XU, JIA YU, HE, YU QIAN

I am posting this fraud on behalf of the comp. I am working with.

Our company is situated in Northern Europe. We are one of the biggest producer of building materials in this branch. Our raw material suppliers are mostly European based suppliers. Just a few months ago we decided to go and hunt for cheaper supplier and we reached as far as China. This Chinese comp. is represented by a lady here in our place. Trust to both comp. was established.

Samples were sent and tested. After we found the quality we were satisfied of. Plans were made. At the start, the Chinese comp. demanded 100% cash in advance because we are a new costumer to them. Due to our solvent liability policy, we did not agree the 100% but agreed to pay the 30% in advance and the remaining 70% will be before the container will be released from the custom.

Bank account was sent by the Chinese comp. and we agreed to transfer the money. After a few days, we received a letter that we have to use another account name due to some problems with their bank account. Our company was acting in good faith and did not questioned the matter. Money was transferred by our bank. As a blessing in disguise, our Accounting Mngr. forgot to change the name of the beneficiary. So, the transfer was questionable and did not pushed through. Then came another letter from China, demanding for their pay. We told them that money was sent but it is on hold due to the mistake in beneficiary name. Then the China girl, told us that they did not change their bank account. This is when we discovered that there is something that doesn’t sounded right. We then investigated the IPs and with the help of one of your nice and helpful Scamwarner, we found out that the emails were sent from Nigeria.

More details coming!

^^

Received: from bay0-omc3-s15.bay0.hotmail.com (65.54.190.153) by

(192.168.5.15) with Microsoft SMTP Server id 8.1.240.5; Thu, 18 Aug 2011

12:48:58 +0200

Received: from BAY155-W24 ([65.54.190.189]) by
bay0-omc3-s15.bay0.hotmail.com

with Microsoft SMTPSVC(6.0.3790.4675); Thu, 18 Aug 2011
03:49:04 -0700

Message-ID: <[email protected]>

Return-Path: [email protected]

Content-Type: multipart/alternative;

boundary="_371c2c16-d9fb-4df8-b715-f0de634d904b_"

X-Originating-IP: [219.82.70.174]

From: =?gb2312?B?0+C3vLe8?= <[email protected]>

To:

Subject: Anna from Hangzhou Anyang Building Materials

Date: Thu, 18 Aug 2011 10:49:04 +0000

Importance: Normal

MIME-Version: 1.0

X-OriginalArrivalTime: 18 Aug 2011 10:49:04.0119 (UTC)
FILETIME=[724E7870:01CC5D94]

X-MS-Exchange-Organization-PRD: hotmail.com

X-MS-Exchange-Organization-SenderIdResult: Pass

Received-SPF: Pass (AB-DC01.addabyggkjemi.local: domain of

[email protected] designates 65.54.190.153 as permitted sender)

receiver=AB-DC01.addabyggkjemi.local; client-ip=65.54.190.153;

helo=bay0-omc3-s15.bay0.hotmail.com;

X-MS-Exchange-Organization-SCL: 3

X-MS-Exchange-Organization-PCL: 2

X-MS-Exchange-Organization-Antispam-Report:
DV:3.3.10416.480;SV:3.3.9010.377;SID:SenderIDStatus
Pass;OrigIP:65.54.190.153



Fra: ??? [mailto:[email protected]]
Sendt: 18. august 2011 12:49
Til:
Emne: Anna from Hangzhou Anyang Building Materials



Dear ,

I am Anna, i recieved your email just now. I am confused becaused i have
not sent some emails showed in the information you gave me.

The beneficiary is Global Holding Group Co.,Ltd., the same with the
first time your accountant xxx used.

Maybe the person who is talking with you is a cheater? I just sent
emails to you on 9 August, 12 August and 17 August recently.

This is my another email. the post [email protected] may be infected by
virus.

If it's the truth, i am very sorry for that.

Waiting for your email for confirmation.

Anna
008615824194993
http://www.hzanyang.com

---------------------------------------------------------------------

Received: from n1.bullet.mail.cnh.yahoo.com (203.209.250.219) by

(192.168.5.15) with Microsoft SMTP Server id 8.1.240.5; Tue, 16 Aug 2011

02:14:43 +0200

Received: from [203.209.250.222] by n1.bullet.mail.cnh.yahoo.com with
NNFMP;

16 Aug 2011 00:07:50 -0000

Received: from [119.42.242.53] by t1.bullet.mail.cnh.yahoo.com with
NNFMP; 16

Aug 2011 00:07:50 -0000

Received: from [127.0.0.1] by omp1002.mail.cnh.yahoo.com with NNFMP; 16
Aug

2011 00:07:50 -0000

X-Yahoo-Newman-Property: ymail-3

X-Yahoo-Newman-Id: [email protected]

Received: (qmail 97668 invoked by uid 60001); 16 Aug 2011 00:07:49 -0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.cn;
s=s1024; t=1313453269; bh=14sY2AjYqy8qLOjaEO9yQbNHKiic0gbZoLI/trwk35s=;
h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=fc4oFif/kWUWCMw69xJB6ig7GeyN1klxrl/3bwPy7Vo8cLq3AdBG8fu9Gj7WbJ/PUMxHbFUJSy0RE0pPvHIg3mTJjYLkgHhIQoe3Yoni36qhNHFBncG4fwkO/jRRsJ8H/Qqlg50OjftVq2oGl2lDA4VYBqIop3TFjMUjLaw382I=

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;

s=s1024; d=yahoo.cn;

h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type;

b=OxUMr42VS3EkxWjdxYtzMVEGNbb9zqYyrAeLi2M/8Xx9oSrC9UiYGxwOsKqIUpuTkEzyzEH7o7dC920MXO6RbTrM7rFNg26McwOzmi2ktgDkdL2z0FS/DXKZtwCFTrjveewhPkph2DRIyKxJ2oY0/SVryiaVjlIM22ujtejTGXM=;

