Scam Email: Airlines Travel Reservations

While not specifically art-related, artists are often on the move and making reservations and this scam email looked SO real, I thought it was worth sharing for educational purposes.

This type of email is called "phishing" because the intent is to try and get you to click on the link in the email, log in with your personal information on some site, and then they get your log in to use themselves and do all kinds of damage, in this case probably book flights online for themselves with your valid credit card information.

This phishing emails are tough! They look so real. The most common ones look like they are coming from a bank and that your account has been temporarily frozen and you need to log in to confirm your identity. Yikes! In the below scam email, Qatar Airways *is* actually at the url of qatarairways.com. And the booking and cancelling urls look logical. But they are not. If you open a brand new browser window and manually type in qatarairways.com and look at what their real booking url is, its different. No https at the beginning and no booking.qatarairways.com urls. But the fake urls look real and look logical so they will catch some people unaware. And notice the "From" email. If you are not paying attention, it won't stick out but it is not from qatarairways.com.

Of course, phishing emails rely on trying to trick only a population of people who are either currently or have recently used that service. If you've never dealt with Qatar Airways, you will be suspicious - but hopefully not unaware enough to click on the link in the email to check it out - the scammers are counting on that as well.

How do you avoid these phishing emails? When it comes to logging into a site and or "confirming" or "cancelling" personal information - never never never never (one  more time!) never do this by clicking on a link in an email. Period. And DO NOT manually type the SAME url from the email into a new browser. You'll land on the same falsified website that probably looks just like the real one. Google the company or site and go to the site manually from a google search (or whatever search engine you use). Or look up their phone number and do really important things via the phone.

From: "Qatar Airways"
Date: August 29, 2010 6:51:43 AM PDT
Subject: Booking confirmation email

Thanks for the purchase!

Your booking is confirmed.
Booking number: K4QCTI

Your credit card has been charged for $438.60 (USD)

Please print the itinerary/receipt for your reference.
Sign in to qatarairways.com and print it by clicking the link below

https://booking.qatarairways.com/global/en/GetPNRsListServle/

To cancel your booking online, please click the link below:

https://booking.qatarairways.com/global/en/CancelBookTripPlanServlet/
 
On board you will be offered:
– Beverages;
– Food;
– Daily press.

Thank you for choosing Qatar Airways and we look forward to welcoming you
on board.

Best regards,
Qatar Airways

Scam Email: Paul Moore

We've seen this scam email before - under the name of Paul Peter. Exactly same content but change of name and change of gmail account to receive replies. Here is what another artist wrote me this morning:

This is the second of this type letter I have receive which is clearly a scam. The other was from someone with the last name Rice , which is listed as the name of  an art scammer. Note that this letter doesn`t name the piece except in the “subject”. I didn`t respond. Thanks for your efforts to halt this crime. Should this be reported ? If so, where?

Scam Email Sent:

From: Paul Moore [mailto:ppmmore@gmail.com]
Sent: Sunday, August 29, 2010 5:46 PM
Subject: Ruffles, Acrylic

Hello,

Good day to you over there, My name is Paul Moore I'm from Seattle  and i hope this message finds you well.I was going through your works and my eyes caught...., i will like to have it for my new apartment this month. please let me know if the piece is available, if yes let me have the detailed price and more information about it. i will be waiting to read from you.

iTunes Hack - It's Not What You Think

People are seeing thousands of dollars being taken from their PayPal account apparently via the iTunes Store. At first, it was thought to be an iTunes hack. But it is probably not. The more likely culprit is that your paypal account got "phished" via a scam email - you know, the kind that look like they are from PayPal but they actually are not? And then you click on the link in the email to "log in" or "reactivate" your account - but you are at a fake site that looks like PayPal and yet it is not. And now the "phisher" has your paypal account info and can proceed to buy things with that account.

One customer said his account was charged over $4700 in the iTunes store and when he called PayPal he was told a large number of iTunes accounts were compromised. People who were scammed say that the receipt claims it was for the purchase (at $99.99 a time - a clever move by the scammers, aiming to get it underneath the credit card "suspicion" level and also below the automatic level where the merchant has to bear the cost of reversing the payment) of "CastleCraft, Dragon Crystals (10000 Pack), Seller: Freeverse, Inc)". There is no product called "Dragon Crystals" and they don't come in 10,000 packs.

