This just not feel right in my gut...

My question is simple.

- Can someone do any damage to my bank account if they have only the bank account number or PayPal email address and not the PIN nor my name?

Reason for my asking is that I put an advertisement up in a local advertising site stating that I was selling my old iPhone 4. I clearly stated in the ad that the transaction would be in cash and that if anyone was interested in having the phone to email, sms or WhatsApp me to make an appointment to come look a the phone and if they wanted it then they pay-up and walk out with the phone. Simple.

Well, I received two emails from two different people both within a 16 hour period of each other from two different people both stating that they didn't have time to "come by" and look at the phone and that they wanted to buy it, sight unseen, at the asking price (no haggling what so ever), and each one did include, however, that they wanted me to "help" them ship it out of the country. The first one wanted me to post it to his wife in Sweden and the second one wanted me to post it to his partner in the States. They both said they would pay extra to cover the posting cost. In both the mails, they said that if I would send my bank account number or PayPal email address, they would deposit the money for the phone plus the postal cost. They didn't ask for anything else. Not my name, my PIN number, my address or anything. Just the bank account number or PayPal email address. While it seems safe enough to provide a bank account number without the PIN or PayPal email address, it still doesn't sit right with me. The fact that both similar emails were received within such a short period of time of each other, plus the fact that they both wanted me to handle shipping to a destination outside of the country (The Netherlands) and the fact that neither wanted to negotiate the price but just purchase the phone sight-unseen just leaves a sour taste in my mouth.

So again, my question is, can someone get into my bank account and do any damage with only the account number and not the PIN number, or do something wrong with my PayPal with only the PayPal email address? I haven't submitted this information to either one of them, as of yet, until I get some input from an expert on here.

I hope to receive a reply(s) as quickly as possible, because if this is legit then I'm afraid that my stalling too much longer will make one or both of them reconsider buying the phone.

Thanks in advance for any an all information about this.

Here are the details of both emails with the first being first, of course:

First Email:

X-Apparently-To:
[email protected] via 72.30.236.239; Sun, 16 Feb 2014 19:18:40 +0000
Return-Path:
<[email protected]>
Received-SPF:
pass (domain of gmail.com designates 209.85.216.179 as permitted sender) ZWxwIG1lIHNlbmQgdGhlIHBob25lIHRvIG15IHdpZmUgSSdtIFN3ZWRlbiBp ZiBJIGdpdmUgeW91IHRoZSBzaGlwcGluZyBjb3N0PyBTZW50IGZyb20gbXkg aVBob25lIE9uIEZlYiAxNiwgMjAxNCwgYXQgODowMSBQTSwgTWFkUmViZWwg PCBhcmVhNTQ0QHlhaG9vLmNvbT4gd3JvdGU6IEhlbGxvIFllcyBJIHN0aWxs IGhhdmUgdGhlIGlQaG9uZS4gUmVnYXJkcyBPbiBTdW5kYXksIAEwAQEBAQN0 ZXh0L3BsYWluAwMwAgN0ZXh0L2h0bWwDAzc-
X-YMailISG:
Co.jIIsWLDuSaRl2fR8_gkG0KXMaqskgGNCWbTg6QEKTs4vY Q9AVY9Imi3jZOja6UU2z0hvrIWPxcN8fGRU5AjOMbNExLtFGjuySwXBOMobT Tu4FQmlPZZtD15NMuvd7NInpcTvFCKvdCvaN59yvJ8S_kCmnLeeYnDGQIzOO 2uyqv1dPCG6WPF0_8z1ep0a5rF6RufC_1JSoJgPfBQAFMccyyIhLudSaT81e _wDS3BkCVToNMv_huZnFJ36uQAaPpWNSF2GbZbwee8DnbwldqLhFbrApTuxG _K1fEK8p7NxtyBHPP4Grc00iZ6EzBNERBPll9EtpFA7I1kYwIdhMRImhc55h bS3CMmpRQa6k_MYm.fYd9lLE.0w8HBYGiuK6vd_SbhJ5G8bZEZw_ViDlyuOg VpJgrrKyNlYXHj7bqKtwz54QccDh4NtW6lKhINnDwPhAAHW6w32ygfv0IeA_ Jn5PsIFFxe_HyGlDGG82mvnRUKFW8RYQsE0P95.A_RQ.Zubt4MyZBAY3QghS LrEHaqlmm5tovwIVf.puXG5ejTH3vaex03rXpRBD4PwpJiOncoNyExJtJuKA xbuM89OAhrrSSN7GX.xiMklb_V8oaZ.bNwueMhL7YGl9.2xCBHQOaWiSJTsp ModmBmeVqtU_BRTZ3x55X8wXLhwz6xHa4TKtTPENd72vqSxbxVUYPTQMCP26 KeKOf0RIJFQ6u2_kdnxyRAG4s9Hu9OXSpGaXY0NMCJr9LgF7qSrKLbc0LO5h 6MnfDFByeHTxqKLGCPb4mkG1uk4f32y81tnxHyEOcvodOGYknxQwW4B507a_ xN43t5ynzKj6EsxHAzHNiRbfFJlmMGbzuAn.etwAOtxhv0kOFV_yP3amRt6s p0OXe1J0fsf9H9aj4uXDbH13oDZu9aPOuVwXr1UXgpON23D2e_8Q7egP8iHr 4waA4OYcbL1YuipQwOwNc_EwwmU7_HlxMd4qeb27Q6f9I64XDIDR0BXnZKo0 C8hneCFuLOUmKECndF4UQtF81sYkTAGM_3oZefnL.1zh.XHARLBmWvLU8j3H 592tY.qN_sWMVsp8oTrI9iSYomphh0xyENeas7bQ4uQmABfTWrl56Fyl7Pda 1QsAlq9n3DyNnZw5W3tBsDYM9bHvDmXZNLsAmiwXr7r1tTuxioHzsqZ9ZAGB 3gMFNUoICQWOeedZ8y_rFVjIckdfiEULKd0fNKqK.APk2O9jmaI3al3_XvA5 h8YIMxIi.ReGDnZOHjpjkpuUjl53kOGxjIaI7iHZmgcP291XgmzjxCkp_lnb