X-YMail-OSG: paiDvFUVM1nhRTAJPslX2GjJnjKFFVjWqgVTgsJgwY9dE4p

8lmR_MUFk2wJC2csIzqsMcMMu6_ViiAZ9gZUYtphlfx79vZLT7c6HsJ5F9_q

JU8ETmmir5iMk4TEIXq99pPPOy_rGSrKHH45fR0fyzGHo7aG.xQ4xYETC_oK

qsjBUkBdLSv0fLG77GgVwfiNVQLog48.SOQF_eIlt5SUOBZZ0zk6Gzikw3JC

EwtvYn7xvabBg74pbTO0dQDGxtWoiTnIF_moxADwLZeRoe0rKYlfbjuwppLi

MFaR2tuIp.K8Ci9zKhEQvzVzYjRGhddXqTvA_I_N9WVvM._JqaIAFObnPDV6

Z2c68hxSiGszwozO6Uvr0jlvrR5_FzNV01f_a3YRXC.xjFFN68HTLFN_7GNU

XaZ7Qh2LYnRayA3Ovp_rhpzvNi17.N5vxXFsCNsomYuv9veLbrHwmbsw8hQj

EL5iVze65yNmOoA--

Received: from [41.155.8.250] by web92103.mail.cnh.yahoo.com via HTTP;
Tue, 16

Aug 2011 08:07:49 CST

X-Mailer: YahooMailClassic/14.0.4 YahooMailWebService/0.8.113.313619

Message-ID:
<[email protected]>

Date: Tue, 16 Aug 2011 08:07:49 +0800

From: =?utf-8?B?5p6X5a2m5pm6?= <[email protected]>

Reply-To: <[email protected]>

Subject: =?utf-8?B?5Zue5aSN77yaIFNWOiBUZWxleCByZWxlYXNl?=

To:
In-Reply-To:
<2EBCFE7BDBF4534DB4D4C67364E5090802446CA1126B@AB-DC01.addabyggkjemi.local>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="0-2028375118-1313453269=:94878"

Return-Path: [email protected]

X-MS-Exchange-Organization-PRD: yahoo.cn

X-MS-Exchange-Organization-SenderIdResult: None

Received-SPF: None (AB-DC01.addabyggkjemi.local: [email protected] does
not

designate permitted sender hosts)

X-MS-Exchange-Organization-SCL: 0

X-MS-Exchange-Organization-PCL: 2

X-MS-Exchange-Organization-Antispam-Report:

DV:3.3.10415.493;SV:3.3.9010.377;SID:SenderIDStatus

None;OrigIP:203.209.250.219



Fra: ??? [mailto:[email protected]]
Sendt: 16. august 2011 02:08
Til:
Emne: ??? SV: Telex release



Dear ,



I will be waiting to hear from you as soon as your financial manager
contacts your bank to have the beneficiary name changed to HE, YU QIAN
because that was what i gave you on the bank details and not GLOBAL
HOLDING GROUP CO. LTD. Please inform your financial manager to contact
your bank to make changes if not the payment will not be released to us
and resend the new copy of the wire transfer slip to me once the changes
have been made so that I can contact xxx and give and the telex
release.

Best regards


Anna Yu

Room 1908,Oujiang Building
310018 Hangzhou

Zhejiang,China
M:+86-1582419 4993


------------------------------------------------------------------------


Received: from n6e.bullet.cnb.yahoo.com (203.209.230.50) by

(192.168.5.15) with Microsoft SMTP Server id 8.1.240.5; Mon, 15 Aug 2011

17:15:22 +0200

Received: from [202.43.217.102] by n6.bullet.cnb.yahoo.com with NNFMP;
15 Aug

2011 15:08:57 -0000

Received: from [203.209.250.222] by t2.bullet.cnb.yahoo.com with NNFMP;
15 Aug

2011 15:08:57 -0000

Received: from [119.42.242.53] by t1.bullet.mail.cnh.yahoo.com with
NNFMP; 15

Aug 2011 15:08:57 -0000

Received: from [127.0.0.1] by omp1002.mail.cnh.yahoo.com with NNFMP; 15
Aug

2011 15:08:57 -0000

X-Yahoo-Newman-Property: ymail-3

X-Yahoo-Newman-Id: [email protected]

Received: (qmail 39841 invoked by uid 60001); 15 Aug 2011 15:08:56 -0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.cn;
s=s1024; t=1313420936; bh=JJU7K8c/Xc5Jz52CXgY2TjkiBrPMaiiO2YREcftD+5g=;
h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;
b=bpDb5OdNilAufcfgT0EfHtg8R/Sa8ywmwI8ctTZZwt84/Yjq0xlz0HLh5qiRhzRXurjqdHM55umpD0IMjEnJmckg2qvR2jQEgCZENP1KVyKi+xnrAAxrf/hrfqZpT4kOJUE4F+2ui80rvWgqkX1Z8exbCztH39bBRfMj7h/kknA=

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;

s=s1024; d=yahoo.cn;

h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;

b=ecDykxGKo8m1G0KR1AlHuhFYQBVeNsLY96Bl2jJBpMK6tro0CvOkdy7aZs/jNuM7LsXSuZFoWU3D4nTdVEqDhqbBsYCcj2AHqiC1gjCNvvOyzNfnpr620CHs+HPUVFAjWKkbKbDaMzS3TwQALYlsVcE9XeW34pal5aXt5V9OA88=;

X-YMail-OSG: uhBNPeIVM1nfAzPklU81b2_j97tE1aXU3_33SzhWtSpkPB9

m2pkTU1N2VBU1II5bKV_st0_LUh1xyBgous8CWdrWvBB0uqphZ.dl3sk7hp0

3CDj1X5O8zNvYqG32mqYHEwrqQk8LAFklU1Ek1DBBvFHlJcVn8wZZ_sKIUU2

xB3vbLCSQR9isDLjkzRDTssfUuCK75A31n68xNm84W5zBhuft8MV5CrLeMmW

qwq5z5rVv3QXpVu5iPsFthMurjNRdwFjOTBQAl5.cQUaDXcjBHKtoAzhN7zR

9RjQkk9PiammEMY1XUxkO3BIi.euxzLuwV9DFIgehKuzNDqIfiqmLCklpgGC

XkQlWtxRdU4CXV38WNs6NIphvKU7Waak1qxZ.v.iHtmzc.jqXHnigou9Bw2J

N7REsSYwZY2gjL8OY6tez66BPkAG.CDdpgRJKGOTsCcdcmNnv6Pf4GIfZA57

CVjiEKKYmsNIsXw--

Received: from [41.155.38.70] by web92101.mail.cnh.yahoo.com via HTTP;
Mon, 15

Aug 2011 23:08:56 CST

X-Mailer: YahooMailClassic/14.0.4 YahooMailWebService/0.8.113.313619

Message-ID:
<[email protected]>

Date: Mon, 15 Aug 2011 23:08:56 +0800

From: =?utf-8?B?5p6X5a2m5pm6?= <[email protected]>

Reply-To: <[email protected]>

Subject: =?utf-8?B?5Zue5aSNOkFubmE=?=

To: <

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="0-2088920323-1313420936=:36479"

