Gumtree possible scam please advise

Norbert replied to your ad: 2008 VW TOURAN 1.9 TDI SE 105 3780
Inbox
x
[email protected]

11:52 AM (9 hours ago)

to me
Hi there,
The vehicle is perfectly maintained, with no technical issues whatsoever, HPI clear, TAX and MOT valid until 07-2013. The price £3,800 includes delivery to your address. Currently is in custody of a shipping company with all the papers necessary to sell, ready to be delivered to its new owner. I`m letting it go as I've moved to Spain because of a bad and painful divorce and I can`t use it here, I need a left hand drive car. I will only sell it through eBay Motors because they will handle the payment in a secure way for both.
Let me know if you`re still interested
Debra Watson

What you scamwarner guys think?

I think it sounds like this: viewtopic.php?f=4&t=1193

A follow up on the story:

[email protected]

10:10 PM (5 hours ago)

to me
Let me explain how the eBay Motors works:
The transaction will be under eBay Motors fully surveillance, giving us both security and insurance that nothing will go wrong. They will be the 3rd, objective party involved in the transaction. They will hold the funds until you receive and inspect it. Once your payment is confirmed, the shipping will be started in 24 hours, and will last 2-5 days until it gets to your address. You will have 10 days for inspection from the moment the vehicle arrives at your address. If it is not like I have described it eBay Motors will refund your payment in maximum 3 working days and the vehicle will be returned on my expense.
This way I know that you have the money and you have time to inspect it before committing to buy, knowing that I don't have access to the money. We are both covered.
If you`re still interested get back to me with your full name, shipping address as well as your phone# so i can forward your details to eBay Motors and they will notify you about our deal. Like this you'll be able to talk directly with them and ask all you want to know.
Waiting your answer today if it's possible !
Debra Watson

http://pages.motors.ebay.com/buy/purchase-protection/

Please post the email headers so that we can see where she really is. A few grammar errors tell me she is not from England (or USA either), and I suspect she is not in Spain either.

Just to make sure it is perfectly clear to anyone reading this thread:
The scenario you are describing is a complete scam.

ebay motors protection ONLY applies to vehicles bought and sold through ebay. As soon as it comes up in connection with a vehicle on Craigslist or Gumtree, it is a certain scam, because ebay motors has NO connection to these sites.
Here is ebay motors' published warning on the topic taken from here: http://pages.motors.ebay.com/buy/security/index.html

Auto Scams on Craigslist & other sites

eBay's Vehicle Purchase Protection (VPP) covers only certain vehicle transactions that are completed ON eBay.com. If a Craigslist seller "promises" you eBay protection programs, walk away. It is fraudulent. Only cars bought and sold on eBayMotors.com can legitimately offer up to $50,000 in vehicle protection.

Common warning signs:

Sellers who want to move the transaction from one platform to another (for example, from Craigslist to eBay Motors).
Sellers who claim that eBay's Vehicle Purchase Protection covers an auto transaction conducted outside the eBay site.
Sellers who push for speedy completion of the transaction and request payments via quick wire transfer payment systems. See example.
Sellers who refuse to meet in person, or refuse to allow the buyer to physically inspect the vehicle before the purchase. See example.
Transactions in which the seller and vehicle are in different locations. Criminals often claim to have been transferred for work reasons, deployed by the military, or moved because of a family circumstance, and could not take the vehicle with them.
Vehicles advertised at well below their market value. Remember, if it looks too good to be true, it probably is.

And even if the vehicle is listed on ebay, it is NOT an escrow service. The program does not involve holding money so you can inspect the car. It is designed to cover very specific situations (outlined in ebay motors terms) in which there are problems with a vehicle that was bought through ebay motors.

Also be advised of the scammer trying to convince you that ebay / paypal / whatever has a new policy. If you can't read about it on the official site, it doesn't exist.

[email protected] via w2dx44aof3ug6qi3.vkstxwmiy863xro4.gol1xjj.2-6ak6eam.2.bnc.salesforce.com

2:57 PM (16 hours ago)

to me
Hello,

Thank you for your email reporting this to us.

The information you have shared with us does, in our experience, show hallmarks of fraudulent activity and I would strongly advise you not to follow their instructions and end contact with them immediately.

We take reports of this nature, and the safety of our users, very seriously. I have removed this ad and used the information to try and prevent this person from using Gumtree again in the future.

Etc...

