Yet Another Cycling Forum

General Category => The Knowledge => Ctrl-Alt-Del => Topic started by: Jaded on 02 February, 2016, 11:06:13 pm

Title: Today's scammer
Post by: Jaded on 02 February, 2016, 11:06:13 pm
A little different from 'today's spammer' thread - and quite possibly worse.

A friend sent me an email the other day. Along the lines of "I hope you can help, I'm stuck in a foreign place, and I need money, please help me as soon as you can. "

So I knew his account had been hacked. It was Gmail so a good hacking target. I saw him later that day and he said he couldn't get into his email.  I helped him initiate a Google password recovery process. This only takes 3 to 5 days, so it's pretty helpful! The next day he had an email from Google saying "We see you got access to your account again, if you haven't then reply to this email."

The problem was he hadn't got access to his email and he couldn't send any emails from his recovery address. But the bigger problem was that a relative of his has sent four figure sum to the scammers.

Oh well,  i've been helping as much as I can, but Google with the lack of a phone service and their 3-5 day recovery don't help at all.

Yes, it was a weak password. But why won't they let you ask for a password reset unless you are on a browser / IP address you normally use, when they let a scammer put 2-step verification on from a different IP?
Title: Re: Today's scammer
Post by: madcow on 02 February, 2016, 11:19:40 pm
My employer moved to Google mail/ drive etc last year and our e-mail system has been hacked at least twice now to my knowledge.
Scammers send an e-mail with attachment titled "confidential information for you only" or somesuch.
If you search on google the website address carries a warning "may have been hacked".
After less than 12 months use we are now returning to Microsoft .

Is gmail known to be lots less secure?
Title: Re: Today's scammer
Post by: Afasoas on 03 February, 2016, 08:59:33 am
Is gmail known to be lots less secure?

We've been using it for as long as I've been here and it hasn't happened yet. But I suspect you are confusing anecdata with science. The problem is most likely people using the same creds for other sites, or people authorizing rogue applications to send email from their Google accounts.
Title: Re: Today's scammer
Post by: Jaded on 03 February, 2016, 09:18:11 am
My anecdata is that the vast majority of these scams come from hotmail or gmail accounts.

I guess that as a broad generalisation people that use free gmail/hotmail don't view computer security in quite the same way as those that have proper domains for their business/serious personal emailing.
Title: Re: Today's scammer
Post by: jsabine on 03 February, 2016, 09:38:58 am
My anecdata is that the vast majority of these scams come from hotmail or gmail accounts.


Isn't that simply a factor of the fact that enormous numbers of people have hotmail or gmail accounts?

My countervailing anecdatum is that the only time I've had a holiday disaster scam email, it came from a yahoo address, while the overwhelming mass of other dodgy spam from friends' addresses has been from corrupted BT accounts.

Quote
I guess that as a broad generalisation people that use free gmail/hotmail don't view computer security in quite the same way as those that have proper domains for their business/serious personal emailing.

I'm sure that madcow's employer was paying plenty for its gmail for business setup, and has every right to assume it's as secure as any other email provider; equally, I don't think that choice will have affected the attitude he or his colleagues take to security.

As for private use, sure, if you have your own domain you may well have a reasonably secure approach. But I'm not convinced that choosing a free email provider indicates anything much as compared to simply using your ISP's email service.
Title: Re: Today's scammer
Post by: Jaded on 03 February, 2016, 09:51:43 am
My anecdata is that the vast majority of these scams come from hotmail or gmail accounts.


Isn't that simply a factor of the fact that enormous numbers of people have hotmail or gmail accounts?

My countervailing anecdatum is that the only time I've had a holiday disaster scam email, it came from a yahoo address, while the overwhelming mass of other dodgy spam from friends' addresses has been from corrupted BT accounts.

Quote
I guess that as a broad generalisation people that use free gmail/hotmail don't view computer security in quite the same way as those that have proper domains for their business/serious personal emailing.

I'm sure that madcow's employer was paying plenty for its gmail for business setup, and has every right to assume it's as secure as any other email provider; equally, I don't think that choice will have affected the attitude he or his colleagues take to security.

As for private use, sure, if you have your own domain you may well have a reasonably secure approach. But I'm not convinced that choosing a free email provider indicates anything much as compared to simply using your ISP's email service.

Yes, the numbers thing is probably a factor.

As for the other stuff, I did say "as a broad generalisation" .
Title: Re: Today's scammer
Post by: Feanor on 03 February, 2016, 10:06:08 am
Thing is, it's pretty hard to tell the source of an e-mail.

Just because it claims to come from joe.blow@gmail.com doesn't mean that it actually did.
It doesn't mean joe's e-mail account is compromised.

Obviously, these scams rely on sending the mail to someone who is likely to know joe, so they must harvest e-mail address pairs that have some chance of working.
So it *could* be joe's account that's compromised.
But it might well be anyone who happens to have both you and joe on their contact list.
Hard to say.
Title: Re: Today's scammer
Post by: Jaded on 03 February, 2016, 10:09:11 am
Yes, that's true, in this case the password of the account has been changed and 2-stage verification added, so they have either cracked the password or got it by a rogue app asking for it.
Title: Re: Today's scammer
Post by: mrcharly-YHT on 03 February, 2016, 11:30:27 am
provide a mobile # for password recovery - a link etc is txted immediately.

Title: Re: Today's scammer
Post by: Ian H on 03 February, 2016, 11:43:23 am
...But the bigger problem was that a relative of his has sent four figure sum to the scammers.


That's a good reminder of one's internet security responsibilities.
Title: Re: Today's scammer
Post by: Afasoas on 04 February, 2016, 09:38:01 am
Thing is, it's pretty hard to tell the source of an e-mail.

Just because it claims to come from joe.blow@gmail.com doesn't mean that it actually did.
It doesn't mean joe's e-mail account is compromised.

Obviously, these scams rely on sending the mail to someone who is likely to know joe, so they must harvest e-mail address pairs that have some chance of working.
So it *could* be joe's account that's compromised.
But it might well be anyone who happens to have both you and joe on their contact list.
Hard to say.

Gmail and Office365/Outlook.com will pretty much spam anything that fails SPF/DKIM. Using SPF/DKIM for a domain/mail server doesn't prevent spoofing, but it does make it easier for receiving mail servers to discern whether or not a sender has been spoofed.

One sure sign that your email address is getting spoofed is receiving lots of bounce messages for emails you haven't sent.
Title: Re: Today's scammer
Post by: Ham on 04 February, 2016, 10:07:47 am
Since initiating Sun Protection Factor on my domains the number of bounced mails spoofing send from <random chars>@mydomain has dropped significantly.
Title: Re: Today's scammer
Post by: jsabine on 04 February, 2016, 01:47:07 pm
[...] the overwhelming mass of other dodgy spam from friends' addresses has been from corrupted BT accounts.

Thing is, it's pretty hard to tell the source of an e-mail.

Just because it claims to come from joe.blow@gmail.com doesn't mean that it actually did.
It doesn't mean joe's e-mail account is compromised.

