Strange mail (spoofed?)

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Thu Feb 10, 2011 3:50 pm

Today I received an email that would appear to be from a friend of mine saying he is stranded in the UK and asking me to loan him GBP 1,500. I can't imagine this friend would ever be stuck without access to money (or that he would approach me if he was). Plus the language of this mail has several lad hallmarks.... and the originating IP traces back to Nigeria. Uh oh!

The strange thing is the mail appears to be sent from my friend's actual email address and when I click on the reply button the address comes up the same I normally use to write to him.

I'd like to warn my friend that his account may have been compromised, but don't want someone in Nigeria picking up my warning if they are in his box. I'd call the friend but we live on different continents with maybe an 11 hour time difference. So before I do that, any thoughts among the people here of what is going on?

Specifically:

> Is the return path of this mail somehow being redirected to another account than shown?

> If I start a new mail to my friend would it be more likely to reach him for real or do we think someone is in his account and scamming from there?

One thing I see in the header is that the FROM and TO lines both show my friend's real name and email address, but I am otherwise not expert in reading these things.

Thanks.

Quote:

Delivered-To: XXXXX
Received: by 10.91.209.5 with SMTP id l5cs86322agq;
Thu, 10 Feb 2011 00:35:57 -0800 (PST)
Received: by 10.151.5.21 with SMTP id h21mr2827476ybi.391.1297326956760;
Thu, 10 Feb 2011 00:35:56 -0800 (PST)
Return-Path: <XXXXX>
Received: from col0-omc3-s18.col0.hotmail.com (col0-omc3-s18.col0.hotmail.com [65.55.34.157])
by mx.google.com with ESMTP id u18si5518841ybe.9.2011.02.10.00.35.54;
Thu, 10 Feb 2011 00:35:56 -0800 (PST)
Received-SPF: pass (google.com: domain of XXXXX designates 65.55.34.157 as permitted sender) client-ip=65.55.34.157;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of XXXXX designates 65.55.34.157 as permitted sender) smtp.mail=XXXXX
Received: from COL115-W18 ([65.55.34.136]) by col0-omc3-s18.col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Thu, 10 Feb 2011 00:35:34 -0800
Message-ID: <[email protected]>
Return-Path: XXXXX
Content-Type: multipart/alternative;
boundary="_3f678158-bd84-49f1-a338-db18469b521e_"
X-Originating-IP: [41.58.90.194]
From: MY FRIEND <HIS REAL EMAIL ADDRESS>
To: MY FRIEND <HIS REAL EMAIL ADDRESS>
Subject: Sorry to disturb you with this......
Date: Thu, 10 Feb 2011 01:35:34 -0700
Importance: Normal
In-Reply-To: <[email protected]>
References: <[email protected]>
MIME-Version: 1.0
X-OriginalArrivalTime: 10 Feb 2011 08:35:34.0727 (UTC) FILETIME=[7C437D70:01CBC8FD]

--_3f678158-bd84-49f1-a338-db18469b521e_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Hi,

Compliments of the season,i hope all is well with you?

I traveled to United Kingdom, London for treatment of my Cousin who is suffering from Autism, though it can't be cured, but it can be treated behaviorally and/or medically. Current therapies include Seratonin Reputake Inhibitors (SRI) and i have tried to treat her here but her appointments take too long and i hate to see her suffer as she means everything to me.

However it has now become very necessary for her to undergo therapies as the ailment is now life threatening so am deeply sorry for not writing or calling you before leaving, the news of her medical appointment in the United Kingdom arrived to me as an emergency and that she needs family support to keep her going, I hope you understand my plight and pardon me.

Seratonin Reputake Inhibitors (SRI) is very expensive here in the United Kingdom, so I want to transfer her back home to have the surgery implemented as they have called their hospital branch in the United States and booked an appointment for immediate therapy.

I Am wondering if you can be of any assistance to me at this time, I need about £1500(GBPounds) to make the necessary arrangement, I traveled with little money due to the short time I had to prepare for this trip and never expected things to be the way it is right now. I'll surely pay you back once I get back home, I'll reimburse you at my return,

Regards

THEN MY FRIEND'S NAME AND ADDRESS AT THE BOTTOM (i.e. his usual signature, but excluding phone number)

Posted: Thu Feb 10, 2011 6:17 pm

It's a common scam. Your friend has fallen for a phishing scam, and given his password to a scammer who has sent that email to all his contacts.
He probably knows as one of his more local contacts would have alerted him.

Posted: Thu Feb 10, 2011 6:24 pm

Consider sending him a text message.

Anyway ... what's an 11 hour difference between friends ? Your day is bound to overlap his at some point.

Posted: Thu Feb 10, 2011 7:05 pm

Yes, of course... it must be a phishing scam. Smile

I'll get in touch with him, and as you say someone local has probably told him already.

Cheers.