NEW SCAM FROM "WESTERN UNION" PLEASE BEWARE!

Hi,

I have just received a scam from "Western Union". Please see below. These people must think we are idiots And the best is that I have never ever sent money via Western Union to anyone.


Dear Sir / Madam,
For 156 years, Western Union has been connecting people. At Western Union, there's so much more than money you're sending. Every sender and receiver is important to us.(Ibet!!!) To celebrate our 156th anniversary, we're rewarding our customers with prizes of USD60, 000.00

Because you sent money on-line, from an agent location or received money through Western Union, you've been selected.

However, you are required to forward the following information for immediate payment of your USD60, 000.00

1.) Bank Name:
2.) Beneficiary:
3.) Account Number:
4.) Bank Address:
5.) Swift Code or Routing Number:
6.) Your Mobile Telephone Number:

You will be contacted by a Western Union in the next 24 hours as soon as you forward your required information and you will receive the USD60, 000.00 prizes immediately from us.

Save time, send money, earn rewards! Western Union is a service people trust.

ANNIVERSARY DAY

Thank you for using Western Union!
-----------------------------------------------------
We endeavor to maintain physical, electronic and procedural safeguards to guard your Information. We also endeavor to restrict Information access to our employees, agents and representatives that need to know it. Western Union will never disclose your personal or billing information to a third party.

This is the email header:

Microsoft Mail Internet Headers Version 2.0
Received: from SSPR-EXC2. with Microsoft SMTPSVC (removed)
Wed, 7 Apr 2010 09:59:41 +0200
Received: from nbscc-itx-) by SSPR-EXC2.
Wed, 7 Apr 2010 09:59:40 +0200
Received: from ) by nbscc-itx-(removed)
Wed, 7 Apr 2010 09:59:39 +0200
Received: from n69a.bullet.mail.sp1.yahoo.com (n69a.bullet.mail.sp1.yahoo.com [98.136.45.16])
by (removed)
for (removed) ; Wed, 7 Apr 2010 10:00:54 +0200
Received: from [69.147.84.144] by n69.bullet.mail.sp1.yahoo.com with NNFMP; 07 Apr 2010 08:00:52 -0000
Received: from [67.195.9.83] by t6.bullet.mail.sp1.yahoo.com with NNFMP; 07 Apr 2010 08:00:52 -0000
Received: from [98.137.27.129] by t3.bullet.mail.gq1.yahoo.com with NNFMP; 07 Apr 2010 08:00:51 -0000
Received: from [127.0.0.1] by omp203.mail.gq1.yahoo.com with NNFMP; 07 Apr 2010 08:00:51 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 99561 invoked by uid 60001); 7 Apr 2010 08:00:51 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1270627251; bh=9GN7cpZVwrvWCs1+JVKZeTddjyDgveyJU9ifq5MjEJ4=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b= Removed Domain key

DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=att.net;
h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;
b= Removed
Message-ID: <[email protected]>
X-YMail-OSG: Removed
Received: from [41.245.52.20] by web180506.mail.gq1.yahoo.com via HTTP; Wed, 07 Apr 2010 01:00:51 PDT
X-Mailer: YahooMailRC/324.3 YahooMailWebService/0.8.100.260964
Date: Wed, 7 Apr 2010 01:00:51 -0700 (PDT)
From: Western Union Anniversary <[email protected]>
Reply-To: Western Union Anniversary <[email protected]>
Subject: Thank you for using Western Union!
To: undisclosed recipients: ;
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-547957653-1270627251=:95372"
X-Proofpoint-Virus-Version: vendor=fsecure engine=1.12.8161:2.4.5,1.2.40,4.0.166
definitions=2010-04-07_06:2010-02-06,2010-04-07,2010-04-06 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 ipscore=0 phishscore=0
bulkscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx
engine=5.0.0-0908210000 definitions=main-1004070007
Return-Path: [email protected]
X-OriginalArrivalTime: 07 Apr 2010 07:59:39.0525 (UTC) FILETIME=[46050350:01CAD628]

--0-547957653-1270627251=:95372
Content-Type: multipart/alternative; boundary="0-151732099-1270627251=:95372"

Content-Type: application/msword; name="Thank you for using Western Union!.doc"

Content-Disposition: attachment; filename="Thank you for using Western Union!.doc"


I have removed the irrelevant domain keys to make it easier to see the things that are relevant as listed by The Enchantress below Ralph

Thank You for posting this information Debbie. A definite scam.

It will alert and save others from being scammed. Well Done

From: Western Union Anniversary [email protected]
Reply-To: Western Union Anniversary [email protected]

IP = 41.245.52.20 = Johannesburg in South Africa

Also of Note - in header (by n69.bullet.mail.sp1.yahoo.com with NNFMP)

IN SOME CASES Yahoo use a special protocol "NNFMP" to denote sender MAY be in a list of known scammers, or is using special software to hide their own IP address and details.

Note - it does not necessarily follow that if this protocol is not in a header - it should be assumed that the mail is NOT from a scammer.

And the best is that I have never ever sent money via Western Union to anyone.

If the scammer sends out enough emails, some will be received by people who have used WU. And I wouldn't be surprised if some scammers think that Western Union is used regularly by most people.

These people must think we are idiots

They certainly do think that, the problem is that some people ewill have the details fit, as Arnold says they may have recently sent or received money by Western Union and could currentlty be in a situation where they desperately want to believe it is true.