Cheque massbait - maybe on again - watch this space

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Wed Mar 25, 2009 8:36 pm

@HM: Is he still writing you from dept3? I got him to send me one msg from dept1 and now nothing, even after I re-sent the WU receipt (.dll). Glad to hear he's still dragging himself to the computer once in a while though.

Master of Master Baiters Joined: 02 Dec 2008 Posts: 518

After being absent forever, the scammer contacted me again four days ago, checking if I was still interested. Smile

Posted: Wed Mar 25, 2009 9:56 pm

I got a script response from Dep't. 2 but nothing of value yet.

Posted: Wed Mar 25, 2009 10:34 pm

I'd be really interested if you can get some interaction from dept 2 - please let us know if you can!

Posted: Thu Mar 26, 2009 12:01 am

I have been emailing with him through Dept 3.

I got one quick email from him today after I told him that I have the cash ready to send but the WU office was in a really bad neighborhood so I needed to find another place to send it from. (This is after he spent 1/2 hour online chatting with me about where I could find a WU office yesterday.)

Than I sent another note saying the money was sent. I did not send a tracking number or anything. That was about 4 hours ago and I have not had a reply since.

For those wondering about the status of the undeliverable packages, the victim is on vacation until tomorrow, so I will call her back tomorrow afternoon/evening.

Posted: Fri Mar 27, 2009 12:11 am

I told him I sent the money yesterday and sent him a M7CN number. He complained, he emailed back asking for a scan of the receipt. I didn't answer right away. He called and left a message. My first scammer voice message. Very Happy

I just send a copy of the receipt. I wonder if he will have any trouble opening it. Wink

There was some discussion about where this group is located. The voice message sounded like a person with a Nigerian accent. Definitely not Asian or Eastern European.

Posted: Fri Mar 27, 2009 12:36 am

I think you're right HM, the evidence seems to point there mostly, although I'm sure there may be "affiliates" dotted around.

One (anonymous!) baiter told me that UPS had stopped his (and UPS said others too) package recently, so anybody at that stage wanting credibility/more cheques can also claim that.

UPS is the weak link in his chain - the packages seem to be sent using stolen cards with a fake return address but from various US locations. It also seems one of his "affiliates" opened an email sent by a baiter from a US location, so it could be that he has active accomplices doing the actual money order mailing - which means there must be some sort of UPS drop-off/pick-up going on. Anyone who can chase down more UPS numbers and get them over to the UPS customer service/security/fraud desk ASAP may make a bigger difference than they realise. At least that account will be killed, and they may get lucky catching an accomplice. UPS will obviously never condone baiters etc, but may still be pleased to follow up on information given "straight" if it saves them money too.

Anyone got any interesting stories from their baits yet? Has he called you anything nasty? Can you get him to? Wink

Posted: Fri Mar 27, 2009 2:20 am

Here's one of my older phone messages from "George." He's gotten more profane as time goes on. Sure sounds West African.

http://members.419eater.com/~bohigal/CheckLadCalls/unknown_2009-03-21_09-080.mp3

Posted: Fri Mar 27, 2009 4:15 am

Hi all!

I'm a student and just lost my part time job as a server, so applied with Forex in order to pay for tuition & books for my last semester. (very straight bait)

I was hired from Dept. 2. Same script everyone has been receiving - Notification of payment coming, cash it, forward it. But no tracking no. I mailed from a yahoo acc't. so he'd see I am where I'm supposed to be.

I wrote:

Dear Mr. Patel,

This is confirmation that I received your email (below). I need your help as I want to do a good job for your company on my first assignment. You said the payment would arrive at my address at 10:30am, Tuesday (today) 24th of March.

It is right now 12:20pm CST (central standard time) here in Crossville, TN. I have been waiting for two hours for the UPS man, but so far he has not arrived. Did you mean EST (Eastern Standard Time)? The difference between the two time zones is one hour.

Please let me know as soon as you can. I have an afternoon class at 3:30pm (my time) which I must attend or I will lose credits. Please send me the tracking number so I can either call them or go online and see what the progress of the check is.

I don't want to lose my first job opportunity with you, so I hope you will see this soon, and give me the tracking receipt information. Meanwhile, if it should arrive before you get back to me I will let you know immediately.

Very Truly Yours,
me

*At this point, I set up a two week free trial of readnotify and got impatient for a response & broke the cardinal rule of baiting (sparsely worded mail) but sent:

Dear Mr. Patel:

Did you receive the email (below) I sent you this morning while I was watching for the UPS truck to arrive? I waited for quite a while, and even called my neighbor to see if she would keep an eye out for him, but she wasn't home. I finally had to leave a note on my door as I had to get to class.

