Scottish Scammer has hacked my friend's gmail account.

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Hello I'm New here! Joined: 23 Dec 2009 Posts: 1

I was very nearly taken in by this because before I received the email, my friend's account started to chat with me, giving me a reduced version of the email:

Frederick: hi
Sent at 3:40 PM on Wednesday
me: hey dude
how are you?
Sent at 3:41 PM on Wednesday
Frederick: you there?
Sent at 3:50 PM on Wednesday
me: just about
Sent at 4:04 PM on Wednesday
Frederick: how are you doing?
Sent at 4:10 PM on Wednesday
Frederick: you there?
Sent at 4:14 PM on Wednesday
me: I'm good
settling in for the hols and coursework
you?
Sent at 4:30 PM on Wednesday
Frederick: not too good at the moment
me: how come?
Frederick: am in a kind of deep shit
me: oh...?
something you've done/ not done? Or someone else?
ah, seen email, reading now
Frederick: i went for a short vacation in scotland,unfortunately for me i got mugged at gun point
me: !!!!
Frederick: it was a brutal experience
me: dude, what about parents?
Frederick: all cash credit card were taking off me

So the email account is legit, but has been hacked. Since the email asks directly for money to be sent, does the postcode the scammer uses help in any way since that is in the email.

I live in the south of England, so Edinburgh is a bit far for me. Anyone on here live close enough to the postcode in the email below to check it out in any way? Or is that not what should be done?

Delivered-To: [email protected]
Received: by 10.216.30.202 with SMTP id k52cs775531wea;
Wed, 23 Dec 2009 08:32:27 -0800 (PST)
Return-Path: <[email protected]>
Received-SPF: pass (google.com: domain of [email protected] designates 10.103.127.7 as permitted sender) client-ip=10.103.127.7;
Authentication-Results: mr.google.com; spf=pass (google.com: domain of [email protected] designates 10.103.127.7 as permitted sender) [email protected]; dkim=pass [email protected]
Received: from mr.google.com ([10.103.127.7])
by 10.103.127.7 with SMTP id e7mr4387774mun.2.1261585946807 (num_hops = 1);
Wed, 23 Dec 2009 08:32:26 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=gamma;
h=domainkey-signature:mime-version:received:date:message-id:subject
:from:content-type:content-transfer-encoding;
bh=Ag2yDGLl+kyvASfde4z3mEN9UNrNUZxNhIInymLPSuo=;
b=MTB58JPa0sYUsWvaQ/rxD++jLY8hE/NXNt6TeDLZl1S4Vwj5F98QS3beme2swyLEKW
Z02yyP6hQnro3bKvs0Sj1YGewL1m9O2VRfRlcylJqGkiVutiiqn66lNn9z17QKUCNIY0
48ljPqyZHiTXBls27UgwMo3i015t4IRewsU7w=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=gmail.com; s=gamma;
h=mime-version:date:message-id:subject:from:content-type
:content-transfer-encoding;
b=rfurbiZTcFvU/7gNO7GwU07ohPTaraj+7DpGyzEET9Uw4J9ritZgLeHnWHtFzaUaHh
8otrt9FZ1NAvsJLFfrM3YtcG1UVed5gRRABByRCRzZAsLvZNaro670VBDKmL/vT0axa7
Zj/5OcHkDpC3bc6trNFTSRBH4Npsx6hNqB+fM=
MIME-Version: 1.0
Received: by 10.103.127.7 with SMTP id e7mt4387774mun.2.1261585943029; Wed, 23
Dec 2009 08:32:23 -0800 (PST)
Date: Wed, 23 Dec 2009 17:32:22 +0100
Message-ID: <[email protected]>
Subject: My Predicament
From: Frederick Levy <[email protected]>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

How you doing? We made a trip to scotland unannounced some days back,
Unfortunately we got mugged at gun point last night! All cash, Credit
card and phone were stolen, we got messed up in another country,
stranded in London, fortunately passport was back in my hotel room.
It was a bitter experience and i was hurt on my right hand, but would
be fine. I am sending you this message cos i don't want anyone to
panic, we want you to keep it that way for now!

but I=92m having troubles sorting out the hotel bills, wondering if you
could loan me some money to sort out the hotel bills and also take a
cab to the airport about (1000 pounds).I have been to the police and
embassy here, but they aren't helping issues, I have limited means of
getting out of here, we canceled our cards already and made a police
report, I won=92t get a new card number till I get back home! So I
really need your help.

You could wire whatever you can spare to my name and hotel address via
Western union:

Mod Edit: Name and Address removed - 7/9

Get back to me with the details, would def refund it to you once we
arrive! Hopefully tomorrow

I await your prompt response.

Posted: Wed Dec 23, 2009 7:43 pm

I doubt he's from where he says he is.

I think you should tell him you'll be sending him the money. Of course, you may have to borrow it from someone else which may take a few days, or you may get mugged on your way to Western Union, or your dog may develop a strange disease that costs a bundle....etc. Smile

Some of the geniuses here have created great modalities you can use, like a Western Union receipt, a website for him to get his MTCN number (which takes forever and is very frustrating), etc.

String him along and have fun! Smile

Posted: Wed Dec 23, 2009 7:47 pm

I'd start by phoning your friend and letting him know what's happened.

Also, this scammer is most likely not in Scotland. We can't be certain because GMail tends to mask IPs, but he's more likely than not somewhere in West Africa. Western Union outlets over there are pretty lax with regard to security and will hand over money with as little as the MTCN.