It is now emerging that it was their paypal accounts that were compromised (and I guess the hackers just really like iTunes). Not iTunes.

This can not be said enough (and so we say it again): be absolutely sure before you enter critical data such as your username and password onto any site. And when logging into a site, never go to the site from an email login link - put the real site url in your browser 'location' field and go there independently of any links in an email and then log in.

Scam Email: Smith Paul

I just love when I get these myself in my own email box. Then I can look at the full headers and see all kinds of things. Let's begin with the actual lame scam email:

From: Smith Paul [smithpaul479@gmail.com]
Subject: Mail Order

Hello Sales, Top of the day to you. I am Smith Paul, I would like to place an order from your store but before i proceed, i would like to know if you can ship to AUSTRALIA and accept credit card as a method of payment, If you do kindly get back to me with your valid website address for selection of items needed. I await to read from you today. Regards Smith Paul

Now look at the full headers and see what you can see:

Return-path: [alfuraih@l1.fancytech.com]
Delivery-date: Mon, 23 Aug 2010 15:53:26 -0500
Received: from l1.fancytech.com ([74.200.215.226]:59448)
(envelope-from [alfuraih@l1.fancytech.com])    id 1One1G-0004cI-KY
Subject: Mail Order
From: Smith Paul [smithpaul479@gmail.com]
Message-Id: [E1OndlA-0007mM-P6@l1.fancytech.com]
Date: Mon, 23 Aug 2010 15:36:48 -0500
X-AntiAbuse: Primary Hostname - l1.fancytech.com
X-AntiAbuse: Sender Address Domain - l1.fancytech.com
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php /home/alfuraih/public_html/aa.php

X-Source-Dir: alfuraih.com:/public_html

You'll notice that this scammer is using php software to send these emails and it even has the folder address on his server computer where the software lives that is generating these scam emails. You'll notice the actual server origin is registered to fancytech.com, which no surprise is a foreign entity. You'll notice the actual IP of the originating server that sent the email: 74.200.215.226.

He probably doesn't even get that he probably got his faked name backwards...

Scam Email: Patricia Fenton

We've been receiving a number of reports now that perhaps the scammer previously sending email as Barbara Santos is now sending the same scam email as Patricia Fenton. Here's a consistent clue with this spammer - they always seem to be using the email service called mybestmail.com.

Hi Kathleen,
Thanks again for having your Stop Art Scams Blog. Here is the address that was used on my emails from "Patricia Fenton":pat.fenton1@mybestmail.com [209.59.166.66] Thanks again-- and let me know if there is anything else that I can do to help fight these scammers!
Rebecca

Scammers Make DDoS Threats to Website Owners

An artist friend got an email along these lines so I wanted to post this alert to others.

A group of scammers is trying to trick website owners into sending them money by threatening to launch crippling Distributed Denial of Service (DDoS) attacks.

According to security researchers from Symantec who intercepted the fake messages, the scammers are sending them to email addresses they gather from domain whois information.

The rogue emails come with subjects of "Hosting – Important Updates and Information" to make it look as if they appear from the recipient's domain registrar and contain intentional spelling mistakes to avoid spam filters.

"We hold a huge network of Distributed Denial Of Service Attack, allowing to suspend any website. We have been watching [domain_name] and were able to find out that you have spent pretty money much for its advancement and we want to to offer you to spend a little more yet.

"Just as little as 200 bucks as a voluntary donation to our fund will keep your web site away from DDOS attack," part of the message signed by the "Top Manager of ZeleniyHach project," reads.

The scammers claim that if the money are not sent to them in the form of a Webmoney Payment Check within 48 hours, another zero is added to the sum, making it $2,000.

"Attempts of gathering personal information or money by using tactics similar to those mentioned here are very common in scam attacks. Symantec recommends that users ignore emails from unknown senders […]," Symantec's Samir Patil, writes.

Even though Symantec assures users that this is just a scam, DDoS-based extortion does exist and has been used by cybercriminals before.

However, buying DDoS services from a botnet runner to attack the competition's services is a much more common occurrence.

