Why do scammers use this type of email format?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

*** BANNED *** Joined: 02 Jun 2013 Posts: 177

I received this mystery shopper scam yesterday. When you copy and paste it,you can't read what it says easily. Has anyone seen this before? Why do scammers use this? How can you report it where the provider can understand what it says? Any insight?

x-store-info:fHNTDlzCF8Nxw6HwcfGQy+S7Ax/lqLSmNphQ3OF+T9E=
Authentication-Results: hotmail.com; spf=temperror (sender IP is 62.142.5.117) [email protected];
dkim=none header.d=gmail.com; x-hmca=none [email protected]
X-SID-PRA: [email protected]
X-AUTH-Result: NONE
X-SID-Result: NONE
X-Message-Status: n:n
X-Message-Delivery:
X-Message-Info:
Received: from emh07.mail.saunalahti.fi ([62.142.5.117]) by BAY0-MC2-F22.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Sat, 6 Jul 2013 09:46:16 -0700
Received: from saunalahti-vams (vs3-11.mail.saunalahti.fi [62.142.5.95])
by emh07.mail.saunalahti.fi (Postfix) with SMTP id 10FC43FDC;
Sat, 6 Jul 2013 19:46:13 +0300 (EEST)
Received: from emh07.mail.saunalahti.fi ([62.142.5.117])
by vs3-11.mail.saunalahti.fi ([62.142.5.95])
with SMTP (gateway) id A049B60F82F; Sat, 06 Jul 2013 19:46:13 +0300
Received: from Unknown (83-245-193-202.elisa-mobile.fi [83.245.193.202])
by emh07.mail.saunalahti.fi (Postfix) with SMTP id CC35E3FFA;
Sat, 6 Jul 2013 19:45:58 +0300 (EEST)
Message-ID:
From: "Research Team" <[email protected]>
Cc: [snip list of cc'd email addresses - JF]
Subject: inquiry #822271
Date: Sat, 6 Jul 2013 13:44:06 -0300
Organization: =?koi8-MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_16AF_01CE7A4E.E2B259A0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512
X-Antivirus: VAMS
Return-Path: [email protected]
X-OriginalArrivalTime: 06 Jul 2013 16:46:17.0047 (UTC) FILETIME=[5587BE70:01CE7A68]

uHello,o

hWeErequireZsecretSsurveyBagent,whoBcan
BhelpSusIsurveyUWesternQUnionIandFWalMart
Sstores(storesLmightMchange)XsecretlyM
withoutLtheirBknowledgePasZweQhaveW
receivedAlotsVofKcomplaintsOregardingGtheir
Rservices.I

GYouEwillChaveStoUuseXtheOfollowingO
pointersUbelowXtoRprepareSyourCreport:EC

M-OAssessmentMandJadviceDonNcustomer
Mcare.C
R-UStoreLlayoutFandReaseYofCselection.Y
J-ODepthQofIselection.I
K-GCustomerUcareRprogrammeVandB
serviceSaudits.U
T-LStaffTappearance.B
D-YStaffsUapproach.S
L-RStaffYknowledgeKofHproduct.L
S-JGeneralZServiceClevel.G
M-RStoreQcleanliness.U
W-SCashPandQwrapIareaXappearance.X
R-QExitMpolls.B
X-VTelephoneOsurveys,QandAmarket
QresearchCprojectsRundertakenZ

DTheSfundsQtoSshopRatWWalmartV
storesEandEtoTcompletePtheUWestern
XUnionJsurveyPwouldHbeKprovidedIby
Uus.WeTfeelJyouTareDdedicatedJandX
requestPyouJtoEfillUinStheQfollowing
OinformationWbelowLandWsendEusGback.J

AFirst-NameB:
ULast-NameT:
YAddressC:
PCityG:
NStateP:
UZipZ:
FCountryF:
HPhone-NumberN:

PIsPthereLaEWesternPUnionIoutletNnearby
UtoOyourJplace(replyRwithKaYYESAorONO)E:
VIsDthereJaKWalMartNstoreRnearbyEt
oIyourAplace(replySwithUaOYESEorLNO)B:

EPayment:YouMpayTwouldWbeBpaidD$200
TonFeachAevaluationEandWyouDcould
LevenBtakeWthisGasCyourPpartNtime
Hjob,whichRjustGrequiresGanLhourYor
DsoCtoJcompleteBtheVevaluation.N
FP.S:JAVbriefDdescriptionJonUhowUto
CgoNaboutZtheBprocessMwouldIalsoAbe
GsentTtoRyourOaddressOwithEtheMfunds
OforDfutureUreferences.A

CThankUyou,W
QMarkCSimaH

[snipped unnecessary domain keys and reformatted to prevent forum blowout. - JF

Posted: Sun Jul 07, 2013 7:44 pm

please fix the format, blows of my screen

*** BANNED *** Joined: 02 Jun 2013 Posts: 177

Here is the email (I took out the other letters and symbols so you can understand it.

Hello,
We require secret survey agent,who can help us survey Western Union and WalMart stores(stores might change) secretly without their knowledge as we have received lots of complaints regarding their services.
You will have to use the following pointers below to prepare your report

-Assessment and advice on customer care.
-Store layout and ease of selection.
-Depth of selection.
-Customer care programme and service audits.
-Staff appearance.
-Staffs approach.
-Staff knowledge of product.
-General ServiceClevel.
-Store cleanliness.
-Cash and wrap area appearance.
-Exit polls.
-Telephone surveys, and market research projects under taken

The funds to shop at Walmart stores and to complete the Western Union survey would be provided by us.We feel you are dedicated and request you to fill in the following information below and send us back.

First-Name:
Last-Name:
Address:
City:
State:
Zip:
Country:
Phone-Number:

Is there a Western Union outlet nearby to your place (reply with a YES or
NO):
Is there a WalMart store near by to your place (reply with a YES or NO):

Payment:You pay would be paid $200 on each evaluation and you could even take this as your part time job,which just requires an hour or so to complete the evaluation.
P.S: A brief description on how to go about the process would also be sent to your address with the funds for future references.

Thankyou,
Mark Sima

Posted: Sun Jul 07, 2013 8:46 pm

Quote:

with the funds for future references

Fake cheque scam? and as you are already watching WU you might as wel do a test there and sent them $1,000 from that cheque to see how they treat you ?

*** BANNED *** Joined: 02 Jun 2013 Posts: 177

I was talking about the first email! Anyone ever get emails when you try to copy and paste other letters and symbols appear? What is the purpose of that?

Posted: Sun Jul 07, 2013 11:49 pm

no purpose they made the document on a "strange" mailer or copied it for a "strange" word-processor, no clue why, but they all look like the stuff word-perfect adds to txt, it's just the formatting that shows

*** BANNED *** Joined: 02 Jun 2013 Posts: 177

The extra characters are invisible until you copy and paste the email.

Posted: Mon Jul 08, 2013 6:46 am

thrasher4 wrote:

I was talking about the first email! Anyone ever get emails when you try to copy and paste other letters and symbols appear? What is the purpose of that?

Its an attempt to get past spam filters. You don't see the extra characters as they're formatted to be invisible but the parser of the spam filter sees them and the idea is that instead of trigger spam words it sees random garbage.

When you cut and paste to a plain text editor the invisible formatting is lost and you can see the garbage characters.

*** BANNED *** Joined: 02 Jun 2013 Posts: 177

Why can't or won't gmail deactivate a scammer's email when someone complains? It shouldn't matter if the scammer hides their ISP.

Master Baiter Joined: 21 Jun 2013 Posts: 144

^^^ you know it only takes a few minutes to create a new email address. It is better to go for bigger stuff like bank accounts. When they get a new email address it gives the lads an escape route from baiters they could continue to scam people under a new email address and just drop any baiters that were contacting them under the old email address which does not work anymore.

*** BANNED *** Joined: 02 Jun 2013 Posts: 177

I agree with you mostly,except,if a scammer's email gets deactivated,they loose the addresses and phone numbers of some of their victims. So I guess it is good and bad.

