Check Scams, Debt Collection scams and other financial scams.
by bill_b3llo Thu Oct 30, 2008 1:26 pm
There is a prolific scam going on now that involves law firms collecting money owed to Asian companies. The scammers are targeting Law Firms, and using verifiable company names.

The firms are asked to collect overdue payments from real companies who the scammers give fake contact info for, and then receive a counterfeit check drawn on that real company's account. They are then asked to take a percentage and wire the rest to a bank in Korea.

I know of one firm who has lost $158,000 on this one already. The scam company is Rising Sun Ltd of Hong Kong, and the CEO is Hakuchi Samurai. The supposedly delinquent company is Crown Royal Ventures.

I'm putting this here so hopefully a google search will turn up something. Surely, a law firm would do some research, but who knows.

Here's the initial reply to the law firm when they respond. The web site they mention is only a few months old, and most likely a fake. The scammers are well versed in legal and business terms, and use documents that can obviously fool a law firm. This is one of the best scam groups I've seen.

BTW, lawyers are not the easiest people to warn, trust me.

Good morning to you and thank you very much for your prompt response, I would have the opportunity to talk to you sometime but thought you should know what we are looking for by email which enables me present/express my case better than telephone due to my accent and English but that we are very optimistic that this relationship will be beneficial to both parties. You may view our website http://www.risingsunhk.com to intimate yourself about our organization. Rising Sun Ltd was established in June 1973, we are one of the fastest growing manufacturing companies in Asia; we are into Products & Business Design & Production, and Sales of Small Soldering, Equipment, Mini Solder, Desolder, and Various Tools.


After a careful research, we have been able to establish that delinquent or past due accounts running over US$1,863,650 would have been settled if we had a reputable lawyer/firm representing our organization in collections or possible law suit. We have these accounts around the United States and we are happy to know that you have registered attorney around the country.


We can say this authoritatively; a friend tried it in Europe and his delinquent account has been reduced to a significant extent, hence we are taking same step. To give you a better understanding of what your responsibilities will be as our legal representative, it is important that you know some difficulties we are faced with presently with our customers in North America; a lot of customers don’t fully fulfill their obligation in terms of payment.


I thank you for indicating in your response your interest in knowing more about our corporate needs and one of it been collecting/recovering payments from delinquent accounts owed to Rising Sun, we are ready to work with you. However, beside your hourly billing/expenses and retainership, we have percentage for you based on the mode of settlement or collection, just to show we are eager to have payments from these clients with delinquent accounts.


We are incapacitated due to international legal boundaries to exert pressure on such clients or commence litigation in such cases. We have recently put in measures to avoid instances like this, as it cost us lot of money in recovering these accounts, at times these account are written off as bad debt. At this moment it will not be proper for me to provide you with list of delinquent accounts until there is client–attorney engagement/relationship. Below are the areas we would require your expertise.


1. Provide consultation and legal advice in cases of customers with delinquent payments based on agreed amount per hour or percentage.


2. Receive the said funds of past due account and keep in a trust account on our behalf until the funds are required by our company and also maintain the running of your expenses.


3. 65% of payments from that region is used for the purchase of raw material for production and outstanding payments due our suppliers, you will be instructed on how and when to disburse, at the end of the month you shall supply us with details of how much was collected and disburse for us to reconcile our accounts.


We suggest that cases of clients with delinquent payment will be billed on a case by case bases, however let us know your retainer fee or charge for any funds recovered on behalf of Rising Sun I do hope this is acceptable to you. Upon receipt of your letter of engagement and resume, our board will sit and go through the terms contract you have written, before a final decision to retain your services or not. I will await your update on how we may proceed.


Accordingly it is imperative that you respond immediately as time is of the essence and we are poised to utilize your services with immediate effect. We are currently planning of establishing a sales office officially in the U.S in the nearest future, you can assist in working out the legal modalities/frame work for us. Please accept my sincerest appreciation for your willingness to render your services, as we look forward to your prompt response to my email. If you have any questions or concerns, please contact me personally anytime by email. Please send me a retainer agreement ASAP which should include your costs and other charges.


Best Regards.