According to a Kaspersky Lab report on the underground economy released last year, botnet owners charge between fifty to several thousands dollars for launching DDoS attacks, depending on length and target.

Scam Email: Martin Robert

Here is a scammer that can't decide on what fake name to settle on, got lazy and rather than have it look like it was going to one person (who he supposedly saw your web site and liked some "products"), just sent it to a group distribution list, and clearly could not get his command of the English language together. Like not even close (how's that for grammar...)

From: roberts martins [martins_roberts@yahoo.com]
Subject: info
To: martins_roberts@yahoo.com

Hello,

My name is Martin Robert, Am American, but lives and work here in Cyprus .I run

a company  here in Cyprus.

I recently viewed your web page and i was caught up in ordering some of your

products,we are located in Cyprus,i will like to know if you have the items in

stocks.

DO YOU ACCEPT US ISSUE CREDIT CARD?
HAVE YOU SHIPPED INTERNATIONAL IN THE PAST?
DO YOU HAVE A PERSONAL SHIPPING AGENT?


  So kindly get back to me with the right contact person email,phone  number

and confirmation of your website so that i can place my order quickly,i want you

to know that i have my own personal shipping agent that will come for the pick

up at your store,please advise so that i
can proceed by going ahead to place the order.


I am waiting anxiously to hear back from you.

Best regard.

From the desk of Purchasing Manager,

Fax:206-984-4614
Email : martins_roberts@yahoo.com

Martin Robert

Scam Email: Lynda Diamond

We've seen this particular email content a *lot* lately, with just the name and email changed up. But the content remains basically unchanged. Also, we've reported in the past on a Linda Diamond [lindadiamond1@live.com] so this particular scammer does seem fond of just creating new accounts on live.com.

From: "lyndiamond@live.com" [lyndiamond@live.com]
Subject: Placing an Order!!!

Hello Sir/Madam, I am lynda diamond, an American but I live and work here in Australia. I will like to place an order for some items from you, but I will like to know what you have available in stock . Let me have your website address so I can view the products you have presently in stock and if there is any special pricing I need to know about. Lastly regarding payment I will be sending you my credit card for the full payment charges for my order . In order to avoid any form of delays can you let me know the type of credit cards you accept? I hope to hear from you as soon as possible so we can proceed with the Order Regards Lynda

Scam Email: Paul Sanders

Okay "Paul", you are going to have to put a little more effort into your illegal activities than this!

From:    Paul Sanders (sanderspaul@yahoo.com)
Subject: Please respond for more details.‏

Hello,

I am Paul Sanders, I am ill and would die having been diagnosed with
cancer disease.
I want to distribute my funds to charities in your country through you.
 
Please respond for more details.

Respectfully,

Paul Sanders

Scam Email: Paul

Here is a scammer reported today that doesn't even reference a last name. Perhaps as more reports come in, we'll be enlightened as to what fake last name this scammer is using, but for now, it's just "Paul".

From: Paul [paulpp77@yahoo.com]
Subject: Order Inquiry

Good day,

We browsed through your web page and we are interested in ordering some of your products,we are located in Norway,we will like to know if you have the items in stocks,so kindly get back to me with the right contact person email,phone # and confirmation of website so that we can place my order quickly, and i want to know if you have your own personal shipper or can the order be picked up at your store,please advise so that we can proceed by going ahead to place the order.

Regards
Purchasing Manager
Paul

Scam Email: Alice Drew - Still Sending Email

We anticipated that the "Alice Drew" scammer would not go away, given we know this particular scammer successfully got money out of some artists last week.

It seems the key to my making their lives miserable is to post their names and emails as widely as I can and then just educate as many artists as I can to google the name BEFORE they send any money or artwork. And these alerts will be showing up in google results. That seems to be the key that is beginning to work.

The twist I didn't like about the below email was it would appear Alice Drew is going through Facebook pages and emailing artists. Ack!

Here is an email I received this morning from an artist:

Thanks to your site and list of scammers I caught this one before it went too far!

It seemed too good to be true and very strange. Sure is!

Thanks for the site, saved me!!

