This e-mail scam gets points for trying a little harder than usual

Received this morning:

Bank of East Asia Ltd.
Bank of East Asia Building,
137 Market Street, Singapore 048943
Email-seahchaio1@hotmail.com


Good Day,

A customer of ours who may relate to you (perhaps) in Singapore died three years ago in Tsunami tragedy in Indonesia leaving behind an estate/capital (US$14.2M with interest) in a bank here where I work, till date nobody has come forward or put application for the claim. Please log on to this websites for more information about the Tsunami tragedy.

http://www.asianews.it/index.php?l=en&art=2375
http://www.asianews.it/index.php?l=en&art=2745

During the bank private search recently for the late gentle man relatives your name and email contact was among the findings that matches the same surname as the deceased (name WITHELD for security reason) who died intestate with no Will or next of kin. To maintain the level of security required I have intentionally left out the final details.

I urge you to come forward since I can provide you with the details needed for you to claim the estate/capital so that I can be gratify by you, in this way $4,260,000.00 for you and $9,940,000.00 for me and my colleagues that will do all the crucial part in the bank to have the claim release to you promptly.

To affirm your willingness and cooperation,please do so by replying me at my private email (seahchaio1@hotmail.com) with your FULL NAME, DATE OF BIRTH,TELEPHONE NUMBER, FAX NUMBER, PRIVATE EMAIL ADDRESS, BANKING DETAILS AND POSTAL ADDRESS.

I do expect your prompt response.

Thank you,
Mr.Seah Chai.
Email-seahchaio1@hotmail.com

The author of this scam has done a few things to improve the perceived credibility of his or her offer (I'll assume hereafter the author is a male). First, by posing as a Singapore national, his fractured English is much more excusable than it would be if he was posing as a native English speaker.

Second, and more significantly, he refers to an event that we actually know about -- the December 2004 tsunami. He even provides links to legitimate news articles about the tsunami, hoping that this appeal to authority will overcome our reticence, and hoping that we won't notice that this documentation is completely immaterial to his business proposal. This rhetorical sleight-of-hand works in other settings, so why not here?

Third, he realizes that the Hotmail contact address needs to be explained, and attempts to do so: "Look, I'm suggesting that we split this money, and it wouldn't do for my employer to know that we're doing this, so please contact me at my private e-mail address." Unfortunately, the author's credibility is undermined by the presence of two other addresses in the message header. The Reply-to address (seahchaio3@hotmail.com) is a slight variation on the address in the message, but the From address references domain centrum.cz, suggesting that the message originated in the Czech Republic.

But maybe not. The detailed mail header shows all of the "hops" the message made on the way to my mailbox. At one point it passed through mail.centera.com.au (which doesn't show up in any Whois listing) and lvbw.net (an ISP in Branson, Missouri, USA). The ordering of the entries suggests that the message actually originated in Branson.

Thanks for playing, whoever you are. Keep at it, and you may create a masterpiece in time.

Another pathetic e-mail scam

Really -- what are they teaching in the Scammer Schools these days? There must be a lot of social promotion, because a lot of guys are graduating without even the most basic skills. Here's one that came in this morning:

ATTENTION: EDU WEBMAIL SUBSCRIBER:

This mail is to inform all our {EDU WEBMAIL} users that we will be upgrading our site in a couple of days from now. So you as a Subscriber of our site you are required to send us your Email account details so as to enable us know if you are still making use of your mail box. Further informed that we will be deleting all mail account that is not functioning so as to create more space for new user. so you are to send us your mail account details which are as follows:

*User name:
*Password:

Failure to do this will immediately render your email address deactivated from our database.Your response should be send to the following e-mail address.
Your Admin Manager: webmailsubscriber@jmail.co.za Yours In Service.
Mr fred johnson

I didn't realize that our university's webmail server was being administered by a guy in South Africa. Huh. You learn something new every day.

Lamest attempt at en e-mail scam that I've seen in a long time

You would think that by now the folks that perpetrate the Nigerian-style e-mail scams (where someone offers you fabulous riches in exchange for just a little bit of your money) would have figured out some Basic Rules For Scam Composition. You have to establish a certain level of credibility in order to get your victim to bite.

Granted, different people have different thresholds of credibility, so the scammers have seen a good measure of success even when their messages have laughable formatting and atrocious grammar and spelling.

Today I received a scam message that was so bad, I had to conclude that either (1) someone is trying to break into the business and hasn't learned the rules yet, or (2) someone is researching human gullibility for his or her PhD dissertation.

Here's a screenshot of the message. Click to view a larger image.