Obviously, these scams rely on sending the mail to someone who is likely to know joe, so they must harvest e-mail address pairs that have some chance of working.
So it *could* be joe's account that's compromised.
But it might well be anyone who happens to have both you and joe on their contact list.
Hard to say.

Aye, but ...

The cases I'm thinking of, the spam has turned up in my mailbox with DisplayName $MyFriend, SenderEmail $SomethingRandom, and the distribution list something that looks *very* likely to have come from $MyFriend's contacts (though of course it could have come from the contacts list of several other acquaintances-in-common).

This holds true for quite a few emails, from several different people in about three different circles, and in every case but a couple the DisplayName has been of someone I know to use BT (in the other couple, they've been Yahoo users).
Title: Re: Today's scammer
Post by: Feanor on 04 February, 2016, 02:11:15 pm
Since initiating Sun Protection Factor on my domains the number of bounced mails spoofing send from <random chars>@mydomain has dropped significantly.

Yes, I did that way back.
This thread has prodded me into also setting up DKIM on my mailserver.
I'll have a hack at it tonight, if I get the time.
Title: Re: Today's scammer
Post by: Feanor on 05 February, 2016, 06:32:20 pm
OK, so got DKIM configured on my e-mail domain and all is working, with only mild swearing.

Main problem was trying to put the public key TXT record into DNS ( using AAISP's web interface ).
It accepts it on the web interface, but never serves it.
Turns out there's a 255 character limit on the strings in a TXT record, which 2048 bit keys bust.
Fortunately, you can "split it into" "shorter strings".
And then it works.

Title: Re: Today's scammer
Post by: Phil W on 05 February, 2016, 06:56:59 pm
Most DKIM keys are 1024 bit.
Title: Re: Today's scammer
Post by: Feanor on 05 February, 2016, 07:07:08 pm
True, but I didn't know that at the time.
I do now!

The key-pair generator I used defaulted to 2048, and I didn't at the time see a good reason to change it.

Still, I learned about how to shoe-horn long strings into a TXT record.
Title: Re: Today's scammer
Post by: Phil W on 05 February, 2016, 07:17:05 pm
I put DKIM and SPF in place for LEL2017.  It's stopped Danial's emails ending up in the spam bin / bounced which was a problem he had reported from LEL2013  ;D
Title: Re: Today's scammer
Post by: Feanor on 05 February, 2016, 09:33:12 pm
That's the reason I'm re-visiting this whole issue.

My work previously did it's own e-mail, but we've gone all cloudy Orrifice 360 in the last few months.
It's caused a problem when I try to e-mail myself at work from my home address.
The work mail is hosted by MS, who reject all my home mail as spam because I don't pay for it not to be.

It's already:
Not on a dynamic IP;
Has a valid MX / A / AAAA / Reverse lookup in DNS;
Has valid SPF
Now has valid DKIM too.

But not good enough, it seems.
I've hit the 'request de-listing' links in the bounces, and had auto-replies that I've been de-listed, but they lie.
Google suggests that I need to call a magic number and talk to a person, and that's the Only Way.
I may do that later.

It is possible to have independent un-paid-for mail accepted by MS, but it's an uphill struggle, and SPF and DKIM help in the process.
Title: Re: Today's scammer
Post by: hellymedic on 06 February, 2016, 10:01:08 pm
My anecdata is that the vast majority of these scams come from hotmail or gmail accounts.

I guess that as a broad generalisation people that use free gmail/hotmail don't view computer security in quite the same way as those that have proper domains for their business/serious personal emailing.

'Mike's came from a bt.internet = yahoo account.
Title: Re: Today's scammer
Post by: Feanor on 06 February, 2016, 11:00:11 pm
Maybe it did, and maybe it didn't.

It's difficult to tell, even for people who know about this stuff.
You can't believe what an e-mail says in the "From:" field.

Think of it like paper mail.
You get a letter, in an envelope, addressed to you, delivered by the postman.
On the back of the envelope, there is a sticker, which says:
Sender: Joe Blow, 100 Main Street, Anywhere.

Is that the genuine source of the letter?
No, it's just what the sender stuck on the envelope.

It's the same with e-mail.






Title: Re: Today's scammer
Post by: Steph on 11 February, 2016, 09:58:57 pm
That particular scam is known as the Spanish Prisoner and is centuries old.
Title: Re: Today's scammer
Post by: Jaded on 12 February, 2016, 01:24:44 am
It took 9 days to get the email address back in action.
Title: Re: Today's scammer
Post by: Gattopardo on 14 February, 2016, 11:05:46 pm
Well a defunct email address from viola.fr, no longer has an email part, is quite happily spamming people.  But none that I know.
Title: Re: Today's scammer
Post by: Mr Larrington on 23 February, 2016, 06:50:13 pm
Quote from: Cluefree Twunt


 Valued Customer,
 
 Please note that starting from February 23, 2016 we will be introducing new online banking authentication procedures in order to protect the private information of all online banking users.
 
 You are required to confirm your online banking details with us as you will not be able to have access to your accounts until this has been done.
 
 As you're already registered for online banking all you need to do is to confirm your online banking details.
 
 Confirm your details
 
 Once you've completed this you'll be able to manage your money whenever you want, giving you more control of your finances.
 
 Regards
 Customer Service
 Halifax - Uk Alert Team

Except there isn't a link - fraudulent or otherwise - in the entire message. 2/10 - must try harder.
Title: Re: Today's scammer
Post by: Ian H on 23 February, 2016, 07:38:07 pm
No links in this one either, but then I don't think there are meant to be.

Quote
Hello Friend,

You probably must be thinking how strange it is to receive a letter from a total stranger. I'm karin Bengt, from Sweden, and I'm sorry for reaching out to you in such a strange way, I decided to use the Internet because it still remains the safest and fastest means of getting information, sharing opinion across to an audience and connecting with people from half way around the world. The purpose of this email is for us to get connected, be friends and learn about each other. I'll hope to hear from you again.

Kind Regards.

Karin.
Title: Re: Today's scammer
Post by: Veloman on 23 February, 2016, 10:17:49 pm
^^^^^^ Go on, reply and ask for a photo!
Title: Re: Today's scammer
Post by: contango on 25 February, 2016, 12:58:29 am
^^^^^^ Go on, reply and ask for a photo!

I got a nice email from a young Russian girl who kindly included a link so I could see her photos. Sadly I accidentally deleted it before I could enjoy her curvy charms. I am making something of an assumption that she was old enough to actually have curves.
Title: Re: Today's scammer
Post by: Hot Flatus on 25 February, 2016, 09:52:11 am
ANTI-TERRORIST AND MONETARY CRIMES DIVISION
FBI HEADQUARTERS IN WASHINGTON, DC
FEDERAL BUREAU OF INVESTIGATION
J. EDGAR HOOVER BUILDING
935 PENNSYLVANIA AVENUE, NW
WASHINGTON, DC 20535-0001


This is to officially inform you that it has come to our notice and we have thoroughly completed an investigation with the help of our Intelligence Monitoring Network System that your E-mail address was among the email that Won UK National lottery Award which you did not claim, we want to let you know that one of the bank worker where your fund was deposited arrange with his friend to come as the owner of the E-mail that won the prize which they claim your fund, but now your fund has been recovered from them and the people that claim your fund has been arrested.