Hakuchi.
Last edited by bill_b3llo on Wed Dec 17, 2008 8:00 pm, edited 1 time in total.
Advertisement

by Scam Patroller Fri Oct 31, 2008 4:33 pm
@ Bill, I received a second email from a lawyer who received a warning from you, I wasn't aware of your post here as I have not been available much for the last week, he was asking where you had posted online about the scam, I searched and found it here, and have given him the link to this topic, I just sent him this reply:

Dear xxxx,

I have been away for the last week or so, and as a result, I am not up to speed with things, but using the search function at the top of our forum, and typing in the words, "Hakuchi Samurai", it shows that Bill made a post about the scam which is located here:

http://www.scamwarners.com/forum/viewtopic.php?t=1578

Having now read the post, it has all the hall marks of a classic fake check scam, basically, it works like this.

Lets pretend I am the scammer and you are the lawyer, I ask you to act on my behalf to claim unpaid monies owed to my company, I give you the contact details of a real company that owes me money, except they are not the contact details of the real company, they are fake details.

The contact details actually put you back in touch with the scammer (ME), so when you contact me about the unpaid monies, I say, ok then, I'll put a check in the post for you, except it's a fake check made out in the real companies name, you receive it, take your fee and wire the rest to the scammers bank account.

Some time later, and it can take up to 6 months or longer, the check will be returned to your bank by the issuing bank as being counterfeit, you are now left in the position of owing your bank the full amount of the fake check that you deposited and withdrew funds on.

We see many people caught up in smaller fake check scams, mostly through selling things on the internet, they get caught in what's called the "overpayment scam", whereby, say they are selling a car for $8000, the scammer sends them a check for $12,000, asks them to deposit the check, take their $8000 and send the overpayment to their shipper so that they can collect the car for them, of course, the scammer is also the shipper.

The victim is out at least the $4000 that they sent to the shipper after cashing the fake check, possibly more if they spent any of the other $8000 they had in their account, it's pretty much the same in your case, only these scammers are after bigger fish, namely you and other law fims, where they can make tens or hundreds of thousands of dollars in one hit.

Regards,

Scam Patroller.

Remember, if it seems to good to be true, then it is.

http://www.419eater.com - http://www.aa419.org

by bill_b3llo Fri Oct 31, 2008 4:43 pm
These slippery bastards have other names, and are now trying to pass this off as a referral from another real lawyer by impersonating his email.


Dear Counsel,

I am sending this email as a mutual introduction. Mr Robert Weihua is the
Managing Director of Kyle Enterprise Ltd of Hong Kong. Kyle Enterprise Ltd is a
supplier of steel. Kyle is owed payment on a shipment that they made to a
customer here in the US in Febuary 2007. The company is now seeking advice and
possible representation in litigation against the non-paying company.

I can not handle this matter at the moment as I will be going on vacation. I have
represented this company in the past. This matter is in your jurisdiction;
contact Mr. Robert weihua if you are interested in representing him. Your
respective contact information is as follows:

Robert weihua
Managing Director
Kyle Enterprise Ltd
45 Des Voeux Road
Central Hong Kong
ph: 81-3-458-01680
email: [email protected]


I encourage you to contact one another to see if this is a situation where you
can work together.

Sincerely,

Kenneth Farley, Esq.

Law Office of Kenneth Farley
121 N. Central Avenue
P.O. Box 748
Idabel, OK 74745-0748
[email protected]
Last edited by bill_b3llo on Thu Nov 13, 2008 10:32 pm, edited 2 times in total.

by Scam Patroller Fri Oct 31, 2008 4:57 pm
Just a note on the 2 domain names in the email addresses in the post by Bill above, highlighted in red:

bill_b3llo wrote:Robert weihua
Managing Director
Kyle Enterprise Ltd
45 Des Voeux Road
Central Hong Kong
ph: 81-3-458-01680
email: info@kyleenterprisehk.net

Law Office of Kenneth Farley
121 N. Central Avenue
P.O. Box 748
Idabel, OK 74745-0748
rkenneth@kennethfarleylaw.com


Both of those domains were only registered 11 days ago, both registered by the same person using privacy protection, both using the same webhost and nameservers, which makes them both fake, Who-is for the domains:

Domain Name: KENNETHFARLEYLAW.COM
Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server: whois.PublicDomainRegistry.com
Referral URL: http://www.PublicDomainRegistry.com
Name Server: ROSEPARK.EARTH.ORDERBOX-DNS.COM
Name Server: ROSEPARK.MARS.ORDERBOX-DNS.COM
Name Server: ROSEPARK.MERCURY.ORDERBOX-DNS.COM
Name Server: ROSEPARK.VENUS.ORDERBOX-DNS.COM
Status: clientTransferProhibited
Updated Date: 20-oct-2008
Creation Date: 20-oct-2008
Expiration Date: 20-oct-2009


>>> Last update of whois database: Fri, 31 Oct 2008 15:50:42 EST <<<

Domain Name: KENNETHFARLEYLAW.COM

Registrant:
PrivacyProtect.org
Domain Admin ([email protected])
P.O. Box 97
Note - All Postal Mails Rejected, visit Privacyprotect.org
Moergestel
null,5066 ZH
NL
Tel. +45.36946676

Creation Date: 20-Oct-2008
Expiration Date: 20-Oct-2009


Domain servers in listed order:
rosepark.mars.orderbox-dns.com
rosepark.earth.orderbox-dns.com
rosepark.venus.orderbox-dns.com
rosepark.mercury.orderbox-dns.com

Status:ACTIVE



Domain Name: KYLEENTERPRISEHK.NET
Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server: whois.PublicDomainRegistry.com
Referral URL: http://www.PublicDomainRegistry.com
Name Server: ROSEPARK.EARTH.ORDERBOX-DNS.COM
Name Server: ROSEPARK.MARS.ORDERBOX-DNS.COM
Name Server: ROSEPARK.MERCURY.ORDERBOX-DNS.COM
Name Server: ROSEPARK.VENUS.ORDERBOX-DNS.COM
Status: clientTransferProhibited
Updated Date: 20-oct-2008
Creation Date: 20-oct-2008
Expiration Date: 20-oct-2009


>>> Last update of whois database: Fri, 31 Oct 2008 15:46:21 EST <<<

Domain Name: KYLEENTERPRISEHK.NET

Registrant:
PrivacyProtect.org
Domain Admin ([email protected])
P.O. Box 97
Note - All Postal Mails Rejected, visit Privacyprotect.org
Moergestel
null,5066 ZH
NL
Tel. +45.36946676

Creation Date: 20-Oct-2008
Expiration Date: 20-Oct-2009


Domain servers in listed order:
rosepark.mars.orderbox-dns.com
rosepark.earth.orderbox-dns.com
rosepark.venus.orderbox-dns.com
rosepark.mercury.orderbox-dns.com

Status:ACTIVE

Remember, if it seems to good to be true, then it is.

http://www.419eater.com - http://www.aa419.org

by bill_b3llo Fri Oct 31, 2008 11:17 pm
I've made contact with the actual Kenneth Farley, and he assures me he is in no way involved in these emails. That was never a question, but it is worth mentioning for the record.

Edit: New email address: [email protected]

They now have a number of companies they can match to the lawyers jurisdiction. These guys are pretty good. :evil:
by rsn3772 Tue Nov 18, 2008 4:19 pm
The law firm I work at received this email today; thanks for posting your warning -- it was the first thing I got when I looked up Mr. Farley!

**********************
Dear Counsel,

I am sending this email as a mutual introduction. Mr Harry Yuang is the Managing Director of Namhae Chemical Corporation . Namhae Chemical Corporation is a manufacturer and supplier of chemical. Namhae is owed payment on a shipment that they made to a customer here in the US in Febuary 2007. The company is now seeking advice and possible representation in litigation against the non-paying company in New Mexico.

I can not handle this matter at this because is in New Mexico and as I will be going on vacation. I have represented this company in the past.
This matter is in your jurisdiction; contact Mr. Chang Liu Jung if you are interested in representing him. Below his is contact information as
follows:

Harry Yuang
Namhae Chemical Corporation
[email protected]

Should you have any questions please contact my legal assistant Randa Mitchell ([email protected])



I encourage you to contact one another to see if this is a situation where you can work together.

Sincerely,

Kenneth Farley, Esq.