Return-Path: [email protected]

X-MS-Exchange-Organization-PRD: yahoo.cn

X-MS-Exchange-Organization-SenderIdResult: None

Received-SPF: None (AB-DC01.addabyggkjemi.local: [email protected] does
not

designate permitted sender hosts)

X-MS-Exchange-Organization-SCL: 5

X-MS-Exchange-Organization-PCL: 2

X-MS-Exchange-Organization-Antispam-Report:
DV:3.3.10412.477;SV:3.3.9010.377;SID:SenderIDStatus

None;OrigIP:203.209.230.50



Fra: ??? [mailto:[email protected]]
Sendt: 15. august 2011 17:09
Til:
Emne: ??:Anna



Dear



I want you to contact your Bank immediately and ask them to change the
Beneficiary name on the slip. The beneficiary name is supposed to be HE,
YU QIAN and not GLOBAL HOLDING GROUP CO. LTD our companies name. Please
make changes and resend the transfer slip to me so that I can contact
xxx and give her the telex release and also send the original copy of
the Bill of Lading to you.

Best regards


Anna Yu


------------------------------------------------


Received: from n6e.bullet.cnb.yahoo.com (203.209.230.50) by

(192.168.5.15) with Microsoft SMTP Server id 8.1.240.5; Mon, 15 Aug 2011

10:04:02 +0200

Received: from [202.43.217.102] by n6.bullet.cnb.yahoo.com with NNFMP;
15 Aug

2011 07:58:02 -0000

Received: from [203.209.250.223] by t2.bullet.cnb.yahoo.com with NNFMP;
15 Aug

2011 07:58:02 -0000

Received: from [119.42.242.53] by t2.bullet.mail.cnh.yahoo.com with
NNFMP; 15

Aug 2011 07:58:01 -0000

Received: from [127.0.0.1] by omp1002.mail.cnh.yahoo.com with NNFMP; 15
Aug

2011 07:58:01 -0000

X-Yahoo-Newman-Property: ymail-3

X-Yahoo-Newman-Id: [email protected]

Received: (qmail 67959 invoked by uid 60001); 15 Aug 2011 07:58:01 -0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.cn;
s=s1024; t=1313395081; bh=1q+ve9T0o/cRfKvH1RLwXDEctadJkDnExAnyQQ89/qA=;
h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=dQupLhySYLiWhjehjScD/vSCdGo701xyWg1R57bttWD8Gg0eL2F9sqhjs8RQJcamSjn8MlIJG3sB1bHXhNfxYEwVYFFehnHQHguknGn+t628pL+YCdoegLcSiOd6NbqoLacEEfRjgnunyKDQQDO/EnsKYAbHz2yi4XOhUsbcrDo=

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;

s=s1024; d=yahoo.cn;

h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type;

b=ZV21h9nSdF6spRQwY8LxDUPNAl9Fv2HS0ZdYbDaKZ1ARIVwax+HzH4C9RoZbal92xRdwQmab8gb6s9RAOG2Eb+eb0w0YVEkPBa7XcZnSrv4yZxjtqEICMqAHiQOp0Ntu74uu1bchJnwHZGHakjfvmUkW5TMas4+ZHMIIuCacJmc=;

X-YMail-OSG: Xk_cyFEVM1lZ7WewHZvXXcque6ukX4U.bUQ4F8mSHQEXiNz

YifpIRpV.xFJ1PlD64dP5cFz3MYCU.5wM3JXgrBni89Gxkt2etEHF.t50YwU

XA8g_okQiZgyT7xqYXYBHN0o7BpbHinIbov6w7oRurCm7CmixMFZH.iWXJDz

uyQUkP5SwLBFQhB_N75kK0NJDiVc7jmrSqU2LvnqgOUoPgyTcg_ap5mZcb_z

LyWKo8aXSRxxPHUZLnThyIjwS4grIMEZPYRVWSN4B5wCpMNeLC_6lwvxL0_g

FUdD9_5kwW6n3sONtnLxy5Co2J9DEl.DNhuZZk8HXFc_aUAdixiZHAbZBX.1

FNnuTGPurORJ4RPWILkTG_9sWYyw3lEGXEElb4NBdFwm_Asx6_YfjimEG1X9

WuPGDANfusMwt4_zW3S.6gFgIPICitL1PhwajTSLJh5BpDjGu_FSzp7zyZbq

XByM.jkhVX58jsA--

Received: from [41.155.38.70] by web92106.mail.cnh.yahoo.com via HTTP;
Mon, 15

Aug 2011 15:58:01 CST

X-Mailer: YahooMailClassic/14.0.4 YahooMailWebService/0.8.113.313619

Message-ID:
<[email protected]>

Date: Mon, 15 Aug 2011 15:58:01 +0800

From: =?utf-8?B?5p6X5a2m5pm6?= <[email protected]>

Reply-To: <[email protected]>

Subject: Confirm new bank details

To:

In-Reply-To:
<2EBCFE7BDBF4534DB4D4C67364E5090802446CA1126B@AB-DC01.addabyggkjemi.local>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="0-1407440890-1313395081=:65697"

Return-Path: [email protected]

X-MS-Exchange-Organization-PRD: yahoo.cn

X-MS-Exchange-Organization-SenderIdResult: None

Received-SPF: None (AB-DC01.addabyggkjemi.local: [email protected] does
not

designate permitted sender hosts)

X-MS-Exchange-Organization-SCL: 4

X-MS-Exchange-Organization-PCL: 2

X-MS-Exchange-Organization-Antispam-Report:
DV:3.3.10412.477;SV:3.3.9010.377;SID:SenderIDStatus

None;OrigIP:203.209.230.50



Fra: ??? [mailto:[email protected]]
Sendt: 15. august 2011 09:58
Til:
Emne: Confirm new bank details



Dear ,



Like i informed you last week, Our account department just contacted us
that our company account has been closed because another customer sent
fraud payment to our account so the bank is investigating the matter and
will take 31 days to finish investigation. So I do not want you to send
the balance payment to our company account which you used in sending the
deposit payment.

