Employment/Hospital Scam – Saint Vincent and the Grenadine

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Thu Jun 30, 2011 2:48 pm

The original contact came from LinkedIn.

Sorry in advance for the incredibly long email. I am only showing the full headers for the first contact from each person.

From - Wed Jun 29 10:46:04 2011
X-Account-Key: account4
X-UIDL: <omitted>
X-Mozilla-Status: 0013
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
X-Apparently-To: <omitted> via 98.138.213.221; Wed, 29 Jun 2011 08:37:49 -0700
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
X-YMailISG: 5wz.bZkWLDvD5Kr0S2BUX8w40_.h5Kpkg3Fj5PRgGPXrltlf
dthRGMT0p87.fvNzbhi1awuoTd06FDZIcPw9WVeG63yY4im2MmMP_oXoaugb
v93fYKRQ6UQ7Z9BC9HkpDeZay7wt3JLOSmbIOpHvJAjbo2q4eX59n2ZHSZ4v
XjNgMQ6joMAI6FQDqE16hMu01TSABCvte50F9z2S3Kr1fpnUGfcgmkqpnlLY
9vCCDVhNiDVnxeucJ8tjn6KJD0rWFVjeYrMOo_iNvb4ln4A__9GlAG71LPHr
l64H705e_Of0ai.H1JVv8XHfKEz4.Ipql.EGPdDe1b_Mo2JOxmw.f6gTsV5g
o_r8UdAeesQTFGNsabCIswewMKDxHKqFUEQKtfw4QGDWUTTDx40WBwTfRBfY
ld2n6QYAk0HKarY4yRckbzAGTFTYYfZ1Msw80CF9sNG9aOuSZ0p1X1x6jRrF
aJY-
X-Originating-IP: [98.139.91.218]
Authentication-Results: mta1074.sbc.mail.sp1.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 66.211.168.231 (EHLO fgateway14.isp.att.net) (204.127.217.84)
by mta1074.sbc.mail.sp1.yahoo.com with SMTP; Wed, 29 Jun 2011 08:37:49 -0700
Received: from nm20-vm0.bullet.mail.sp2.yahoo.com ([98.139.91.218])
by att.net (frfwmxc14) with SMTP
id <20110629153640f14007h4lje>; Wed, 29 Jun 2011 15:36:40 +0000
X-Originating-IP: [98.139.91.218]
Received: from [98.139.91.63] by nm20.bullet.mail.sp2.yahoo.com with NNFMP; 29 Jun 2011 15:37:44 -0000
Received: from [98.139.91.1] by tm3.bullet.mail.sp2.yahoo.com with NNFMP; 29 Jun 2011 15:37:44 -0000
Received: from [127.0.0.1] by omp1001.mail.sp2.yahoo.com with NNFMP; 29 Jun 2011 15:37:44 -0000
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 3304 invoked by uid 60001); 29 Jun 2011 15:37:43 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1309361863; bh=Ggsr9XQcp0/yMIijY4EGmykvb6UCziQy+oIa0WWtlZ0=; h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=Guk6pwresbbbNhCOgW5HmHS6NmT7rruaXkWOsScCqeg6psU/Fg/i44qZrDCjkYickWgHwvzCAo1rf9AQ4SrXGB1NDCiceFUmapZPhj9w9Fqsgk60yO5wjmuwlEyRylfnL62KrQB9MBnb7Ta/c/HmBAbrRMDx8NfmF7p3+b36cU0=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type;
b=eH8LB/9PjB/h23J2hciRsEi2CWpMPz2VEUSlFrYu+R2HBsoxADLfQGTHY1FbPLeoT/pu/mPqwAHCQxmmJasr64siUOHtbKIfXXC+A2hCbp+lW1a8RVu1noC+ylBxROgh4m5WanLoSnixB6kWmtDr6hB65l19ssqOBTWMeKcFgQ0=;
X-YMail-OSG: beVlMfEVM1ma8RHQZ6yqeisjuTJR3D5_3wncUjac.SNd8lx
6RK1hngxL1Xlkn3fPWkQJAihyKp4gP1ogisZmSU_ZqjmsioYFjirtE7BPlKp
X3F.BRCt9cXma8sz4lwvbdL7_IocpNj8TsPYN4Z_02pButobnHxLt8a7fVne
3FG6SiTzV.p7m0uF54dt1nYP.LOx1K47ncm5t.K3b7FHEyhHXI6Nsa5B1bqA
qjCGGOiMNO5cg_7.HxkaEsiNq3Mhmcc6EkOE5LGu1w0fmMDcHzXoMwBynxIQ
cdqSmZjlZObYT8qODK6CjG1FpbycAZnmLJzB9N6trouSsB3RJ
Received: from [216.226.68.12] by web113311.mail.gq1.yahoo.com via HTTP; Wed, 29 Jun 2011 08:37:43 PDT
X-Mailer: YahooMailClassic/14.0.3 YahooMailWebService/0.8.112.307740
Message-ID: <[email protected]>
Date: Wed, 29 Jun 2011 08:37:43 -0700 (PDT)
From: Xavier Phelps <[email protected]>
Subject: Re: LinkedIn message
To: <omitted>
In-Reply-To: <omitted>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1504035040-1309361863=:86862"

--0-1504035040-1309361863=:86862
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

I went through your resume
and i have a few questions

where are you currently located?
are you currently employed?
if so, why are you interested in leaving your employer?
if not, under what circumstances did you leave?