Law Office of Kenneth Farley
121 N. Central Avenue
P.O. Box 748
Idabel, OK 74745-0748
[email protected]
by John Koenig Wed Nov 19, 2008 2:31 pm
I imagine this thread involves a lot of lawyers, so i'll ask a legal question. Doesn't the UCC put some limits on how long a bank has to reject a deposited payment? An earlier post states that the bank can reject the check as counterfiet up to 6 months later! Is that right? How does that affect normal legal practice? For example, we won't cut funds out of our IOLTA account until the check has cleared. Can the bank come back up to 6 months later to reverse the transaction?
by fraud fighter Wed Nov 19, 2008 3:24 pm
I work in the Fraud department at a bank and one of our law firm client's received a cashier's check from these scammers. The cashier's check was drawn off of SunTrust Bank. Before depositing the item, we contacted SunTrust and verified with them that the item was indeed counterfeit. The number printed on the check (1-800-561-4028) is NOT a valid SunTrust phone number. We called the number and a gentleman answered pretending to be a SunTrust representative. He asked for the check number and the amount and placed the call on hold. He then returned and provided payee information and expressed that the item was valid.
I have reported the phone number to http://www.Phonebusters.com. Unfortunately, Phonebusters informed me that the toll free number is listed with a company called Callture and they do not shut numbers down.

Here is additional information regarding the scam targeting law firms:

Scammers are using the following email addresses:

<[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>

As mentioned in previous posts, the scammers are using the names of true businesses and claiming that these companies owe money to them for services. One of the true busines names they are using is:

Rolled Steel Products- Los Angeles, CA

I advise any of you or your clients to report these scams to http://www.IC3.gov
by bill_b3llo Wed Nov 19, 2008 11:37 pm
Please keep posting any email addresses or phone numbers you find. And thanks to those who have provided this already. It all helps very much.

Bill


More company names:

Southern Tool Steel, Inc.
Joseph T. Ryerson and Son, Inc.
Mutual Welding Company, Inc
Blue Ridge Mining Company or Blue Ridge Mining Group
MasterPieces Puzzle Co., Inc.
Edward Jones Securities
Save A Buck Interprises
Mystik Toys Inc.
Mega Marbles Inc.
KidCore Toys Inc.
Belmont Toys Inc.
Another World Interprises
Shin Nippon Wheel Industries Co., Inc
Shanghai Kingstronic
Nanjing Yunman Trading Company
MP & Toys Group
Train Central Inc.
Gordon Construction Zin
Last edited by bill_b3llo on Fri Jan 16, 2009 10:08 pm, edited 5 times in total.

Write me at scamspook at gmail.com
by Runamok Thu Dec 11, 2008 7:35 pm
I just posted part of this on the introduction page, then found this. My law firm was targeted; yesterday we received the "cashiers check" from the allegedly delinquent customer of our "client." The client, who signed a representation agreement with us, claims to be one M. Lee from Boying Model Factory. This is a real company. They were allegedly referred to us by an attorney in California, one Richard Fine. He is a real lawyers.

As it seems to help, I will post my last email from "M. Lee" here:

From: [email protected]
Boying Model Factory
1th Building, 98industrial City, Wangfeng, Shajiang, Baoan District, Shenzhen, Guangdong, China 518104

Attention*****

Good day to you and thank you very much for your update.

We have been informed that the check is drawn on certified bank funds and sould be available one business day upon deposit. We specifically requested for payment instrument that will enable prompt release of funds due to our urgent need.

There is a pending business transaction with our associates in Japan "KENPET INVESTMENT" and we intend to make the funds less your retainer and transfer fees wired to them accordingly. It is very important that the funds are wired to them today as this will enable the prompt release of our shipment as we are already behind schedule.

Please find wiring instruction for "KENPET INVESTMENT" in a second mail to you with subject "wire information".

I need you to attach a receipt of the wire transfer slip in a mail to me so that I may update my associates accordingly.

It will be most helpful if the wire transfer is effected today as time is of the essence.

Thank you very much for your services as I await your prompt action.

Do acknowledge receipt of this mail.

Sincerely

M. Lee


While M. Lee had told me the delinquent customer was in my area (Maricopa Cnty, AZ, USA), the check came from the U.K. It arrived via FedEx with no note or other identifying correspondence. The check is from Citibank, but indicates its from Citibank in Phoenix, AZ. How did it come from the UK? Oh, and there is no Citibank in Phoenix, AZ.

