Nigerian scams on Craigslist April 10. 2009
I was selling a lens I don't use all that often on Craigslist last night. This morning I got a respond from someone overseas (hint #1) wanting to buy the lens as a gift for someone else (hint #2). They even offered an extra USD$120 for shipping (big hint#3). I'm like no matter where you live, the premium for a lens can't be USD$120! 
So I played along and told them I still have the lens. They replied saying they're international and can Paypal me the money. At this point I'm like, maybe there are generous people since I doubt I can be defrauded by straight Paypal transaction. I told them my paypal email address so they can send payment to me. Of course I logged onto Paypal and go through the motion of requesting money and turns out the buyer - sandyjames1@hotmail.com is a verified member. Now I'm like whoa... Lucky me!
They "sent" payment this afternoon. Fancy Paypal email and stuff. But their mistake is 2 fold.
1) They emailed me saying payment was sent. Now this email's writing style is very different from initial emails.
2) The from email address is "service@paypal.com <verifyitemteam@mail2consultant.com>". Such an amateur.
Now I emailed Paypal reporting that a verified member's account might have been compromised, so hopefully that member is not screwed of any money.
Below are the email exchanges -
Delivered-To: <me>@gmail.com
Received: by 10.100.119.7 with SMTP id r7cs120690anc;
Fri, 10 Apr 2009 00:57:34 -0700 (PDT)
Received: by 10.115.18.3 with SMTP id v3mr1807933wai.141.1239350253208;
Fri, 10 Apr 2009 00:57:33 -0700 (PDT)
Return-Path: <bounce-anon-whack=gmail.com@craigslist.org>
Received: from mxo4p.craigslist.org (mxo4p.craigslist.org [208.82.236.169])
by mx.google.com with ESMTP id n40si1118509wag.48.2009.04.10.00.57.32;
Fri, 10 Apr 2009 00:57:33 -0700 (PDT)
Received-SPF: pass (google.com: domain of bounce-anon-whack=gmail.com@craigslist.org designates 208.82.236.169 as permitted sender) client-ip=208.82.236.169;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of bounce-anon-whack=gmail.com@craigslist.org designates 208.82.236.169 as permitted sender) smtp.mail=bounce-anon-whack=gmail.com@craigslist.org
Received: from blu0-omc3-s27.blu0.hotmail.com (blu0-omc3-s27.blu0.hotmail.com [65.55.116.102])
by mxi3p.craigslist.org (Postfix) with ESMTP id DC9C4963BF
for <sale-brvbs-1115590185@craigslist.org>; Fri, 10 Apr 2009 00:57:31 -0700 (PDT)
Received: from BLU146-W25 ([65.55.116.73]) by blu0-omc3-s27.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Fri, 10 Apr 2009 00:57:31 -0700
Message-ID: <BLU146-W25E67157F52599960A116BEF800@phx.gbl>
Content-Type: multipart/alternative;
boundary="bdab837b-fecd-4505-8168-64524796d2dc"
X-Originating-IP: [80.250.34.59]
From: Sandra James <sandyjames1@hotmail.com>
To: <sale-brvbs-1115590185@craigslist.org>
Subject: Canon EF-S 55-250mm IS - $320 (Belltown)
Date: Fri, 10 Apr 2009 00:57:31 -0700
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 10 Apr 2009 07:57:31.0841 (UTC) FILETIME=[00607B10:01C9B9B2]
Hello seller,
Let me know if you still have this posting available for sale.
Get back to me as soon as possible..