If you receive any E-mail that you did not understand that is from unknown person to you please do forward it to us to verify and bring the person to justice.

It has come to the attention of our Money trafficking investigation department, that you have some funds valued 800,000.00 Pounds on your name, the said payment is awaiting adjudication and we have authorized this winning to be paid to you, this funds are from UK NATIONAL LOTTERY.

Re-confirm, Names, Address, Phone Number, Age / sex, Occupation and Country, to avoid double claim of your fund.


YOUR IMMEDIATE RESPONSE IS NEEDED

JAMES B. COMEY
FBI DIRECTOR
Title: Re: Today's scammer
Post by: LEE on 25 February, 2016, 09:56:57 am
JAMES B. COMEY really is the FBI Director so it sounds legit if it's come from him.

I also know he dropped out of school when he was 12 which makes his poor comprehension of punctuation and spelling perfectly understandable..and actually makes it more credible.
Title: Re: Today's scammer
Post by: Mr Larrington on 25 February, 2016, 12:38:41 pm
"If you receive any E-mail that you did not understand that is from unknown person to you please do forward it to us to verify and bring the person to justice."

I trust you forwarded the scam e-mail back to the sender ;)
Title: Re: Today's scammer
Post by: De Sisti on 25 February, 2016, 12:56:20 pm
If you right click on a hotmail email, scroll down and click on message source and look for the ip address
against x-originating ip. That should give you the ip address of the machine (not the server) that sent the email.
Then use one of the ip look-up tools to find out where the machine is located.
Title: Re: Today's scammer
Post by: Jaded on 25 February, 2016, 01:04:04 pm
Remember to do it on your iPhone, 'cos the FBI can't look in there.
Title: Re: Today's scammer
Post by: Steph on 12 March, 2016, 04:02:11 pm
JBC is a busy man:

Hello Dear

I am Mrs Elizabeth Gale, Sample; I am a US citizen,58 years Old. I reside here in Minnesota.My residential address is as follows.
123 Main street Minneapolis, Mn 12345-0000, United States, am thinking of relocating since I am now Rich And comfortable with my Family. I am one of those that took part in the
Compensation in Africa many years ago and they refused to pay me, I had
Paid over US$8,000 for the past years while in the US, trying to get my
Payment all to no avail.And they always stopped my funds with one reason or the order. However, I decided to travel with my Son to WASHINGTON D.C with all my
Compensation documents, And I was directed by the ( FBI) Director JAMES
BRIEN COMEY,to Contact AGENT ERIC MAX, who is a representative of the
(FBI) and a Member of the COMPENSATION AWARD COMMITTEE,
presently in Kenya.And I contacted him and he explained everything to me.

He took me to the paying bank for the claim of my Compensation payment This was paid to me successfully.Right now I am the happiest woman on earth because I have finally received my compensation funds of( US$2.5Million) Hence, AGENT ERIC MAX, showed me the full Information of Those that are yet to receive their compensation
funds and I saw your name as one of the scam victims and one of the
US$3.5Million Beneficiaries that is why I decided to email you to know if
you have Received yours, and to advise you to stop dealing with those
people,they are not with your funds, they are only making money out
of you.I will advise you to contact AGENT ERIC MAX, You have to contact him Directly on this information below to know if he can help
you too. FBI COMPENSATION AWARD AGENT
Name: AGENT ERIC MAX
Email: ericmax@swissmail.com
Phone: +254712371049

You really have to stop dealing with those people that are contacting you Andtelling you that your fund is with them, it is not in anyway with Them,
they are only taking advantage of you and they will dry you up until You
have nothing left. The only Money I paid after I met AGENT ERIC MAX was just $1,500. for the Ownership Paper Works, Take note of that because that was only money I Paid.Once again stop contacting those people, I will advise you to contact

AGENT ERIC MAX so that he can help you to deliver your fund instead
of dealing with those liars that will be turning you around asking for
different kind of money to Complete your transaction.

Thank You and Be Blessed.
Mrs Elizabeth Gale.



And the headline was about someone called Hazard, who seems to have gone walkabout.
Title: Re: Today's scammer
Post by: Mr Larrington on 13 March, 2016, 10:03:21 am
From: winner's list <redacted>
Subject: winner's list
Reply to: markzuckerberg924@yahoo.com

Hello
This is the CEO/ Founder of Facebook
Mr Mark Zuckerberg We remember your User on Facebook. We wold like you to contact  the clamming agent right now so that you can be able to know if your name is on the  winner's list Search (Agent sarah smith) and Message her. Tell her you want to know if your name
is on the winner's list

No links.  No attachments.  No discernible purpose ::-)
Title: Re: Today's scammer
Post by: Diver300 on 19 March, 2016, 12:04:18 pm
.... sent a real letter.

inviting me to "comply with current legislation" and fill in the enclosed direct debit mandate, which was actually a standing order mandate.

The return address on the envelope is
FAO Tony
Colmore Plaza
20 Colmore Circus
Queensway
Birmingham
B4 6AT

I've checked who is at that address, and there are 148 companies registered there, so either Tony is being careless, or is trying to hide his identity.

The beneficiary bank account is at Cash Plus in London, but I guess that the scammers could scan and reprint anything I on the mandate.

The letter has a franked envelope, and a franked return envelope, so their returns must be good to risk over £1 on a scam.


Title: Re: Today's scammer
Post by: jsabine on 20 March, 2016, 12:34:49 am
.... sent a real letter.
[...]
The letter has a franked envelope, and a franked return envelope, so their returns must be good to risk over £1 on a scam.

Tape it round a brick?
Title: Re: Today's scammer
Post by: Jaded on 20 March, 2016, 02:01:11 am
Or a clutch. I know one mail order company once received a clutch through their return postage system. It dud get the problem resolved quite quickly.
Title: Re: Today's scammer
Post by: Steph on 11 April, 2016, 07:53:03 pm
Attention
This is Mr Anderson King director of DHL company, i want to inform you that there is package brought to this office to ship it to your address and the package value the sum of $11.8MUSD. In order to receive your items through DHL company, you are required to confirm your full delivery information, such as, your full name,home address,nearest airport and ph number.

In service with DHL company
Mr Anderson King
Title: Re: Today's scammer
Post by: Steph on 12 June, 2016, 09:31:00 am
"UNGODLY ACT", and all in caps.

ATTENTION. BENEFICIARY

PLEASE WE ARE VERY SORRY FOR ALL THE PROBLEM THAT YOU HAVE PASSED THROUGH
BECAUSE OF THIS YOUR BELONG PAYMENT OF WHICH YOU FAILED TILL NOW, FIRST OF ALL,
I WANT TO INTRODUCE MY SELF TO YOU, MY NAME IS KEVIN NEWMAN, I AM THE NEW
ELECTED DIRECTOR GENERAL OF WESTERN UNION OFFICE BENIN REPUBLIC I HAVE BEEN
CHOSEN LAST WEEK. I AM WRITING THIS MAIL WITH DEEP SORROW, I SAW YOUR NAME ON
OUR FILE YESTERDAY THROUGH MY SEARCHING AS THE ONE OF THE MOST BENEFICIARY
WHICH DID NOT RECEIVE YOUR FUND VALUED ($4.7 MILLIONS UNITED STATES DOLLARS)
WHICH SUPPOSES TO BE TRANSFERRING AT THE RATE OF $5,000.00 PER DAY DURING
FORMER MANAGER REGIME.