The wire instructions I received are:

BANK NAME; HANA BANK ITAEWON BRANCH.

ADDRESS; #737-28,HANNAM-DONG,YOUNGSAN-GU,SEOUL,KOREA.

SWIFT CODE; HNBNKRSE

TELEPHONE; 82-2-794-1111

ACC/NO; 773-910007-00732

ACC/NAME; KENPET INVESTMENT.

We have not deposited the fraudulent check, and have made a report with IC3. But thank you scamwarners.com -- way to see it coming!
by Ralph Fri Dec 12, 2008 12:12 am
The company that email came from may be a legitimate company but the website doesn't look real to me, I will wait for Bill before I do anything but I think the site is fraudulent.

Here is the information on the site

boyingmodelfactory.com

Domain Name: BOYINGMODELFACTORY.COM

Registrant:
PrivacyProtect.org
Domain Admin ([email protected])
P.O. Box 97
Note - All Postal Mails Rejected, visit Privacyprotect.org
Moergestel
null,5066 ZH
NL
Tel. +45.36946676

Creation Date: 05-Nov-2008 site very recently created
Expiration Date: 05-Nov-2009 one year expiry


Administrative Contact:
PrivacyProtect.org
Domain Admin ([email protected]) Privacy protect which hides the identity of the owner
P.O. Box 97
Note - All Postal Mails Rejected, visit Privacyprotect.org
Moergestel
null,5066 ZH
NL
Tel. +45.36946676

Technical Contact:
PrivacyProtect.org
Domain Admin ([email protected])
P.O. Box 97
Note - All Postal Mails Rejected, visit Privacyprotect.org
Moergestel
null,5066 ZH
NL
Tel. +45.36946676

Billing Contact:
PrivacyProtect.org
Domain Admin ([email protected])
P.O. Box 97
Note - All Postal Mails Rejected, visit Privacyprotect.org
Moergestel
null,5066 ZH
NL
Tel. +45.36946676

Status:ACTIVE

PRIVACYPROTECT.ORG is providing privacy protection services to this domain name to
protect the owner from spam and phishing attacks. PrivacyProtect.org is not
responsible for any of the activities associated with this domain name. If you wish
to report any abuse concerning the usage of this domain name, you may do so at
http://privacyprotect.org/contact. We have a stringent abuse policy and any
complaint will be actioned within a short period of time.

The data in this whois database is provided to you for information purposes only,
that is, to assist you in obtaining information about or related
to a domain name registration record. We make this information available "as is",
and do not guarantee its accuracy. By submitting a whois query, you agree that you will
use this data only for lawful purposes and that, under no circumstances will you use this data to:
(1) enable high volume, automated, electronic processes that stress
or load this whois database system providing you this information; or
(2) allow, enable, or otherwise support the transmission of mass unsolicited,
commercial advertising or solicitations via direct mail, electronic mail, or by telephone.
The compilation, repackaging, dissemination or other use of this data is expressly prohibited without
prior written consent from us. The Registrar of record is Directi Internet Solutions Pvt. Ltd. d/b/a PublicDomainRegistry.com.
We reserve the right to modify these terms at any time.
By submitting this query, you agree to abide by these terms.


The concerns noted in red combined with a scam email coming from their domain makes it look quite shaky to me.

@Bill, just for the record I will not report the site incase you already know of it :wink:

@Runamok, if you dont mind can you stay tuned, the site killers may need some further information to help get the site dealt with and the bank account used by scammers can be reported and dealt with as well but again they may need a little more information, both are great ways to slow the scammers down.

The information they are most likely to need is the header, if you let us know which email providor you use we can give you instructions on how to retrieve it from your email
by bill_b3llo Fri Dec 12, 2008 1:27 am
This sounds like the same group, if the checks are coming from London now. The site killers have done a great job, but these guys keep evolving. The new domain is a fake too, as far as I can tell. I can't find any real domain by that name, so fire away.

Please keep posting up any company names or email addresses these thieves use. If any law firm does recieve a check from Toronto or the UK, please preserve that and any documentation. These are some excellent fakes from what I've seen.