They have approved a subsidiary account for you to use in sending the
remaining balance payment since our companies account has been placed
on closed. Below is details of our companies subsidiary account and I
want you to take note of the account so that payment will not be sent
to a wrong account or our company account that has been closed so you
have to inform your financial manager as soon as he gets back today.



BANK NAME: THE HONG KONG SHANGHAI BANKING CORPORATION LIMITED
BRANCH ADDRESS: SHOP 36-5, LEVEL 3, OCEAN CENTRE HARBOUR CITY, KLN,
HONGKONG
SWIFT CODE: HSBCHKHHHKH
ACCOUNT NUMBER: 053273108833
BENEFICIARY NAME: HE, YU QIAN
BENEFICIARY ADDRESS: BAI YUN QU SAN YUAN LI DA DAO ZHONG HE YI JIE 10
HAO, GUANGZHOU, P.R. OF CHINA



I want you to acknowledge the receipt of our companies subsidiary
account as soon as you receive it and i want you to have the remaining
balance payment transferred this week as soon as your financial manager
get back into our subsidiary account as stated above since our companies
account has been closed because another customer sent fraud payment to
our account so the bank is investigating the matter and will take 31
days to finish investigation.



Thanks in advance.

Best regards


Anna Yu

Room 1908,Oujiang Building
310018 Hangzhou

Zhejiang,China
M:+86-1582419 4993
T:+86+571+86925060
hzanyang.en.alibaba.com
http://www.hzanyang.com
Room 1908,Oujiang Building
310018 Hangzhou

Zhejiang,China
M:+86-1582419 4993
T:+86+571+86925060
hzanyang.en.alibaba.com
http://www.hzanyang.com


T:+86+571+86925060
hzanyang.en.alibaba.com
http://www.hzanyang.com




Received: from n1a.bullet.mail.cnh.yahoo.com (203.209.250.182) by

(192.168.5.15) with Microsoft SMTP Server id 8.1.240.5; Fri, 5 Aug 2011

15:46:49 +0200

Received: from [203.209.250.223] by n1.bullet.mail.cnh.yahoo.com with
NNFMP;

05 Aug 2011 13:46:44 -0000

Received: from [119.42.242.52] by t2.bullet.mail.cnh.yahoo.com with
NNFMP; 05

Aug 2011 13:46:44 -0000

Received: from [127.0.0.1] by omp1001.mail.cnh.yahoo.com with NNFMP; 05
Aug

2011 13:46:44 -0000

X-Yahoo-Newman-Property: ymail-3

X-Yahoo-Newman-Id: [email protected]

Received: (qmail 38355 invoked by uid 60001); 5 Aug 2011 13:46:44 -0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.cn;
s=s1024; t=1312552004; bh=fuTBxoPwoonz9taRZEnM+Nq9KzE3co7rCpnoPUwOrD8=;
h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:Cc:MIME-Version:Content-Type;
b=dqtNKI+c2G/rnyAdwx2k7ad0k7cx8ImZIcsjyJYQOkBstK8mlmqRKtfPbIZ7/DA1RXLfxDDZCH+DVgKAVBt2u9IyZ7hkjDlS4tSeLDUUZ46XtazKKCn075IHElnAp/03luHslSxr611SXLowZHgTi+aP9PhOUtozM0cqoetI8ws=

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;

s=s1024; d=yahoo.cn;

h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:Cc:MIME-Version:Content-Type;

b=sf45iXLsDME4e343nt0gsrPcjbKiBDaK7BpY+oXlp9qKcT9Suf02ynjI5hIcBhzSOMNXgN8o3cEU5GUCzlpWMzmIv0KH7hnBDuAS9NAP5zMr2Lm1N5NSzFqENu3fYjAElccABVF9NVn6qPLKfnJFoTnLn7qgU7TRWZQoQmzcU5Y=;

X-YMail-OSG: RXw3zToVM1mbkRra5yiuY7Bj8hiB4svQ_mqbQnnoRaAcFX_

l.qS8knbOiwDqj9hZo.K2_.CLcI50P4HBaqHEZm0Rgyge43tleVScSfA1hRF

qI2Q5VSlnjHg5_5mNfeUejtFNiFahm0Ie_bxJKugeHw1B09eD7mklGpb6pEY

Zie1NArDtlq8v7jfItmfRyrQIIi.VTK7QK7IX8qzHu9DTXw3pvnA8vbY41zT

iHIXx.JmpSPPoRMGyuY_yhYfJZcb.p22XHp8i6iHFnnYyNmrNu3BvzyBUKEn

PxkBAefK5uIH0fxIYCwHicHflB0olfhCOeiacohvzGc317a.G29FaBGLAwAs

JdUCw8WaIxVW5bWv.QFmawxhkNcjNBFWq0FDBlhUf..1ktDYCYcDz98hgCuj

Gy2MUrUaZu9r6l2iokkFYMhMDkgd1u6BUyFzbNxP2.tsjKCvkVALMlrbEUg1

VV9N4uRLxkpfy.A--

Received: from [41.155.8.114] by web92107.mail.cnh.yahoo.com via HTTP;
Fri, 05

Aug 2011 21:46:43 CST

X-Mailer: YahooMailClassic/14.0.3 YahooMailWebService/0.8.113.313619

Message-ID:
<[email protected]>

Date: Fri, 5 Aug 2011 21:46:43 +0800

From: =?utf-8?B?5p6X5a2m5pm6?= <[email protected]>

Reply-To: <[email protected]>

Subject: Change of bank details

To:

CC:

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="0-8931653-1312552003=:38213"

Return-Path: [email protected]

X-MS-Exchange-Organization-PRD: yahoo.cn

X-MS-Exchange-Organization-SenderIdResult: None

Received-SPF: None (AB-DC01.addabyggkjemi.local: [email protected] does
not

designate permitted sender hosts)

X-MS-Exchange-Organization-SCL: 0

X-MS-Exchange-Organization-PCL: 2

X-MS-Exchange-Organization-Antispam-Report:
DV:3.3.10404.463;SV:3.3.9010.377;SID:SenderIDStatus

None;OrigIP:203.209.250.182





Fra: ??? [mailto:[email protected]]
Sendt: 5. august 2011 15:47
Til:
Kopi:
Emne: Change of bank details



Dear ,


Our accountant just informed us that our company account has been
closed because another customer sent fraud payment to our account so the
bank is investigating the matter and will take 31 days to finish
investigation. So I do not want you to send the balance payment to our
company account which you used in sending the 30% advance payment
because our company account has been closed.