Here is the header requested to identify the scammer:

[email protected]
to: ************@gmail.com
date: Sat, Dec 1, 2012 at 11:52 AM
subject: Re: Norbert replied to your ad: 2008 VW TOURAN 1.9 TDI SE 105 3780
mailed-by: comcast.net
signed-by: comcast.net

Delivered-To: **********@gmail.com
Received: by 10.49.109.67 with SMTP id hq3csp1018776qeb;
Sat, 1 Dec 2012 03:52:04 -0800 (PST)
Received: by 10.220.223.13 with SMTP id ii13mr3620977vcb.2.1354362723630;
Sat, 01 Dec 2012 03:52:03 -0800 (PST)
Return-Path: <[email protected]>
Received: from qmta02.westchester.pa.mail.comcast.net (qmta02.westchester.pa.mail.comcast.net. [2001:558:fe14:43:76:96:62:24])
by mx.google.com with ESMTP id ql6si6157100veb.35.2012.12.01.03.52.03;
Sat, 01 Dec 2012 03:52:03 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 2001:558:fe14:43:76:96:62:24 as permitted sender) client-ip=2001:558:fe14:43:76:96:62:24;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 2001:558:fe14:43:76:96:62:24 as permitted sender) [email protected]; dkim=pass (test mode) [email protected]
Received: from omta01.westchester.pa.mail.comcast.net ([76.96.62.11])
by qmta02.westchester.pa.mail.comcast.net with comcast
id WBgN1k0020EZKEL51Bs3EG; Sat, 01 Dec 2012 11:52:03 +0000
Received: from sz0064.wc.mail.comcast.net ([68.87.26.138])
by omta01.westchester.pa.mail.comcast.net with comcast
id WBs31k0052ymm843MBs3xZ; Sat, 01 Dec 2012 11:52:03 +0000
Date: Sat, 1 Dec 2012 11:52:03 +0000 (UTC)
From: [email protected]
To: ***************@gmail.com
Message-ID: <899724992.675036.1354362723252.JavaMail.root@sz0064a.westchester.pa.mail.comcast.net>
In-Reply-To: <[email protected]>
Subject: Re: Norbert replied to your ad: 2008 VW TOURAN 1.9 TDI SE 105 3780
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_Part_675035_1895568491.1354362723251"
X-Originating-IP: [::ffff:69.42.71.245]
X-Mailer: Zimbra 6.0.13_GA_2944 (ZimbraWebClient - FF3.0 (Win)/6.0.13_GA_2944)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.net;
s=q20121106; t=1354362723;
bh=g0wNZwKynnk3WvJvZv/BalTbgXnr2DfX3St4kVpmIRM=;
h=Received:Received:Date:From:To:Message-ID:Subject:MIME-Version:
Content-Type;
b=VF8Hdb6eh3qoW7HBHwjWIjBh6YUnpoVsfY8ntkCf0u/YT9pqbN0UIQQusooT45JWo
0jovAvmK+QKcxgtrnCjdepVBuFU0rQYL5CB9Pl+2esUF6vMuwpy2d6nmHmeQ5cEncb
jkn7iquv2uh1MEAaaR338s52q8U4YeQBiKzQcdBRlTCCqUy9KZYBm0OaGIVQlpI7dm
PN5DP5kWyP/9qIGjtOOVHTTjTdWghuC4OaYKaqkIuTL8MLMAXmYG3zb1zENpzB1L1V
8rNqy91xbnA8n9g5AmS3P+na1bCBY7ios50bntuOIOZXp0YNzpaudkbGFaPdnNVRHv
3y2BZUo6pa9LQ==

If you have any other information that you feel would be useful to stop this individual or others acting in a similar way, please let me know.

I did not send any sensitive information I guess they are still waiting for my reply...

Many thanks for all the help!!
Norbee

The scammer is in the netspace of an ISP called Webair on Long Island in New York. Being that close to NYC is consistent with being an immigrant from some non-English-speaking country, as is shown in his writing.

can`t

I noticed the unusual "`" rather than "'" which isn't in my keyboard and implies a different language one. I have it if I mess around with special characters and that's impractical. Maybe someone can pick this up and tell us what keyboard has this as normal.

It's hex 60, which is a perfectly normal character. On my keyboard, it's in the upper left corner, under the escape key. It's the same character you use in the shell when you want the output of a command inside another command. On the same key is the tilde, which stands for your home directory.

Foreign typing habits, not a foreign layout.

Webair is an international company, providing a variety of hosting and other internet services. Undoubtedly they provide solutions such as virtual private networks.

Depending on how they are configured, some providers will always show an originating IP, while others (such as gmail) only show the location of their servers, regardless of where the user is actually located. We do not always know which providers will work which way.

Like all major cable internet providers, comcast would certainly have a web-based interface to allow customers who are traveling to manage their email. The scammer could easily log into a comcast account from virtually anywhere in the world using that interface. We don't know how every provider's web-based interface is configured.

So, in reality, based on one header, we can't say much with certainty when we are not completely familiar with comcast or webair's specific services. The person emailing might be located in NYC. On the other hand, he/she might be somewhere else in the world. If this is the case, the comcast email account used might have been set up by or for the scammer, or it might even be an innocent person's account that was phished or hacked and then taken over by the scammer.