The message body is quite illiterate, and should immediately cause a reader to ask: Why would a FedEx employee be entrusted with this task if she has the writing skills of a fifth grader?

Here's the text of the message, with original formatting preserved:*

Subject: CONFIRM OWNERSHIP (PARCEL) Via Mail fedexcustomerservices_dep23@yahoo.com.hk

We have been waiting for you to contact us. Your package itself is a Bank Draft which worth over $500,000.00.usd As you know, FedEx do not ship money in CASH or in CHEQUES but Bank Drafts are shippable.

However, you will have to pay a sum of $291.00 USD to the FedEx Delivery Department being full payment for the Security Keeping Fee of the FedEx Company as stated in our privacy terms & condition page.

FedEx Delivery Post Contact Person: Mr. Peter Luis Tel: +234-8078-082-201 Email: fedexcustomerservices_dep23@yahoo.com.hk Kindly complete the below form and send it to the email address given above. This is mandatory to reconfirm FULL NAMES:. TELEPHONE:.. ADDRESS :..COUNTRY:.

Yours Faithfully,
Mrs Victoria Wallison
FedEx Online Team Management

This has the hallmarks of a typical scam message, including the phenomenon of a global corporation using Yahoo (in Hong Kong, no less) as its contact address. It also has the aforementioned problematic formatting and grammar.

But the message body is not what made me laugh out loud. If this was a legitimate message from FedEx informing me that I -- and nobody else -- had a valuable package waiting for me in the form of a $500,000 bank draft, I would expect the message to be addressed to me -- and nobody else (assuming of course that a company would use a nonsecure form of communication like e-mail to deliver such a notice). But the loser who sent this one had several dozen addresses in the To: field in addition to mine. Lame!

Oh, and the From: field referenced a Michael Booker, hailing from a domain for an electronic components business located in England. No sign of FedEx or Mrs. Victoria Wallison. Lame!

More accomplished scammers will put a bogus-but-legitimate-looking address in the From: field, and then put the real address (for the throwaway Yahoo, Hotmail, etc. account) in the Reply-To: field (which many e-mail programs do not display).

With a quick look at the detailed mail header (in particular the Received: fields), it was obvious to me that the message was in fact sent from the mail server of that English electronic component business. That leaves two possibilities (that I can think of at the moment):

1. Michael Booker is himself the scammer, and deserves all of the hate mail he'll receive because he wasn't clever enough to conceal his actual e-mail address, or
2. Michael Booker inadvertently downloaded a spyware/trojan horse program that has turned his PC into a zombie -- generating spam e-mails at the behest of some unknown party, using Booker's e-mail account.
   

I suspect the latter, because this is a well-established method of operation for spammers. If this is the case, perhaps the hate mail he receives will persuade him to be a little more diligent to keep his PC invader-free.

Whoever the actual scammer is: C'mon guys, you're dissapointing me! But thanks for the laugh.


* Reproduced here as search engine bait. If I can help just one person keep his money in his wallet, I'll be a happy man.

What ARE they teaching in those phishing scam schools these days?

I am Mr. Robert Dutu, and even though I know that you know that I'm trying to scam you, I am going to try to scam you anyway. Oh, you are the CEO of an anti-phishing software company? Excellent. Now, sir, I was wondering if I could have a little bit of your time so I can tell you about a remarkable business opportunity.....

Don't take candy from strangers. But £6,000,000? Why not?

Do you enjoy reading the countless emails offering millions of dollars if only you would help the sender in some noble task? It seems that -- even after all these years -- there are still plenty of naifs out there who actually take the bait, because the flow of such "offers" shows no sign of slowing.

I can think of at least three reasons why I enjoy reading them:

1. I am amused by their imprecise command of the English language, even though they often purport to come from some highly-educated native of an English-speaking country.
2. I am intrigued by the social-engineering design of the message -- i.e. what technique they think will persuade the reader to reply. This usually involves an appeal to compassion, adventure, or simple greed.
3. I note how the average scammer has a (justifiably) low opinion of the average bait-taker's knowledge of how the internet works.
   

You can see all three points at play in the following message that I received this morning:

From: Mrs Russell Haswell
Reply-to: mrsrhaswell@8u8.com
Date: Mon, 16 Mar 2009 09:18:46 +0100

Here writes Mrs. Russell Haswell, suffering from cancerous ailment of the brain. I was married to Dr. Collen Haswell, an English man who is now dead. My husband was into private practice all his life before his death. Our life together as man and wife lasted for three decades without a child.
My husband died after a protracted illness, before his death, we had an agreement and arragement to uplift the down-trodden and the less-privileged individuals as he had passion for persons who can not help themselves due to physical disability or financial predicament. I can adduce this to the fact that he needed a Child from this relationship, which never came.

