Ex-baiter ...

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Fri Feb 18, 2011 10:03 am

Hey there. I used to do the odd bait back a few years, but real life intervened and I had to use my time elsewhere (though I still fondly recall the bait where I killed five fake banks in a row).

However.

My mother called me tonight, to tell me about a family friend who has become involved via a dating site with someone who claims to be an American serviceman in Afghanistan. His story is that he wants to come out to Australia to be with her, but that the US Department of Defense needs to have her checked out - at her expense - before he can leave. The figure being bandied about is between $2000 and $6000 Australian (which is pretty close to the $USD figure anyway).

Well, I said "scam!" straight away; my mother agrees (she called me because of my experience in these matters). But the trouble is, the friend won't hear a word against him. Currently he's apparently sent her a photo of him holding a sign saying "I love you" (sound familiar?). I've asked my mother to see if she can forward one of his emails to me, and possibly the photo as well, so I can run it past you guys. If there's similar scams being baited out there, finding an identical photo would be gold, as would finding similarly worded emails.

I'd bait this guy myself, but it has been years, and I'm a tad out of practice, and seriously, I don't have the expertise and time to bait this guy as he deserves to be baited (if he is a scammer. Which I believe he is).

So, to summarise. Strongly suspected scammer. Soldier in Afghanistan. Attempting to get evidence.

I'll let you know how it goes.

Posted: Fri Feb 18, 2011 2:02 pm

Not strongly suspected.
Confirmed. The name of the fee may change, but the person is 110% bog standard African romance scammer.

The US military and the US DOD do not charge servicemen's friends or families for "checking them out" or anything else.

The US military likes to keep things internal. This includes requests. People from outside the military cannot request leave for people in the military, period, NO exceptions.

http://www.scamwarners.com/forum/viewtopic.php?f=13&t=6527

Posted: Fri Feb 18, 2011 2:28 pm

^^^^ 1000% YUP!

Dorothy is spot on! I spent 30 years in a uni and I can personally confirm that the US DOD/Mil does not charge for that stuff. And yeah, the service member is the one who initiates leave.

Posted: Fri Feb 18, 2011 3:02 pm

Yup.

Found the requisite information in the ScamWarner site, and posted the link to my mother, who's forwarding it on to the friend.

Trouble is, she sent the $6000 this morning (the friend only told Mum about it this afternoon, and Mum immediately thought to ask me).

So unless she can stop it before he claims it, she's out that amount. But I'm very hopeful that she'll cut it off then and there, no matter what.

Oh, and his name?

Brian Smith.

I'm still hopeful to get details for baiting purposes.

Posted: Fri Feb 18, 2011 3:09 pm

If you can get the details, please post them at scamwarners too, so that other victims can be warned.

If she still isn't accepting it, please let me know or post over at scamwarners (I'm dotti over there) with as much info as you can get, and we can start to try to profile this scammer and get some more compelling evidence.

Posted: Fri Feb 18, 2011 3:16 pm

Will do, and muchly appreciated. I'll be following this one until it gets sorted out. Any details I can get (including any forwarded emails, the photo he sent her, and the faked documents) I will pass on.

I just wish I'd found out before she made the payment.

Posted: Sat Feb 19, 2011 12:47 am

Okay, it may not be as bad as we first thought; she's sent two payments, one for $1550 AUSD and one for $4000 AUSD. The first went through, the second not yet. She has also read the information in the site I sent to her (the same one that was recommended - thank you kindly for that) and is now fully aware and horrified.

I have the emails that have been sent to her, plus the "Vocational Leave Form" graphic (which I have edited appropriately).

Now, she has also told me the WU order numbers, the name she sent them under, and the name of the person they were being sent to.

What's the best way to see if I can get WU to cancel the second one if it has not already been collected?

And should I just post up the forwarded emails with full headers and see what you guys can make of them?

Thanks in advance.

EDIT: She's called Western Union (with a number I supplied her) and found that the transfer had been blocked due to some irregularity. So she's cancelled the $4000 and will get it back Monday.