I trust you will keep in mind the time zones as far as deliveries go, and that I am on CST (Central Standard Time), not EST (eastern Standard Time) Also, UPS usually requires a signature or it gets sent back, so I need to know when I have to be home to sign for and receive it.

I assure you I will do my very best to carry out my responsibilities for your company. So for this not to happen again, please give me just a little notice and a tracking number so that I can schedule my day around it. Surely it takes at least a day to get to me from the client who is sending it. If you will just notify me in the beginning (right when it is sent off) I will be sure to be at home.

Please put your trust and faith in me. I am very capable of handling this job and I promise you will find my work more than satisfactory, but I do need the necessary information from you in order to be able to service your clients properly.

I hope to hear from you soon,

Very Truly Yours,
me

[b script response: [/b]

Dear Representative,

This email is to remind you that we are yet to receive any response from you concerning the funds in your possession. Kindly complete the transaction today and email the necessary Western Union information that the receiver will be needing to pick up the funds.

Regard's
GEORGE PATEL

I got used to him mailing back right away, but didn't get anything for a day so sent this knowing when he saw the subject line he'd have to open it thinking it was details of a payment on it's way:
From me:
MONEY TRANSFER CONTROL NUMBER AND PAYMENT
Hello,
Please verify your correct address for payment. Thank you.
-

Next reply came from a different name & address. This is the same one that Yastreb posted a few pages back but the number in it is 12 instead of 13 (which we know is dead). Same script as Dep't. 2:

RE: PAYMENT AND WESTERN UNION MONEY TRANSFER NUMBER

From john brown Thu Mar 26 01:35:45 2009
Return-Path: <[email protected]>
Authentication-Results: mta212.mail.re4.yahoo.com from=live.com; domainkeys=neutral (no sig); from=live.com; dkim=neutral (no sig)
Received: from 65.54.246.159 (EHLO bay0-omc2-s23.bay0.hotmail.com) (65.54.246.159) by mta212.mail.re4.yahoo.com with SMTP; Thu, 26 Mar 2009 01:42:58 -0700
Received: from BAY111-W5 ([64.4.17.105]) by bay0-omc2-s23.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 26 Mar 2009 01:35:45 -0700
Message-ID: <[email protected]>
Return-Path: [email protected]
Content-Type: multipart/alternative; boundary="_6ede2c5a-48ad-4387-8624-3afa247285a5_"
From: john brown <[email protected]> Add sender to Contacts
To: <[email protected]>
Subject: RE: PAYMENT AND WESTERN UNION MONEY TRANSFER NUMBER
Date: Thu, 26 Mar 2009 08:35:45 +0000
Importance: Normal
In-Reply-To: <[email protected]>
References: <[email protected]>
MIME-Version: 1.0

the funds is to be wired to -
Name: Cecilio Rabasto
Address: 14 Dao Street
City/State: Quezon City, Novaliches
Zip Code: 1123
Country: Philippines

Secret question and answer you use to secure the transaction is:
Test Question: Favorite Color
Answer: Green
Reason For Sending Money : Personal
-

*Note: Apelord came back with Redmond, Washington (state).... but ReadNotify tracked it to Riverside, California.
From ReadNotify:

To [email protected]
From [email protected]
Subject PAYMENT AND WESTERN UNION MONEY TRANSFER NUMBER
Sent on 26-Mar-09 at 01:56:30am 'US/Central' time
1st Open 26-Mar-09 at 03:28:39am -5:00 (86%) Riverside, California, United States

Tracking Details

Opened 26-Mar-09 at 03:28:39am (UTC -5:00) - 1hour32mins9secs after sending
Location Riverside, California, United States (86% likelihood)
Opened on 71-80-139-181¸dhcp¸rvsd¸ca¸charter¸com (71¸80¸139¸181:2951)
Language of recipient's PC: en-us (English/United States)
Browser used by recipient: Moz/4.0 (MSIE 7.0; WinNT 6.0; WOW64; GTB5; SIMBAR={8E97E740-131E-11DE-894E-002186B09ED9}; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)
Referrer http://by111w. bay111. mail. live. com/mail/InboxLight. aspx?FolderID=00000000-0000-0000-0000-000000000001& InboxSortAscending=False& InboxSortBy=Date& n=1600839357
Last log No more activity after 26-Mar-09 at 03:28:49am (UTC -5:00) - Log data indicates email was read for at least 10secs (approx.)