Thanks
---
Delivered-To: <me>@gmail.com
Received: by 10.100.119.7 with SMTP id r7cs146175anc;
Fri, 10 Apr 2009 08:21:50 -0700 (PDT)
Received: by 10.224.19.210 with SMTP id c18mr4092959qab.233.1239376910337;
Fri, 10 Apr 2009 08:21:50 -0700 (PDT)
Return-Path: <sandyjames1@hotmail.com>
Received: from blu0-omc1-s12.blu0.hotmail.com (blu0-omc1-s12.blu0.hotmail.com [65.55.116.23])
by mx.google.com with ESMTP id 16si1525141qyk.102.2009.04.10.08.21.50;
Fri, 10 Apr 2009 08:21:50 -0700 (PDT)
Received-SPF: pass (google.com: domain of sandyjames1@hotmail.com designates 65.55.116.23 as permitted sender) client-ip=65.55.116.23;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of sandyjames1@hotmail.com designates 65.55.116.23 as permitted sender) smtp.mail=sandyjames1@hotmail.com
Received: from BLU146-W12 ([65.55.116.7]) by blu0-omc1-s12.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Fri, 10 Apr 2009 08:21:50 -0700
Message-ID: <BLU146-W125A408F255AB45CFD7355EF800@phx.gbl>
Return-Path: sandyjames1@hotmail.com
Content-Type: multipart/alternative;
boundary="2d732fef-d0bd-443f-b389-4c4bec120038"
X-Originating-IP: [80.250.34.59]
From: Sandra James <sandyjames1@hotmail.com>
To: <<me>@gmail.com>
Subject: RE: Canon EF-S 55-250mm IS - $320 (Belltown)
Date: Fri, 10 Apr 2009 08:21:47 -0700
Importance: Normal
In-Reply-To: <49DF6224.2070509@gmail.com>
References: <BLU146-W25E67157F52599960A116BEF800@phx.gbl>
<49DF6224.2070509@gmail.com>
MIME-Version: 1.0
X-OriginalArrivalTime: 10 Apr 2009 15:21:50.0033 (UTC) FILETIME=[11E5C410:01C9B9F0]
Hello,
Thanks for getting back to me.This unit is the exact of what i want for my security Agent as a convocation gift..so i will add an extra $120.60 USD as the shipping charges confirm from http://www.usps.com for international shipping..making it a total of $440.60 USD..and i will make the total if you can help me handle the shipping perfectly..You can send me your PayPal email ID or a PayPal money request through PayPal and i'll proceed with the Payment right away...
Thanks
Hope to read from you soonest
Best Regards...
--
Notice they did not quote the original mail? (I found that cheats usually don't quote your replies)
--
Delivered-To: <me>@gmail.com
Received: by 10.100.119.7 with SMTP id r7cs187847anc;
Fri, 10 Apr 2009 11:49:52 -0700 (PDT)
Received: by 10.224.2.74 with SMTP id 10mr4344529qai.259.1239389392192;
Fri, 10 Apr 2009 11:49:52 -0700 (PDT)
Return-Path: <sandyjames1@hotmail.com>
Received: from blu0-omc1-s26.blu0.hotmail.com (blu0-omc1-s26.blu0.hotmail.com [65.55.116.37])
by mx.google.com with ESMTP id 7si1732784qyk.75.2009.04.10.11.49.52;
Fri, 10 Apr 2009 11:49:52 -0700 (PDT)
Received-SPF: pass (google.com: domain of sandyjames1@hotmail.com designates 65.55.116.37 as permitted sender) client-ip=65.55.116.37;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of sandyjames1@hotmail.com designates 65.55.116.37 as permitted sender) smtp.mail=sandyjames1@hotmail.com
Received: from BLU146-W37 ([65.55.116.7]) by blu0-omc1-s26.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Fri, 10 Apr 2009 11:49:52 -0700
Message-ID: <BLU146-W376F87D61613ED79C595E3EF800@phx.gbl>
Return-Path: sandyjames1@hotmail.com
Content-Type: multipart/alternative;
boundary="0b15d255-e4f2-4514-8c7b-c43d08390ed7"
X-Originating-IP: [80.250.34.59]
From: Sandra James <sandyjames1@hotmail.com>
To: <<me>@gmail.com>
Subject: I have sent The Payment:::::::::::::::::::Kindly Ship Via Global
Express Mail ::::::::::::
Date: Fri, 10 Apr 2009 11:49:52 -0700
Importance: Normal
In-Reply-To: <49DF691A.5090806@gmail.com>
References: <BLU146-W25E67157F52599960A116BEF800@phx.gbl>
<49DF6224.2070509@gmail.com> <BLU146-W125A408F255AB45CFD7355EF800@phx.gbl>
<49DF691A.5090806@gmail.com>
MIME-Version: 1.0
X-OriginalArrivalTime: 10 Apr 2009 18:49:52.0051 (UTC) FILETIME=[21C29030:01C9BA0D]
Hello Mate,
This is to get you aware that the payment has been made for the purchased item and i am sure PayPal has sent you the confirmation email for the payment and i will like you to follow all protocols as regards the payment and get back to their member care by sending the necessary details of the shipment to them so that they can verify it and credit your account afterward... Furthermore,I will like the item shipped via USPS Global Express Mail (EMS SPEED POST) for a fast and cheap shipment, and the label number must start with
EB, EQ, EH,EB,EM
Here is the Mailing Address Below?
Victor.O.Johnson
# 10 M.K.O Abiola Way Ring RD
Ibadan,Oyo State
23402,Nigeria
Kindly get back to me ASAP
Its nice doing business with you
Regards
--
CRAP! Nigeria (BIG BIG HINT IT'S FRAUD!!!) Then why the hell does it matter what the label number start with??? More to the point, Paypal NEVER require members to email them to "verify" payment and shipment details.