THE REASON I AM EMAILING YOU TODAY IS TO INFORM YOU THAT THE FORMER WESTERN
UNION MANAGER HAS BEEN SACKED OUT SINCE LAST WEEK DUE TO HIS ILLEGAL WORK
UNGODLY ACT, I AM HERE TO INFORM YOU THAT THE ONLY THING THAT WILL LEAD YOU TO
RECEIVE YOUR FUND IS BY TRUSTING ME AND FOLLOW MY DIRECTION, YOU SENT ALLOT OF
MONEY TO HIM IN ORDER TO GET YOUR FUND WHICH LATER FAILS. THEREFORE I AM TO
TELL YOU THAT THE REASON YOU DID NOT RECEIVE YOUR FUND IS BECAUSE YOU DID NOT
FOLLOW THE DIRECT WAY TO GET YOUR FUND BUT TO EXTORTING MONEY FROM YOU IN
VARIOUS QUARTERS. DUE TO THE FORMER MANAGER'S ATTITUDE WE THEREFORE RESOLVE TO
SACKED HIM OUT SINCE HE DIDN'T KEEP OUR INSTRUCTION,

SO NOW WE HAVE ARRANGED TO PAY YOU BECAUSE ALL OUR INVESTIGATED CONFIRMED THAT
YOU ARE THE RIGHT PERSON TO RECEIVE THIS FUND NOTE WE HAVE TWO OPTION TO PAY
YOU AND YOU THE ONE TO MAKE YOUR CHOICE OPTION (1) 0UR WESTERN UNION GOLD CARD
WHICH YOU WILL WITHDRAW DAILY $4000.00 OPTION (2) RECEIVE DAILY CASH $5,000.00
TILL THE TOTAL PAYMENT COMPLETED. THERE IS ONE CERTIFICATE CALLED (FUND RELEASE
ORDER CERTIFICATES) WHICH YOU SUPPOSE TO OBTAIN FROM FEDERAL HIGH COURT
SERVICES WHICH WILL NOTICED THAT YOU ARE NOT A BENIN CITIZEN BUT YOU DID NOT
HAVE IT AND THAT IS ONLY WHAT YOU NEEDED NOW.

ACCORDING TO THE INSTRUCTION PASSED TO THIS WESTERN UNION DEPARTMENT FROM THE
OFFICE OF THE (FEDERAL HIGH COURT SERVICES) THIS WILL DULY GUARANTEE AND COVER
THE MONEY AS BEING LEGITIMATELY ACQUIRED FROM THE BENIN GOVERNMENT. SO I WANT
YOU TO KNOW THAT YOUR FUND OF ($4.7 MILLIONS USD) IS STILL WITH THE FEDERAL
GOVERNMENT ACCOUNT BUT IT WILL RELEASE IMMEDIATELY TO THIS WESTERN UNION OFFICE
AS SOON AS YOU OBTAIN THE (FUND RELEASE ORDER CERTIFICATES)

ACCORDING TO OUR MESSENGER WHICH WENT TO THE FEDERAL HIGH COURT SERVICES OFFICE
BENIN REPUBLIC FOR THE RELEASE ORDER CERTIFICATES HE TOLD US THAT IT WILL COST
YOU THE SUM OF $100.00 ONLY FOR THE OBTAIN OF IT, SO HE TOLD US THAT THEY WILL
ISSUE IT WITHIN ONE DAY IF THE FEE WILL BE PAID. SO RECONFIRM US YOUR FULL
ADDRESS WITH THE OPTION EITHER YOU WANT IT GOLD CARD OR DAILY PER OK I WILL BE
AWAITING TO HEAR FROM YOU IMMEDIATELY WITH THE PAYMENT INFORMATION TO OBTAIN
THE FUND RELEASE ORDER CERTIFICATES,

RECEIVER NAME :.............EKANE ANYA
LOCATION CITY:.............COTONOU
COUNTRY:............BENIN REPUBLIC.
QUESTION:..................WHEN
ANSWER:..................NOW
AMOUNT:...............US$100.00
MTCN:.........?

I AM HERE GIVING YOUR GUARANTEE AND ALSO 100 % PERCENT ASSURANCE THAT THIS IS
THE ONLY MONEY YOU WILL PAY AND AFTER YOU PAY IT YOU WILL RECEIVE YOUR FUND
IMMEDIATELY. I WILL BE WAITING RIGHT TO HAVE THE PAYMENT INFORMATION IN ORDER
TO ENABLE US OBTAIN THIS NEEDED CERTIFICATE SOON. EMAIL THE WESTERN UNION FOR
CONTACT ( uwestern650@yahoo.com )

REGARDS,
MR. KEVIN NEWMAN
Tel +229 98486013
WESTERN UNION SENIOR MANAGER
Title: Re: Today's scammer
Post by: Steph on 30 September, 2016, 06:25:44 pm
This one is quite good, from the anatomical peculiarity to the erroneous assumption that I have a problem with TEH GAYZ. And while it goes on about Italy, it's from 'Nam.

Dearest One,
May the peace of the Lord be with you and your Family. My Name is Vincenzo Giorgetti, I am from Italy, I am an engineer and i have worked with so many construction firms across the globe. My last appointment was with Abbes Construction Public Co. Ltd.Thailand under engineering project/contract awarding section.
I am so impressed to meet you and have you as a friend. My heart longs for some one that I  can trust with a charity work with some funds which i am going to WILL to your favor for this Godly work. I have been Diagnosed with  Esophageal Cancer of the Lungs. Esophageal cancer is a cancerous (malignant) tumor of the esophagus. This is the tube that moves food from the mouth to the stomach.According to my Doctor I will die any moment. we  discovered this illness very late, due to my laxity in carrying for my health. It has defiled all forms of medicine, and right now I have only about a few months to live, according to medical experts.
I was hit with this ailment on coming back from ASIA to UK on 10th December,2014. Before this ailment, i have an account with a bank in Thailand worth $5.5million USD DOLLARS which i am prepared to WILL to you for the proposed charity work because i do not have a relation as  I was brought up as an orphan and was married to my late wife for twenty years without a child.
I am not afraid hence i know where I am going.I know that i will die and according to Exodus14 VS 14 says that the lord will fight my course and I shall hold my peace. Therefore I need a God fearing person  be you a christian or a good muslim that will use this fund to help motherless Babies, orphans, charity organization and less privileges ones, and use it judiciously.
I am repented Christian now and God has put it in my mind to give out the rest of my Money to Charity, I don't trust all the Monks here in UK after the Gay scandal and i have no close relation because i lost my wife in a Plane Crash in Sebreneska Eastern Europe in 1985 ever since then I have remain single just me and my business until I was hit with this Ailment of Esophageal Cancer.
 