See here:

First Email:

On Sat, Aug 7, 2010 at 12:13 AM, Alice Drew [alicedrew1@live.com] wrote:
Hello,
I am Alice drew, an American but I live and work here in Australia. I want to place an order in your store,and i will like to know if you ship to Australia,my method of payment will be credit card. So please let me know if i can proceed with the order,And please do not forget to get back to me with the website address where most of your product can be seen. So I will be able to make my choice of items and get back to you with list of items needed.I will await your prompt response as soon as you receive this mail

Thanks with regards
Alice

Second Email:

Hello,
Thanks for getting back to me on time, Please find below for the list of items needed and get back to me with the quote asap.

Edward Ruscha
Sweets, Meats, Sheets
1975
6 color screenprint with varnish overprint
32 3/4 x 25 7/8 inches
83 × 66 cm
Edition 3/55
QTY:1

The Lost Night, Graphite on paper, 43 x 78 Inches
QTY:1

Please get back to me with the total cost estimate for this order so that i can make my payment via my visa or master credit card.
Like i stated in my previuos message i am an American but I live and work here in Australia and I want these products here.
Do not worry about the shipping, I will make arrangement for the pick up of these items from your place thru my shipping agency.
PLEASE LET ME KNOW THE GRAND TOTAL WEIGHT OF THESE ITEMS FOR SHIPPING REASON.
Alice

Scam Email: Justin Johnson

Just received this in my own box this morning. Given we've reported on how an artist unfortunately fell for and lost money to a scam email last week from Alice Drew, I'm guessing we'll be seeing a LOT of this email, with just various fake names and diposable email addresses. This is pretty much the same. Not even personalized. Doesn't care who I am, but they will begin personalizing it once I respond (and by the way, I will NOT be responding at all).

From: "Justin Johnson" [justinandgroupretailstore@ymail.com]
X-Sender: rich@impulsesales.com
Subject: Inquiry

Good Day,

This mail is to make an inquiry on the below Questions.
Do you Ship oversea or do intend to start Shipping oversea? (though we already know of a Freight Forwarder that will pick our packages from you and deliver to us in Australia.

PAYMENT MODE...................CREDIT CARD

Kindly send us price list of your inventory list of your latest collections as an attach file to our email so we can proceed with the order.

Should you require and further clarifications do not hesitate to contact the undersigned.

Kind Regards,
Justin and Group Retail Stores (Australia)

The Anatomy of a Successful Scam

I'm posting this so others can learn from what happened here.

I was so so sad to receive an email tonight from artist who unfortunately fell for the scam recently sent under the name of Alice Drew. I'm not writing this to make that artist feel bad. It is NOT about that. It is about using his experience so others can learn and be fore-warned. It is about my little obsessive-compulsive mission now to spread the word about these scammers and make their lives much less rewarding. And that is why I'm so disappointed to learn that this scammer made at least some money in their efforts last week. It makes me want to double my efforts to thwart them!

While this woman admits english is not a language she is strong at, just focus on the details of how this scam proceeded - so that you never find yourself in the same place.

Dear Kathleen,

Thank you for your blog.

In my husband case, Alice used real person name in Australia, and when we first got her e-mail we check her name and we saw real Alice Drew in Australia, her picture, her job, + next day, when she ordered, she gave us her credit card info, and we charged, it went through but it will be cleared on Monday.  I told my husband to make sure we get the money, then we send the money to her shipping agent.  But she was very rushing, and he felt bad to tell her we don't pay for shipping company unless the money cleared, so he took his own money, send the money to Malaysia. This is the story between thursday and Friday.

Today, we got more order with very expensive shipping fee to send to Malaysia from ALICE. Sia, my husband already sent $520.00 to the shipping agent of Alice Drew in Malaysia on Friday afternoon.  Then They ordered more art pieces, asked him to send shipping money to Malaysia agent again.  Alice said this time, shipping costs $1,300.00.  Then Sia started feeling somethings wrong because they want to combine the shipping to Australia, using her personal shpping agent in Malaysia. Alice ordered total 6 flat prints, mideum size, there is no way the shipping for 6 flat prints will be $520+ additional $1,300 together.

Sia checked ALICE DREW name again on web and he found your blog. Wish he founded earlier. But at least we found out.