Posted: Wed Dec 23, 2009 8:00 pm

This is unfortunately an increasingly common scam. I know two people personally who lost their email accounts to phishers who then tried to scam everyone in their address books -- in one case, successfully. Evil or Very Mad

Hopefully your friend can recover his account with the secret question he used when it was set up.

Posted: Wed Dec 23, 2009 8:30 pm

cece wrote:

I think you should tell him you'll be sending him the money. Of course, you may have to borrow it from someone else which may take a few days, or you may get mugged on your way to Western Union, or your dog may develop a strange disease that costs a bundle....etc. Smile

Not when the scammer has your real life address.

Posted: Wed Dec 23, 2009 8:36 pm

As Nick said, the scammer is probably African. The grammar/punctuation errors even in that short chat are consistent with an African.

Since this is a real friend, I am assuming he contacted you at a real account tied to your real details. We do not recommend playing with scammers when they have your real life information.

At this point, the best thing to do is to contact your real friend as suggested and have them take steps to recover the account. You also might want to notify any mutual friends to be on the alert.

Posted: Wed Dec 23, 2009 8:44 pm

Dorothy wrote:

You also might want to notify any mutual friends to be on the alert.

I missed that, but that is VERY IMPORTANT. Just as important as telling your friend himself.

You'd best get cracking. Any time wasted brings your friends closer to getting relieved of their ducats.

Posted: Wed Dec 23, 2009 9:28 pm

your friend might also consider whether she/he did anything that helped the scammer to hijack the account.

using an internet cafe pc or a hotel pc can be insecure, if you enter a password and the pc remembers it.
another way to lose your passwords is to scrap a pc without cleaning the hard drive -
that's a big problem if you use internet banking and forgot to wipe the account details.

hope you get it sorted for your friend.

Posted: Thu Dec 24, 2009 12:45 am

A friend of mine also had his account hijacked, and everyone was sent an email saying he'd been mugged in Nigeria and needed cash to get home. What this sack of crap DIDN'T know was my friend is wheelchair bound, so him being in Nigeria was unlikely at best.

I wrote back as his ex wife, and said I was gonna meet him there with whole stack of Federal police friends to track down the varmints that robbed him.

He only bit for a few days, but it was fun while it lasted. My friend got a few laughs out of ME being his ex wife

Hello I'm New here! Joined: 24 Dec 2009 Posts: 3

Hi,

I am the victim of this fraud.

I did text everyone I knew
I took a look at the Met Police and they don't seem to have anything
The gmail recovery does not seem to have worked

Anything else?

Posted: Thu Dec 24, 2009 9:40 am

Hi echelon, I take it you used this form: Clicky

If you can give accurate info there is a chance you can convince them you are the genuine owner of the box. If not it could be lost for good.

Did they phish your PW or use some other means? If they used a phishing email can you PM a copy of it (to the best of your recollection), to one of our moderators so we can have it for our records? Don't post it on the forum as we do get the occasional lad breeze through and we don't want to give them ideas plus a format.

The only practical advice I can give, is you txt your contacts and tell them not to reply, but instead report the account as hacked and supply googlemail with the evidence. Be more careful in the future and make yourself aware of the ways scammers use to hack boxes. Wink

Hello I'm New here! Joined: 24 Dec 2009 Posts: 3

windypops wrote:

Hi echelon, I take it you used this form:

Did they phish your PW or use some other means? If they used a phishing email can you PM a copy of it (to the best of your recollection), to one of our moderators so we can have it for our records

I actually can't recall receiving a phishing email (gods honest truth). I normally just delete them. I have no typed in my email address + password anywhere or at anytime, as it usually just comes to outlook

Posted: Thu Dec 24, 2009 10:33 am

Then you may want to do a scan on your pc. Did you download any exe files sent in your mail that you can remember?

Posted: Thu Dec 24, 2009 10:48 am

I think you should notify all your contacts, and ask them to block this account, then make a new email account and give them the details.

Have heard that scammer can link to all your contacts and then to theirs if they open his email. You an of course change you password to stop him getting in again, so I was advised when it happened to me.

Is this good reason for changing passwords regularly?

Hello I'm New here! Joined: 24 Dec 2009 Posts: 3

I have run Spybot S&D and AntiVir (both updated) both did not show any dire warnings.

Like I said I have tried using the form but

https://www.google.com/support/accounts/bin/request.py?ara=1&hl=en&contact_type=ara&ctx=ara

An email address we can use to contact you*
Please enter an email address that you can access. (e.g. [email protected]) I used my uni account

Do you use Gmail with this account?* no

Email address you use to sign in to your account (e.g. [email protected])* [email protected] Surely this my google account

Do you currently have access to the email address that you use to sign in to your account?* I don't understand what its asking if my account has been compromised i don't have access to it.

It then errors with Invalid email address. If you use Gmail with this account, please change your answer to 'Do you use Gmail with this account?' On the Email address you use to sign in to your account (e.g. [email protected])* does this mean it has been deleted?

Mod Edit: I've XX'd out your email address - 7/9

Posted: Thu Dec 24, 2009 12:17 pm

Am not very IT clever but if you can acccess the gmail account then you can change the password. But I think it is a good idea to close account, and much easier than trying to get google to make instructions clear. Rolling Eyes

Posted: Thu Dec 24, 2009 10:57 pm

I live near Edinburgh if that helps!

Scottish Scammer has hacked my friend's gmail account.	View next topic View previous topic