I want you to Distribute these Funds to people that need it. I am 70yrs old, God has really Blessed me with fortunes.
As soon as I receive your reply indicating your interest to help, I will inform you on how the funds will be transferred to you and i want you to always pray for me because I don't have many days to live on this earth. so i will advice you forward your response to my personal email address for easy response
Title: Re: Today's scammer
Post by: robgul on 30 September, 2016, 06:53:13 pm
Over the last 3 or 4 days I've had probably 300 emails addressed to random characters or words before the  @<mydomain> (I have about 6 domains where they're doing this)   e.g.  uucp@domain  or  root@domain

All the messages have something like   "[Cured]Receipt 35-870076"   in the Subject line and are one of the following:  a) We tried to deliver a parcel today   b) Your debit card has been blocked   c) NN has asked me to send you a copy of our invoice  d) £nn has been deposited in your account today    - and they then all ask me to open an attachment (most of which are .txt files)

What is odd is that they all have the word [Cured] in the subject line??

I've been noting the before the @ text and adding them to the forwarding tool at my host's mail system to reject anything to that address at the domain.

It'll probably stop in a day or two - but it's annoying as some of the [Cured] stuff is coming to genuine email addresses we use.

Why - what's happening?

Rob
Title: Re: Today's scammer
Post by: DaveReading on 30 September, 2016, 08:48:53 pm
It'll probably stop in a day or two - but it's annoying as some of the [Cured] stuff is coming to genuine email addresses we use.

Inbox rule in the meantime ?
Title: Re: Today's scammer
Post by: robgul on 30 September, 2016, 09:00:19 pm
It'll probably stop in a day or two - but it's annoying as some of the [Cured] stuff is coming to genuine email addresses we use.

Inbox rule in the meantime ?

Yep - done that for [Cured]  - just shoots 'em into the Predictive Spam folder (using Time & Chaos Intellect mail client) - although I'm also trapping some manually at the BT server and marking them as Phishing before they get to my email client.

Rob
Title: Re: Today's scammer
Post by: Pickled Onion on 01 October, 2016, 08:18:40 am
What is odd is that they all have the word [Cured] in the subject line??

I've had a load of those, but instead of an attachment they had e.g.
Quote
DHL Express ServiceFile "DHL_parcel_b078d8354.zip", size 10444 was deleted by Kaspersky Security 8.0 for Linux Mail Server
Anti-Virus status: Suspicious
Threats found: HEUR:Trojan-Downloader.Script.Generic

I don't run Kaspersky, and neither does my ISP. Is it possible they are sending their spam via a compromised mail server, but have failed to turn off the virus filter?
Title: Re: Today's scammer
Post by: robgul on 01 October, 2016, 08:22:37 am
What is odd is that they all have the word [Cured] in the subject line??

I've had a load of those, but instead of an attachment they had e.g.
Quote
DHL Express ServiceFile "DHL_parcel_b078d8354.zip", size 10444 was deleted by Kaspersky Security 8.0 for Linux Mail Server
Anti-Virus status: Suspicious
Threats found: HEUR:Trojan-Downloader.Script.Generic

I don't run Kaspersky, and neither does my ISP. Is it possible they are sending their spam via a compromised mail server, but have failed to turn off the virus filter?

Quite a few of my messages were DHL parcel delivery attempts - but with an attachment, not the Kaspersky text.

Looking at the "reject email" report at my ISP for the last 12 hours (with loads of manually set rules on the pre @ text) there have been about 70 messages - all "Cured" - at least they didn't arrive here!

Rob

Title: Re: Today's scammer
Post by: Ian H on 01 October, 2016, 10:41:34 am
The emails with zipped attachments have been going for some time in various forms:  here is your invoice; please check your payment; failed to deliver parcel; etc.  Gmail is good at catching them.
Title: Re: Today's scammer
Post by: rogerzilla on 01 October, 2016, 10:47:16 am
Quote
i have no close relation because i lost my wife in a Plane Crash in Sebreneska Eastern Europe in 1985 ever since then I have remain single...God has really Blessed me with fortunes.
;D
Title: Re: Today's scammer
Post by: Steph on 02 October, 2016, 08:53:41 am
The heights have finally been reached!

From Mrs. Michelle Obama
The White House
(Official Residence of the President of the US)
1600 Pennsylvania Avenue NW
Washington DC 20500 USA

How are you today? This is last you will ever hear from me and you fail to
comply.

I am Mrs. Michelle Obama and I am written to inform you about your Bank
Cheque Draft brought by the United Embassy from the government of Benin
Republic in the white house Washington DC which contains the sum of
$20.000.000 millions us dollars credited from the bank of America, the
delivery of your funds has been mandated to be deliver to your address  as
soon as you get back to me with your home address and your cell phone
number.

Bear in mind that I have taking my time to be in charge of your funds as
instructed by my husband to ensure that you received your funds
successfully from the white house to reduce the economy and I’m the only
one that has your funds in regard to my husband Mr. Barack Hussein Obama
II and you will have to pay the sum of $95.00 only before your Bank Cheque
Draft will deliver to you on Friday, the reason why the fee is required is
to have your funds clearance  paper from the origin of the funds to avoid
any harassment from the authority and you are also expecting to be
announce as winner of the said amount by Friday as soon as your fund is
delivered to you.

So you are urgent advised to get back to me with your home address and
also the payment information today for immediate effect of your delivery.
Note that the $95 is the only fee and final payment you have my assurance.

However, according to our agreement with the originated Benin Republic,
all our communications should be on email for record purpose so follow my
instruction accordingly, even if you don’t have the $95 try to borrow it
and send it immediately today because this is your life opportunity and I
don’t want you to lose the chance any more.

Please I will advice you to urgent make the payment this morning via
western union  money transfer to the listed cashier information as
instructed you by the originated authority. I will look forward to
received your email today with the payment to enable the origin secure the
required clearance papers required at White House Benin to deliver your
funds. Note that it will take only 14hrs to deliver your Bank Cheque Draft
in receipt of the $95 payment.

Please find the payment data below to send the $95 via western union.

Receiver Name:     DAN BONIFAE
Country:            BENIN
City:               COTONOU
Question:         Urgent
Answer:            Needed
Amount:         $95.00
MTCN reference number............
Sender Name...........
Sender's Telephone……
Sender's Address........

I look forward to your respond to your email with the payment today.

Regards


Mrs. Michelle Obama
The White House
(Official Residence of the President of the US)
1600 Pennsylvania Avenue NW
Washington DC 20500 USA
Title: Re: Today's scammer
Post by: DaveReading on 02 October, 2016, 03:08:17 pm
even if you don’t have the $95 try to borrow it

What a thoughtful touch.
Title: Re: Today's scammer
Post by: Jaded on 19 October, 2016, 11:12:41 pm
(http://www.alfiecat.co.uk/yetacf/IMG_9700.PNG)
Title: Re: Today's scammer
Post by: Wombat on 20 October, 2016, 01:45:30 pm
Do not be tempted, that stuff is a disaster, and may cost thousands to remove in order to cure the rot that it might cause.

