Help with car classified scam.

EDIT: I talked to the REAL krisha, she is just as much of a victim in this whole scam as me, so when you read this, please understand that everything i wrote was from before i knew how she was involved. also, i suspect audrey has nothing to do with the scam other than the scammers used her info. the real thieves are most likely in Nigeria as almost all of the emails except the first few were traced back there.


Hi guys, my name is chris.
I need help figuring out if i have been scammed or not, if so, it's either a pretty intricate plan done by several people, or a very foolish one done by one person. either way, i sent them $250 for a deposit, and havent heard a word from them since, well, heres what happened.

I logged on to http://www.thesamba.com to look for an old vw bus to buy. I found an ad for a 78' vw bus, located in anderson indiana. i dont have the original ad because the site admin took the ad down after i reported it. but basically it said the basics, the bus ran, it needed a muffler, brakes and a front tire. it had 2 crappy pictures posted of it .i responded to the ad in an email.

"hi, saw your ad on the samba for a 78 bus. i was wondering if you could send me some more pictures of it.
Also, is it in driving condition? or would i need to trailer it home? i live near grand rapids MI so it's a good 8 hour trip.
thanks,
Chris xxxxxx (family name removed) - Michelle"

She responded
from k*******[email protected]

Hi Chris,
just read your email,the van is in perfect condition.Drove it to East hartford, CT for my late husbands funeral.How soon do you want the van? my son can drive to your location.
Thanks,
Krisha.
Along with this email she attatched 3 pictures. here is one of them

here is the EXIF data from that image
Exif IFD0

* Image Description = VLUU L200 / Samsung L200
* Camera Make = Samsung Techwin
* Camera Model = VLUU L200 / Samsung L200
* Picture Orientation = normal (1)
* ? (0x0000) = 0x00,0x00,0x00,0xd6
* Y-Resolution = 72/1 ===> 72
* X/Y-Resolution Unit = inch (2)
* Software / Firmware Version = 812061
* Last Modified Date/Time = 2009:08:12 16:53:48
* Copyright Owner = COPYRIGHT, 2007

So i believe this to be an original image from the posters camera and not stolen from some website. but i could be wrong.

I then responded
Thanks for the pictures Krisha,
I'm afraid I'll have to wait till after the holidays to be able to pick it up, but i am very interested. Would you be able to hold it for me if i give you a deposit? maybe $100 or $200? (call it a Christmas bonus:) I actually have a lot of friends in Anderson IN (i assume that's where the bus is?) that go to AU so this would give me an incentive to come visit them.
I'm very excited about this bus, i hope we can work something out, your ad said $1000, is that correct? it sounds very fair to me and i'll be willing to pay that amount. I've always wanted an old bus and figured this is a good time for me to get one. I plan on restoring it eventually once my other project is done, but it'll be nice to be able to drive it in the meantime.
also, does it have a title? i assume so seeing as you just drove it but you never know.
Do you have any more pictures? maybe of the drivers side and rear? or any under carraige or engine shots?
What does the bus have in the rear passenger compartment, is that a bench or fold down bed?
those are all the questions i can think of for now.
Hope you have a good day
Chris


she replied

Ok i understand your concern, i'll be more than willing to keep the bus for you with a deposit of maybe $250 pls and yes it does have a title. I'll accept the deposit with a walmart moneygram sent to me at

Krisha ********
25 cloverdale dr.East hartford, CT 06118..

And when i get back to IN, you are welcome anytime to take the bus and pay me the balance in cash. Let me know when you are ready to make the deposit and i'll let you know how to get it to me from walmart.

Thanks

me:

Sounds good Krisha, I will probably be able to deposit it tonight. Ive never used walmarts moneygram service but don't i just get a reference number and give it to you to pick up? I really appreciate your willingness to hold it for me. Right now im guessing it'll be the weekend of jan 9th that i'd be able to pick it up. If you won't be back by then just let me know when and i'll be able to pick it up any weekend after that.
let me know about the moneygram and i'll make the deposit after work today.
Thanks
Chris

Krisha:

Hi Chris,
Ok thats fine, Just go to walmart, tell them you want to send money using the moneygram transfer service and then pick up the sender's form, fill with your info and mine then give to the agent to process, when the agent is done..you will be given a receipt, email me with the reference number as on receipt. OK weekend of Jan 9th is fine, we should be back by then.

Thanks.