They have approved a subsidiary account for you to use in sending the
balance payment for your order because our company account has been
closed. Below is the details of our companies subsidiary account which
you will use in transferring balance payment for your order which i have
also revised on the proforma invoice.


BANK NAME: STANDARD CHARTERED BANK(HK) LTD.
BRANCH ADDRESS: 617-623 NATHAN ROAD, MONGKOK, KOWLOON, HONG KONG
SWIFT CODE: SCBLHKHHXXX
ACCOUNT NUMBER: 57019854444
NAME OF BENEFICIARY: XU, JIA YU
BENEFICIARY ADDRESS: RM 402, DA TANGJIE 108, GUANGZHOU, P.R. OF CHINA


I want you to acknowledge the receipt of our companies subsidiary
account as soon as you receive it which you will use in transferring the
balance payment for your order since our companies account has been
placed on hold. Also email me a copy of the swift confirmation as soon
as you send the balance payment to our companies subsidiary account.


Please understand me.Thank you !
Looking forward for your confirmation !

Best regards


Anna Yu

Room 1908,Oujiang Building
310018 Hangzhou

Zhejiang,China
M:+86-1582419 4993


---------------------------------------------------------------


Received: from n1a.bullet.mail.cnh.yahoo.com (203.209.250.182) by

(192.168.5.15) with Microsoft SMTP Server id 8.1.240.5; Wed, 17 Aug 2011

12:28:12 +0200

Received: from [203.209.250.223] by n1.bullet.mail.cnh.yahoo.com with
NNFMP;

17 Aug 2011 10:28:13 -0000

Received: from [119.42.242.52] by t2.bullet.mail.cnh.yahoo.com with
NNFMP; 17

Aug 2011 10:28:13 -0000

Received: from [127.0.0.1] by omp1001.mail.cnh.yahoo.com with NNFMP; 17
Aug

2011 10:28:13 -0000

X-Yahoo-Newman-Property: ymail-3

X-Yahoo-Newman-Id: [email protected]

Received: (qmail 34572 invoked by uid 60001); 17 Aug 2011 10:28:12 -0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.cn;
s=s1024; t=1313576892; bh=qGErc9Nc9tUCF2a1Orzxz4vX6QXI5iLgFpuzAijjbk8=;
h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;
b=cUbyCZ2rFU8M+iHVdb3DVOhqDrx1QdrUD/S6Dnql+CZsS3PKxnKObB8A2pGU/CXrZlTQF033qck6HFZBZn4nfqoTBGlxOvByEqRs/e1l/YHIJdYDAy1PAZ6akY7L8P9lbnpZFST3yJpXomaykahLrTCRIgJL96jodSEFqGfd9oM=

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;

s=s1024; d=yahoo.cn;

h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;

b=WcnS2UnjuWS+bnLy81v/CXXetDI5XKR2WsOWvZOoTqL9HrTTNBZJlXkvPlBRO9ofzpl0D0OdPyT1BcrEmVPxA+ibVtMWtU5WfOVdVgwVqrPaa8dLtkSHnnT8JgvSnW39X52to4JZmklUHFZeS2fQ/6iAI/sSxfRZGWZ/nLWw/xM=;

X-YMail-OSG: gm564v8VM1kswYTmkREGpceo_52AFPruFmefs5pflq4.ciy

PNtbX0KgfpKNFYXW7Khf3MNErnL4TZAmXnl82ePApXrNiNBX9XF_UKp1Nevf

1Jvtzdxe1ectKjYnXEkWRm5oGuoTDyD7Q_gvNNNve1llnv41TdRbPEDlw3NI

I083zWLV8lHLk._fVumkM9D5n39eGpcg5oiyQd_Fda1FtB1pHUWU2hKBjKBg

w8LZZtECPjX2eX3JS4CTLAVZklY.XCZDZ8R.4jDr8dE8.jwVVdG2M3Q5Z1Bk

PW4N5tE4tXUKQN7QrKjqZ7WhNb_tORSzl3RbE0XDVc36AVxHlWcY_IjxKr3C

g6X01bKN7M4prNbdSJSD28pVwzNli1WWCSGuj5H_SD1eK8jL9dx1.00I6DY5

.HAXQYubbY27qMgrdqwLHxtxuYlxAZbvbN.lDrq.H.Fi3SxRshMyOGvCU9p0

x2ZTRLfSut55sBhM-

Received: from [41.155.33.160] by web92108.mail.cnh.yahoo.com via HTTP;
Wed,

17 Aug 2011 18:28:07 CST

X-Mailer: YahooMailClassic/14.0.4 YahooMailWebService/0.8.113.313619

Message-ID:
<[email protected]>

Date: Wed, 17 Aug 2011 18:28:07 +0800

From: =?utf-8?B?5p6X5a2m5pm6?= <[email protected]>

Reply-To: <[email protected]>

Subject: SV: Response needed

To:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="0-1398147865-1313576887=:29714"

Return-Path: [email protected]

X-MS-Exchange-Organization-PRD: yahoo.cn

X-MS-Exchange-Organization-SenderIdResult: None

Received-SPF: None (AB-DC01.addabyggkjemi.local: [email protected] does
not

designate permitted sender hosts)

X-MS-Exchange-Organization-SCL: 1

X-MS-Exchange-Organization-PCL: 2

X-MS-Exchange-Organization-Antispam-Report:

DV:3.3.10416.480;SV:3.3.9010.377;SID:SenderIDStatus

None;OrigIP:203.209.250.182



Fra: ??? [mailto:[email protected]]
Sendt: 17. august 2011 12:28
Til:
Emne: SV: Response needed



Dear ,



It is easy to resolve the issue. All your finance manager have to do is
contact your Bank and tell them to contact THE HONG KONG SHANGHAI
BANKING CORPORATION LIMITED via fax, email or anyway they can contact
them and inform them of the change in beneficiary name to HE, YU QIAN
which i believe would be the easiest way because if the beneficiary name
is not correct the Bank will not release the money because the name used
to set up our subsidiary account by our agent was not GLOBAL HOLDING
GROUP CO. LTD so the bank might think the money is not for us and place
it on hold until your Bank contact them to release the money into HE, YU
QIAN account with the same account number and details i gave to you.