I know you weren't tempted (how could I guess  ;D) but just wanted to reinforce that.
Title: Re: Today's scammer
Post by: jsabine on 21 October, 2016, 12:55:26 am
Do not be tempted, that stuff is a disaster, and may cost thousands to remove in order to cure the rot that it might cause.

Do you have any references for that, or any indication of the likelihood of problems? I know that insurers seemed a little wary of it a few years ago, but my MiL's partner has some sort of business interest in the stuff and (some time ago) persuaded both her and my BiL to have their roofs done: I'd welcome evidence for my own scepticism.
Title: Re: Today's scammer
Post by: Canardly on 21 October, 2016, 08:28:59 am
Glad the potential for rot has been highlighted.
Title: Re: Today's scammer
Post by: hatler on 21 October, 2016, 08:51:33 am
Anything which stops wood being ventilated will result in its rotting, unless it's a very dry environment.

Quote
Dry Rot
Dry rot is the most serious form of timber decay in a building and requires over 20% moisture level for spore germination. It is a fungus that destroys wood and eventually reduces timber to a dry crumbly consistency. It thrives in moist unventilated conditions and can occur in the areas of a property that are not often seen, so damage may be extensive before the attack is discovered.

From here. (http://www.northlanarkshire.gov.uk/CHttpHandler.ashx?id=4157)
Title: Re: Today's scammer
Post by: mrcharly-YHT on 21 October, 2016, 09:28:05 am
If you could spray it *above* the roof timbers, it would be great.

I'm a bit surprised this stuff isn't being marketed in Australia - roofing over there is usually steel structural members and often corrugated aluminium or steel sheeting. sprayfoam would insulate, deaden sound from rain and increase the strength of the roof. Given the temperature ranges they are getting over there (winter lows are about 5C lower than they used to be, summer highs are about 5C higher) insulation would be a good thing.

They haven't discovered double glazing yet.
Title: Re: Today's scammer
Post by: Mr Larrington on 21 October, 2016, 12:14:08 pm
Or central heating, if Professor Larrington's current experience is in any way typical.
Title: Re: Today's scammer
Post by: mrcharly-YHT on 21 October, 2016, 01:31:08 pm
Well, um, no, because for a large part of the year the main concern is cooling the house, not heating it. It's atypically cool in Perth ATM.

Where is Prof staying (don't say she's in student digs in Currie Hall)
Title: Re: Today's scammer
Post by: trekker12 on 21 October, 2016, 01:34:53 pm
Twice this week I've received an e-mail from Natwest telling me my account was accessed by someone unknown in New Zealand and I should log in through the link given to confirm my details were correct. They gave a little map of New Zealand showing exactly where the account had been accessed, which I thought was jolly nice of them, particularly as I don't have a Natwest account.

The main part that gave it away though was the fact a fly had clearly landed on the map as it was photographed (presumably using a mobile phone) so as you scrolled the e-mail, the fly moved with it!!
Title: Re: Today's scammer
Post by: Mr Larrington on 21 October, 2016, 08:14:44 pm
Where is Prof staying (don't say she's in student digs in Currie Hall)

Dunno ;D  I shall ask next time she cranks up Skype.
Title: Re: Today's scammer
Post by: rr on 21 October, 2016, 11:53:16 pm
.... turned out not to be a scam, micro's german exchange's father, this close to the spam folder
Title: Re: Today's scammer
Post by: eck on 24 October, 2016, 12:18:01 pm
The guy from the "Windows Technical Department"rang me today concerned that my computer was at risk. He asked me to press my Fn key and my windows key at the same time.
I told him that the computer is about 12 feet away from my living room window and I couldn't reach them both simultaneously and, no matter how hard I pressed the window, nothing was happening.
He didn't seem to appreciate my difficulty.  ???
Title: Re: Today's scammer
Post by: Canardly on 24 October, 2016, 01:07:04 pm
Begging via packets of tissues 'for sale' being left on empty train seats together with begging note is a new one. Apparently organised crime behind this one, so don't be tempted.
Title: Re: Today's scammer
Post by: essexian on 25 October, 2016, 04:12:24 pm
That was a bit strange.....

Upon checking my personal emails this morning, I noted that I had just purchased £25 of xbox play vouchers. Why is that strange...well I don't own an xbox and have no intention of ever doing so. Also, the purchase was made using a card I don't own.....

So, one email off to Amazon later they cancel the order and state that it seems someone has used my log in to place the order. There were also two other orders they cancelled for two further xbox vouchers.

I suppose someone could have broken into my Amazon account to place the order but why use a card which doesn't belong to me? I suppose it could be stolen and they thought using a "mug" to cover its use might be the way to cover their tracks?

So, password changed and all cards deleted off of Amazon. I doubt I will use it again in the short term. Oh, my last purchase from them is quite funny..... Magistrates Court practice guidance "handbook." (its about 1000 pages long). Its a cracking read.....  ;D
Title: Re: Today's scammer
Post by: Steph on 13 November, 2016, 05:35:19 pm
Begging via packets of tissues 'for sale' being left on empty train seats together with begging note is a new one. Apparently organised crime behind this one, so don't be tempted.

Been going on for a while. Organised gangs, mostly eastern European, been hitting Southern for over a year.
Title: Re: Today's scammer
Post by: ian on 14 November, 2016, 04:31:52 pm
Begging via packets of tissues 'for sale' being left on empty train seats together with begging note is a new one. Apparently organised crime behind this one, so don't be tempted.

Been going on for a while. Organised gangs, mostly eastern European, been hitting Southern for over a year.

It used to happen when I moved to London many years ago then died out for a while (mostly replaced by the bloke that just need your help to get into 'the about to close homeless shelter' and the Brockley crazy baby milk lady) – either tissues or a pen. Used to be ubiquitous on the Chicago L, the only train system I've been on with more mad people per carriage than London. Though admittedly, they're not close to the numbers on any night bus that goes through Elephant & Castle at 3am.
Title: Re: Today's scammer
Post by: Mr Larrington on 14 November, 2016, 09:59:03 pm
Quote
From: Catholic Charities <info@christ.com>
To: Me
Subject: Catholic Charities Assistance Letter.

Dear Loved one,

 It fills us with delight to announce that our organization has been enjoying your patronage in the locality from last two decades. It makes us proud to do something for the local area development.As you are aware that this area is having a population of not less than 1000 people live there. Most of them are really poor people and live on daily labor. Those people have provided us so many services though they are poor.  We wish to provide them with basic amenities for life in the coming festival eve.

