New Twist on 419 Scam - Read our story

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Fri Feb 01, 2008 11:14 am

Hello all at 419eater.com. As you can see, this is my first post here. Normally, I am more of a lurker on these forums, but I felt I finally had an opportunity to post something worthwhile, informative and quite interesting. This post is a narrative of a 419 scam that was attempted on my company, this time with a twist which I had had not heard of. I hope this will serve to warn others about this particular fraud. Also, since the fraudster is still out there, perhaps members could give me some advice about what to do with him: forget it and move on or waste some of his time. I should point out here that I will be including parts of the email conversation my colleague had with the fraudster and that sensitive parts such as names, products, our company etc. will be redacted. I am also going to distort the fraudster�s alias and email address slightly in case he does an online search for them so as not to tip him off.

Before I start, I would like to give a little background on myself and my company. We have been trading online for over 3 years with a number of websites, selling items to businesses, mainly in Ireland where we are based but also to other countries in Europe. Personally, I would consider myself quite savvy on scams and techniques and telltale signs to spot scammers, having spent sometime on these boards, and reading up generally on 419 and other scams online. Like any company which publishes contact details, we receive quite a steady stream of scam emails from the traditional dying relative 419 emails to unsubtle requests for huge shipments of our product to be delivered to Lagos which are clearly fraudulent. Additionally, we previously have done business with companies worldwide (mainly in Asia) using only email (not phoning them) mainly due to the language barrier. Mainly thanks to careful research on the company before doing business/paying for goods, we have yet to be scammed, but we realise this kind of transaction is high risk.

Anyway, here is the first email we received from this scammer. (I have obscured his alias with spaces)

Quote:

from f e d [SPACE] m e d <asena_****** [AT] yahoo.com>
to sales@[website redacted]
date 9 Jan 2008 16:39
subject [product name redacted]
signed-by yahoo.com

Dear sir,
I have a client who is much interested to buy 7pics of this [product name redacted] found in your advert and is offering to pay 180 Euro each kindly get back to me if the price is acceptable.
Kind Regards
F e d [SPACE] M e d

Ok, there were about twenty alarm bells in this first message � yahoo email, odd name, representing a client and not himself, looking for only a discount of only �9 (retail price was �189) typos, no questions about the product, no contact phone number etc.

Anyway, my colleague sent him a reply recommending him a slightly different machine we had recently added to our site and quoting him a price. He replied as follows (I have obscured the company name with spaces):

Quote:

from f e d [SPACE] m e d <asena_****** [AT] yahoo.com>
to [name redacted] <[email redacted]>
date Jan 16, 2008 3:12 PM
subject Re: [product name redacted]
signed-by yahoo.com
mailed-by yahoo.com

Hi [name redacted],
Thanks for the reply,After much consideration my client have decided to go ahead with the purchase of the 7 units of [product name redacted] and bank transfer will be more secure and faster method of payment,so please provide for my client an account details to effect payment, the followings were required for the bank wire transfer to be effected from here
BANK NAME AND ADDRESS
ACCOUNT NAME
ACCOUNT NUMBER
BANK SWIFT CODE
Please confirm to us when the payment refflected in your account so we can proceed on the shippment
Also send the contract or perfoma-invoice for my client by scan to our mail,For the contract here is the info :-
C O P P E R [SPACE] P R O C U R E M E N T [SPACE] S E R V I C E S
URBAN NUEVO VERSALLES 201-11A
LORANCA,FUENLABRADA 28942
MADRID-SPAIN
Best Regards
F e d [SPACE] M e d.

Again, there are a number of suspicious things in the email most notably the speed at which he has decided to complete the transaction. However, the customer being located in Spain would explain his poor English and preference to use email instead of calling us. In fact, we had made moderately large sales (successfully) to different companies in Europe under similar circumstances. We were suspicious at this point, but we decided to forward him an invoice with our bank details anyway, reasoning that if the funds originated from a Spanish account with the same name, it would be unlikely to be a scammer. To be completely honest, this was a mistake probably fuelled out of the desire to make a sale and not out of common sense. The invoice total was for �1320.