Once she forwards me the original mails, I will post them up so people can get to baiting this ratbag.

EDIT 2: Does this go here?

Posted: Sat Feb 19, 2011 2:44 am

Hey Zap, welcome back. Sorry it had to be under these circumstances. Glad to hear she's convinced now though.

Post up the emails and headers, just remember to xxx out the friend's email addy and real name. It would also be helpful for her to post any information that she has over at Scamwarners as well. It may prevent someone else from falling victim.

Also please direct her to go to scamwarners and read up on money recovery scams (CLICKY). Since she's paid out, she is going to be a prime target for a recovery scam.

As for the lad... as soon as his email addy is posted here, he will have plenty of attention. Twisted Evil

Posted: Sat Feb 19, 2011 4:20 am

Yeah, the emails I currently have are forwarded from the victim, so the headers don't seem to have much in the way to ID the original scammer. I've asked for full headers; anyone here know how to get full headers out of a bigpond email?

In the meantime, here's the ID card he showed her.

oh, and his email addy is .

insults and more · Posted: Sat Feb 19, 2011 4:46 am

She's down about $1,500, but you saved her from almost certain bankruptcy at his (and others') hands.

You may want to find her some kind of group therapy or some other way of dealing with the realization. Money can always be gotten again, but recovering one's sense of confidence in the world is undoubtedly much harder.

Posted: Sat Feb 19, 2011 5:29 am

Yeah well, I strongly suspect that if she gets another such offer, she'll be running it past me.

She showed a fair bit of willingness to keep him chatting so that I could get any information I could on him, so I think she's gone from "fooled" to "aware" to "shocked" to "angry" in very short order.

Plus, she found the pics of the guy on ScamWarners site (this helped seal the deal for her).

Currently, we're waiting for him to mail to her Yahoo inbox so she can post me the headers. I've advised her to cut all connections to him after that. Anyone wanting to bait him thereafter can say they are a friend of "Anne" (who just died in a car accident or something).

An interesting note; the writing sounds like a typical mugu to me, but apparently the first installment was picked up by a woman called in Pendleton, Indiana (at least that's what WU told her).

Posted: Sat Feb 19, 2011 11:01 am

... and we have headers!

(I rigged up a Yahoo account and got him to mail me).

Quote:

X-Apparently-To: [email protected] via 98.138.85.196; Sat, 19 Feb 2011 02:43:04 -0800
Return-Path: <>
Received-SPF: none (mta1096.mail.sk1.yahoo.com: domain of does not designate permitted sender hosts)
X-YMailISG: vLi1RjIcZAr.SJBrUTovTepzJC4Vor9mb6PbNfXueobIN..r ERqvWcD8qfhEWzamcZpKLTlG1Fmx2TgrGCT5vX63YyGDmJlk6seX.N51mN7p r.ULHP5HWK0nmsUiHYLeZcsLoSmxZ0pKMuaNEW1oMCYrR_cHtFh4751fB.JY 6phEzbIMXq0DijQQqECgXEFxMCYhe9.e1Ky2ISNkjxNmMx3PFz55_GooI3dX 3nrQnrw6eSgh4FF.m3_EcvfKhXIOmzhBGTeIlZpdgpjMtndASlyH7p.hds0h sAklMtCsVjrW36D0dszMh0F.QXT2u.fQ87CrBpexY0MOfKWRbVBHimdFk.Ch YrAK1FRAveHkZ5.gdCUul.jQqtKKs6nIsrQvHmOFNx5vKTpoTOdhXDvSzZTU ij9A2plwRH9wblpCMb4Sn32RcvO7U4Oi0eV3CshriaGIjmHDPX6TYMv5WyYe mUdiW8IkupWcXoCRyVVvBGXqBqtWYoFXLBwFpPJ1yGDJ0FHmlFRKAKJkRImh GmpapD_KuOvPv1.ylVt3GhDWZjXTzDAeg2C3fjgrI39wn3wbZUBoCr2Kas_d 717ka0E4WIXzYbuA3Y.bQajMMuHszZfvcNWdyvLSmC6KzBRYYblKnILFfme0 UYYm5lLFx7hvx9VxnMZGtLGdgi_EN.abCpzh4NIgD6selMGkk8n94ppN26L8 xZOia.bNyHvmHSfPMrz1TSHbjtUzWreVfZRKFux52OEKFAW2JE8ZO0pVANe_ t4A1GVcvqPgeoA.B8gPtd8I2t9FkgHx7I7cAM47ZGxGsri_beWQnjj_DGU.z Uigst7cGk1Vk.l5p.KvDxAMN42LfNc3nTzxTepZ5K5F08rmybP0vO_oFz9RW hlHnl922F2OslXp.FLo8NajT7ByLYvteOvPzloN2z1eWn0oOB7Q82P8R9OHu Qc43iLsc.pfRjkfFJL4url4h7aAODpswlxJqOeg_Fni2vhKCt36H3fr5_bdg Sqh4mBjcSFe6cAchRvx1ovc61LaC_.gx63L383RmYAFCTSVyS00iPLNAKyQP UDIDFwedAWr5CFQWa1vqZDu5XtAja8fGFuXOcEdOKHVU.BrJKIeBaTKmK.Qz qV49orp0uu97LYq448W9Xzyj7XD155CbLwpXrNeYB4F6ulqhQJ6D.n2UFYKa Ldlzr5g7kVvufGUNWtf1FwnDb4Jslv7hgl7x_f3NsBOrjjuepNLG5KDrlOBm XRtOgTEsPDvDwxAXlclLbW33FlRMMtUljOmEILZviMH2BodyJtVVsvJH5j1j ac7CyD6j5VH2ywBgIFTxML.c_bHcxam0J8tw6oON2OjhxVUgEccieTDBqG0g naSeqWZmBNvF8XMMp.JQeMIxZjbZkYqg1rLev5Qq3uq5LCm98g--
X-Originating-IP: [77.238.189.223]
Authentication-Results: mta1096.mail.sk1.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO nm7-vm1.bullet.mail.ird.yahoo.com) (77.238.189.223) by mta1096.mail.sk1.yahoo.com with SMTP; Sat, 19 Feb 2011 02:43:04 -0800
Received: from [77.238.189.49] by nm7.bullet.mail.ird.yahoo.com with NNFMP; 19 Feb 2011 10:43:02 -0000
Received: from [212.82.108.125] by tm2.bullet.mail.ird.yahoo.com with NNFMP; 19 Feb 2011 10:43:02 -0000
Received: from [127.0.0.1] by omp1034.mail.ird.yahoo.com with NNFMP; 19 Feb 2011 10:43:02 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 40966 invoked by uid 60001); 19 Feb 2011 10:43:02 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1298112182; bh=qvjwoFxEiji1u4lht57E03bWNlnUqBMoVrw+5k4TEa4=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:References:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=k81juztCVZ6cTp8HlsWHswEtImCmXL/YxyDbNn68ISLeN1GiYZAOrOQE+pDhoZ4xT0/MucT18cyDOY4b//cykdJgBrMhojv2fTnaauesVnz0N1I2cwMNL+XO+loGryTV/fLYKIwOxehN3JiTDAjrnch/g3VgVdU5UMqKeniJ0jo=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:X-YMail-OSG:Received:X-Mailer:References:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=iwEVsGziygLdwcdjbigIE3/+sIN7u2wkrGZkPfSudaGUym5yiZ/Ld4zk282Ryz2wIS8OBTZT8rUoPCbmtF3Q6/+3/LAVcfLB0QxMGBE6r/tjJ1hP8IbH8McYxAYq3eXKG5c2KUq0VaERWtdWJ5keM0HohacNzPADa184d1dGNPA=;
Message-ID: <[email protected]>
X-YMail-OSG: FGXMaBsVM1lQlKpMVoxb4JNYDPSsb7Qg8Nb.Dz62kZmL5eS 9l1D7x77v3nNQC8BRD3Fwq97tDCzSP8BzrnCtLslxfDPOCT6v3RK4t_BuIKY erLJxceP2Ht1IhEcSazB2ivRyJ0NnqnKOtt7e5reQxuPplK84qbL_kxzmwJb IloS0z0PcmjWEzSA4q2O2ip0plJue_lpi03y5980p7LlYGm_V1mYWsaDh_0T whR0njkZaBXpGputp4R5PH2eom_jHGmLg1CYEQWab9CH32Q--
Received: from [66.90.73.3] by web24820.mail.ird.yahoo.com via HTTP; Sat, 19 Feb 2011 10:43:02 GMT
X-Mailer: YahooMailRC/555 YahooMailWebService/0.8.109.292656
References: <[email protected]>
Date: Sat, 19 Feb 2011 10:43:02 +0000 (GMT)
From: This sender is DomainKeys verified brian smith <> View contact details
Subject: Re: Hiya
To: xxx xxxxx <[email protected]>
In-Reply-To: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1080276953-1298112182=:40155"
Content-Length: 3287