Posted: Wed Jul 10, 2013 1:49 am

^There is no Good as far as I can see. We Baiters are one thing but what about real Victims? Please have a look at Scamwarners.com to see what we are really all about. Shutting down a Lad's Box will only make our work more difficult. Potential victims will not be able recognize/research/Google/etc./Sorry its been a very long day....

Never get a Lad's Box shut down as it is counterproductive. Know the Enemy then kick him/her where it hurts!

Posted: Wed Jul 10, 2013 2:07 am

Quote:

if a scammer's email gets deactivated,they loose the addresses and phone numbers of some of their victims.

It would have to be a particularly stupid lad to not keep an alternative active email account that they use to keep track of all their victims. Most would forward all the details to a separate account for reference.

Closing a lads account just pisses off everyone in SW that have collected formats and links to lads emails. Try explaining to a convinced victim that the format they have received is really the same as some other lads email. They will always believe that their one is the real one.

It is better for all concerned that we do not close lads email accounts, this has been learned from everyones collective experiences over the years that Eater has been running.

Please keep asking, we don't mind explaining the how and why of what we do

Not quite a Newb Joined: 24 Dec 2012 Posts: 69

T4 there is no good in shutting down a scammers email account. It's best to know where they are. It seems that you refuse to read all of the info recommended to you . What about a mentor? Have you gotten one yet ? You ask questions and then ignore the advice given. There are a multitude of baiters that have been here for so long, who know what they're talking about. The purpose of listing email addy's here and at scamwarners is so that a google search will lead almost victims to info that will save them from being scammed. You have already put I.T.P.'s at risk with your brilliant fake check plan. This is a group ! Meaning we work together and observe certain rules that protect people from becoming victims. It seems that you want to work alone and do things your way. Maybe this site is not the right fit for you. You're very lucky that the powers that be haven't already bounced you out. I suggest that if you want to be part of this group you should start reading and listening to those who know much more than you or I. Believe me no one is going to be impressed with lone wolf ,hot shot, stunts. My apologies for being so harsh . It just makes me crazy to see more people being hurt by these scammers.

Posted: Wed Jul 10, 2013 11:48 am

Dear Thrasher,
Please read this thread:
http://forum.419eater.com/forum/viewtopic.php?t=234316

Baiters were just starting up on an FBI scammer only to have the E-mail(s) shut down. For now, it seems the Baiters can't reach the scammer. Keep an eye on the thread and see if takes very long before they are contacted again from a different address. Second, by shutting down those E-mail addies anything that a Baiter has posted at a Warning site is now basically worthless. And what the Scammer's present new E-mail address is?????

Crying or Very sad

*** BANNED *** Joined: 02 Jun 2013 Posts: 177

Well,all I was doing is asking a question. I haven't reported many scammer email accounts. Is it okay for me to give a scammer a fack address? What I have done in the past is look up addresses in a city and if the address number is 2741 I would remove a digit and the fraudulent check will be sent back to the person who's on the return address or it will be destroyed (sometimes they don't use a return address). Also,how do scammers pay for shipping the fake checks? Credit cards can be tracked. Some of these scammers have commercial base pricing and get electronic rates. Can they use cash to pay for this? About my baiting,I got two mystery shopper scammers to give me bank accounts which I reported to the banks and to Alan. I am having a hard time getting others to give the some. Collin Friedman is one that I am having a hard time getting a bank account from.
Any advice?

*** BANNED *** Joined: 02 Jun 2013 Posts: 177

Collin F's email address is [email protected]

Maybe someone else can bait him? How do I report email addresses on here (not to spamcop or the email provider) and how do I look up email addresses?

