Heads up - new scam around...

[Rhys]

I just received the following email via a craigslist advert. What aroused my suspicions is that I had it from 3 quite different adverts I'd place on Craigslist going back a month and more.


I just rang the hotel and they did have a wedding but not a morning wedding for that date. The text sounds very Nigerian. The lady at the hotel had had phonecalls from several people asking about the booking, saying it sounded scammy and I've forwarded her a copy too. I love the fact he's mis-spelt his name in his email address!


Needless to say I'm playing him along to see what kind of bogus check I receive (which I'll scan and place on the web for all to see).


Hi,

I am Charles, the secretary of a wedding committe that has been
constituted to see to the smooth running of my boss's son's wedding
ceremony. Although I am presently at a seminar workshop which will
soon end but I am saddled with the responsibilty of locating and
arranging for a good and experienced wedding photographer,
videographer and DJ and So, i searched through the net and found you
appropriate for the service you have posted on craiglist.
The details of the wedding are as follows:

WEDDING DATE : 26th July, 2008.

WEDDING TYPE : Social

VENUE OF THE WEDDING :
Mills House Hotel
115 Meeting Street
Charleston, SC 29401


TIME : 10 A.M. Prompt

No of Guest : 350 approx.

Every other necessary details will be forwarded to you as soon as
they are available. So, how much will your service cost me for just 4
hours on that day.
Thanks in anticipation of your favourable response.


Yours
Charles White

 

[Mike30D]

Not really anything new, just a different angle at trying to scam people out of money.

 

[Rhys]

Oh undoubtedly. After I checked with the hotel and posted this, I searched for the first line of text in the email and found it on the 419 scam site.

I'm waiting in eager anticipation to receive my first bogus check. I'm not even going to bother cashing it - I'll scan it, post it and send the check off to the bad checks unit.

 

[Mike30D]

I'm surprised, that one seems like the english was pretty good. Most of them have really bad english and broken sentences.

 

[Rhys]

The English was better but capitalisation, punctuation and general understanding of the words used in normal English was sadly lacking. I was an English lecturer at one point.

It's lacking the basic information without which I don't take anything seriously...
bride and groom's name
a postal address

 

[altyfc]

Yeah, just a scammer.

I work in the travel industry and frequently getting emails from people telling me that they want to transfer funds to me so that I can book multiple hotels on their behalf. It's a variation on the same rubbish.

 

[MarcusM]

These emails are funny. I remember when I used to get the "Nigerian son of the king" or something like that - emails a few years ago asking for my checking account info so they can deposit hundreds of thousands of dollars for safe keeping.

These emails all have the same feel - like the same person writes all of them. They try to present themselves as some distinguished person with authority, and throw in all these "big" words which make absolutely no sense in the context used.

Makes me wonder who the idiots are that fall for them.

 

[Rhys]

They do seem stupid. The best we can do is waste the scammers time and money by making them print and post their bogus checks.

This makes some sobre reading though: http://english.ohmynews.com/articleview/article_view.asp?article_class=5&no=311047&rel_no=1

 

[John_Olexa]

These emails are funny. I remember when I used to get the "Nigerian son of the king" or something like that - emails a few years ago asking for my checking account info so they can deposit hundreds of thousands of dollars for safe keeping.

HAHAHAH ..yep! I know I shouldn't have even click them. But they were good for laughs!

 

[Rhys]

Ok. I had a reply from this turkey. I sent him my box number to send the check to - lol. He replied so I have him hooked.

Hello,

Thanks for getting back to me ealier, i am very happy to hear from u,
and I would like if this can work out for us... i am ok with that
price but i will like to inform u that my payment mode will be inform
of check payment which will be post to u, i will make the payment
fully so that no one would book the day again, I am very sorry for any
inconvinecy this may cause to you it was due to my inability to get
back to US on time because am still at the seminar session here..... i
promise i will responsible for any extra cost on getting the check
cash there so that things will be alright and your charges wont be
affected.......... $1000

If u will like to serve us please get back to me here so soon with ur
details (full name and full address ''not p.o. box'' to send the check
down to u), i will call you later on phone at my convinent time to
talk and make sure we already booked for the day. Hope i will not be
disapointed and i should count on you for this, because i have a very
tight schedule this time i would have get to u in person.