Summary - as at 26-Mar-09 at 03:28:57am (UTC -5:00) - 1hour32mins27secs after sending
Total Opened 1 time by 1 reader

and few minutes later:

Thursday, March 26, 2009 8:51 AM
Phone number!
From: "john brown" <[email protected]>
To: [email protected]

Send me your phone , i called but no response.- [color=blue]Never gave him one
------------------------------------------------------------------------------------

Phew... Okay, I don't have a K-7 number set up mainly because I don't want to ever talk to a lad. But I need to send a number pretty soon, and to buy time I'd like to know what you think about this one: 541-967-0010 which answers "The business number you have dialed is experiencing a temporary service problem. It has been reported to West Communications who is looking into the trouble, etc. Or maybe suggest some other number besides the "please deposit a coin," etc. - If it's a somewhat sophisticated operation with a lot of lads involved, I think they'd see through that one - or have already encountered it. I'm hoping it IS a large operation and that we're putting more than a dent in it.

Am trying to get responses from more addresses so RN can track them. Perhaps someone who has a female voice or voice message? You never know with lads, but I don't want to lose him over a phone no. We need to keep emailing dep't. 2 and the live.com one for more responses.

Sorry for such a lengthy post but most of it happened in the past 2 days. As you can see, I'm quite new & still reading around the forums to educate myself. I have a good mentor as well, but haven't bugged him with this one yet. So any suggestions will be appreciated. Very Happy

Posted: Fri Mar 27, 2009 4:29 am

Hi HouseofGalt, Set up a 7K number. It is really easy and you never need to actually talk to him. It just sends you a recording of any voice messages he leaves.

bohigal, That was a nice long message from Dead George. That caller had a heavier accent than the one that called me. It sounded like he said "Thank you and I am so pissed" at the end of the call? Smile

Posted: Fri Mar 27, 2009 5:00 am

HarvestMoon,

Thanks! As long as I don't have to talk to him or her, also, I'm so bad with technical things I've never wanted to look into it. Some baiter I'll make, huh?

It's late here, so I'll send the West Com. one tonight. Tomorrow I'll try to set up the K-7 so it's ready for back-up Very Happy

Posted: Fri Mar 27, 2009 10:33 am

Once again I want to thank you all for taking this Lad on and giving him a hard time. It's a sweet revenge, and even better for the other payoffs.

beers!

all round!

(Oh, and keep it up!)

Posted: Fri Mar 27, 2009 1:22 pm

Hmm.... Wonder how accurate readnotify actually is. The first mail first from [email protected] came back to Riverside, California.

I sent the "The business number you have dialed is experiencing difficulty"etc. ph. number to the same address & received:

Quote:

Hello xxxx
How are you?I hope all is well ..I read your mail and i tried calling but your phone wont go through anyways i will like you to send me the western union informations ASAP.I await your response

This time RN says:

Tracking Details
Opened 27-Mar-09 at 00:35:40am (UTC -5:00) - 6mins36secs after sending
Location Lagos, Nigeria (86% likelihood)

I don't understand it.

Well, whichever one it is it's interesting to look at the up to date Live Tracking feature. First email says:

Total Opened 10 times by 3 readers

Reader #1 Opened 1 time for 1min38secs total
Reader #2 Opened 1 time
Reader #3 Opened 8 times for 10mins total

Latest one shows:

Total Opened 5 times by 3 readers
Reader #1 Opened 2 times for 1min39secs total
Reader #2 Opened 2 times
Reader #3 Opened 1 time for 11mins37secs total

I can just see a bunch of 'em huddling around a computer saying "Hey, I look what I just got in" Laughing

Posted: Fri Mar 27, 2009 1:58 pm

What IP's are the CA ones? If we can eliminate a webmail point of presence it means we have a chance at someone in the US - which would be better than great Smile

Posted: Fri Mar 27, 2009 2:13 pm

Ut oh...I think Dead George is pissed. Wink

Quote:

This humble and able position was given to you to assist you raise extra cash for yourself.You have been joking around for days and this lovely and able company knows.incase you think you are talking to a fool,You are not as the western union confirmed that you didnt send any funds.I call 800-325-6000 myself.

Thanks all the same for wasting my time

Note: "He" seems to really dislike renamed dll files.

Edited to update:
Well it looks like I still have him on the hook. I sent a copy of the "real" WU receipt this time and it seems like the whole problem is that I spelled the name wrong. Embarassed

I just got another phone call and this email:

Quote:

Mr Cecilio is not able to get the money because of the mistake on the last name.Please call Western union to correct this please,I see the receipt and i know you have sent it.I am so sorry if i have given you head ache on this,Please send me an email once you have correct the last name to Rabasto and if there is any new MTCN number please let me know.I want all of this sorted out today.After this you will get better payments and you will enjoy this job total.

God bless you
George

So "Rinse and Repeat" now I have to go back to WU and resend the money with the correct spelling. Rolling Eyes

Anybody have any ideas of how I can drag this out for a few more days?

Posted: Fri Mar 27, 2009 5:50 pm

I saw a scammer send someone back to WU seven times as they kept forgetting to write the beneficiary name down, so they'd get it wrong each time.