I realize now how stupid it was of me to send money this way, especially without knowing her phone number or actual address. But i was excited about the bus, i've wanted one since i was a kid and i couldnt let this deal slip away. anyways, i sent the moneygram, then replied.

Alright, finally got it done. Your reference number is 16323770. My cell number is ********** if you need to call me for any reason. Please let me know when you got it. Hope your're having a good day.
Chris.

she replies

Hi,
Ok got it, Pls email me your Name and address as on receipt from walmart Moneygram.

Thanks

I replied with my name, and address (stupid me)
this is the last i heard from her, after a week i wrote her two more emails.
Hi, krisha,
what's the address where the bus is located? i was thinking of having a friend from anderson maybe go and take some pictures for me. Unless you have some already you could send. i was looking for some pictures of the undercarraige, drivers side, rear shot, front shot, and pics of all the rusty areas. I only ask because im trying to locate sources for any body panels i may need so i can start restoration right away when i get it home. also, could you measure the height of the bus? My boss offered to let me use his enclosed trailer but i'm afraid it might be a tight fit.
Thanks in advance, i hope i'm not burdening you with all these questions. im just excited to start working on it.
hope you're having a great day.
chris m.


Hi, havent heard from you in a while, im trying to plan my trip so i'll need to know the address of where im going.
hope you had a wonderful holiday.
chris



Some information as been removed:
****Disputed****
It is speculative and without substance.
-Michelle




all of this research was done just after i had called audrey. i made sure that i used my skype phone in hopes of not giving myself away since it is harder to trace the number to my name without the proper resources. i was laying in bed and i started getting phone calls to my skype number, it wasent from the number i called audrey at, so i did a reverse lookup, it was a cell phone from east hartford ct, so it had to be her. she tried calling 3 more times that night, but left no message. when i woke up at 8am i saw she had tried to call another 3 times, between 7:45 and 7:50. still no message. i called the number, no answer, but her voicemail said audrey. i called again after work and she finally answered. i asked her why she had been trying to call me and she said "i just wonderded if you caught that person yet?" remember, she first call me back about 4 hours after my first contact with her. it seems highly unlikely that was her original intention for calling me so many times. i think she was trying to figure out who i was.

after this, i had contacted the admin of http://www.thesamba.com, he shut down her account and told me her login IP address traced back to Quebec Canada and was most likely a jacked IP. I traced her first emails originating ip address and it too came back from Quebec Canada. i thought maybe i was on to something but i traced the next email to LA California, and get this, all of the emails after that trace to Lagos nigeria.
I sent a test email to myself just to see if the trace site even worked. it sure did, it pinned me down to within 5 miles of my house. so im thinking they either used a proxy server or maybe even used someones infected pc to send emails remotely. but i think they got lazy toward the end, because like i said, all of the following emails come from nigeria.

I called the moneygram people and tried to get them to verify which store the money was picked up at, or even verify that it was picked up in hartford ct. she told me she cannot give that info to me, i'd have to contact local law enforcement and they could give that info to them. i filed a police report on monday, but still haven't got a call from the officer to talk about the details. i emailed krisha on the 27th saying:

Hi,
have not heard from you in over 2 weeks
I called the phone number for the address you gave me at 25 cloverdale dr, east hartford ct. and no one there has heard of you.
if you do not respond soon i will contact law enforcement.

This brings me to today, while at work i got an email at 11:34am from krisha *****. it said:

What do you mean? you spoke to who? you not hearing from me doesnt give you any right or reason to get to conclusion.I have things to take care of this period and also for new year.I believe the only time i would be in contact with you is january regards you coming,and me checking my email and reading this!!!!!!!!!!!!!!!!!!!!! its very annoying.


i also noticed that only 9 minutes after receiving this email, i got a call from audrey on my skype number.
i had already suspected that audrey is behind all of this. or maybe this is just another coincidence. There is no reason audrey should be so interested in some person, whom to her, called asking for someone who doesn't live there. anyways, i told her the cops figure anything out, i will give her a call. she said" ok but you might not be able to reach me for a few weeks, i have things i need to take care of" she was also very interested in how i obtained her phone number, she said she paid a lot of money so that it would be unlisted.

