dKD
GWstYHtfXmf9aezKIaAey5P5IOLMIrcnHpf8KF3UpYwY.U45xlb7znqhfgY9
ZaaNkMU6Gem_c5jsc2_4kGMjVAroQNeUrni59E58hixUqxqLrF7FxfglXM4N
.EImVH4uQH0FBX1_8ZlTPGbABej8z10dMJpqbRmtOyiMS59BUGSF_7GwVPIr
XFmd7rad84AxntKZggNU7ZGBG5GT_NLNhaFW2NvEIqBZbVWDT9pZ2ud4Obxc
.FzDZNx.vx8OoF9fqc4_z7XiHyZnZPKqkoaHZMXcGLd7OsRSgRQei95b8Iyh
lq7fa3176x.qnhoqT6qZc8PehBpTeoLWMQ0i5pU03P3Lk7m9IFpojQFo9CxU
p5MjWtlTSXX4VaSdqjXjvSKnisUl13paJVwb3e9_0mdPdMT1PPSntTep4Du8
PJDjk6JEDKw6UBPMWeUnKousNQLuFlz932vmqyp6crrweDnzTgSXork.e5Li
S1kUuaJpvd0hVEMpAxIjDCPQj0SbAJO4BYYXrm2ywGyBZj76Gg6BJf8L7BW9
WIaKuqlsPSoXS4pZbUAqhfM1KF.XIfxSoQwf_Y3Y7yP78Ay2JD6K2vb4d51.
ot1DUbOI.eyuU0p5ukxRoV8k6sSJUwSzESyihCyhkbS_ljL2LzPE7y03dKQF
NwpSsgTiGiC2QJHy8NMY9klIEPYdLlqYgGZrauHk
X-Originating-IP: [98.138.91.93]
Authentication-Results: mta1086.mail.sp2.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO nm17-vm2.bullet.mail.ne1.yahoo.com) (98.138.91.93)
by mta1086.mail.sp2.yahoo.com with SMTP; Tue, 05 Jul 2011 09:02:48 -0700
Received: from [98.138.90.52] by nm17.bullet.mail.ne1.yahoo.com with NNFMP; 05 Jul 2011 16:02:46 -0000
Received: from [98.138.89.196] by tm5.bullet.mail.ne1.yahoo.com with NNFMP; 05 Jul 2011 16:02:45 -0000
Received: from [127.0.0.1] by omp1054.mail.ne1.yahoo.com with NNFMP; 05 Jul 2011 16:02:45 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 13027 invoked by uid 60001); 5 Jul 2011 16:02:45 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1309881765; bh=6UZ/7nGtKbysgtACCbCukSUW7R2V/IKjTIVGcsepAJU=; h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=LcXWturOHNUGu+Hzx3eTsTdUqLjIwYrVglikYwfmJyYJgvpFwonNxylyajFQPsrNiMLco5GuOvFlHwLOPnHGO70fUplJOBi20KbtIezj6BWZKQOixfpSM5lYXU1iZiEXUY2kecFGJjkGZt4VTl+JeDexvBHFDfChcvGnJwgyMZc=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=4A0c58TLkfcmk1FDPOEgoCWdfzd1jF/4qxmMFQMtkr427nWQUXi8UuvZ68OEwYzFsWjHCvQlTLSkC/IE6Jyo7b+4U+pylYKrA0OcPaE3QrsGI+rNpgOfEUOK3ZndMdrym8J1EibEcVUJG5bbCvrNt3tfhqESPrHK/gT46RJnerQ=;
X-YMail-OSG: hsMiIYwVM1lk4ve8I3gncbwl.ul9Tph4D1GQnwqPlsf1eVs
lfQn_bOex16V910SP3Co6XGRsE01QTL3fxx5na3k5.3yNzHQyt9Xx4kQMNMD
Vdh8gDBKk.bcjyY8wUvakagtemhpsqUlM8TsesPuv.k0huQw3wWKvxfxeXch
oTwjBhX8GJHVvpMowoihzSJHghiJTYsGWAjtgrWcTYypeSkumL9jSMN3y9ny
we0Bm.fbajb48_X3NwHlaU1lnKvBpx.6F.25mkQEFRLnDFWq7L_5QzlX6nW7
l.auxDk9WjmWyV6ITR9kwsdOAOwl6Odz4PuXbn0YBnOSNvAsAAvcm
Received: from [98.138.197.77] by web125307.mail.ne1.yahoo.com via HTTP; Tue, 05 Jul 2011 09:02:45 PDT
X-Mailer: YahooMailWebService/0.8.112.307740
References: <[email protected]>
Message-ID: <[email protected]>
Date: Tue, 5 Jul 2011 09:02:45 -0700 (PDT)
From: Elizabeth Ayuk <[email protected]>
Reply-To: Elizabeth Ayuk <[email protected]>
Subject: CV IMPRESSIVE
To:
In-Reply-To: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1596547352-1309881765=:11743"
Content-Length: 9940

And thank you for your answer.

Thanks for the header. Sadly, the the origin only shows the location of Yahoo headquarters,USA.
However, I saw "NNFMP" in the header which strongly suggests that the scammer used a trick to hide his true location.

I see. Thank you for your help

Regretably the header is not saying much in this case.
Originating IP: 98.138.197.77 Originating ISP: Yahoo! City: Sunnyvale Country of Origin: United States
However if you look at the header there is NNFMP contained within. Whilst not conclusive, those letters in the header usually are an indication of a suspect email.

omg i received thesame email too fr same sender w/ exact details.. i'm worried coz ive already emailed them my personal details and credentials aswell as resume... what should i worry about?

Hi kafagway98, I have replied to this in your thread here:

viewtopic.php?f=42&t=22220

Au pair scammers write to many many people at the same time, and most of these will send the scammer their personal details, CV, references, photographs, and maybe a passport scan as well. The scammer isn't really interested in any of these things; he only asks for them to make himself appear authentic. Please don't worry about any of the above things which you have sent to the scammer - they probably were not even looked at!

If you have sent your bank details or credit card details to the scammer, however, please contact your bank and credit card company immediately for advice. But don't worry about anything else.