We don�t hear anything for a couple of days, but then on the 29th January, a payment of �4800 appears in our account � I�m sure this sounds familiar! At this point, we had written of this person as being a genuine customer and did not associate him with this transaction. However, a couple of hours later, my colleague received this email:

Quote:

from f e d [SPACE] m e d <asena_****** [AT] yahoo.com>
to [name redacted] <[email redacted]>
date Jan 30, 2008 7:14 AM
subject [product name redacted]
signed-by yahoo.com

Dear sir,
I've just been informed by my client that the sum of (4,800 Euro) was errornoeusly sent to you instead of your 1320.72Euro,this was due to mix up of invoice as the amount sent to you was meant for another customer of my client.
Please go ahead and accept the money as it might suprise you that you received more money than you expected then made a devolution by taking your amount of 1320.72EURO and the rest i will get instruction from my client what to do with it.
Finaly please try and let us find an objective solution to this problem as the client is very worried and is a very important client to us,and we have given our word to him not to worry that the problem will be solved.
Thanks.
F e d [SPACE] M e d

At this point, of course we were sure it was a scam. However, I would like to point out there was a 10-second interval where I thought to myself: �Maybe this guy genuinely sent the wrong amount�. It�s slightly embarrassing to admit that, but I really did feel bad for the guy for a few seconds.

Also, at this point I was puzzling over the mechanics of the scam. My best guess was that it was a hijacked/phished bank account and that the scammer was trying to use us to launder the funds to another account while we would have to deal with the consequences when the account owner discovered his funds were stolen.

Anyway, I immediately contacted my local branch, explained the details to my account manager and faxed them the email conversation. Our bank is Bank of Ireland and I must say that they handled the situation quite well.

While I was waiting to hear back form the bank, two things happened. First, another email from our friend (I have added spaces to his name to obscure it):

Quote:

from f e d [SPACE] m e d <asena_****** [AT] yahoo.com>
to [name redacted] <[email redacted]>
date Jan 30, 2008 10:25 AM
subject Re: [product name redacted]
signed-by yahoo.com

Hi [name redacted],
I hope you have recieved my previous mail?Please if the payment refflected in your account kindly endevour to return back the overage to the account provided by the client as instructed.
EMIRATES BANK DUBAI (U.A.E)
A/C NO ; 002739228****
A/C NAME ; A D E W A L E [SPACE] A D E Y E M I [SPACE] I S M A I L
SWIFT CODE ; EBILA***
Best Regards
F e d [SPACE] M e d.

Of course, this is what we were expecting, a bank in the UAE appeared to be quite an amateurish twist, but I�m sure people could fall for it.

At this point, I decided to do a little research of our scammer (I should have done this at the beginning). Examining his email headers, I found his originating IP address:

195.225.63[DOT]115

Checking this on Maxmind�s lookup service:

Hostname 195.225.63[DOT]115
Country Code A2
Country Name Satellite Provider
Region
Region Name
City
Postal Code
Latitude 0
Longitude 0
ISP Ariave Satcom LTD
Organization Ariave Satcom LTD
Metro Code
Area Code

A little more searching led me to:

http://www.ariave.com/news.htm

which hinted that the company was based in Ajuja, Nigeria.

Another site explained:

"Ariave Satcom is a broadband satellite ISP based in Israel that provides Internet connections to many customers in West Africa, including many Nigerian internet cafes."

Well, at this point that probably should have been obvious. Google searches for his IP and neighbouring IP�s in his IP block yield all sorts of results for traditional 419 emails, banned forum lists, email harvesters, fake sales of high tech goods (mobile phones, iPods) etc.

At this point, I heard back from the bank which had had a little difficulty in tracking down the incoming bank transfer. That�s because there was no incoming transfer!

