control of a Hotmail account.

This one's a bit strange, and I have no experience with this type of scam,
Late last week I received an e-mail from what I thought was an old friend
In Sydney. BUT it was titled HALLO. Which this person would never use
On reading the e-mail it was clear it was not him.
This is his e-mail. I have permission from him print his name and e-mail address,
as this is important.

-------Original Message-------

From: Removed
Date: 6/11/2009 12:43:09 AM
To: Removed
Subject: HELLO,

Hi
Glad to reach you via email with the hope that everything is working fine for you and I'm sorry for not letting you aware that I'm currently on a trip to England for a seminar,Unfortunately I misplaced my wallet where my money and other relevant document where kept on the way to my apartment and I'm sending this message to you with inconviniency cause I need your ugent assistance with a loan of 1,500 British pounds to take care of my self on feeding and get myself back home as soon as possible.I will appreciate whatever you can provide to assist me out of my troubles; I’ll pay you back as soon as I returned home, So please kindly let me know if you can help me So I can send you details to transfer the loan as soon as possible.

Removed

Headers.

MIME-Version: 1.0
Received: by 10.150.201.3 with HTTP; Fri, 6 Nov 2009 02:55:44 -0800 (PST)
Date: Fri, 6 Nov 2009 21:55:44 +1100
Delivered-To: me
Message-ID: <[email protected]>
Subject: HALLO
From: my e-mail address.com>
To: Removed@hotmail.com
Content-Type: multipart/alternative; boundary=000e0cd6b28684f4810477b1af3a

--000e0cd6b28684f4810477b1af3a
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

I phoned my friend, to be told that some weeks ago, he got an e-mail, from Hotmail,
Asking him to up-date his e-mail account, and would he please provide his e-mail
User name and password,, which he did.. Consequently this person now has his
Address book.
He now has no control over this account, and all his mail goes to this unknown person.
On my advise he has now Changed his e-mail address and informed every one about
the change, and not to use the old Hotmail account. I have requested he does not
Cancel the old account. And have his permission to print it in full here.

I replied with a short note, again using his old Hotmail account address

G'day Removed,
So sorry to hear about your problem, please send me your contact details ,
And I will see what I can organise to get you home

I then checked with my friend and he has not received this e-mail, So the Scammer
is controlling the account. And any mal, for his address, now goes to the Scammer
FIRST
This was his reply

Thanks for your concern ,Kindly use my address below to transfer the fund via western
union or money gram and I will be glad to received the money as soon as possible today so I can
start making arrangement on how to get my self back home.

Receiver's Name: Removed

Address:
12 Hagley Road, Birmingham B16 8SJ, England
Waiting for the western union transfer details as soon as the transaction has been done.

With kind regards, Yours sincerely.

R

Headers,

Received: by 10.150.201.3 with SMTP id y3cs119091ybf;
Fri, 6 Nov 2009 04:31:30 -0800 (PST)
Received: by 10.204.156.25 with SMTP id u25mr4529439bkw.129.1257510689365;
Fri, 06 Nov 2009 04:31:29 -0800 (PST)
Return-Path: <[email protected]>
Received: from blu0-omc4-s34.blu0.Hotmail.com (blu0-omc4-s34.blu0.Hotmail.com [65.55.111.173])
By mx.Google.com with ESMTP id 28si89406bwz.17.2009.11.06.04.31.28;
Fri, 06 Nov 2009 04:31:29 -0800 (PST)
Received-SPF: pass (Google.com: domain of Removed@hotmail.com designates 65.55.111.173 as permitted sender) client-IP=65.55.111.173;
Authentication-Results: mx.Google.com; spf=pass (Google.com: domain of Removed@hotmail.com designates 65.55.111.173 as permitted sender) [email protected]
Received: from BLU133-W12 ([65.55.111.135]) by blu0-omc4-s34.blu0.Hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Fri, 6 Nov 2009 04:30:33 -0800
Message-ID: <[email protected]>
Return-Path: Removed@hotmail.com
Content-Type: multipart/alternative;
Boundary="_ab5e2800-d57e-48e3-8aa6-85863c1dc675_"
X-Originating-IP: [172.190.214.134]
From: Robert <Removed@hotmail.com>
To: <me me me .com>
Subject: RE: HALLO
Date: Fri, 6 Nov 2009 12:30:34 +0000
Importance: Normal
In-Reply-To: <[email protected]>
References: <[email protected]>
MIME-Version: 1.0
X-OriginalArrivalTime: 06 Nov 2009 12:30:33.0801 (UTC) FILETIME=[EF88B390:01CA5EDC]

--_ab5e2800-d57e-48e3-8aa6-85863c1dc675_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

If anyone gets this sort of request, from an ISP, or an e-mail provider.
DO NOT DISCLOSE YOUR PERSONAL DETAILS. YOUR provider already has them.
Or knowns where he can find them in there system. I got the original e-mail
Simply because the Scammer had control of my friends address book. He also
Now controls the e-mail address

I have removed your friends details from the post, there is no need to keep them in there and they may lead to your friend.

You may recall seeing emails that are supposedly from an email provider asking for you to confim your password and other details, much the same as a bank phishing email, this is what happens after you give a scammer your email password.

The scammer will begin contacting your contact list and telling them about problems that require money to be sent urgently.

Please contact your friend and if he still has access to the email address he should immediately change the password and explain to his contact list that he is OK and not to send money.

If he does have access he should contact his email provider and advise them of what has happened and ask them to reset the password for him.

I will check in a moment but I presume the headers will point to Africa

Address given by scammer is Birmingham Marriott Hotel Birmingham, 12 Hagley Road, Five Ways

http://www.smoothhound.co.uk/a60954.html

Thanks for all the help and info,

As far as that address goes, my friend considers it dead and had now got himself a new address

I've run the address through Google earth, and that address is a building site..