Note that if we do not get any response from you, we won't send the
Telex release to xxx or send the original copy of the Bill of lading
to you until the beneficiary name on the transfer slip is changed to the
name i gave you when emailing our bank details to you. Because without
the beneficiary name, the bank will not credit our subsidiary account
with the payment until the error is fixed and after changing the
beneficiary name to the name i gave to you on the bank details we would
need a confirmation from your bank showing that the beneficiary name has
been changed.


Best regards


Anna Yu

Room 1908,Oujiang Building
310018 Hangzhou

Zhejiang,China
M:+86-1582419 4993
T:+86+571+86925060
hzanyang.en.alibaba.com
http://www.hzanyang.com


T:+86+571+86925060
hzanyang.en.alibaba.com
http://www.hzanyang.com

Sendt: 5. august 2011 15:47
Til:
Kopi:
Emne: Change of bank details

This is the first email when the fraud started.

Samples were sent and tested.

Have the scammers really invested in some samples to make it all the more believable?
Normally they just demand advance fees.

Is the CHN company all mugu-made? Or has a mugu impersonated the middlewoman from one point on? I guess rather from the start, right? Real company in CHN and mugu impersonates the Anna-person via yahoo.com?

Where was the sample sent from? China or 9jaland?

Mail sent 22. August 2011

Received: from n2b.bullet.cnb.yahoo.com (202.43.216.212) by xxxx
(192.168.5.15) with Microsoft SMTP Server id 8.1.240.5; Mon, 22 Aug 2011
07:48:18 +0200
Received: from [203.209.230.74] by n2.bullet.cnb.yahoo.com with NNFMP; 22 Aug
2011 05:48:43 -0000
Received: from [203.209.230.76] by t4.bullet.cnb.yahoo.com with NNFMP; 22 Aug
2011 05:48:43 -0000
Received: from [127.0.0.1] by omp105.mail.cnb.yahoo.com with NNFMP; 22 Aug
2011 05:48:43 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 59659 invoked by uid 60001); 22 Aug 2011 05:48:43 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.cn; s=s1024; t=1313992122; bh=jRvnhhCJmAMz0cWFhi4q9sK6YdDLgOBmGHz/R/6U7/8=; h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=WxgrJfHEd0hukz42NSwxxmoKamnoV7IgrPQnKfjV+DHWIFHyAV1ah6PBNIyCHXfFNJwFFNP3jvvUs3VIW/OoQhd9PQc5IDV66evQV/WGQrm+1wr6bdV8b0n6jVCkva/1Wo0ejmjh6pfT855kL7gJtbqMxMlvUDpNaFaVg80Xctg=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.cn;
h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;
b=IYoPQSqReZdOJZaF0vU2Y8TnrD9bUB8dxDQHhFITiQfp2nhWUbxHRihJd0InxiGK1MqZzLikIC/giFRL6sbUn07GgcvpIMBuQukuxrfV4jIK3VgzQQcZWI98SBi+XRmbQyAjYzdjaluexogX27Dfk2OmmxZEvkWBrkbzQc5F6oc=;
X-YMail-OSG: zOVA.RcVM1lgdsgbWq0pjdMD8Qc_s2Ki6bwSwcuf0XeMFwl
1M3ddnxTMBuUPJXA4Ej34DiL9R7L82pWmiIaFAFbV1JXiMjAgPrAokI4nMcA
BCqnQpDZjX53uAw8OBVyOn3_MuidUne4xNgfxsZE1PjfqEC2K6rRO8vPOuRt
peVtXVjUi0zlCDlwDxPn2M..N2cENrLF11gK9Gc47Ci9ah3p.DZJeo3LgX4x
k1jnEVyEMmjylhkBbkIRVB3tWwxji3gkZ2YWPApcQgeaUoT6q7fjDSHqkrmX
26oKxiMxgRqDvmTZ7bNjMP.FF4zvnesj_hCoj.gJyHtQO6KAuWMPBDSJS4sR
ZkUcNIzCbQm8w8nuFM_0U_IkuzXsKLq.NLSUoeSlug65qz1Q_O_8GpbMYWx0
F1N7XZ_qyIbfL.SOEW4DvdqW.EPdSJxhp6uJdqkhf4SsAhQHF2tN_0p5CsQE
6tACVIhM9mA2fi88-
Received: from [41.155.70.69] by web15807.mail.cnb.yahoo.com via HTTP; Mon, 22
Aug 2011 13:48:42 CST
X-Mailer: YahooMailWebService/0.8.113.313619
Message-ID: <[email protected]>
Date: Mon, 22 Aug 2011 13:48:42 +0800
From: Anna Yu <[email protected]>
Reply-To: Anna Yu <[email protected]>
Subject: Confirm receipt
To: "xxxxx" <xxxxxxx>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="0-1717220859-1313992122=:59274"
Return-Path: [email protected]
X-MS-Exchange-Organization-PRD: yahoo.cn
X-MS-Exchange-Organization-SenderIdResult: None
Received-SPF: None (xxxxxxxxxx.local: [email protected] does not
designate permitted sender hosts)
X-MS-Exchange-Organization-SCL: 5
X-MS-Exchange-Organization-PCL: 2
X-MS-Exchange-Organization-Antispam-Report: DV:3.3.10421.494;SV:3.3.9010.377;SID:SenderIDStatus
None;OrigIP:202.43.216.212

From: Anna Yu [mailto:[email protected]]
Sent: 22. august 2011 07:49
Til: xxxxxxxx
Subject: Confirm receipt

Dear xxxxxx,

I want you to kindly confirm from your finance manager if the Bank of America have acknowledge the receipt of the swift message sent by your bank in regard to the change of beneficiary. I want you to let me know and inform your finance manager to contact your bank and request for a copy of the swift message sent to Bank of America for them to change the beneficiary name as proof so that we can send the Telex release to Karen today to avoid delay.