u20oRAclNHkNmjrLqpcWDfT.Yjzf7wHm6fJyUFyNPdUIrvawitcjwDgIYZm9 NKpWBFF5t5B9OZz08nx3ErKB.LBESApaKRH5EZL4_ARRBFVgIq1PinnN95iS e.PICGnVo9ck7j8O5eD1aAQ7q1yrmom8YgMpMIOQ7MnYYklO.N.8M0bxwxwE U42kEBLI9J3axBvb253KU83sIssxBE9KyULcmdcaPK_tVCWwEIOIvSXLP8zZ 2Y9Of5pWjUM3ovYuBCEJAIFcSsZ5svMt067ZYxAI9g3CPxx2tUDcqfwJc3dz F2U.OpQE6IIdIczDuQt8f50o.MWLjs0ePQ.TDnW5j6EKQt9znlX0Da.r0SEF f4lrPzDehk9B0U3OkojEhy2i
X-Originating-IP:
[209.85.216.179]
Authentication-Results:
mta1285.mail.ne1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=pass (ok)
Received:
from 127.0.0.1 (EHLO mail-qc0-f179.google.com) (209.85.216.179) by mta1285.mail.ne1.yahoo.com with SMTPS; Sun, 16 Feb 2014 19:18:40 +0000
Received:
by mail-qc0-f179.google.com with SMTP id e16so22475579qcx.38 for <[email protected]>; Sun, 16 Feb 2014 11:18:39 -0800 (PST)
DKIM-Signature:
v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:references:from:content-type:in-reply-to:message-id:date:to :content-transfer-encoding:mime-version; bh=HIXGCdsqsCYg/w4e67dq4FvtmPKQU82r/VkKVeyFkwc=; b=fnQVthArgU7iA/quv0I7eGqR2BybdcgeV2FnBRleOTVhq3ADW2DimpkuwpXGkq9wq+ vx+V1DVTqu3Vbp6gsquyWcbMSU7vSDjhML1HwhfVOJbw7SrJvJ1deyc8MiuQDQkOl25L TSPlqkK+Uvxq9aDpDpIdWKm+lH7T8G0tX1CIVJFXtZGhiCK1LOBtB/Y/OHCfNe8kcA74 f8gfYD0KvJGo1Ug1VLr7Qvhx2e9MOtqKf9/2k+iAYncN/Che54UvgcC9z5IsgZE3fzd0 v1x0WObfh0OUwA3RBXbF8nmALIGhZau0rapEAjRRsDPCWTZ6VKwNBeKUA49mBKb5K9sz TXrg==
X-Received:
by 10.224.122.20 with SMTP id j20mr2870633qar.82.1392578319263; Sun, 16 Feb 2014 11:18:39 -0800 (PST)
Return-Path:
<[email protected]>
Received:
from [10.101.47.3] ([107.6.95.55]) by mx.google.com with ESMTPSA id z1sm37544462qaz.18.2014.02.16.11.18.37 for <[email protected]> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sun, 16 Feb 2014 11:18:38 -0800 (PST)
Subject:
Re: Advertentie: [139000087 - iPhone 4 + FLAPPY BIRD + Factory Reset + Jailbroken + MORE..] - reactie ontvangen