Return-Path: [email protected]
Received: from mip.hushmail.com (LHLO smtp10.hushmail.com) (65.39.178.7 Cool

by
server with LMTP; Sat, 6 Jul 2013 20:46:11 +0000 (UTC)
Received: from smtp10.hushmail.com (localhost [127.0.0.1])
by smtp10.hushmail.com (Postfix) with SMTP id 0ABD9C00F9
for <[email protected]>; Sat, 6 Jul 2013 20:46:48 +0000 (UTC)
X-Hush-Verified-Domain: gmail.com
X-Hush-Real-Recipient: [email protected]
X-hush-tls-connected: 1
Received: from mail-qa0-f66.google.com (mail-qa0-f66.google.com [209.85.216.66])
(using TLSv1 with cipher RC4-SHA (128/128 bits))
(No client certificate requested)
by smtp10.hushmail.com (Postfix) with ESMTPS
for <[email protected]>; Sat, 6 Jul 2013 20:46:47 +0000 (UTC)
Received: by mail-qa0-f66.google.com with SMTP id d13so759333qak.9
for <[email protected]>; Sat, 06 Jul 2013 13:46:46 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20120113;
h=mime-version:in-reply-to:references:date:message-id:subject:from:to
:content-type;
bh=cgvj8iPyYrDPKAEIl8zsa+ckIpHAa4c/ceS6spuo9dE=;
b=uV3zaIsuZUPiwq/raBr/ST3TtKZ1yOPjgvQo3cmguVK42v3avEnosTrrSP9gY7p/tZ
pkN+Hio00l0L9s+mr8lsI3gMV3a+BRoDOoGYQYFppisF7BR/XZ4UpFtTKsk6m2B70WpO
cuYRx1jQllXD11dNWNm/umlg/WLZtgKGmVH7Vbz0KDS8mii9kHPqeGGmWMcjq0JWcV1U
5g51TLLAPQYmL6wW9MEAkMKqz+ddqcXsWDXGufbYvXlVGlnZ6WGpX9Av8J3pjaP1WjJb
/3s4GYPGXNdXBq7quKB3kJCpu2w2fw/tRS2uA34ddDMRb3OiwZxONOFxEodTuVbWYpW4
Sbbg==
MIME-Version: 1.0
X-Received: by 10.224.23.72 with SMTP id q8mr12353127qab.63.1373143606449;
Sat, 06 Jul 2013 13:46:46 -0700 (PDT)
Received: by 10.49.70.137 with HTTP; Sat, 6 Jul 2013 13:46:46 -0700 (PDT)
In-Reply-To: <[email protected]>
References: <[email protected]>
<[email protected]>
<[email protected]>
<CAATOaRn=EQYFWSah4af_15W_V7zfNBpQS6ShdZvHhcbfiMORjA@mail.gmail.com>
<[email protected]>
<CAATOaRnCBCjD9Y=WZ7p6LOn0Ug7BpcrRxz5Ao2eQGF=wksn6yQ@mail.gmail.com>
<[email protected]>
<CAATOaR=--K7oUxq2oXZcKdXhuiwM2P6v+4NgJidw4ZVxKdMAaQ@mail.gmail.com>
<[email protected]>
Date: Sat, 6 Jul 2013 21:46:46 +0100
Message-ID: <CAATOaRmoosNbMMUSP_s7Au19qvg1qUvCJkWnCh23BD6zNWO5mg@mail.gmail.com>
Subject: Re: mystery shopping
From: Collin Friedman <[email protected]>
To: [email protected]
Content-Type: multipart/alternative; boundary=001a11c24ddce35aad04e0dde8b9

If i dont hear back from you with the WU information by end of today, consider this transaction null and void, i will contact the bank on monday morning to cancel the payment on the check and then return the money back to bank, this is the only way we accept which is Western Union only.

On Fri, Jul 5, 2013 at 6:48 AM, <[email protected]> wrote:
Nope,sorry,it can't be done that way. It's not possible. I can't get any where except my bank. If you want your money,please give me your bank account information as this is the only way! I can wire the funds from my bank. Please give me your bank account information so I can do so. I cashed the check on Wednesday and I'm waiting for the information so I can wire the money from there! Please understand this is the only way!

Olga

On July 4, 2013 at 5:14 PM, "Collin Friedman" <[email protected]> wrote:
this mystery shopper job is to evaluate western union, so you have to wire the funds via western union, kindly get this done today and get back to me asap

On Wed, Jul 3, 2013 at 4:46 PM, <[email protected]> wrote:
Hello Collin,

I got the check yesterday. I cannot drive so I can't wire the money by western union or money gram. However,I live a block away from my bank so I can wire the money directly from there if you give me your bank account information. Please reply and let me know!