We called Western Union. They said the money already cashed in Malaysia. They told us to make Police report for Malaysian Police and LAPD. We called Malaysian Police, but they told me they only accept the police report at the police station.  I explained Malaysian Police Officer we are not the only one to get this fraud.  More people in US must be going through right now. He said he will talk to his superviser and get me back by e-mail.  I am  doubt about it 80%.

Still, we are going to LAPD tomorrow to make Police report.

He was very excited about getting orders from over sea through his website because it is not usual for us. Artists are very simple. We didn't think about this would have been happened to us. Now we are telling all our art district artists in Los Angeles. I am Japanese, my English is not good enought to tell people what happened from ALICE but I keep my voice laud in my facebook, anywhere I can.

Thank you very much for your blog.

Scam Email: Alice Drew

Here is one received this morning. Sent to an artist but didn't bother to personalize enough to identify them as such. It is a common one floating around (same email, just name and email address altered) and one of the silliest approaches - so these scammers are interested in placing an order but too freakin' lazy to google the website address??? I also never get their persistence in horrible formatting.

From: Alice Drew [alicedrew1@live.com]
Subject: Placing An order!!

Hello,
I am Alice drew, an American but I live and work here in Australia. I want to place an order in your store,and i will like to know if you ship to Australia,my method of payment will be credit card. So please let me know if i can proceed with the order,And please do not forget to get back to me with the  website address  where most of your product can be seen. So I will be able to make my choice of items and get back to you with list of items needed.I will await your prompt response as soon as you receive this mail

Thanks with regards
Alice

Cashier's Checks are NOT the Same as Cash

Here is a great article on cashier's checks. It is the most common approach when scammers target anyone online, which includes the many artist-targeted scams we report on. Yes, scammers will also avoid this phrase and tell you they will pay with a credit card or even do a direct bank deposit (neither of which you should do - many of the credit cards are stolen and with a direct bank deposit they will get your bank account number). But most of the scammers still say money order or cashier's check (then they'll do something else to try and bypass your gut instinct that something is not right - they will offer to send it overnight via Federal Express).

So the lesson of this article? Cashier's checks are not the same as cash. And there are ways you can determine if the potential buyer is a real buyer and not a scammer.

Counterfeit Cashier’s Checks Continue To Flood The Banking System

The increasing number of counterfeit cashier’s checks flooding the country continues to cause major problems for both banks and consumers.   The FDIC is routinely issuing special alerts on 15 to 40 banks per month that report counterfeit checks bearing their name.

Counterfeit cashier’s checks represent a major risk to consumers who can be held liable by their bank for the full amount of a deposited counterfeit check - see Why You Can’t Trust A Cashier’s Check.

Many consumers assume that a cashier’s check is equivalent to cash.  That belief is now dangerous to your financial health as a tidal wave of counterfeit cashier’s checks are now flooding the country.  The counterfeit cashier checks can be very similar to authentic teller checks.  The average consumer would not be able to detect a counterfeit cashier’s check.  Often times, the depository institution accepting the check is not able to detect counterfeit checks until the check is returned unpaid.

The FDIC has already issued 14 special alerts in August on banking institutions reporting counterfeit cashier’s checks. Counterfeit cashier’s checks bearing the following institution’s names are reportedly in circulation.