Thanks
Charles

I've just told him that I use solely a box number. If he calls it quits now then no problem. If he's as greedy as I think then he'll continue my entertainment.

 

[THORHAMMER]

can you PM me the header info from your email ?

like ALL of it.

Ill find out who it is.

Also you should show up there that day with a group of buddies IF you go dont go alone. Might be a scam to rob you.

-Thor

 

[Rhys]

How do I get the full headers from Yahoo email?

 

[Rhys]

Ok. Found how...
Here you are.... posted in no particular order...

From chalse white Mon Jun 30 11:07:03 2008
Return-Path: <bounce-anon-********[email protected]>
Authentication-Results: mta391.mail.re4.yahoo.com from=gmail.com; domainkeys=fail (bad sig)
Received: from 66.150.243.14 (EHLO mxo7s.craigslist.org) (66.150.243.14) by mta391.mail.re4.yahoo.com with SMTP; Mon, 30 Jun 2008 11:07:05 -0700
Received: from fg-out-1718.google.com (fg-out-1718.google.com [72.14.220.153]) by mxi2s.craigslist.org (Postfix) with ESMTP id 5574364352 for <[email protected]>; Mon, 30 Jun 2008 11:07:04 -0700 (PDT)
Received: by fg-out-1718.google.com with SMTP id l27so1059958fgb.19 for <[email protected]>; Mon, 30 Jun 2008 11:07:04 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:mime-version:content-type:content-transfer-encoding :content-disposition; bh=Za2/MQaYSgRtK34Hvxg5wkaHJ1sXLSEfOR+QJZzDm1Q=; b=hIDHJCSCgArxqo+zdC5L57iAVjMuNNQn9LcO8nu93h8TaYjhhmn0Pmq6fliuJoimoz hlzLnCK7UTGRcRCfVCDJqAPgbaM9Kg4xNkc4EpP9XZeLpcWt0r66IpdIUoF7y5CzInla yToEdgfe1Z5eHBZMeWQpu8a5WRCAjF2ke2pLg=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type :content-transfer-encoding:content-disposition; b=Ll1BGQ+LsbawwVGKSAYFY5qv2VbZx+1eb3LLmsBtV3BtHa4YazUB9m6RyMzOlzmolG lKqsdM7ierokOR5x5Zw8NPsoj5Q04mQqPJLx5h8nzWiVgA1SKygiyD36BlLT3kGihMO0 gyNwfa1ln89PEp+veG4StXJYINEvmMe1iXk0Q=
Received: by 10.86.87.13 with SMTP id k13mr2202823fgb.69.1214849224029; Mon, 30 Jun 2008 11:07:04 -0700 (PDT)
Received: by 10.86.58.7 with HTTP; Mon, 30 Jun 2008 11:07:03 -0700 (PDT)
message-ID: <[email protected]>
Date: Mon, 30 Jun 2008 11:07:03 -0700
From:
"chalse white" <[email protected]>
Add sender to Contacts
To: [email protected]
Subject: Professional event photography (Lexington/Richland)
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Content-Length: 1362


From chalse white Mon Jun 30 19:52:36 2008
Return-Path: <[email protected]>
Authentication-Results: mta410.mail.re4.yahoo.com from=gmail.com; domainkeys=pass (ok)
Received: from 72.14.220.154 (EHLO fg-out-1718.google.com) (72.14.220.154) by mta410.mail.re4.yahoo.com with SMTP; Mon, 30 Jun 2008 19:52:37 -0700
Received: by fg-out-1718.google.com with SMTP id 16so807383fgg.40 for <*****@yahoo.com>; Mon, 30 Jun 2008 19:52:36 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=njmaPVELVxKiQ7/hLuPZqNVr7M8j+ZWhmHj22mdZ+QI=; b=MQ2EKp7yZbjYk6NjZbPplfTvCqTAi3ViDHmW65bjmHh/DXSdZB8yCgcQn1gZ9IrD7t MshS+QOK2L7T8ghxtLXm28kqAQDUjPYeAu53ODxFGpzq9LU9IbsgHQZkGNr6nrqccGYn bnxYV9UNRwsuitaHT4baZCwPqrThG86mWewQw=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=BuDc7gj0MRScl+6bnu3jyfXeurhG6oshqgTP0gigB41N5znu6zW75pbTGrUkRhNdem cyQw6lkKp4FPWwadJbOuLjs09cOWLtYvsw0hNdXmZ2saLYEBTR3ezcSBZl2kEtw2ZZZP Kp+hMAxMXBEeH4Th1qFPFa5vjR4UKcBpk1Jig=
Received: by 10.86.27.9 with SMTP id a9mr7025337fga.57.1214880756838; Mon, 30 Jun 2008 19:52:36 -0700 (PDT)
Received: by 10.86.58.7 with HTTP; Mon, 30 Jun 2008 19:52:36 -0700 (PDT)
message-ID: <[email protected]>
Date: Mon, 30 Jun 2008 19:52:36 -0700
From: This sender is DomainKeys verified
"chalse white" <[email protected]>
Add sender to Contacts
To: "****" <*****@yahoo.com>
Subject: Re: Professional event photography (Lexington/Richland)
In-Reply-To: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <[email protected]> <[email protected]>
Content-Length: 193