Instead, the scammers had physically lodged a fake Ulster Bank (another Irish bank) bank draft into our account and had purported it to be an incoming transfer. This, I must say was moderately clever. Of course, the offer of an overpayment on a bank draft has become a commonplace scam, so this was an interesting twist on the scam as people regard transfers (which this appeared to be) as being much more secure cleared funds.

What is also interesting and a little scary was that this lodgement appears to have been physically made at a branch of Bank of Ireland in Dublin. Anyone who lives in Ireland knows we have a large and growing Nigerian population; most of whom I assume are honest hard-working people. However, it appeared at this point, that our scammer had an accomplice in Dublin, quite near to where we are physically located.

We decided at this point to report the matter to the local police (Gardai) since there was a possibility that they could catch the guy who made the lodgement. The matter is still in progress but I do not know if anything will happen.

Meanwhile, the fake lodgement is still appearing in our account but the bank has promised to reverse it and deal with the matter fully. They also have a copy of the lodgement slip and hopefully have footage of the guy on CCTV. (It has occurred to me that some banks may accept lodgements by post/mail so this is also a possibility).

The reason why I have posted this in such detail is twofold. Firstly, I wanted to warn people about this scam. Secondly, I would like some advice from the forum about our situation. The scammer in Nigeria has emailed us again looking for confirmation of the transfer etc. My first instinct was to ignore these. However, I wonder if there is any point communicating with him, either to waste his time as he has wasted ours or to try to get him to reveal some information. Or is there any way we can trace him through the UAE bank account he provided? Or should we just call him a mugu and move on!?

All feedback is appreciated.

Posted: Fri Feb 01, 2008 12:02 pm

Very interesting IrishSeller ..and thank you for posting.

My advise to you would be to leave this guy alone. ... it sounds like the authorities have got a handle on this.

The scammer has all your details and it sounds like he has a 'representative ' in Ireland.

Simply tell him that your Bank has detected the the transaction is fraudulent and has cancelled it, therefore your transaction with him is now terminated.

Please come back and let us know any developments

EDIT to comment

Quote:

(It has occurred to me that some banks may accept lodgements by post/mail so this is also a possibility).

A very good possibility !!!! ....it could have been posted anywhere in the world, and although I expect that your Bank will still have a lodgement slip or covering letter it won't have the envelope it arrived in.

Moderator Joined: 10 Jan 2007 Posts: 14513

Thanks for posting this, and welcome to Eater. This information will help educate other folks about the scam.

This appears to be some "overpayment" scam. Scammer agrees to buy a product, and then sends too much money by accident, and wishes to have you wire him the overpayment. While it is normal done by check, it appears a few scammers are now using bank transfers (it may be a hacked account, or an "account" flash --- a member with more banking expertise than I will likely chime in to explain it for you).

In anycase, drop all correspondence with this scammer. He has your informaiton and banking details. We never bait people that have our personal informaiton. Just make sure your bank is aware of the situation. Not to worry, he will cease contact with you in a few days once he realizes you did not fall for it.

EDIT: Spot beat me to the punch

Trophy Videos · Posted: Fri Feb 01, 2008 12:15 pm

First of all, I'd like to say I'm sorry that you got involved with these guys. Many innocent people have fallen for schemes like this. This scam is a bit of a twist on the standard check scam. Instead of the vic receiving the check and depositing it, the scammer gets the account number, and sends one of their gang to physically go to the bank and do it them selves. This is a bit riskier for them, as you said, there are cameras in banks.

You should immediately stop all contact with them. This means no emails, no phone calls, no letters. Ignore all their attempts to contact you. They will eventually move on.
Contact a Moderator on this forum to give you additional support and direction. We also
have a sister site, Scamwarners.com, where you can also report this scam to warn others,
and they also help victims of scams. Click on the link above in the webpage^^up there, to get there.

You seem to have bank details in UAE, and there might be a possibility of getting their account shut down by the people over at aa419.org.