    * SA-117-2010: Counterfeit Bank Checks Bearing the Name The Old Fort Banking Company, Bettsville, Ohio, are Reportedly in Circulation
    * SA-116-2010: Counterfeit Treasurer’s Checks Bearing the Name Century Bank, Somerville, Massachusetts, are Reportedly in Circulation
    * SA-115-2010: Counterfeit Cashier’s Checks Bearing the Name American State Bank, Sioux Center, Iowa, are Reportedly in Circulation
    * SA-114-2010: Counterfeit Cashier’s Checks Bearing the Name Empire Bank, Strafford, Missouri, are Reportedly in Circulation
    * SA-113-2010: Counterfeit Official Checks Bearing the Name Bank Mutual, Milwaukee, Wisconsin, are Reportedly in Circulation
    * SA-112-2010: Counterfeit Cashier’s Checks Bearing the Name First Suburban National Bank, Maywood, Illinois, are Reportedly in Circulation
    * SA-111-2010: Counterfeit Cashier’s Checks Bearing the Name O’Bannon Bank, Buffalo, Missouri, are Reportedly in Circulation
    * SA-110-2010: Counterfeit Cashier’s Checks Bearing the Name First National Bank, Selling, Oklahoma, are Reportedly in Circulation
    * SA-109-2010: Counterfeit Cashier’s Checks Bearing the Name Brenham National Bank, Brenham, Texas, are Reportedly in Circulation
    * SA-108-2010: Counterfeit Treasurer Checks Bearing the Name East Cambridge Savings Bank are Reportedly in Circulation
    * SA-107-2010: Counterfeit Cashier’s Checks Bearing the Name MERCO Credit Union, Merced, California, are Reportedly in Circulation
    * SA-106-2010: Counterfeit Official Checks Bearing the Name Corefirst Bank & Trust are Reportedly in Circulation
    * SA-105-2010: Counterfeit Official Checks Bearing the Name Amer Un Svgs & Ln Assoc, Chicago, Illinois, are Reportedly in Circulation
    * SA-104-2010: Counterfeit Cashier’s Checks Bearing the Name Athens Federal Community Bank, Athens, Tennessee, are Reportedly in Circulation

The reason that criminals continue to produce counterfeit cashier’s checks is because the scam works. Many consumers would have doubts about accepting a personal check from a stranger due to the risk that the check would not clear.  It has been a time tested practice to request a cashier’s check for payment to eliminate the risk of a bad check.  Unfortunately, the prevailing belief that all cashier’s checks are as “good as gold” can no longer be relied upon.

If accepting payment in the form of a cashier’s check for the sale of an item, exercise due diligence to avoid potential problems.  Check with your bank on the authenticity of the cashier’s check, or better yet, hold off on delivery of the item sold until the cashier’s check clears your bank account (Note from Stop Art Scams: sometimes the bank WILL clear the check only to remove the funds later when they realize the check is fraudulent - so have a live bank person research it).

How Counterfeit Cashier Check Scam Works

A typical scam using a counterfeit cashier’s check for a purchase usually involves the following ploy.  The purchaser presents to the seller a cashier’s check for more than what is owed and gives some elaborate explanation for why the check exceeds the amount due.  The seller accepting the cashier’s check feels safe, especially since the check exceeds the amount he is due.

The buyer then asks the seller to cash the cashier’s check and immediately forward the overpayment to him.  The con man knows that banks are required to make funds on the first $5,000 of a cashier’s check available to the depositor within one day.   The seller deposits the check and sends the overpayment to the purchaser.  In three to five days, the seller finds out that the cashier’s check was counterfeit and that his account has been debited to make restitution on the counterfeit check.

Consumer Vigilance Essential - How To Tell If You Are Being Scammed

Ohio Valley Bank, which has previously reported counterfeit checks bearing its name, has the following good advice for consumers.

If you can answer “YES” to any of the following questions, you could be involved in a FRAUD or about to be SCAMMED

* Is the CHECK from an item you sold on the internet, such as a car, boat, jewelry, etc.?
* Is the amount of the CHECK more than the item’s selling price?
* Did you receive the CHECK via an overnight delivery service?
* Is the CHECK connected to communicating with someone by email?
* Is the CHECK drawn on a business or individual account that is different from the person buying your item or product?
* Have you been informed that you were the winner of a LOTTERY, such as Canadian, Australian, El Gordo, or El Mundo, that you did not enter?
* Have you been instructed to either “WIRE”, “SEND” OR “SHIP” MONEY, as soon as possible, to a large U.S. city or to another country, such as Canada, England, or Nigeria?
* Have you been asked to PAY money to receive a deposit from another country such as Canada, England, or Nigeria?
* Are you receiving PAY or a COMMISSION of facilitating money transfers through your account?

Report Fraud To FDIC

Information about counterfeit items, cyber-fraud incidents and other fraudulent activity may be forwarded to the FDIC’s Cyber-Fraud and Financial Crimes Section, 550 17th Street, N.W., Room F-4004, Washington, D.C. 20429, or transmitted electronically to 'alert [at sign] fdic.gov'.

Online Car Buying Scam

I know, this isn't art related either, but all these scams have common approaches, so we learn from all of them and become better at recognizing a fake offer when it is presented.