If you can move him to MoneyGram, you can't check for invalid transactions online, it takes a trip to the branch I gather. Shame...

Posted: Fri Mar 27, 2009 5:55 pm

HarvestMoon wrote:

it seems like the whole problem is that I spelled the name wrong. Embarassed

Geez, MOM!! Get it right this time! Wink

Play around with him for a bit more with the fake WU. Spend a few days on sorting that out. Finally, ask him about MG. Spend a few days on that. Send Janey to do it. (That would be funny.) And then, go for a bank account transfer.

Just some ideas.

And no, I haven't heard back from him on any of my accounts. He hasn't even emailed me back to wonder where his money is. That's ok. I am patient. Very Happy

Posted: Fri Mar 27, 2009 6:40 pm

@HM: Depending on how far away / sparse your WU counters are, there is always the "Burning WU" modality. The bank / store / bodega you frequent has closed due to a fire / riots / flooding / anthrax attack. I have some burning bank photos that might be useful, if you want to go this route. I could photochop something too if you need.

Posted: Fri Mar 27, 2009 7:11 pm

Thanks bohigal, I sent you a PM with my email address. I just might decide to go the burning building route. These guys seem to like getting "solid" proof of an event. His attitude totally changed when I sent him a copy of my WU receipt.

I just wasted 1/2 hour of his time on chat again. He gave me the advice about RULES OF LIFE by richard templar.

I told him that the WU people were very rude. Than we talked a bit about karma...and the burning building might be a good example of what happens when people are rude.

Posted: Fri Mar 27, 2009 11:16 pm

HarvestMoon,

Glad you've still got him. I think he's calling the wrong department at WU. This is their helpline no. 206-600-5271 (courtesy of GS_fan) Smile

Regarding the check you receivedFriday,
March 27, 2009 3:41 PM
From: ©Forex Trading Ltd" <[email protected]>

Hi there,

How you doing?

I would like to know what is actually going on.

I would like you to get back to me with the situation report.

The Company is actually worried at this point.

We haven't heard anything from you since the payment has been delivered to you.

Please get back to me if you have cashed the payment and if you have sent the money.

We need a situation report right away.

This is very urgent.

Please get back to me before the end of the day today.

I await your immediate response.

Thanks and have a wonderful weekend ahead.

Georgeanwhile, back at the ranch I received this from Dep't. 2:

Posted: Sat Mar 28, 2009 12:16 am

Thanks HofG, I forgot about that number. See if I can work it in somehow. Right now the WU office is on fire, thanks to bohigal

Update on undeliverable packages:
I talked to the person that might be receiving the undeliverable packages. She said that there as been an increase on the number of packages she has been receiving recently. I wonder why?? Wink

I should find out over the weekend if she received any packages that were addressed to the baiter names.

Posted: Sat Mar 28, 2009 12:41 am

You guys may want to PM HarvestMoon if you've been baiting with non-obvious baiting names so she can see if your money orders are kicking around. Bit of fun if nothing else Smile

Posted: Sat Mar 28, 2009 2:53 pm

@Manbiteslion,

Quote:

What IP's are the CA ones? If we can eliminate a webmail point of presence it means we have a chance at someone in the US

This is what I don't understand. I received two seperate mails from the same address - ([email protected]) but read notify came back with two seperate locations:

Tracking Details: (lst email)
Location Riverside, California, United States (86% likelihood)
Opened on 71-80-139-181¸dhcp¸rvsd¸ca¸charter¸com (71¸80¸139¸181:2951)

Tracking Details: (2nd email)
Location Lagos, Nigeria (86% likelihood)
Opened on dial-pool44¸lg¸starcomms¸net (41¸219¸205¸134:57122)

Question

I just checked Live Tracking. I see the lad has forwarded my email to:

Location Stoney Creek, Ontario, Canada (86% likelihood)
Opened on host171.xicom58.juch-tech.com (208.78.58.171:38136)

And as of today:

Total Opened 10 times by 4 readers
Reader #1 Opened 3 times for 1min39secs total
Reader #2 Opened 3 times
Reader #3 Opened 3 times for 12mins58secs total
Reader #4 Opened 1 time

Isn't this fun? Laughing

Posted: Sat Mar 28, 2009 3:33 pm

Very interesting HofG. I think I'll add read notify when I get around to setting up my new laptop. I wonder why your email is getting so much attention.

Posted: Sat Mar 28, 2009 3:46 pm

If anyone wants guaranteed special attention from George, pretend to be from Puerto Rico - apparently (thanks anon!) he has a profitable enclave down there we should dilute

Cheque massbait - maybe on again - watch this space	View next topic View previous topic