---
Check the email headers, none of them come from Paypal. n00bs!!!
So I played along and told them I still have the lens. They replied saying they're international and can Paypal me the money. At this point I'm like, maybe there are generous people since I doubt I can be defrauded by straight Paypal transaction. I told them my paypal email address so they can send payment to me. Of course I logged onto Paypal and go through the motion of requesting money and turns out the buyer - sandyjames1@hotmail.com is a verified member. Now I'm like whoa... Lucky me!
They "sent" payment this afternoon. Fancy Paypal email and stuff. But their mistake is 2 fold.
1) They emailed me saying payment was sent. Now this email's writing style is very different from initial emails.
2) The from email address is "service@paypal.com <verifyitemteam@mail2consultant.com>". Such an amateur.
Now I emailed Paypal reporting that a verified member's account might have been compromised, so hopefully that member is not screwed of any money.
Below are the email exchanges -
Delivered-To: <me>@gmail.com
Received: by 10.100.119.7 with SMTP id r7cs120690anc;
Fri, 10 Apr 2009 00:57:34 -0700 (PDT)
Received: by 10.115.18.3 with SMTP id v3mr1807933wai.141.1239350253208;
Fri, 10 Apr 2009 00:57:33 -0700 (PDT)
Return-Path: <bounce-anon-whack=gmail.com@craigslist.org>
Received: from mxo4p.craigslist.org (mxo4p.craigslist.org [208.82.236.169])
by mx.google.com with ESMTP id n40si1118509wag.48.2009.04.10.00.57.32;
Fri, 10 Apr 2009 00:57:33 -0700 (PDT)
Received-SPF: pass (google.com: domain of bounce-anon-whack=gmail.com@craigslist.org designates 208.82.236.169 as permitted sender) client-ip=208.82.236.169;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of bounce-anon-whack=gmail.com@craigslist.org designates 208.82.236.169 as permitted sender) smtp.mail=bounce-anon-whack=gmail.com@craigslist.org
Received: from blu0-omc3-s27.blu0.hotmail.com (blu0-omc3-s27.blu0.hotmail.com [65.55.116.102])
by mxi3p.craigslist.org (Postfix) with ESMTP id DC9C4963BF
for <sale-brvbs-1115590185@craigslist.org>; Fri, 10 Apr 2009 00:57:31 -0700 (PDT)
Received: from BLU146-W25 ([65.55.116.73]) by blu0-omc3-s27.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Fri, 10 Apr 2009 00:57:31 -0700
Message-ID: <BLU146-W25E67157F52599960A116BEF800@phx.gbl>
Content-Type: multipart/alternative;
boundary="bdab837b-fecd-4505-8168-64524796d2dc"
X-Originating-IP: [80.250.34.59]
From: Sandra James <sandyjames1@hotmail.com>
To: <sale-brvbs-1115590185@craigslist.org>
Subject: Canon EF-S 55-250mm IS - $320 (Belltown)
Date: Fri, 10 Apr 2009 00:57:31 -0700
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 10 Apr 2009 07:57:31.0841 (UTC) FILETIME=[00607B10:01C9B9B2]
Hello seller,
Let me know if you still have this posting available for sale.
Get back to me as soon as possible..
Thanks
---
Delivered-To: <me>@gmail.com
Received: by 10.100.119.7 with SMTP id r7cs146175anc;
Fri, 10 Apr 2009 08:21:50 -0700 (PDT)
Received: by 10.224.19.210 with SMTP id c18mr4092959qab.233.1239376910337;
Fri, 10 Apr 2009 08:21:50 -0700 (PDT)
Return-Path: <sandyjames1@hotmail.com>
Received: from blu0-omc1-s12.blu0.hotmail.com (blu0-omc1-s12.blu0.hotmail.com [65.55.116.23])
by mx.google.com with ESMTP id 16si1525141qyk.102.2009.04.10.08.21.50;
Fri, 10 Apr 2009 08:21:50 -0700 (PDT)
Received-SPF: pass (google.com: domain of sandyjames1@hotmail.com designates 65.55.116.23 as permitted sender) client-ip=65.55.116.23;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of sandyjames1@hotmail.com designates 65.55.116.23 as permitted sender) smtp.mail=sandyjames1@hotmail.com
Received: from BLU146-W12 ([65.55.116.7]) by blu0-omc1-s12.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Fri, 10 Apr 2009 08:21:50 -0700
Message-ID: <BLU146-W125A408F255AB45CFD7355EF800@phx.gbl>
Return-Path: sandyjames1@hotmail.com
Content-Type: multipart/alternative;
boundary="2d732fef-d0bd-443f-b389-4c4bec120038"
X-Originating-IP: [80.250.34.59]
From: Sandra James <sandyjames1@hotmail.com>
To: <<me>@gmail.com>
Subject: RE: Canon EF-S 55-250mm IS - $320 (Belltown)
Date: Fri, 10 Apr 2009 08:21:47 -0700
Importance: Normal
In-Reply-To: <49DF6224.2070509@gmail.com>
References: <BLU146-W25E67157F52599960A116BEF800@phx.gbl>
<49DF6224.2070509@gmail.com>
MIME-Version: 1.0
X-OriginalArrivalTime: 10 Apr 2009 15:21:50.0033 (UTC) FILETIME=[11E5C410:01C9B9F0]
Hello,
Thanks for getting back to me.This unit is the exact of what i want for my security Agent as a convocation gift..so i will add an extra $120.60 USD as the shipping charges confirm from http://www.usps.com for international shipping..making it a total of $440.60 USD..and i will make the total if you can help me handle the shipping perfectly..You can send me your PayPal email ID or a PayPal money request through PayPal and i'll proceed with the Payment right away...