Olga

On July 2, 2013 at 6:02 PM, "Collin Friedman" <[email protected]> wrote:
you are going to receive it today, once you receive the check, deduct $300 for your first week payment and wire the rest to:

David Hoffman
Washington, DC 20002
United States

Kindly get back to me with the information below after wire the funds,

Senders name and address
MTCN
Amount sent after WU charges
Name of WU agent that attend to you
your comments about the store environments

Get this done today so that we can move to the next assignment

On Tue, Jul 2, 2013 at 3:16 PM, <[email protected]> wrote:
Do you have a tracking number? Please let me know!

Olga

On June 30, 2013 at 5:17 PM, "Collin Friedman" <[email protected]> wrote:
Okay, i will send out the first week payment to you in amount of $2700 and you will deduct $300 for your first week wages and wire the rest via western union to another shopper to his/her to take care of another shopper, after you complete the first week payment, second week assignment will be send to you then.

On Sun, Jun 30, 2013 at 8:20 PM, <[email protected]> wrote:
Hello,

I googled secret shopper and it gave me your email. I would like to join your team. Please let me know more! My information is below!

Thanks
Olga Levosyuk

154 Music Street
New Orleans,LA 70117

*** BANNED *** Joined: 02 Jun 2013 Posts: 177

The postal address wasn't an actual address,I removed a digit and it may have been destroyed.

Posted: Wed Jul 10, 2013 2:42 pm

Fake addresses are ok. What I do is give a house number that is off the chart rather than remove a digit. If I see that an address of 15545 is close to the end of a street I would use 15645. Then I google that address to see where Google puts it to be sure. I use one that would be in the middle of some farmers field about a mile from the end of a road. Either way, make sure you Google whatever address you use and be sure it doesn't go to an innocent third party's address.

Not trying to slam you Thrasher. Just wanted to show a real-time effect of getting E-mail addresses killed. I had one that was attached to a website killed once. The Scammer was in contact with me within an hour of the website (And E-mail addy) going down.

The Lads probably use stolen credit card details to mail things. They try as much as possible to live off their victims money rather than their own. I'm sure there are exceptions.

*** BANNED *** Joined: 02 Jun 2013 Posts: 177

How do I get more bank accounts to kill? It isn't easy to get one from Collin.

Posted: Wed Jul 10, 2013 3:02 pm

Thrasher, I don't intend to be difficult, but READ THE STICKIES. Every question you have asked is dicussed extensively there and at EaterU.

With regard to bank accounts, I don't think you are going to get one from a mystery shopper scam to evaluate Westy. Might be wrong but I doubt it. Why not just send him fake forms?

Posted: Wed Jul 10, 2013 3:08 pm

I harvest most of my Piggy's from the Dakar Darlings. It's great that you want to kill piggy's. You'll get better at coaxing them out of your Lads as you go. Meanwhile wasting the Scammer's time is also a good thing.

Very Happy

*** BANNED *** Joined: 02 Jun 2013 Posts: 177

I got T.L. to give me bank accounts (a mystery shopper scammer) and E.B. (another mystery shopper scammer) to give me atleast one. Who is Westy?
How do I get fake forms? Also,how do I report emails so others can bait them? I talked about T.L. in other posts.

Posted: Wed Jul 10, 2013 3:39 pm

You can get a lot of fake forms at the upper link in my signature line.

You can report E-mail address along with their headers (Minus your E-mail info) in the Surplus section here at Eater.

You can also mosey over to Scamwarners and check that the E-mail address(es) have been listed there. If they haven't, then you should list them using the posting giudelines at ScamWarners. Reporting addresses that aren't already there can help save other potential victims.

Posted: Wed Jul 10, 2013 5:26 pm

If the guy's scam is to evaluate Western Union, it's unlikely he's going to ante up a piggy.

Check Big Al's signature lines and check some of the listed baits-great ideas for wasting the lad's time. A few trips to the local WU office will do him good. Ask him how to fill out forms, where to go, why etc.

Why do scammers use this type of email format?	View next topic View previous topic