Posted: Sat Feb 19, 2011 11:17 am

Okay, from that I get ... Ireland?

Am I doing this wrong, or is that what everyone else gets too?

EDIT: Ahh, a more in-depth analysis gets me Chicago, routing through Ireland.

Incidentally, I'm setting up a bait on Mr Smith, but anyone else can feel free to chat to our Soldier in Kabul looking for a romantic interlude.

Posted: Sat Feb 19, 2011 2:20 pm

Ahhh, It's our friend NNFMP.

NNFMP is not well understood (and yahoo hasn't exactly been open with tht information)--it is some sort of yahoo-specific protocol that most often appears in spam and scam email headers. What is known, though, is that while it sometimes appears in legitimate headers, it most frequently appears in spam and scam messages--and when it's there, the originating IP will not show, only a bunch of yahoo's servers.

So basically, when you see NNFMP, you can't get a location--which means you have to use readnotify or another tool to get one.

Quote:

An interesting note; the writing sounds like a typical mugu to me, but apparently the first installment was picked up by a woman called in Pendleton, Indiana (at least that's what WU told her).

Probably another vic. Quite a few romance scammers will use vics as mules, sometimes using an unrelated job scam format, but more often they will work the money collection role right into the romance scam.
The number of victim/mules seems to be even higher when dealing with scammers posing as US military. The victims are often convinced that by receiving and forwarding payments, they are helping soldiers (often they will be collecting for multiple names) who are on missions and can't get access to their money. Some have even been so hooked that they have been convinced that they had a "job" working for the US military!

The ID card looks like it was likely based on the image here. Notice the bar code is the same.

419Eater is my life Joined: 29 Sep 2010 Posts: 407

@Dorothy... Is the lad up for grabs or is he hands off for now?

Posted: Sun Feb 20, 2011 2:16 am

I may have found a way to work out the possible location.

In the mails he's sent so far, replying to those my friend sent, the time/date stamps are about eight hours apart, allowing for response time. He's using at least two different computers (given that one shows time/date in 24 hour time, while the other shows AM/PM).

This is distinctly west of Kabul, which is 4 hours west of us.

So ... what scamming locations are on or about GM+2?

Posted: Tue Feb 22, 2011 7:08 am

extremeb wrote:

@Dorothy... Is the lad up for grabs or is he hands off for now?

It looks like he's losing interest in my bait, and trying harder to get back to his original victim (who, as far as he knows, is in a coma in hospital) so yeah, go for it. Bait him into a greasy spot.

here · Posted: Tue Feb 22, 2011 8:06 am

ooh I've got a couple of modalities in mind for this lad

if he likes lady victims perhaps Nora can help him first off Twisted Evil

BMH
PS and a BIG well done to you and mum on saving another victim, must be a good feeling - don't kick yourself that you missed stopping the 1st payment, think of the 10s of thousands of dollars you DID save

Posted: Tue Feb 22, 2011 10:54 pm

I too would like to re-enter the romance forums. If it's not off limits, may the Ditz enter the fray?

and from Memory, most of West Africa is GMT +2

eta: From http://wwp.greenwichmeantime.com/time-zone/gmt-plus-2/

Quote:

GMT+2 Zone - Time = GMT+2

What time zone is GMT+2 in?
GMT+2 Standard Time is 2 hours ahead of Greenwich Mean Time (GMT+2).