Runamok, thanks for posting that bank account, and we will take good care of that one. :-)

I'll see if I can contact Mr. Fine.

A warning has been issued to the American Bar Association for distribution to it's state chapters. Here's the edited version:

Scammers step up efforts against law firms

by xx- Chief Security Officer - Law Enforcement Support Division, Fraud Aid, Inc.
and xx– Cyber Crimes Investigations, Vancouver Police Dept.

December 1, 2008, updated December 11, 2008

The Facts

Nigerian scammers operating out of Canada and the U.K. have stepped up their efforts against U.S. and
Canadian law firms in what is called the “Collection” scam. The suspects have access to mass produced
counterfeit negotiable instruments, mostly in the form of certified or corporate checks, and have
successfully defrauded a number of lawyers in both the U.S and Canada.

On or about August 4, 2008, a suspect using the aliases xx and xx purchased
mailing lists of North American law firms from an online marketing company.

On or about October 21, 2008, the same group purchased an internet domain of kyleenterprisehk.net and
email services from Rosepark Telecom, an internet service provider favored by fraud artists.

Other known aliases of suspects and companies involved in the fraud are Deborah Morrison, Philip
Franklin, Bernard Morin, Genentech, Devlan Construction, Edward Jones Securities, Mystik Toyz, Bajer
Design & Marketing, Inc., Phillips Toy Mart, Belmont Toys, Toys 4 Fun, Kidcore Toys, Train Central,
Masterpieces Puzzles, Mega Marbles, Another World Enterprises and Save A Buck Enterprises.

The Scenario

The target firms will be, or have already been, contacted by an individual claiming that their company
wishes to engage the firm for collection efforts and/or the purchase of property by an offshore client. A
person from the law firm will then contact the person supposedly owing the debt (an accomplice) at which
time they will agree to pay the full amount, or an amount over what was "due." These checks will be sent
via UPS, FedEx, Canada Post and in some cases, U.S. mail.

The instrument will arrive and, to the naked eye, appear to be legitimate. In some cases even
examination by the bank fails to detect the counterfeit. These checks are stolen from real companies and
altered so that only the name of the payee is changed. It is not until the check returns to the legitimate
company and an audit is performed that the counterfeit is detected. At this time the law firm is held
accountable for the lost (stolen) funds.

False Due Diligence

Some firms have already made the mistake of believing that simply depositing the check and waiting for
the bank to approve payment is sufficient due diligence. There is also a false belief that a faxed copy of a
drivers license and or passport is legitimate identification. The only true identification is a “face to face”
with the person you are doing business with—even then they may produce false identification.
These counterfeits are created with the names, routing and account numbers of legitimate companies.

The normal processing for any check is for the instrument to be sent to the paying bank. The paying bank
will often only check to see if the funds are available and that the account that the check is drawn against
is in good standing. In these cases, it may be months before the scam is discovered and even then only
by the real company itself during account reconciliation.

Correct Due Diligence

The check is ALWAYS the weak point of the fraud and there is only ONE way to verify the legitimacy of
the check and the transaction.

The company that supposedly drafted the check should be contacted directly. Any phone number printed
on the check should first be verified. If one is not present on the check, either do an online search or use
directory assistance to locate the company’s real phone number. Ask to speak directly with the Accounts
Payable department to verify the validity of the check and transaction.

If you have been a victim of this type of scam, or are in the process of completing a transaction, contact
your local police department and advise them of the situation.

Write me at scamspook at gmail.com
by Runamok Tue Dec 16, 2008 7:31 pm
Checking back in. I tried to come on your site the day after I first posted, but site was down for some reason. I'm happy to give you all access to whatever information I have in these emails. I have saved all of them in electronic and written format. The check sits here in my office, in case the IC3/FBI ever want it. Thanks again for all of your great work. I'll be back to see if anyone here needs anything I can help with!
by Runamok Wed Dec 17, 2008 3:22 pm
I figured out how to copy the header from the emails I have from "M. Lee" of Boying Model Factory. I don't know if one email header is different from another, but here's the header from the last email I received.

