Thoughts on this?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Hello I'm New here! Joined: 11 May 2007 Posts: 5

Hi everyone, first time poster long time reader, good work!

Anyway, I wanted to bounce this through you guys, as this really is the center of all scam info!

I run an online shop, I wont mention it here, but its a pretty sucessful sportswear business. We sell mainly to the UK, but the other week we had a most odd email. It may turn out to be ok, but appreciate your thoughts.

We had an email from a chap wanting a large amount of a product, its a very large amount that runs into the thousands. His name is one I would associate with a Nigerian spammer, but he is claiming to be from the US.

Anyway, before we order from our suppliers we asked for a non refundable deposit. He has been having issues with our online store and decided to email his card details over, something I really would not suggest.

I am just about to process his card (I wonder if it will go through), but have you ever heard about anything like this?

He also types in pretty broken English in UPPERCASE!

Thoughts?

Posted: Fri May 11, 2007 9:30 pm

Can you check his IP address in the email headers to determine if he is actually from where he claims to be?

Posted: Fri May 11, 2007 9:39 pm

check the headers first before you do anything else Wink

Hello I'm New here! Joined: 11 May 2007 Posts: 5

Hi Guys,

Thanks for the replys, just looking at the headers it looks ok, he is using a yahoo email.

How would I tell if hes not coming from the US?

Apologies but this is all new!

Posted: Fri May 11, 2007 10:19 pm

just because it is yahoo it does not mean he is in the USA.
In the header the last IP listed is his, copy and paste his whole header into this site and it will check it for you.

http://headertool.apelord.com/

Posted: Fri May 11, 2007 10:34 pm

B3ndy,

It doesn't sound like you are looking at the full headers. I don't know exactly how to tell you to retrieve the full headers because it differs between different services. What email service are you using? (ie: outlook, gmail, earthlink, aol)

The full headers should look something like this:

Quote:

Return-Path: <[email protected]>
Received: from compute1.internal (compute1.internal [10.202.2.41])
by store18m.internal (Cyrus v2.3.8-fmsvn11108) with LMTPA;
Wed, 09 May 2007 02:52:17 -0400
X-Sieve: CMU Sieve 2.3
X-Resolved-to: [email protected]
X-Delivered-to: [email protected]
X-Mail-from: [email protected]
Received: from n5.bullet.mail.re4.yahoo.com (n5.bullet.mail.re4.yahoo.com [206.190.56.24])
by mx5.messagingengine.com (Postfix) with SMTP id 487122D4A
for <[email protected]>; Wed, 9 May 2007 02:52:17 -0400 (EDT)
Received: from [68.142.237.87] by n5.bullet.re4.yahoo.com with NNFMP; 09 May 2007 06:49:34 -0000
Received: from [66.196.101.132] by t3.bullet.re3.yahoo.com with NNFMP; 09 May 2007 06:49:34 -0000
Received: from [127.0.0.1] by rrr3.mail.re1.yahoo.com with NNFMP; 09 May 2007 06:49:34 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 24082 invoked by uid 60001); 9 May 2007 06:49:34 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:Date:From:Subject:To:In-Reply-To:MIME-Version:
Content-Type:Content-Transfer-Encoding:Message-ID;
b=yG/Zjd0YPrLDU9yCJ8BtFrIcbHImGfrR+uUadVb2Jy2fO1PA8gZznshLA
1tq5O0tGt7UOWlT8X69PbAJOEurpq8dmyCkxXFhJkvVfWIqjBn/vd6JJ90YL9e
Y7qGGqmEcm8pzw8TZqOUbpH68/2ZRNfNE0Ewk+0iFsjRp/5AIgj8=;
X-YMail-OSG: GVBfVZwVM1nNSCRof.n7Vxl1yrlUmyHL_wGv6smKBosHL.mFbIegZG1yy6
le64AOlwUYzcg1zHtspBgon1zOqOoDlQ--
Received: from [82.128.13.161] by web63808.mail.re1.yahoo.com via HTTP; Tue, 08 May 2007 23:49:33 PDT
Date: Tue, 8 May 2007 23:49:33 -0700 (PDT)
From: Dr Brown Willy <[email protected]>
Subject: CRIMINAL ELEMENT!!! WILL BE HANDED OVER TO YOU SOON
To: Dean Whitter <[email protected]>
In-Reply-To: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1575301060-1178693373=:23815"
Content-Transfer-Encoding: 8bit
Message-ID: <[email protected]>

Hello I'm New here! Joined: 11 May 2007 Posts: 5

Hi Guys,

Thanks for al lthe help, I extracted the header and checked it against the site.

Details:

216.252.110.36 United States*
007.05.11.13 United States*
216.252.110.36 United States*
41.204.45.192 Ghana*

With the last IP being the originating IP address.

So its spam right?

Posted: Sat May 12, 2007 9:08 am

Smells scammy to me.

I would wager the credit card will be stolen.

Posted: Sat May 12, 2007 9:16 am

Not spam, its a scam. Your erstwhile customer is planning on paying for his order with stolen CC info. Since the real card holder probably doesn't know that s/he's been phished, it will take a month or 2 for the chargeback to come through. In the meantime, you will have accepted the order and shipped it out to a mule (a scam victim used as a go-between) in the US, who will reship it to a drop used by the real scammer. When the chargeback comes, your only recourse is to go after the mule- who is really a victim him/herself.

Hello I'm New here! Joined: 11 May 2007 Posts: 5

Hey everyone,

Well thank you for all your help, I knew this would be the place to ask!

So the question is, what do I do with the guy? I am happy to hand him over to one of you guys if you want to have some fun.

Ben

Posted: Sat May 12, 2007 1:01 pm

Post up his full header and I for one will play with the little twat Twisted Evil

Also other details you think may be of use to us

Hello I'm New here! Joined: 11 May 2007 Posts: 5

Hey Dark, PM in your inbox.

Ben

Posted: Sat May 12, 2007 1:27 pm

THanks

let the games begin Twisted Evil

Posted: Sat May 12, 2007 7:18 pm

you have a PM

Posted: Sat May 12, 2007 8:42 pm

guymannemisis

you posted after my post indicating a PM from you to me Question

I have not received a PM from you

Posted: Mon May 14, 2007 5:36 am

I have a question. Do you already have the CC info? I mean the card holder's name and the company/bank that issued the card. Can you call the bank and let them know you have reason to believe this card is being used without the cardholder's permission?
Just wondering

Posted: Mon May 14, 2007 3:15 pm

I have the CC's info, number and pin code but the other details are fake,
BUt I have sent the info to mastercard although, I am not sure what they can do with it.

The mugu is still trying to use the card and last time he ordered 1,000 pounds of sporting clothes from an online store, that's where I got the info, just helping out the online store..

I have written to the mugu telling him the info is wrong and also contacted him as another online company to draw him away from the original compant and over to me Twisted Evil