Is it just me or do Krisha ******* and Audrey Bertram share very similar lives???? husbands passing away recently, connections to east Hartford ct, and both are "taking care of things, and wont be in contact for some time" also i must point out that Audrey is Jamaican, she has a thick Jamaican accent and her English is slightly broken, much like the emails i get from krisha *******. there are just too many coincidences for this not to be a scam. what do you guys think? im not sure what to think of the Nigerian connections though

your help is much appreciated, i feel ive done my best to unravel this story to this point, but im not a private detective by any means, this is my first time doing anything like this and don't have the resources or skills to go much further. if anyone is interested i can provide more details like, ip addresses , email headers, phone numbers, ect. just email me at chris deleted address-no need to hand it to spammers and scammers--members may post here or contact Chris via pm. - dotti or ask here. also, i am stopping communication with her until suggested otherwise by you guys.

whew, that was long.

Hi Chris,

When you see "moneygram" and Nigerian IP's together in a U.S. online marketplace purchase/sale it's definitely a scam. So unfortunately you have lost your deposit.

You have done an excellent investigation into the matter however. I would caution you not to assume that Audrey is complicit in the scam unless you have solid proof that she has been involved. What you have uncovered is some circumstantial evidence but it may not be enough to link her to the crime. Please do not let that prevent you from reporting the matter to the police. Scammers often use stolen id's and "mules" to collect money from scam victims via western union or moneygram and then forward those funds to the scammers in West Africa. Often, these mules believe that they are performing a legitimate job collecting client payments for an employer.

I would strongly urge you to delete your personal information from your post. Along with scam victims and the general public, we are frequently visited by scammers here at scamwarners and they are always harvesting email addresses and other personal information with a view to committing fraud.

There may be some more helpful advice offered by other U.S. based members of our support team soon so please check this thread frequently in the coming days.

i responded to the ad in an email.

"hi, saw your ad on the samba for a 78 bus. i was wondering if you could send me some more pictures of it.
Also, is it in driving condition? or would i need to trailer it home? i live near grand rapids MI so it's a good 8 hour trip.
thanks,
Chris Myers"

She responded
from [email protected]

Chris, does this imply that you originally wrote to a different e-mail address in the first instance ? ...if so what was it?

I'm inclined to agree with Peta .... once the Lagos IP addresses appeared things stated to look bad.

michelle,
my first contact with krisha was sent via thesamba.com's web service. designed to protect the seller. it is up to them to respond via email or phone. i have only been in contact with her through [email protected]

Peta, thank you. Unfortunately i didn't uncover the Nigerian IP until after i had sent the money and suspected something was up due to the lack of communication. But i guess we all have to learn somehow right? im just glad it was $250 and not thousands. by the way, do you think there any chance i would be able to bait them into sending $250 back, with the promise of sending them the full $1000? (which of course i will not). they are greedy bastards, but also very smart. i guess it would depend which gets the better of them.

also, i am only suspecting Audrey's involvement. i am still treating her as innocent when i speak to her on the phone. i am just being careful not to give her any information about what's going on. i will leave it up to the police to decide who to point fingers at. i am just trying to unravel EVERY possibility.

do you think there any chance i would be able to bait them into sending $250 back, with the promise of sending them the full $1000?

No, once they get their hands on money, they will not let go of it--and since they scam for a living, they are naturally suspicious of everyone else. If they run check scams as well as fake sales, though, they might send you a fake check or money order. It may be a good enough fake to pass initial review and you might get away with cashing it, In our banking system, if a check hasn't been determined to be fake, banks are required by law to make the deposit money available within 5 working days. But--and this is the part that can get you into trouble--days, weeks, or even months later, if the check is found to be fake or stolen, banks can go after you for the money, plus additional fees, and you may be subject to criminal charges for passing the checks in the first place.

I am the victim of the scam as you are. We both have been scamed. I have a detailed email sent by the person. My name is correct but my email address, the names you have provided as well as the addresses you have given are not related. I have sent you a private email. Please reffer to that email thank you. Also all the above statements are untrue. I am no nearby related to any of the person nor I live in that address. So please for the security of those personals I would suggest you to delete any information because it does show up int he internet. Thanking you. If you want to know more please do contact Removed email addresss - Ralph. thank you

Hi Krisha

Welcome to Scamwarners

Scammers do use the details of innocent people all of the time, it may be past victims who have provided their identification or it could be stolen from a web site.

Charles Soludo for instance is a very popular person that scammers pretend to be.

In this case, I am still puzzled by the scam, it certainly does not follow usual trends and perhaps "that Chris kid" can help us shine some more light on this by providing a header from the emails received which we can use to see what has occured here.

Meanwhile, some details have been removed already as the person who is named is NOT a scammer, rather a scammer has used her name.