Does GMT+2 observe Daylight Saving Time?
GMT+2 does not operate Daylight-Saving Time
Countries in GMT+2 Time Zone

The following counties use GMT+2 as their Time Zone. NB No Summer Time / Daylight Saving Time is used.

Botswana, Burkina Faso, Democratic Republic of Congo (part), Ethiopia, Lesotho, Libya, Malawi, Mozambique, Rwanda, South Africa, Swaziland, Zambia, Zimbabwe

419Eater is my life Joined: 29 Sep 2010 Posts: 407

internationalchrysis wrote:

I too would like to re-enter the romance forums. If it's not off limits, may the Ditz enter the fray?

We've all been missing the Ditz...good to hear she's back Wink

Posted: Wed Feb 23, 2011 1:56 am

Go for it, but remember to stagger your attempts a bit or you're likely to spook him.

Posted: Wed Feb 23, 2011 2:20 am

Just sent this to lad from the Ditz. Hopefully not too over the top, I couldn't see if the original email had been posted:

Quote:

Dear Brian,

Thank you for your email, it made me smile to think that even though I am going through an ugly divorce that you would be interested in someone like me. To tell you about myself, my name is Kathrin, I am 43 years old and live in Yalbraith in New South Wales Australia. I live on a farm, which I am fighting for control of with my soon to be ex husband Nick.

I have no children, but am very close to my niece Sabrina who set up this account for me. I must confess, I am not very computer literate. English is not my native tongue (I am German Born) and I find a lot of Computer terms difficult to understand.

Please, tell me more about yourself. I look forward to hearing from you

Posted: Wed Feb 23, 2011 2:16 pm

Sweet, this sounds like a good start.

He's responding to me again after a bit of a slow start, and he tried to come the heavy on me, to which I responded with a well-earned slap (note: this lad grovels well after a good slap) so this should be fun.

Quote:

Dear Shiela,do you really mean you can help us with the processing on ground,am so sorry if you think i was insolent lately,i never mean to be that annoying as i found myself so uncomfortable with the whole issue going on.i really want to know your opinion on this matter cos Anne and i was already getting it through before the ugly incident rear its head,i wish you knew Anne was heading to make the payment of the fund for my departure to queensland.i will really appreciate it if you can get back to me to know what you really want to do about this.
yours sincerely...Brian smith.

Posted: Wed Feb 23, 2011 2:45 pm

The Ditz got a response as well;

Quote:

Hello please can i know you more than this i mean what did you do for living and how long have you been on this dating site i will like to know this for now am brian 48years old working with US Army presently observing my deployment here in Afghanistan hope to hear from you soon.can you send me your pictures at first?

I send this back:

Quote:

My dear Brian,

I am more than happy to send you a picture. It is of myself and my soon to be ex husband Nick in happier times. I have been on several dating sites, though I have recently taken down all of my accounts after I started getting invitations from strange men for sex. I am not like that at all, I am hoping you are not like that.

You are in Afghanistan? That is along way from Australia, will there be any problems with distance do you think? I am looking for a relationship, not a email friend. would you be willing to move to Australia if things work out?

I do not work schatzi. I am what is known as a home-maker here in Australia, or a Hausfrau in my native Germany. Once I get control of this farm, I will sell it and live off the proceeds, despite the fact that Nick ran it into the ground.

Please write back to me. I find myself getting excited by the fact you are interested in me, I thought that once the divorce began, I would neve find anyone ever again...

As requested, I send my photo... Of International Chrysis & Nick Nolte

419Eater is my life Joined: 29 Sep 2010 Posts: 407

Quote:

As requested, I send my photo... Of International Chrysis & Nick Nolte

I hope you sent a pic of Nick during his better days Wink