 The list of such items includes clean drinking water, their dwelling houses, some medicines, food materials and garments. Also, some additional things like nutritious foods, medicines and books for children will also be distributed. Our efforts can be flourishing with your whole hearted support. We wish your support with us.TEXT PHONE NUMBER (423)330-1100
 james mcnurlen..Email to reply:[redacted]
Headquarters: Alexandria, Virginia
 Thanking you,
Yours faithfully,
Catholic Charities USA

I have not the words and, while they do have them, they're not capable of assembling them into a coherent sentence.
Title: Re: Today's scammer
Post by: Jaded on 15 November, 2016, 11:02:38 pm
Isn't that an email from a Trump supporter?
Title: Re: Today's scammer
Post by: Wowbagger on 13 June, 2023, 05:42:43 pm
Jan's phone and mine rang simultaneously a few minutes ago, being contacted by the same number: 020 4586 2821

This, apparently, is a known scam associated with solar panels. Neither of us answered before the calling computer gave up.
Title: Re: Today's scammer
Post by: Jaded on 13 June, 2023, 05:48:36 pm
I had a new thing today - BT's TXT to Voice number* calling the land line, to say I had a text message.

The text message wasn't from a number I recognised, in fact it wasn't a proper number at all, so I ignored it. It rang 5 times before I found out how to stop them: call 0800 5875252 and choose the option to change the curfew, eventually in the options you get '5' to switch them off altogether. If someone wants to TXT me they can use my mobile  :)

*08456021111
Title: Re: Today's scammer
Post by: Morat on 07 July, 2023, 10:10:20 pm
I got done yesterday.
There was an ad on Facebook (warning no1) for a Loakes Shoes sale.
I clicked it and was taken to a perfect copy of the Loakes site (With valid cert) which offered a sale with 80% off their range (warning no2).
I bought 63 quids worth of shoes using their legit Stripe checkout and didn't get a confirmation email.
So I logged into the site again to see what's up, order still there "payment pending". OK fair enough, thinks I, the site is probably busy due to the sale.

having closed my browser during the day, I tried to log in again to check on the order and lo and behold, there was no record of the order at all. Also, I had to change my password to log in. Uh Oh.

The site I had ordered from was loakeuk.shop (now taken down) and the real site is loake.com

So, I'm out £63 pending a claim process which may or may not return my money from Mastercard after 30 days.  I called my bank before the payment went through but they were unable to cancel it because "it wasn't fraud, you entered your details". It's possible I'll get the money back 30 days after non receipt of goods. I'm not holding my breath.

So..the moral of the story is - don't trust anything on Facebook because they CBA to vet advertisers. Don't order through Stripe because they cba to vet their customers.

I asked the bank and they said it would have been the same situation had I used a credit card. I guess I'll stick to Paypal.

The worst part is two of my mates gone done after I passed them the link, and 5 of _their_ mates got done similarly. Agh.
Title: Re: Today's scammer
Post by: Polar Bear on 07 July, 2023, 10:16:43 pm
I have a bit of a worry at the moment.  I ordered something on Tuesday and paid with PayPal.  The money has been taken but there is no sign of any transaction.  £122. 

I could be wrong but I think that I have suckered.  🙁
Title: Re: Today's scammer
Post by: Morat on 07 July, 2023, 10:20:54 pm
What do paypal say? I've found them to usually side with the buyer if there's an issue. Good luck.
Title: Re: Today's scammer
Post by: Polar Bear on 08 July, 2023, 08:03:23 am
I have emailed the "seller".  I am away until Wednesday so if nothing has happened by then I will contact Paypal.
Title: Re: Today's scammer
Post by: MikeFromLFE on 08 July, 2023, 08:45:46 am
There was a post on Mastodon yesterday saying how everything on Britain now is either a scam or subjuct to enshitification. Which about sums it up.

Friend of my wife - normally tuned in - got scammed via Facebook. They bought about £60 worth of garden stuff (plants, compost etc) and were persuaded to pay using PayPal 'friends & family'. A few friendly emails went back and forth, until..... well you guessed it - the emails were undeliverable and no more was heard.

PayPal were understanding and did a refund but gave a good talking to about using the correct payment option.
Title: Re: Today's scammer
Post by: Mr Larrington on 13 July, 2023, 01:42:34 pm
Quote
From:
Carli Gray <behehrhe2@gmail.com>
To:
Mr Larrington
Subject:Plan Renewal Details#736290



Hello there,  <Mr Larrington>

Thank you again for subscribing to us!

We are glad to see you choosing MCAfee Total as your preferred Network shield and PC Security service provider.

Your subscription plan was reactivated on July 11, 2023 (auto-renewal), and it will remain active until July 10, 2023, unless you choose to cancel.

The annual total amount of $ 379.89 has been successfully processed from the updated payment method; this charge will reflect on the statement shortly.

Order and Transaction Details:

Reference ID: 5095954361
Seller's name: MCAfee Total Corp.
Payment mode: Auto debit
Subscription fee: $ 379.89

As you opted for auto-debit, the recurring fee will be debited again next year on July 10, 2024, unless you choose to cancel the subscription or stop auto-debit payments.

If you wish to opt out or drop all charges and want the full amount refunded back to the original payment source, please contact us at +1 (888) 713-5736.

 

Sincerely,

Allyson Toughill
McAfee Service Team
Toll-free Number: +1 (888) 713-5736.

[Shortly thereafter]

Quote
From:
Hubert Kelly <apsisjsjjh73@gmail.com>
To:
Mr Larrington
Subject:Order Completed Successfully#326081


Hi there,  <Mr Larrington>

Thank you again for subscribing to us!

We are glad to see you choosing GEEK Squad as your preferred Network shield and PC Security service provider.

Your subscription plan was reactivated on July 11, 2023 (auto-renewal), and it will remain active until July 10, 2023, unless you choose to cancel.

The annual total amount of $ 389.99 has been successfully processed from the updated payment method; this charge will reflect on the statement shortly.

Order and Transaction Details:

Reference ID: 94737-22816
Seller's name: GEEK Squad Inc.
Payment mode: Auto debit
Subscription fee: $ 389.99

As you opted for auto-debit, the recurring fee will be debited again next year on July 10, 2024, unless you choose to cancel the subscription or stop auto-debit payments.

If you wish to opt out or drop all charges and want the full amount refunded back to the original payment source, please contact us at +1 833 216 0626.

 

Best regards

Hubert Kelly
Head Of Accounts Handling Team
Toll-free Number: +1 833 216 0626.

"Hubert"! "Carli"! You've been scammed.
Title: Re: Today's scammer
Post by: Duckfoot1606 on 13 July, 2023, 01:56:46 pm
Phone call yesterday from the UK mobile 07768 420617.

Automated message, advising my Visa card ( note, without identifying a bank or financial institution) was the subject of a transaction request of £900 which was regarded as suspicious blah blah and to press 1 to start a verification process

Hung up

A
Title: Re: Today's scammer
Post by: Jaded on 13 July, 2023, 02:04:50 pm
Mr L, I like the way that your subscription only lasts for one negative day.
Title: Re: Today's scammer
Post by: Polar Bear on 13 July, 2023, 02:12:33 pm
I have emailed the "seller".  I am away until Wednesday so if nothing has happened by then I will contact Paypal.

paypal have informed me that I will be in receipt of a refund today but as yet nothing from the vendor.   Will check my PayPal account later.
Title: Re: Today's scammer
Post by: Polar Bear on 18 July, 2023, 08:34:59 pm
My refund has now arrived.  Phew!
Title: Re: Today's scammer
Post by: Ian H on 20 July, 2023, 10:08:28 pm
Quote
Dear Manager,

Good day. Do you need fabric key ring now?