Thanks
Hope to read from you soonest
Best Regards...
--
Notice they did not quote the original mail? (I found that cheats usually don't quote your replies)
--
Delivered-To: <me>@gmail.com
Received: by 10.100.119.7 with SMTP id r7cs187847anc;
Fri, 10 Apr 2009 11:49:52 -0700 (PDT)
Received: by 10.224.2.74 with SMTP id 10mr4344529qai.259.1239389392192;
Fri, 10 Apr 2009 11:49:52 -0700 (PDT)
Return-Path: <sandyjames1@hotmail.com>
Received: from blu0-omc1-s26.blu0.hotmail.com (blu0-omc1-s26.blu0.hotmail.com [65.55.116.37])
by mx.google.com with ESMTP id 7si1732784qyk.75.2009.04.10.11.49.52;
Fri, 10 Apr 2009 11:49:52 -0700 (PDT)
Received-SPF: pass (google.com: domain of sandyjames1@hotmail.com designates 65.55.116.37 as permitted sender) client-ip=65.55.116.37;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of sandyjames1@hotmail.com designates 65.55.116.37 as permitted sender) smtp.mail=sandyjames1@hotmail.com
Received: from BLU146-W37 ([65.55.116.7]) by blu0-omc1-s26.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Fri, 10 Apr 2009 11:49:52 -0700
Message-ID: <BLU146-W376F87D61613ED79C595E3EF800@phx.gbl>
Return-Path: sandyjames1@hotmail.com
Content-Type: multipart/alternative;
boundary="0b15d255-e4f2-4514-8c7b-c43d08390ed7"
X-Originating-IP: [80.250.34.59]
From: Sandra James <sandyjames1@hotmail.com>
To: <<me>@gmail.com>
Subject: I have sent The Payment:::::::::::::::::::Kindly Ship Via Global
Express Mail ::::::::::::
Date: Fri, 10 Apr 2009 11:49:52 -0700
Importance: Normal
In-Reply-To: <49DF691A.5090806@gmail.com>
References: <BLU146-W25E67157F52599960A116BEF800@phx.gbl>
<49DF6224.2070509@gmail.com> <BLU146-W125A408F255AB45CFD7355EF800@phx.gbl>
<49DF691A.5090806@gmail.com>
MIME-Version: 1.0
X-OriginalArrivalTime: 10 Apr 2009 18:49:52.0051 (UTC) FILETIME=[21C29030:01C9BA0D]
Hello Mate,
This is to get you aware that the payment has been made for the purchased item and i am sure PayPal has sent you the confirmation email for the payment and i will like you to follow all protocols as regards the payment and get back to their member care by sending the necessary details of the shipment to them so that they can verify it and credit your account afterward... Furthermore,I will like the item shipped via USPS Global Express Mail (EMS SPEED POST) for a fast and cheap shipment, and the label number must start with
EB, EQ, EH,EB,EM
Here is the Mailing Address Below?
Victor.O.Johnson
# 10 M.K.O Abiola Way Ring RD
Ibadan,Oyo State
23402,Nigeria
Kindly get back to me ASAP
Its nice doing business with you
Regards
--
CRAP! Nigeria (BIG BIG HINT IT'S FRAUD!!!) Then why the hell does it matter what the label number start with??? More to the point, Paypal NEVER require members to email them to "verify" payment and shipment details.
---
Check the email headers, none of them come from Paypal. n00bs!!!
Trackbacks
Trackback specific URI for this entry
No Trackbacks