From chalse white Mon Jun 30 19:26:40 2008
Return-Path: <[email protected]>
Authentication-Results: mta141.mail.re1.yahoo.com from=gmail.com; domainkeys=pass (ok)
Received: from 72.14.220.155 (EHLO fg-out-1718.google.com) (72.14.220.155) by mta141.mail.re1.yahoo.com with SMTP; Mon, 30 Jun 2008 19:26:41 -0700
Received: by fg-out-1718.google.com with SMTP id l26so877428fgb.38 for <*****@yahoo.com>; Mon, 30 Jun 2008 19:26:40 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=6JGVr/QTAfv4SwgVA/l2jJv4J4jJO5pLllTa1QJr6OY=; b=t8JlIwc38xy7j4BmWKyyAXsD+JhOxuZnoXFHmgDgVxRWoannWP77KjvGp86yGGOLWv 5x3zdruJveL8K/TG+0H9CWpouyCC/gJ3XPCFxCebUi7SROMXgb05/x12oVLEZV6HcSuD /vnOVRKx6WUH9URNqL5vFsdkMGRg5CIfoTeOI=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=FcJ/Wm1eV+WI7wZ5Qa6qrGjCTLId/AL3dl9UJW4StjfCZ1H9O1J30phDzlBtqsqKkd 3Y5+yDbYR36JX6N8pZh1FiWQKcnvfAfvSoazY5eI58AV4nImbRK7/pqRBBctbeXYPvlD sA9JJBKKtVEPLeKr2NZsxMhsnVl1VWwKj4k7E=
Received: by 10.86.60.15 with SMTP id i15mr5182225fga.8.1214879200800; Mon, 30 Jun 2008 19:26:40 -0700 (PDT)
Received: by 10.86.58.7 with HTTP; Mon, 30 Jun 2008 19:26:40 -0700 (PDT)
message-ID: <[email protected]>
Date: Mon, 30 Jun 2008 19:26:40 -0700
From: This sender is DomainKeys verified
"chalse white" <[email protected]>
Add sender to Contacts
To: "****" <*****@yahoo.com>
Subject: Re: Professional event photography (Lexington/Richland)
In-Reply-To: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <[email protected]> <[email protected]>
Content-Length: 1071