Second email:

X-Apparently-To:
[email protected] via 72.30.236.239; Mon, 17 Feb 2014 09:00:14 +0000
Return-Path:
<[email protected]>
Received-SPF:
pass (domain of gmail.com designates 209.85.214.181 as permitted sender) dXkgdGhpcyBpdGVtIGZvciBteSBwYXJ0bmVyIGFuZCBpIHdpbGwgcGF5IHlv dSA0NTAgRXVybyBmb3IgdGhlIGl0ZW0gYW5kIGkgd2lsbCBhbHNvIHBheSB5 b3UgNTAgRXVybyBmb3IgdGhlIHNoaXBwaW5nIGZlZSB2aWHCoCBQT1NUIE5M IHRvIHRoZcKgIFVuaXRlZCBTdGF0ZS4uIEkgd2FudCB5b3UgdG8gc2VuZCBt ZSB5b3VyIFBheVBhbCBlbWFpbCBhZGRyZXNzIG9yIHlvdSBjYQEwAQEBAQN0 ZXh0L3BsYWluAwMwAgN0ZXh0L2h0bWwDAzE-
X-YMailISG:
TbDt4fsWLDv6M.5jVr917wiYbmzqkhMHjZd7WpfTFoS6d2dv gLfZRiO.5iY3h5b9KV73TYp0AKmVHLGcYpcDh4UfObGTUV9ZYw9zHDVXPOWh 9cuESRHcoNIu76hTe2tvsXfneCp0asSsDGDWPijQqpS7qzW5_hwVQfG.vbqW u9oYrS1Ixa_HO1BcAcJKSUM.F5ti.0VKU8GwaZ0SZqZ6jiaxdPblakhctJ7c 6bwhoIssmeXQQmIIVDNktTVoRnhEHgcyE8I2xqFi7HnjjarROuK1vw6wJ.fv RYDzVHK.ZJh75r0IWmC94to12nkaTh_JkV2xnT0927t1.f72D.UMR64aghcE siDsqHlz_2Kkkab1UoyyznzwPj.5TIylm9WEqDJuSnKExp1IHIFHs3Gs6UPe GynP8DpznWtgDB8VXiE1EfjhPlRwDy4UcUaJs2.v95EL2TV7ii_ta7KZRqYn zxDL8QYf2UkUhR6LAKEOVsIsKER4ENZA2mfatiPM1kzkdJREuHfCJgJKAIGt TVf3ltOEabS9hR_fTNS5E.VxsX8aLqmqcdCdVLjOqUZlQcAwYHBP36AqvWbL LJkw_RXLIX0mRQwgJ9b2tLNmmagg6pfD_1oICzX7Qhg1bK8WENQFQ2Aepqa6 LBzz9GhpmbLjSW7HBR.CXNm5WkwEu42KK_j.hQarYgVIMHTKiPKGLtYC7OG7 2krZa5LYhThZcR2XmYrHXLinmeT8MWXiD1UppO4qZRtu3oi.YA_3TbpjjfhT 2ZCUH8EIMcWICn5h7WHWIan4xK2bREGKUx4AzVl0bG5tDApM3DfSh50fy.oX GYJ4PxmFzWakDE6yKt.p8WOZGgSUW5.Kl6hIdbBfLZSu66pvy94_ilRG5AO3 o5i_UK0ErVdCWyHN1Q4xzGtY9I5vlkc6cXQHO6RKLBriG1g9ZlxhZqD2bCJa fUG9liJEF0R6Apg6NUa.cQ1euoads3UV8G8jVryCa7VF54izIZivBXxY4AAY 3G1aE2EZe0nk.E36VDeTC9HCK9bu46wD6SSebsB3L7w1cLpOxCScVuC.2F57 fkAwZe22e81A8rSjwmYUNc.JD4JAsg7Vv..aI.k_ahdHi7hmhoVFt4aMmgVZ IJ2GhpUozLioP3URPgW0MQ5VXgXcb36Wcf.dOf5h2qN0RgnSshiFI3UByd_1 QdpwBqK8YymhbHiKBPQ2f37XXahpPSVG2oI9xMy.rHTgkAaAj8in0ygkl7W9 WniqSjacuhmMUe724xbwTdknPqb08Jlqm7CP7BRAc2a.g1ygb.RvYgcIexNR p3T2R3wfZDJTf1s29Gim0EzckmzsnkQHIGIKrOTSVutTBQWLn_yEZ1NKIfdG fnGk3TnNG8hugiZY2GX7hsuCzOtlGYjYmSz5u6yAd1bLT8UFzMLTN0GIMA--
X-Originating-IP:
[209.85.214.181]
Authentication-Results:
mta1456.mail.bf1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=pass (ok)
Received:
from 127.0.0.1 (EHLO mail-ob0-f181.google.com) (209.85.214.181) by mta1456.mail.bf1.yahoo.com with SMTPS; Mon, 17 Feb 2014 09:00:14 +0000
Received:
by mail-ob0-f181.google.com with SMTP id va2so16824616obc.12 for <[email protected]>; Mon, 17 Feb 2014 01:00:14 -0800 (PST)
DKIM-Signature:
v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=FQEeRubSeDYZpdR+T+FIsfxV/TT6hVyPqsmoe4lthbQ=; b=L5Kr6OmC4Uv2q/GgIlGUr9WXXYs2BgCi19IHd17q4m6IR8JAQG9V8j1zbKoj/bYIZd zaz8y19x8GsLN+51jL5FzRTJ57uz2JvAx91qDYENzTdmH7XxvFl00y5Ty+x62ZCZ76OC FSepX4lRjeL+baVYRvPlhA+mWunpgt9qXgJSMCsC0zz5TR5UE7oDp5Gl0aSI9wde2HWo F2SnZ1Vx/rm9OLK07APS3H5lPsxOeGJqF/Db+ibbE/nE4q9YHDljPQxamjVm9rYMdZ+p kxqxvKqePGtCp9CzMAtdZ5bwindW27zBQCt0aG2PaXjeQoOhdpuSXxyTjUm/OQIdlRsN z+7g==
MIME-Version:
1.0
X-Received:
by 10.182.53.72 with SMTP id z8mr20022283obo.36.1392627614108; Mon, 17 Feb 2014 01:00:14 -0800 (PST)
Received:
by 10.182.28.103 with HTTP; Mon, 17 Feb 2014 01:00:14 -0800 (PST)
In-Reply-To:
<[email protected]>
References:
<20140217060314.20696.88198@localhost> <[email protected]>
Date:
Mon, 17 Feb 2014 10:00:14 +0100
Message-ID:
<CACW5aaji_Qeumtd3HLfw+SpYejPN8sq0f-Btxr4m7gjOJSii3A@mail.gmail.com>
Subject:
Re: Advertentie: [139000087 - iPhone 4 + FLAPPY BIRD + Factory Reset + Jailbroken + MORE..] - reactie ontvangen
From:
abdul lateef <[email protected]>

Sorry for this additional post, but I failed to me one more thing that don't seem right.

Why would they need me to post the phone to Sweden or the USA? I mean, why the hell can't they do it themselves? It just don't make any sense to me.

Just a thought.

