confirm this scam

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Fri Sep 17, 2010 10:14 pm

Talking to my dad he was telling me had a funny feeling about an inquiry to a very nice. brand new BBQ he is selling. After explaining it to me I am confident it is a check scam, however not your straight I will send you a check and you deposit it crap.

Here is the email, have any of you seen this one before? If so, I will post the scammers email if someone wants to bait them:

Quote:

Hello,
I'm completely interested in buying it but I'm very busy with work and other important obligations so i anticipate that I'll have an Electronic Cashier Check issued out to you.I'm in no rush with you till funds are cleared in your bank.This is just a means to send bank check to your e-mail instead of mailing it to you and You will need a Blank Business Check Paper to print it from your e-mail. The blank business check paper is sold for $20 at staples, office max or any stationery store. I will reimburse you with additional $50 and we will arrange pick up when payment has been cleared by your bank. Kindly e-mail me back with your Name and Address address and also remove the Ad if you are interested in selling it to me to avoid interruption by others.

Expecting your response with details requested.

Thanks
J**e.

Baiting Guru Joined: 29 Jan 2008 Posts: 2531 Location: AU

that does sound weird.

can you post the header of the original email?

Posted: Fri Sep 17, 2010 10:55 pm

Sounds like he's expecting you to print fake checks yourself. They just keep getting lazier Confused

Also, what Master said. Can we see the headers?

Posted: Fri Sep 17, 2010 11:41 pm

I am working on getting the header, the email was not to me but my dad so I can not expand on what he forwarded me, as soon as he sends it, I will post it as well.

This is different from anything I have seen here, but there is enough in common with known scams that I have no doubt it is a scam, just in different clothing.

Posted: Fri Sep 17, 2010 11:47 pm

Here it is, I have not edited any of the senders name or email in this one though:

From Jude Winberly Fri Sep 17 11:46:16 2010
X-Apparently-To: [email protected] via 98.136.183.58; Fri, 17 Sep 2010 04:46:18 -0700
Return-Path: <[email protected]>
Received-SPF: none (mta1286.mail.mud.yahoo.com: domain of [email protected] does not designate permitted sender hosts)
X-YMailISG: j3QZ3KccZAoAzlLAzld_aH6UVguohtBr5Z1d_iKL8JNFsVQY
E_6uqNFTy1A._svboLAMDLDDZb_Nq5SvPj1rv5NT7of2Aby7_FN95OQyupmS
Q8GrdEnY2TPGvr5hI6QbnqNsWTs3OZYK2cbVpMwpMzCUKlofVTEBrVUaFZ6k
eI9JbRn6NF0o79OGbwflsraB_scQe5SXcNrv8uvBGh9JUNSkjE7VGDJYGFTs
XEyFOjqmkvz4lLKbv3LBuc9qWm43y2c4uPWBwj5leVeUcPRgKVNDUKGdKtj0
75CY0X1bS3tQ6bYip819TC2jPO1POJDv1PF7DVdXLUfhLJBiufHaZCGtnc63
wIOxH5Q4vGz6PK_XEMSygvyb7ZcfQKt1HDeLoBUK5wolkQTUCOiFhClOEQqy
6T4NV1EUuW9GFdSaX47.eFrwsHNucBglfm344xXWNlAUwW2ztkow27vIK3lL
HfWnjpQIj0dU67nV81Ae8ujDfV.Fy5SAuY69G4dPTVJPq7OBVtmRUdZeGPBU
iIdd139K1ETIWuSORHhmfN.KmlZaJSmmb8yz.wqGAl2WKbo2ONkhDmaQ5xKe
Yewm36eUWbuQxjz9f7hq8ydGN29BY4Luel.u6491CCIktTb5XcCduEvQeEFG
3VolndBQwOo1lD_FRktWHku1Q6E-
X-Originating-IP: [76.13.13.237]
Authentication-Results: mta1286.mail.mud.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO n9.bullet.mail.ac4.yahoo.com) (76.13.13.237)
by mta1286.mail.mud.yahoo.com with SMTP; Fri, 17 Sep 2010 04:46:18 -0700
Received: from [76.13.13.25] by n9.bullet.mail.ac4.yahoo.com with NNFMP; 17 Sep 2010 11:46:17 -0000
Received: from [67.195.9.82] by t4.bullet.mail.ac4.yahoo.com with NNFMP; 17 Sep 2010 11:46:17 -0000
Received: from [67.195.9.99] by t2.bullet.mail.gq1.yahoo.com with NNFMP; 17 Sep 2010 11:46:17 -0000
Received: from [127.0.0.1] by omp103.mail.gq1.yahoo.com with NNFMP; 17 Sep 2010 11:46:17 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 4641 invoked by uid 60001); 17 Sep 2010 11:46:17 -0000
Some of header removed to prevent forum blowout-MM
Received: from [41.155.40.189] by web114211.mail.gq1.yahoo.com via HTTP; Fri, 17 Sep 2010 04:46:16 PDT
X-Mailer: YahooMailClassic/11.4.9 YahooMailWebService/0.8.105.279950
Date: Fri, 17 Sep 2010 04:46:16 -0700 (PDT)

From: Jude Winberly <[email protected]>
Subject: Re: OK ****Firemagic BBQ Drop In **** - $1400

Posted: Fri Sep 17, 2010 11:57 pm

Answered my own questions, using IP tracker, the email was sent from Lagos Nigeria...imagine that.

Posted: Sat Sep 18, 2010 12:43 am

Code:

Received: from [41.155.40.189] by web114211.mail.gq1.yahoo.com via HTTP; Fri, 17 Sep 2010 04:46:16 PDT

Lagos.

I recommend editing out the receiver's address, by the way. Also the mods frown on double-posting. Just saying Wink