When my late husband was alive he deposited the sum of £6,000,000.00 (Six Million Pounds sterling) which were derived from his vast estates and investment in capital market with his bank here in UK. Presently, this money is still with the designated Bank, while my Doctor told me recently that I have limited days to live due to the cancerous problems I am suffering from since it affects the delicate part of my brain. With this hard reality that has befallen my family, and me I have decided to donate this fund to you and want you to use this gift which comes from my husbands effort to fund the upkeep of widows, widowers, orphans, destitute, the down-trodden, physically challenged children, barren-women and persons who prove to be genuinely handicapped financially and i do not discriminate any religion for we all look up to one God.

It is often said that blessed is the hand that giveth. I took this decision because I do not have any child that will inherit this money and my husband relatives are bourgeois and very wealthy persons and I do not want my husband’s hard earned money to be misused or invested into ill perceived ventures. I do not want a situation where this money will be used in an ungodly manner, hence the reason for taking this bold decision.

As soon as I receive your reply I shall give you the contact details of my Lawyer who will guide you through the clearing process from the bank here in the UK. Please assure me that you will act just as I have stated herein.

If you are interested, Please send your response to this email: mrsrhaswell@8u8.com

Endeavor to send your reply to this email: mrsrhaswell@8u8.com

Respectfully,
Mrs Russell Haswell
Benefactor.

Note that Mrs. Russell Haswell claims to be in the U.K., and then note the rampant spelling and grammar errors -- including the occasional awkward or clipped English. Hey, wait... don't the British spell it "endeavour"? "Endeavor" is the American English spelling. And... what's up with the random capitalization? And... since when is Russell a woman's name? And... And... And...

The message quite obviously uses compassion as its bait.

To me, the reply email address is always the dead giveaway. Many scams use throwaway addresses from Yahoo, Hotmail or the like, even though the sender is supposed to be (for example) a fantastically rich businessman. Often, the return address is for a Yahoo domain located in a country thousands of miles away from the sender's purported location. That kind is easy.

This one is a little more tricky, but it's not difficult to see through the veil. The message had a From address of info@charity.com (a domain that is currently not in use for any charity-related purpose), but the message itself (and the Reply-to in the message header) refers to mrsrhaswell@8u8.com. If you simply hit Reply on the message, the reply will go to this address.

It's not Yahoo or Hotmail, so maybe it's real. I've never heard of 8u8.com, but I'm not from Britain, and maybe that's a legitimate company there. How can I be sure? By doing a domain search.

The first stop should be a "WhoIs" domain search at a site like Internic. We enter in 8u8.com, and here's what we get back:

Whois Server Version 2.0

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

Domain Name: 8U8.COM
Registrar: ONLINENIC, INC.
Whois Server: whois.onlinenic.com
Referral URL: http://www.OnlineNIC.com
Name Server: NS1.DNS-DIY.COM
Name Server: NS2.DNS-DIY.COM
Status: clientDeleteProhibited
Status: clientTransferProhibited
Updated Date: 19-jul-2008
Creation Date: 15-jan-2000
Expiration Date: 15-jan-2010

Okay, we don't have our answer yet, but we've been told exacty where to look. Internic says that the domain is officially registered at a place called OnlineNIC. We go to their WhoIs page and repeat our search. Here's what we get:

Registrant :
Tong Li litie@cnsnn.com +86.13902936686
Tong Li
A801,Block A,WorldTradePlaza,Fuhong Rd,Futian Shenzhen
Shenzhen guangdong CN 518026

Ummmm...... Shenzhen, CHINA? Mrs. Russell Haswell, is there something you aren't telling us?


UPDATE: Simply posting this note has revealed another interesting data point: how widespread the scam message's distribution was. Looking at the visitor log for this site shows that many have arrived via a Google search on "Mrs. Russell Haswell". These visitors hail from the U.S., Britain, Ireland, Slovakia, Poland, Sweden, Spain, Kuwait, Vietnam, Australia and South Africa. I'm actually quite crestfallen, Mrs. Haswell. I thought we had something special.

UPDATE, 3 MARCH 2011: As the first commenter notes, Mrs. Haswell apparently experienced a miraculous recovery in 2009, but she seems to have suffered a relapse.  I'm getting a lot of hits on this post again from people searching for information on "Mrs. Russell Haswell" or "Dr. Collen Haswell".   Thanks for stopping by!