Waiting for your soonest reply.

Best regards

Anna Yu
Room 1908,Oujiang Building
310018 Hangzhou
Zhejiang,China
M:+86-1582419 4993
T:+86+571+86925060
hzanyang.en.alibaba.com
http://www.hzanyang.com

Johann Meister wrote
Is the CHN company all mugu-made? Or has a mugu impersonated the middlewoman from one point on?

We believed that the China Comp. is real. Then this middlewoman is based in our country she speaks both Chinese and the other language. She told our CEO that she had been in the factory and assured us that the quality of the goods we are expecting will be personally Quality controlled by her.
Pictures were sent to us regarding the goods they were loading in the container. A full container with our company names on the boxes. (Yes I know pictures can also be manipulated.) 30% of the total cost was demanded. Bank account number was recieved and we promised to pay. Due to our liquidity policy, we waited to pay the 30%, then we recieved an email from [email protected] who told us to change the benificiary of the money. In good faith, we did just like they told us to do. Now, our Accounting Mngr. made some mistakes of what was instructed. So the transfer did not pushed through.
Then we recieved another email fom [email protected] telling us that they did not instructed us to use another bank account.

This was difficult for us to understand to begin with that maybe a mugu intercepted the deal and hacked the real Anna's yahoo account.

Now we don't know anymore if Anna is real or a mugu, right from the very start. When they are using the same email address. Is it possible that different people have the same email address?
We could have paid more to the mugu if we did not investigated the IP's of the emails. Luckily we have learned how to locate the IP. Better late than never

If you have not already reported this to law enforcement in your country, it is important that you do so, especially since there is a possibility that there is an accomplice who is in their jurisdiction.

That´s true, maiblomst. The Chinese person in your country is either a willing accomplice or a "job scammed" one who nevertheless helps criminal activities.

So the container came from China (says the postage stamp?). So Anna, if she´s a real female and not the Nigerian scammer right there in China himself, is a Chinese accomplice then.

Well...how much they ever migh thave paid for the sample and shipping it would almost have been a good investent

Edited to add.

We are also afraid that we can get an empty container. We are the one who will be paying the frieght. So a mugu can send and empty container and demand the payment before costums inspection. Because that is the deal.

Ah I see. So maybe shipment plus then "customs or release fees", which might have happened on top of the bank account scam attempts. So they have possibly never planned to send anything. I misunderstood you about that, I thought you had already received a container with a product sample, THAT would have been out of the ordinary in my opinion.

I think the HGK bank accounts prove there are accomplices there or girlfriends or another money washing mule besides the one in your country.

"Anna" has always been an advance fee fraudster persona and they tried to scam you and certaily other compoanies in your line of work by demanding upfront money for samples that only ever existed in the photos!The Chinese company if it is real was merely impersonated by the yahoo-Anna with the 41.-IP.
At least that´s my idea of the whole thing. That would be a pretty common AFF scam scenario : Companies/individuals being scammed by advance-demanding money for goods that only ever existed in doctored pictures.

I thought you had already received a container with a product sample

We recieved the samples about 4 months ago. It was a sample for free about 50 kgs not a full container.
Then after that we decided to order the kind of product we are interested in. The deal is EX works and EX freight. A full container via HOEG; freight.

This problem is just making us sleepless. Below is the letter of the real Anna sent to our CEO. Forgot to get the header but we located the IP while I was at my CEO’s office and this is from the original Anna. I will post the IP as soon as my Boss comes back from some meeting outside our vicinity.

From: ??? [mailto:[email protected]]
Sent: 24. august 2011 11:06
To: xxxxxx
Emne: Urgent: Anna

Dear xxxx,

It’s a long time we have not contacted.

One disturbing thing happened on last week. I think you have known it. One cheater sent emails to xxxx through my post and another post he applied which is very similar to mine, that is [email protected], while my post is [email protected]. All the mails to xxxx are about to change bank information to do payment to the cheater. I got the only one mail and also the last one sent by xxxxx and found he was cheated. I was very anxious at the time and told xxxxx immediately.

You must be very angry with it. But thing has happened. We must solve it. Last week, my manager Mr Lin sent emails to you and xxxxx to apologize for this matter. We are waiting for your bank’s news on whether the payment can be back. However, from last Friday til now, I have not got any mails from your company even if I contacted with xxxxxx several times. Could you give me an explanation? I swear we have done all we can on this matter but failed! The Chinese police didn’t accept our case. I am very sorry for that.

Our container has arrived at xxxxx for nearly ten days. If we don’t make more communications to solve this matter, there will be many problems, including most loss!

I am waiting for your news or xxxxx’s reply to continue our conversation.

Best regard
Anna

Best regards

Anna Yu
Room 1908,Oujiang Building
310018 Hangzhou
Zhejiang,China
M:+86-1582419 4993
T:+86+571+86925060
hzanyang.en.alibaba.com
http://www.hzanyang.com

The ugly mugu is very persistent and very angry that xxxxx made a mistake.