From chalse white Mon Jun 30 11:11:05 2008
Return-Path: <bounce-anon-********[email protected]>
Authentication-Results: mta120.mail.re4.yahoo.com from=gmail.com; domainkeys=fail (bad sig)
Received: from 66.150.243.8 (EHLO mxo3s.craigslist.org) (66.150.243.8) by mta120.mail.re4.yahoo.com with SMTP; Mon, 30 Jun 2008 11:11:07 -0700
Received: from fg-out-1718.google.com (fg-out-1718.google.com [72.14.220.152]) by mxi5s.craigslist.org (Postfix) with ESMTP id 6E991128A07 for <[email protected]>; Mon, 30 Jun 2008 11:11:06 -0700 (PDT)
Received: by fg-out-1718.google.com with SMTP id e12so758312fga.0 for <[email protected]>; Mon, 30 Jun 2008 11:11:05 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:mime-version:content-type:content-transfer-encoding :content-disposition; bh=Za2/MQaYSgRtK34Hvxg5wkaHJ1sXLSEfOR+QJZzDm1Q=; b=LtMvqBG0VWMV6XsKV7d375//MExLZih3HJi4K7p/Lfns/KiUyzxnWSd4CMDM5192Tg kuTgI40uRpGXkrGkmnKF8ZXVQeHJ8PSTIg/TTFxcI82Fv/MUwq7dYeTWlTCUF1Stg9EI vyZFfLCg9JKIQmB1p/EWoYWvtFGWrCqphDFiA=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type :content-transfer-encoding:content-disposition; b=FOeMikarSdxrdrRJ54vUnLIcNp5oVTabdm5TbUShVkE6ijptmg/pHPln4PLeN6T5Au KTQjIkhUxcbGl5rpcYBCEW4k2RlEOe4qu5IQ6czhXvjZwAWW5U6Px3vAvVjgeQG0fccT T7aygWaVQPZstpUDF2WvAbZ5m4jnCmn2Rk3Mk=
Received: by 10.86.54.3 with SMTP id c3mr6502288fga.55.1214849465322; Mon, 30 Jun 2008 11:11:05 -0700 (PDT)
Received: by 10.86.58.7 with HTTP; Mon, 30 Jun 2008 11:11:05 -0700 (PDT)
message-ID: <[email protected]>
Date: Mon, 30 Jun 2008 11:11:05 -0700
From:
"chalse white" <[email protected]>
Add sender to Contacts
To: [email protected]
Subject: Bargain - low cost wedding/event photography - absolute bargain
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Content-Length: 1362

 

[Rhys]

And the last one of the no particular order series. I note that he's stopped sending since I have heard nothing for almost 24 hours. I think he didn't like the fact I was only willing to give him a PO Box number. Either that or he's sent a check and it'll be waiting for me!

From chalse white Mon Jun 30 11:16:05 2008
Return-Path: <bounce-anon-********[email protected]>
Authentication-Results: mta128.mail.re4.yahoo.com from=gmail.com; domainkeys=fail (bad sig)
Received: from 66.150.243.13 (EHLO mxo6s.craigslist.org) (66.150.243.13) by mta128.mail.re4.yahoo.com with SMTP; Mon, 30 Jun 2008 11:16:12 -0700
Received: from fg-out-1718.google.com (fg-out-1718.google.com [72.14.220.155]) by mxi4s.craigslist.org (Postfix) with ESMTP id 6C4BE88EEA for <[email protected]>; Mon, 30 Jun 2008 11:16:06 -0700 (PDT)
Received: by fg-out-1718.google.com with SMTP id l27so854792fgb.33 for <[email protected]>; Mon, 30 Jun 2008 11:16:05 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:mime-version:content-type:content-transfer-encoding :content-disposition; bh=Za2/MQaYSgRtK34Hvxg5wkaHJ1sXLSEfOR+QJZzDm1Q=; b=qX1mlmWDgqQjHmOD5pH9oBAty6HzGlmVqqK5RO0keoIVVqzxsVmNuYSpuaJ91pjckl jibus3e8DA3I3JIujgx5DE99J8P6AAzoZ50JCyqOYCUO1xrrP1SLGTtqeyXh3zX8AGYh TxkUCkZVswM102yKhHMfKqZsnaTpJaJvcY9Ds=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type :content-transfer-encoding:content-disposition; b=dGDuQYTUPCbII09dQeE+Y37iF1mDposMVMCkbZWYajJbEDnCSWo7AMmJdfrlOcn5yU /7aS/+/as4xBl5uTbML9NzyPd2FwufTkPYzGQm+WKQmAUzUo+GNohx0M+vAWOROZizmM Y0sI8iiuV2zAq48zX0dwQNB8ANp+9hB5CUToo=
Received: by 10.86.59.18 with SMTP id h18mr3062935fga.4.1214849765463; Mon, 30 Jun 2008 11:16:05 -0700 (PDT)
Received: by 10.86.58.7 with HTTP; Mon, 30 Jun 2008 11:16:05 -0700 (PDT)
message-ID: <[email protected]>
Date: Mon, 30 Jun 2008 11:16:05 -0700
From:
"chalse white" <[email protected]>
Add sender to Contacts
To: [email protected]
Subject: Free event/wedding photography (Irmo, SC)
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Content-Length: 1362

 

[MarcusM]

I don't understand what exactly he's trying to do...does he really want wedding photographer services? Seems like a lot of work to scam a few hours worth of service...but I guess he technically would be saving a lot of money if he pulled it off.