Scam Spam du jour

I guess the Nigerian 419 scamsters have established the fact that there are no end of suckers in this world. The following e-mail that I received this morning shows one of they ways they (the scamsters, I mean) are branching out. Comments follow.

From: quartz46@tv2mail.dk
Subject: WINNING NOTIFICATION!!

QUARTZ PROMOTIONS WORLDWIDE.
INTERNATIONAL PROGRAM (NL)
333 COMMERCIAL STREET,
MANCHESTER NH 03105, UK

FROM: THE PROMOTION DIRECTOR
INTERNATIONAL PROMOTIONS DEPT.
REF: 7487/4360/4629
BATCH: 830923183-DX68

ATTN;WINNER,
RE:AWARD FINAL NOTIFICATION:,
We are pleased to inform you of the result of the Lottery Winners International programs held on the 19th of September, 2005. Your e-mail
address attached to ticket number 986047296748-8562 with serial Number 4681-546 drew lucky numbers 5-24-78-62-11-08 which consequently won in the
1st category, you have therefore been approved for a lump sum pay out of £500,000.00.00Pounds (Five Hundred Thousand Pounds).CONGRATULATIONS!!!
Due to mix up in some numbers and names, we ask that you keep your winning information confidential until you file for your claim. This is part of our security protocol to avoid double claiming and unwarranted
abuse of this program by some participants.
All participants were selected through a computer ballot system drawn from over 25,000 companies and 50,000,000 individual e-mail addresses and names from all over the World. This promotional program takes place every year.
This lottery program was organized by our group of philanthropist promoted and sponsored by Mr. Bill Gates of Microsoft Inc, eminent personalities like the sultan of Brunei, Multi Choice and other corporate
Organisations.This lottery program was organized to improving the use of computer softwares and for the benefit of every Microsoft user.
To file for your claim, please contact our fiducial Agent:
QUARTZ TRUST AGENCY.Foreign transfer manager.
Mr.Peter Banks.
FAX +44 700 593 8064
Email:q_trust01@katamail.com
They are your agent, and responsible for the processing and transfer of your winnings fund to you.Remember, all winnings must be filed not
later than 8th of November,2005 or when authentic proof is given for the delay of filing. Please note in order to avoid unnecessary delays and complications, remember to quote your reference number and batch numbers in all correspondence.
Furthermore, should there be any change of address do inform our agent as soon as possible.Congratulations once more from our members of staff and thank you for being a Winner in our promotional program.

Note: Anybody under the age of 18 years is automatically disqualified.

Sincerely yours,
Mrs. Victoria Green,
Lottery Coordinator.

Confidentiality Notice:
The information contained in this e-mail and any attachments may be legally privileged and confidential. If you are not an intended recipient,you are hereby notified that any dissemination,distribution or copying
of this e-mail is strictly prohibited. If you have received this e-mail in error, please notify the sender and permanently delete the e-mail and any attachments immediately. You should not retain, copy or use this e-mail or any attachment for any purpose, nor disclose all or any part of the contents to any other person.


------------------------------------------------------
Opret en gratis TV2 mail på http://tv2mail.tv2.dk

In making several observations about this e-mail, I offer some free advice to the scamsters about how to improve their "product":

• Given that you're supposed to represent a bunch of rich people and organizations, we can be forgiven for assuming you could afford to have someone on staff who is familiar with basic rules of punctuation, grammar, and paragraph formatting.
• If you're supposed to be in country X (England), don't send the message from an e-mail service in country Y (Denmark) and give a reply address for an e-mail service in country Z (Italy). At least the Nigerian-style scamsters could be forgiven for this—after all, they're on the run from corrupt authorities in their home country as they're trying to transfer SIX MILLION U.S.DOLLARS to some lucky e-mail recipient. But the rich folks you represent surely could have scraped up a bit of cash to buy a domain name. Hey, they even could have gone to GoDaddy and gotten both a domain name and e-mail for mere pocket change.
• I'm sorry, but the following is an immutable law: Any e-mail that invokes the name of Bill Gates as a means of establishing its legitimacy is automatically a hoax.
• Organizations dealing in the transfer of hundreds of thousands of pounds/dollars in funds will never, ever, ever send an official e-mail whose Subject line contains more than one exclamation point following a single word. You did it again in the message body, upping the ante by one exclamation point. Good grief—you might as well have followed it with "LOL".
• I've just violated your Confidentiality Notice. Neener, neener!

11/9 UPDATE: Scamorama lists this and dozens of other lottery scams floating around the 'net.