Received: from n6g.bullet.cnb.yahoo.com (203.209.230.67) by xxxxxx
(192.168.5.15) with Microsoft SMTP Server id 8.1.240.5; Wed, 24 Aug 2011
13:47:11 +0200
Received: from [202.43.217.102] by n6.bullet.cnb.yahoo.com with NNFMP; 24 Aug
2011 11:47:02 -0000
Received: from [203.209.230.75] by t2.bullet.cnb.yahoo.com with NNFMP; 24 Aug
2011 11:47:02 -0000
Received: from [127.0.0.1] by omp104.mail.cnb.yahoo.com with NNFMP; 24 Aug
2011 11:47:02 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 70890 invoked by uid 60001); 24 Aug 2011 11:47:02 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.cn; s=s1024; t=1314186422; bh=UzhwukQRDJ8eS7oazOPtwUIReukpnzaRZs04/+fGLyk=; h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=TQTLB7Aur3/dq27H//MHb5OKISIe71Kr0A9aOcJFOhN03i8tWqoFdxV4L8kY1nLIJMqJFXLUikHK+yKLFsiZeZrXW/sO9xNad0YBdcn0Erar2qlH+SAbTlmJn2FlPEZTe1X4C1AFtfNs0vCFER4GnpOWOiwDNZwsh+lD0sFyHRI=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.cn;
h=X-YMail-OSG:Received:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=Uv2xJVy+7c+gfafkcQOTFo8+/VxDdouvXPPk7Uu2w5SpRjGC0cSq6pIdQc3jJDbMicQsIwIkgD32CeS4FQeQUZDNyI7+6c5PyZDcjxKFxQlzsXkypd+PGA0mlFeVUe9YOcs/xYX9plY4Eu5uewzcnVdxGjX4ik1fIgcgTTuN3MU=;
X-YMail-OSG: C6qHX30VM1kq3HjTaV0c0j.ppppbQ7CIy5vkKenu88PKRkg
NELz7N_vdA3suiQ4zBHBPCP0KRoqvYScHrUs7j03Ru05cZehionTUtrIMF6k
NOJnpW07gy6oNiUP08udZtjCVcZUDKXzcpILRLeJZILKQixDL4.wb.vUsFj1
UqMVpgnyL.H_AtG3vnvFJ4GOe8x_SEDXQlbbo9fhsoQucUsvItdRhHdxMirz
QrKEyuo9WBmfMPq81LYeJ3_zNaRAB3aYrln8ljsJR9briA2SyG5wFW1WBPfM
vUDrDd0a97svArysgnjDVNn_bgofYJ1cH5b8Wk4p1ibLRJhLomQienPIjASq
pv85DmWTxjHN2M01N617sT848jr.jq4MNko9Q_bxIXXfMtLExtA4nf0km6Ok
QQHc76OVhR2rrAoYLn33oqk3YL_Yly3PlgE0ZjaVGeMOPBPciXhvHwz2a3VH
MKGeTVsgwz0NGgg--
Received: from [41.155.92.5] by web15801.mail.cnb.yahoo.com via HTTP; Wed, 24
Aug 2011 19:47:02 CST
X-Mailer: YahooMailWebService/0.8.113.313619
References: <[email protected]> <2EBCFE7BDBF4534DB4D4C67364E50908024479F01F43@AB-DC01.addabyggkjemi.local>
Message-ID: <[email protected]>
Date: Wed, 24 Aug 2011 19:47:02 +0800
From: Anna Yu <[email protected]>
Reply-To: Anna Yu <[email protected]>
Subject: =?utf-8?B?5Zue5aSN77yaIFNWOiBSZXNwb25zZSBuZWVkZWQ=?=
To:xxxxxx
In-Reply-To: <[email protected]
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-35836367-1314186422=:70821"
Return-Path: [email protected]
X-MS-Exchange-Organization-PRD: yahoo.cn
X-MS-Exchange-Organization-SenderIdResult: None
Received-SPF: None (xxxxxxxx: [email protected] does not
designate permitted sender hosts)
X-MS-Exchange-Organization-SCL: 5
X-MS-Exchange-Organization-PCL: 2
X-MS-Exchange-Organization-Antispam-Report: DV:3.3.10423.488;SV:3.3.9010.377;SID:SenderIDStatus
None;OrigIP:203.209.230.67

From: Anna Yu [mailto:[email protected]]
Sent: 24. august 2011 13:47
Tol: xxx
Subject: ??? SV: Response needed

Dear xxxx,

Due to the problem with the Beneficiary name, our subsidiary bank has refused crediting our account with the payment so they suggested your bank calls back the payment and resend it. I want you to contact your finance manager to immediately inform your Bank for them to send a swift to your corresponding Bank of America to call back the payment immediately. And I want you to let me know once the payment is in your company account so that i can provide our other company subsidiary account which you will use in transferring the payment and I do not want you to make any mistake in the new bank details that you will use in transferring the payment after it has been called back into your companies account.

Waiting for your soonest reply.

Best regards

Anna Yu
Room 1908,Oujiang Building
310018 Hangzhou
Zhejiang,China
M:+86-1582419 4993
T:+86+571+86925060

hzanyang.en.alibaba.com
http://www.hzanyang.com

We still haven't heard the final report from our bank regarding the final cancellation of the money.
Hope the mugu will not be able to get hold of this money.
Due to economic crisis going on. We are very careful with our liquid assets. So a US$20 000 is very hard burden and difficult to swallow to our economy.

We are going to make a report to the police regarding this matter tomorrow. We are just trying to gather all the necessary papers before we can make the move.

Anyway, the whole Managerial Board are now very good in finding the sender's IP
We never thought about these things could happen to us.

An impostor sending a letter to Anna.
with a yahoo email of our Purchasing Mngr.
We never use free email addy when we communicate with our business connections.


Anna 2011?8?24? ????7:52
"xxxxx" <[email protected]>
"[email protected]" <[email protected]>
Dear Anna,
I was informed this morning by our finance manager that the payment was not transferred by our bank on Monday because of the Bank holiday in our country which would last till Thursday and the Bank confirmed that the payment would be transferred after the bank holiday.( Mugu! You have to google the holidays in my country! We don't have a 4 days holiday in August!)
I am very sorry for the delay in transferring the payment and promising that payment will be transferred right after the bank holiday.
Waiting for your reply.

Best regards
xxxxx

Nobody blames you you´ve done so exceptionally well
I think it´s a common scam. Nigerian imposter pretending interest in a seller´s/company´s product, making a too good to be true offer and then demanding advance fees. Happens with electronic goods all the time but in fact this scam "works" with any kind of branch Many examples here on SW.
Looking forward to any update of the situation. Hope you get all your money back, even if your bank wants some fees for retrieving it, that´s better than losing it all! Seems the contact person in your country might (MIGHT. I´m only guessing.) check out a number of local companies and then forward them to the real mugu for a business offer...don´t know. Or it was just the usual massmail shattergun approach and you happened to reply favourably from the scammer´s point of view.
I am afraid any business that has an online presentation sooner or later gets such scam offers anyway.
And I doubt that they ever intended to send you anything! At best, it would have been "sent" through a fake shipping site. (Also very common for them to operate a fake site to appear more believable.)
Anyway, looking forward to any updates and thanks for sharing this important scam info.
PS. Please don´t bait your own scammer.

PS. Please don´t bait your own scammer.

Never! Or else many will nail me!