Our price and quality are good.


Custom design: available.

Keyring type: embroidery or printed.

Meterial: fabric, metal etc.

Mini order: 200/design.


Hope to discuss with you more :)
Title: Re: Today's scammer
Post by: Wowbagger on 02 August, 2023, 10:25:48 am
Quote
Dear  Keith Walker,

Your assisted bin collection application has been successful. Please ensure your bins are safely accessible to the bin crew.

If you have any further questions please do not hesitate to get in contact.

Adur & Worthing Councils

If that were really Adur & Worthing Council, then I'm sure there would be lots of bloat to the email, in the form of footers about the council, data protection and the like. But that's the entirety of it in the quote.

At least they don't call me Margret.
Title: Re: Today's scammer
Post by: Cudzoziemiec on 02 August, 2023, 10:35:14 am
The worst part is two of my mates gone done after I passed them the link, and 5 of _their_ mates got done similarly. Agh.
Isn't this the classic method of spread; people who might not trust the scam if they saw it themselves, do trust their mates.
Title: Re: Today's scammer
Post by: Mr Larrington on 10 August, 2023, 11:26:48 am
Quote
From:
Bank of England <user40@shistatus.co.uk>
To:
Me <redacted>
Subject:
Santander.co.uk



Update your information, it will only take 2 minutes!

This email is intended for , .
Santander
Update your information, it will only take 2 minutes!
Helo ,

We recently made an effort to connect with you via telephone, but regrettably, the contact number we have in our records appears to be inaccurate. We find this worrisome, as it's important that we can reach you promptly and effectively.

As part of our continuous effort to maintain up-to-date records, we are encouraging all of our customers to review and refresh their contact details, which include their email address and mobile phone number. This ensures that we can swiftly contact you should any security concerns arise regarding your account.

To modify your details, please sign into your digital banking account and amend your information therein. Having precise and current details for you is crucial, so kindly take a few moments to refresh your information at your earliest convenience.

Please be aware that neglecting to update your details may lead to complications with your account, including potential restrictions on certain transactions.
     Area Personal     

[Snip]

I'm not convinced this is genuine ;)
Title: Re: Today's scammer
Post by: Jaded on 10 August, 2023, 11:35:24 am
'worrisome'  ;D
Title: Re: Today's scammer
Post by: Ian H on 10 August, 2023, 03:58:20 pm
Good job I checked the spam folder, or I'd have missed this:-

Quote
"hello!,I love your writing so much! proportion we keep up a  correspondence extra approximately your post on AOL? I need an expert on  this space to resolve my problem. Maybe that is you! Taking a look  ahead to peer you."
Title: Re: Today's scammer
Post by: Wowbagger on 11 August, 2023, 12:58:24 pm
Quote
Dear  Keith Walker,

Your assisted bin collection application has been successful. Please ensure your bins are safely accessible to the bin crew.

If you have any further questions please do not hesitate to get in contact.

Adur & Worthing Councils

If that were really Adur & Worthing Council, then I'm sure there would be lots of bloat to the email, in the form of footers about the council, data protection and the like. But that's the entirety of it in the quote.

At least they don't call me Margret.

Another email to Keith Walker, including his address! This must be some sort of GDPR breach, I would have thought. And his bin still hasn't been emptied.
Title: Re: Today's scammer
Post by: Canardly on 11 August, 2023, 01:09:28 pm
TV licence renewal scam plus parcel delivery scam.  ::-)
Title: Re: Today's scammer
Post by: Polar Bear on 11 August, 2023, 01:10:54 pm
Somebody tried to scam mllePB with a so-called solar panel installation that she'd ordered.  At least we believe it was a scam attempt. 
Title: Re: Today's scammer
Post by: Ham on 11 August, 2023, 01:18:45 pm
As per another thread, I have listed some stuff on FB marketplace within minutes I was contacted by two scammers.

#1 - "I will pay you cash" Sending cash via courier who will collect the item. Only he wants me to pay for Insurance. "Don't worry you will get it back"

#2 - "I will pay paypal". Cash does not arrive. "Look in your spam folder" and there I have a clearly genuine message from paypayonlinebusiness@gmail.com explaining that I need to pay £200 to expand my account to business.

And there's no way to report that to FB <fume>
Title: Re: Today's scammer
Post by: robgul on 11 August, 2023, 02:03:14 pm
As per another thread, I have listed some stuff on FB marketplace within minutes I was contacted by two scammers.

#1 - "I will pay you cash" Sending cash via courier who will collect the item. Only he wants me to pay for Insurance. "Don't worry you will get it back"

#2 - "I will pay paypal". Cash does not arrive. "Look in your spam folder" and there I have a clearly genuine message from paypayonlinebusiness@gmail.com explaining that I need to pay £200 to expand my account to business.

And there's no way to report that to FB <fume>

I flog quite a bit of stuff (mainly furniture) on FB Marketplace and the "is it available" - "I want to buy but am busy so will send Fedex/DHL/UPS with cash" scenario is pretty much tried 3 or 4 times on each item I list.   A quick look at the profile and it's usually pretty obvious as a scammer . . . if I'm in doubt I message back "I think this might be a scam, if it isn't message me with where you live and I'll reply"  . . . seldom get an answer other than someimes   "You don't understand, I will send the money"

Given that, I assume, most people wouldn't fall for the "pay for the insurance" thing and thus expose bank details I just can't see how this works for any benefit? 

There is a way to report the message to FB as a scam - whether they do anything is open to conjecture - look at "other options" on the message and that's how you do it.

[The topic has been discussed on here before]

Oh, and I had a rare Nigerian email last week . .  I'm watching my bank account for a large incoming payment  ;D ;D ;D
Title: Re: Today's scammer
Post by: mrcharly-YHT on 07 May, 2024, 01:05:54 pm
House phone rings. Usually this is someone looked for the person who used to have that number.

"We are calling from Microsoft regarding the computer that is in your house."
I laugh and hang up.
They call back immediately. "Why did you terminate the call?"
"because you are a scammer." Hang up.
They call back, but from a different number. "Why did you terminate the call, we are calling regarding the computer, which we might have to disable."
This time, I swear at them.
They call back again! "we will have to disable the computer which is in your house."
I swear, extensively, and hang up.
Title: Re: Today's scammer
Post by: fruitcake on 08 May, 2024, 06:52:57 pm
I had that one a few times and eventually played along.

"Ooh, you're from where... Oh, right. You are phoning me from Windows... And you think there is a problem with my computer... Gosh. Well, that does sound serious... And you've phoned to help me. Oh kay. Well that's very kind... You must be a very kind person... So you need me to visit a website you're going to give me... And what is that website again?... Say it again please... Tell me once more... I'll get a pen this time... Oh yes, that sounds like a legitimate website... Nothing suspicious about that... So you want me type that into my web browser... And should I acquire a Windows computer before I do that?"

I occupied the guy for a good three minutes before he hung up. Funnily enough, that was the last of those calls I received.