I also need to know your present salary
kindly get back to me with that piece of information.

thank you

I was curious and have been searching for a job for a while, so I sent replies back. His next message is below:

From - Wed Jun 29 13:06:34 2011

Thanks for getting back to me <omitted>.
The job offered is with TMI Wireless
and would pay you $40k per annum.
It would be what you were used to at <omitted>
only with a higher salary.
The job is currently vacant but is time sensitive
let me know if you would be interested in the Job
and We can go from there

All the best

I was interested, but the mistakes in the formatting, and the lack of a professional look or signature had me a little suspicious. I asked for more information.

From - Wed Jun 29 14:36:35 2011

1. the duties are the same as your last role played
2. it would be a full time position
3. denver, colorado
4. benefits include health, dental, 401k, accomodation, transportation

The next step would be for you to say yes if interested
and HR will draft employment contracts

Now, I am in another state halfway across the country. For a company to pay accommodation and transportation is incredibly rare in this economy. Especially for someone they have never met in person, interviewed, or seen work samples from. I knew from reading so many baits that this was a 99% chance of being a scam, but I wanted to make sure – I just couldn't afford to pass up a job if it was real. So I said to send me the contracts for my review. I figured the next response, if it was real, would be from someone in HR, and I would be able to get in person to person contact with them. If fake, then it would somehow work around to a request for money.

From - Thu Jun 30 07:29:46 2011

Fantastic
I will have HR Work on the docs and have them to you by this evening.
Looking forward to welcoming you personally
Have a good one
I have to run a few errands
see you soon

This was immediately followed by:

From - Thu Jun 30 07:29:47 2011
X-Account-Key: account4
X-UIDL: <omitted>
X-Mozilla-Status: 0003
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
X-Apparently-To: <omitted> via 98.138.213.218; Thu, 30 Jun 2011 03:57:45 -0700
Received-SPF: none (domain of yahoo.co.uk does not designate permitted sender hosts)
X-YMailISG: 0.aQFM0WLDtuuHMLig4eZT3fxMtX03ZS1_ldJUIv877_jcGa
gaQi9hpY51JufnQminS_PJxpsAQBZHIVwaf65eYgXkaYwC8ab_b_e7d.6beC
VjI.jvyFD_oIwWxnywM_b4s7lnojiebW.4wjggHNr52tKkVv0TVymJH8fLm9
ELTAiIi.k8RPjVvPWNyuL52adCptoTs9sMEYqey5_f_LhQvAau1l2OwBthPM
5Gd7le6oztRbhqmU2eJypwxk88zpre9xQX_0QXslFcqUFOXln1SXHNVP.77K
XkKJfHpxGfD5iGsUAncOBK9oBjo.L3aTb9lVPW51Ns2N.XXKhXIrTdEj0AqA
v7IiDbTCOJeZc0_B6YbDB1BMYb53FvV6ipLiHtD..F.exk8vYyoSIIdaMKbI
bJbGc_kzQ04db1.RD9iC2wOzpBHfZgHOseHt7qZ75NhCq5NV.pVDcFeUTA--
X-Originating-IP: [217.146.183.234]
Authentication-Results: mta1064.sbc.mail.sp1.yahoo.com from=yahoo.co.uk; domainkeys=pass (ok); from=yahoo.co.uk; dkim=pass (ok)
Received: from 204.127.224.81 (EHLO alnwmxc01.att.net) (204.127.224.81)
by mta1064.sbc.mail.sp1.yahoo.com with SMTP; Thu, 30 Jun 2011 03:57:45 -0700
Received: from nm6-vm0.bullet.mail.ukl.yahoo.com ([217.146.183.234])
by att.net (alnwmxc01) with SMTP
id <20110630105744a010077csae>; Thu, 30 Jun 2011 10:57:44 +0000
X-Originating-IP: [217.146.183.234]
Received: from [217.146.183.209] by nm6.bullet.mail.ukl.yahoo.com with NNFMP; 30 Jun 2011 10:57:43 -0000
Received: from [217.146.183.169] by tm2.bullet.mail.ukl.yahoo.com with NNFMP; 30 Jun 2011 10:57:43 -0000
Received: from [127.0.0.1] by omp1010.mail.ukl.yahoo.com with NNFMP; 30 Jun 2011 10:57:43 -0000
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 34001 invoked by uid 60001); 30 Jun 2011 10:57:43 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.co.uk; s=s1024; t=1309431463; bh=veJypZnTwlPExwWVA0yNrTVFb/8C/EXRt4NnDRxNa3o=; h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Subject:To:MIME-Version:Content-Type; b=1RITHN1OwDaZ/YWx11keGlJOfiwcLyZeSWxDHjN4fcpXC8El7tfDsXrlzF7s4d/CqfrXIjlB1Fu1T8De/mXIhC+YlScIjwMpuJZhQnrp5db7cpnViq3IkHkSYKfVr6/I9Kd0fR/CMsLkunkgo51eqbRRk2o20//G4bARoZEgABU=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.co.uk;
h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Subject:To:MIME-Version:Content-Type;
b=VKjZbiJJk8qEQfCd8teGm+8TNFR3O5weFZ5QKY80T68+7jP1mNEn4z81kAOTwSYzFGYhTWCTkwKbT/rRWbxlWhVRfjR1x6skD7I0MXrCgjw7fa2G78vyy6xxL6A73MkCNPGL/pq7JEgWVEz86gt476ZyaPWncEaE487BpK6w5+c=;
X-YMail-OSG: qHV3KtAVM1lrfMSxkAR1Mc1p3IeapqNrvoCMbmg4onCebdV
cqRlyOeJ_cvTk.vQUflXK9B80v.rZlKIflTn0izSw3vk_BR.dzKuJdyxRj02
I5NnD6HMr.lMMLvOKVIq0NAomitkROIWw0VvKWun_bHHl0BO5QvgXVvHKH7J
wmMVm7nC4Jw.WVP5inICYE7KyHcilZR0FZLsYG3iFl69Yu48Sxeo1shkDmWB
RtPHXPFHf41DTtVX1HIAEMdTZ7GJxKMbtpz5upW__GY5ekCl7LhIi.Li.Qra
2xwORthVqzOYZS.OlARsl0M1c_ylzsJYsrbhNZUfjmoOx6A--
Received: from [216.226.68.12] by web26707.mail.ukl.yahoo.com via HTTP; Thu, 30 Jun 2011 11:57:43 BST
X-Mailer: YahooMailClassic/14.0.3 YahooMailWebService/0.8.112.307740
Message-ID: <[email protected]>
Date: Thu, 30 Jun 2011 11:57:43 +0100 (BST)
From: brian warwick <[email protected]>
Subject: URGENT NEWS ABOUT MR PHELPS
To: <omitted>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1014496633-1309431463=:25181"

--0-1014496633-1309431463=:25181
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

Hello there,

I just saw this email on a document of
a mr xavier phelps and i thought it was important.
he was involved in a ghastly car accident yesterday
and he is in the hospital presently.
he didnt have a wallet on him
and his phone was completely shattered
so we couldnt reach anyone
I was able to contact you because of the document
found on him
it had your name and email address on it

It looks like a corporate contract or something.
either way
if you get this message and you know mr xavier
i think you should try and get back to me

Hes in pretty bad shape and needs immediate medical attention
we need to rush him into intensive care
and we dont know of anyone who will be able to foot his bill
hence my contacting you
it is imperative something is done or he will lose his life.

Scam, scam, scam! I knew it. This message was followed by:

From - Thu Jun 30 07:48:30 2011

I work at the hospice where Mr Phelps was carried.
he lost a bit of blood and will need some attention
Can you offer assistance on his behalf?

I told him not to contact me again. He sent:

From - Thu Jun 30 07:59:42 2011

I saw some documents on him with your name on them
i believe they are employment contracts.
You are <omitted>?
Treatment needs to be started on him
and we couldnt reach any of his kin
and we need payment to be made on his behalf
Can you vouch for him?

I have not replied.

If there is anyone who wants to take their names and addresses and waste their time or money, I would be thrilled to see it, but I feel like I have been exposed by these people, because they were talking to the real me - and they have my real address because it's on my resume. *sigh*

Posted: Thu Jun 30, 2011 8:34 pm

Welcome Bloody Mary,

wise move not to bait this particular scammer. There are enough other ones if you want to bait them!

If you want to help potential victims, could you please post the scam mail over at our sister site, Scamwarners.com? - Link is at the top of our site.

Please do not omit the scammer's email address, victims doing a Google search will find your warning and be saved, and baiters can pick it to have some fun.

Thanks!

Employment/Hospital Scam – Saint Vincent and the Grenadine	View next topic View previous topic