Microsoft Mail Internet Headers Version 2.0
Received: from p02c11m022.mxlogic.net ([208.65.144.245] RDNS failed) by mail.xxxxxxxxxxxx.com with Microsoft SMTPSVC(6.0.3790.3959);
Thu, 11 Dec 2008 04:21:49 -0700
Received: from unknown [67.15.35.158] (EHLO webmail.mailhostingserver.com)
by p02c11m022.mxlogic.net (mxl_mta-6.1.0-1)
with ESMTP id bc7f0494.3098553232.1200.00-009.p02c11m022.mxlogic.net (envelope-from <[email protected]>);
Thu, 11 Dec 2008 04:21:48 -0700 (MST)
Received: from localhost (unknown [127.0.0.1])
by webmail.mailhostingserver.com (Postfix) with ESMTP id 3A183330C88
for <xxxxxxxxxxxxxxx>; Thu, 11 Dec 2008 11:26:12 +0000 (GMT)
MIME-Version: 1.0
X-Mailer: AtMail PHP 5.5
Message-ID: <[email protected]>
To: "XXXXXXXXXX" <Xxxxxxxxxxxxxxxxxx>
Reply-To: [email protected]
Content-Type: multipart/mixed;
boundary="=_3619741510c042a23291dd470c4dd6f6"
X-Origin: 74.210.54.131
X-Atmail-Account: [email protected]
Date: Thu, 11 Dec 2008 11:26:12 +0000
Subject: Wire information
From: [email protected]
X-Spam: [F=0.0770707182; B=0.500(0); CM=0.500; MH=0.500(2008121104); R=0.250(108111111051); S=0.200(2008120801); SS=0.500; SC=none]
X-MAIL-FROM: <[email protected]>
X-SOURCE-IP: [67.15.35.158]
X-AnalysisOut: [v=1.0 c=1 a=d7lHiXSi5jMA:10 a=6gNzRDOZIUrh0hkNqhlcog==:17 ]
X-AnalysisOut: [a=hT9WaoHl2RNvH2yoJSkA:9 a=poLWMZwa_BcfQxnD3LWkobOwOlYA:4 ]
X-AnalysisOut: [a=igkdSQrOE6AA:10 a=KilxtrpNQitT_rUCR1QA:9 a=rid1iLFpNB3qT]
X-AnalysisOut: [qxyhX1pSe3e8Z8A:4 a=XyJZ_TEOfTkA:10]
Return-Path: [email protected]

--=_3619741510c042a23291dd470c4dd6f6
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"

--=_3619741510c042a23291dd470c4dd6f6
Content-Transfer-Encoding: base64
Content-Type: application/octet-stream;
name="KENPET INVESTMENT2.rtf";
Content-Disposition: attachment;
filename="KENPET INVESTMENT2.rtf";


--=_3619741510c042a23291dd470c4dd6f6--
by bill_b3llo Wed Dec 17, 2008 7:28 pm
Thanks Runamok. To trace headers, you can go to http://www.nextwebsecurity.com, then go to public tools--location tools and click on the Scam Email Parser at the top. That email came from Toronto.


And yet another format:

My name is Craig Burton, I run a family business with my wife and son, selling Arts and Crafts
imported from China. We are just a small business trying to grow.

Please find below my details:

NAME: CRAIG BURTON
ADDRESS: 166A HITHER GREEN LANE, LONDON SE13 6QA UNITED KINGDOM
TEL: + 44 2070601797
MOBILE: + 44 7529477075
FAX: + 44 2070601798
EMAIL; [email protected]

DETAILS OF DEBTOR;

NAME OF DEBTOR: JEFF M LAWSON
ADDRESS: 1824 JANE STREET, UNIT 216 YORK, ONTARIO M9N 2T3 CANADA
TEL: 1-647-686-9614
FAX: 1-509-694-5420

AMOUNT OWED: $104,000.00 (One Hundred and Four Thousand Canadian Dollars Only)

I will attach a copy of the sales invoice and a Collection Note Duly signed by Jeff Lawson who
came to our studio to pick up the items.

Please kindly treat as urgent.

I understand that you operate a NO WIN NO FEE POLICY.

I need to know your terms and conditions. I am waiting for your reply

Regards

Write me at scamspook at gmail.com

Who is online

Users browsing this forum: ClaudeBot, Majestic-12 [Bot] and 4 guests