[AlanJones]

My question is simple.

- Can someone do any damage to my bank account if they have only the bank account number or PayPal email address and not the PIN nor my name?

No, your account number is printed on every cheque you issue and your PayPal email address is also easily known (assuming it is your normal email address). Neither would be sufficient for anyone to do anything to your accounts without the necessary PIN/Password.

Why would they need me to post the phone to Sweden or the USA? I mean, why the hell can't they do it themselves? It just don't make any sense to me.

They have no interest in your phone. They would send you a fake PayPal email confirming the payment and then ask you to send the shipping fee by Western Union or similar. It is that money that they are after.

Or they are trying to steal the phone. If you play along, they will send you a message on PayPal letterhead, confirming that they have paid but the money will not be credited to your account until you email them a tracking number to prove the phone has been shipped.

SCAM. Don't do it.

I don't know any way somebody in a foreign country could take money from your account just by having the account number. I would expect the bank to refund you if they allow some strange transaction without calling you first. The reason PayPal was created is so you can have small financial transactions with strangers without revealing your bank account or credit card numbers. Great service; use it when you can.

The account number (as Alan said) and the routing number are written at the bottom of every check. They are sufficient to send money to the account, but not to withdraw money from it. PayPal withdraws money from bank accounts; before the bank will let it do that, it sends some small random deposits to the account and the owner tells it how much they were.

The scammers in this case appear to want the phone. There are scam rings that specialize in buying phones with stolen credit cards and having them reshipped to Russia or Kazakhstan or thereabouts. If they wanted the money, they'd have mentioned the shipper (another character played by the scammer). The fake PayPal email would say that PayPal is holding the money until you provide the tracking number (PayPal doesn't do this), and the bank transfer would be from an account that they stole the password of.

So basically what it boils down to is that I can give the individual my account number and see if he transfer the money to it. If he doesn't, then I know this is really BS. If he does, then I would send it to whatever address he indicates, but I would send it via normal insured post. Not Western Union. If he demanded Western Union then I would know it's a setup of some sort.

If he were to transfer the money to my account, then he's actually the one at a disadvantage. I mean, he would have sent the money to someone he didn't know (namely me) not knowing whether or not I actually had the phone or if I did, if I would actually send it to him.

Am correct in the above?

Thnx everyone for the replies so far. Much appreciated.

Um, no. It is a scam. The only way you win is do not play.

List your phone on ebay, take payment thru PayPal. Ship only when you actually have the money, not a message saying you will get the money later if and when you ship.

Be careful selling phone locally, too. There have been cases where people say, yeah, meet me at McDonalds, then pull out a gun and rob you. Your friend that went with you for protection gets robbed, too. Be careful.

(Western Union is not a shipper)

[AlanJones]

If he were to transfer the money to my account, then he's actually the one at a disadvantage. I mean, he would have sent the money to someone he didn't know (namely me) not knowing whether or not I actually had the phone or if I did, if I would actually send it to him.

Any money that actually arrives in your account (bank or PayPal) will not be the scammer's - it will be from a phished account or possibly a fake cheque deposited into your account. That money will eventually be discovered to be fraudulent and will be reversed back out of your account and you could also have explaining to do about how you came to receive the money - if that happened, the fact that you held onto the money, rather than sending it on as a victim would have done will do you no favours with the authorities.

I thank you all for your advice and have decided to not go along with this person. The risks far outweigh the benefits on this one.

I going to accept the advice to put the device up on eBay and accept through PayPal. Only problem with that is that I've read where there's alot of "cash backs" happening on eBay. Where a person will buy a product, wait a few days or a period of time, then contact PayPal claiming to have never received the product although the product was received. I understand that the buy is always in the right when such a claim is made to paypal and they always end up getting not on the product for nothing but their money back as well. Is this true?

Again, thnx everyone.

[AlanJones]

If you follow the eBay/PayPal rules to the letter and ship the item using a recorded delivery then you should be safe.

Other than that the only thing you can do is look for a store that buys used phones and sell to them, although you will get less than selling privately.

Again...thnx to each of you for your valuable advice. Very much appreciated. Hopefully I can return the favor and help out a bit.

Thnx again.