You should not try to "waste their time," or bait them, as they have your details. Drop them immediately. And wait for additional contact and direction, ok?

SlapHappy

Posted: Fri Feb 01, 2008 12:25 pm

As has been said, drop contact with them immediately. It looks like and overpayment scam alright, combined with an account flash. Often the lad will deposit a dodgy cheque straight into your account (not transfer the money from his account). The transfer shows up in your bank statement very quickly but then the cheque bounces and the cash is deducted again. In the few days that your account is showing the lads money, you have sent him the difference via WU or the like and are now out of pocket.

Posted: Fri Feb 01, 2008 12:31 pm

Other members ^^^ have said it better than I could, but I also want to thank IrishSeller for taking the time to write and post such a detailed report of this attempted scam.

Posted: Fri Feb 01, 2008 12:32 pm

SlapHappy wrote:

Instead of the vic receiving the check and depositing it, the scammer gets the account number, and sends one of their gang to physically go to the bank and do it them selves. This is a bit riskier for them, as you said, there are cameras in banks.

The scammer doen't have to even visit the bank ... he can do it all by post. All he needs is his Victims banking details and put the cheque in the mail.

Most banks in the UK and Ireland use Central Processing Units to receive postal payments so the account holding branch wouldn't even see it.

These Units receive thousands of payments each day and this one would be just another piece of paper ...no need for anything sophisticated Sad

thedevguy67 wrote:

--- a member with more banking expertise than I will likely chime in to explain it for you).

That's me

....30+ years ..including a short spell with Ulster Bank

Posted: Fri Feb 01, 2008 12:46 pm

Have lads gotten smarter? In any case, thanks for warning us about this.

Master Baiter Joined: 05 Sep 2006 Posts: 170

Ex, I don't know if it's truly a matter of lads gettings smarter per se. I see it instead as simply adapting their methods since many of their victims, as has been pointed out, are familiar with the classic check scam, and think that a bank transfer is more secure.

Posted: Fri Feb 01, 2008 5:46 pm

It's not new, lads have been account flashing for a while.

Posted: Fri Feb 01, 2008 5:48 pm

Yeah that's sneaky - cheers for posting it up matey Very Happy

Posted: Fri Feb 01, 2008 6:09 pm

@Irishseller - as others have, I want to thank you for posting your story here. It's a good education as to how overpayment and account flashing scams work. Sadly this is NOT an uncommon scam, although as others have pointed out, the flashing is a newer twist on just sending the fake check to the victim. Having the amount suddenly show up in one's bank account is much more effective, and will rope in some victims who wouldn't otherwise have fallen for an actual fake check.

I would like to reiterate the request to go post your story over at www.scamwarners.com. That is a site that we send real victims to, so they can learn more about scams, and read the stories of others. It is a huge help to them to see that they are not the only ones that have been victimized. I believe there are many people who would benefit from reading your story and seeing that it can happen to anyone, even successful, articulate business people such as yourself.

It's always wonderful to hear that someone was targeted, and escaped without losing a penny. Good job!

It's probably unnecessary, but I'll echo the words of others to drop all contact. However, if this experience has inspired you at all to start scambaiting, WELCOME! Read the stickies, learn how to bait safe, and join in the fun! Many baiters (including myself) starting doing this when we or someone we know was targeted by a scammer. It's our way of exacting some balance of justice out there in the world. Smile

Posted: Fri Feb 01, 2008 6:27 pm

A very good first post IrishSeller.

The clever twist to this scam is that the cheque is purposely being lodged at a different bank to the one you bank with, whether by hand or mail.

I nearly posted more, but that could be helpful to any scammer viewing the site.

I could make a few suggestions that will block this scammer tactic.

Scammers are like urine - if there's a crack in the pan they will find a way through it (apologies for that analogy).

Posted: Fri Feb 01, 2008 8:33 pm

good stuff to know, something to keep our eye open for thanks for the info

New Twist on 419 Scam - Read our story	View next topic View previous topic