In this case, I just feel bad for the guy. From the story, you can tell his gut was definitely telling him something didn't feel right. He just didn't have the knowledge of how to check and know for sure it was a scam. And he proceeded anyway.

Learn from his pain.

Just a few hours after Dr. Douglas Colkitt wired $39,500 for a 2006 Aston Martin, the Sarasota physician realized he had been the victim of an elaborate scam.

The offer looked legitimate, and the seller suggested using something called Google Checkout as an escrow agent. The site included the name of Internet giant Google in the web address, and used graphics from the legitimate Google web site color-for-color.

Colkitt even challenged a customer service representative at the site in two different online chats and told her, "Sorry for the skepticism, but I have been burned before."

Then a new e-mail came and Colkitt realized he was burned again. It was supposedly from a different car seller, but contained the same grammatical and spelling errors as the first seller's e-mail.

"I said, 'This is a scam, I've been scammed,'" Colkitt said.

Colkitt notified Chase bank's fraud department and the FBI in Atlanta, then realized he would have to file his own legal actions to freeze the money.

A judge looked at the evidence -- e-mails and chat logs -- and ordered the money frozen. But Colkitt said not every victim of an Internet scam can get such help.

"A lot of this white-collar crime, it seems like nobody investigates," Colkitt said.

The type of scam has been common for years, said Jeff Ostroff, who has run consumer advocate site carbuyingtips.com since 1997.

And Colkitt unknowingly violated three guidelines to avoiding car-buying scams online, Ostroff said.

First, an escrow online is "just about 99 percent fraud," Ostroff said.

Second, he did not double-check the website he went to for Google Checkout. There is actually a Google Checkout, at checkout.google.com. But scammers set up websites with similar names -- in Colkitt's case it was googlecheckout-transaction.com.

"As soon as you see a dash in the name, you know it's a scam," Ostroff said.

Third, Colkitt only got to the transaction site through the link provided to him in the seller's e-mail.

"How do I confirm this is google checkout?" Colkitt typed in a chat on the site.

The reply: "You've been redirected from your email witch has been sent from our support department support@googlecheckout-transaction.com."

Three tips to avoid car-buying scams online
1. No escrow: A seller requesting a transfer to an escrow account for the purchase is a warning sign for fraud.
2. No dashes: Legitimate websites secure communications,
and if there is a dash in the Web address it is usually a scam. For example, Google Checkout is at checkout.google.com, not scam site googlecheckout-transaction.com
3. Do not follow e-mail links: Find the website yourself or do not go at all.

Puppy Dog Scam

This is not art-related but just a heart-tugger.

There is a scam floating around advertising to adopt this puppy. The scam type is used in many ways but the category of scam is called the "Advanced Fee Scam". In this case, they ask for an adoption fee and transportation costs - for a puppy that will never arrive. Typically the payment has been made via Western Union and is virtually untraceable. A bunch of puppy lovers seem to be falling for this one.

They certainly did find a photo of a damn cute puppy to use. How can you reduce your risk if you see a puppy you want to adopt online? Pay via paypal only to a verified paypal account. If you insist on that upfront, you'll never hear from them again - and you won't lose your money.

Scam Email: Kristen Carson

Love this one. The scammer forgot what fake name they were using and confused it with the name of the intended victim! You just can't call these scammers too bright!

An artist forwarded this to me (and she blogged about it - great! the more scammers are exposed, the better for everyone). The first email from the scammer was the usual: “she” claimed she was pregnant, her husband was in Johannesburg, South Africa, for months. She loves your art and wants to buy four pieces. Her shipping company will handle packaging and other logistics from your location. She was released from the hospital, where she took bed rest because of the stress of her husband being away for months, caring for a small child and being pregnant with another. Her grammar is poor (this *always* seems to be the case), but she says that’s because she not a native speaker of English. Since they are moving from Seattle to Johannesburg, she wants to get the art sale accomplished and the art shipped ASAP. Her husband will mail you a check ASAP.

Same old crap. The faked name being used is Kristen. Now look at email #2 below. Now only does this scammer has detail diarrhea, their name has changed (the artist who forwarded this funny experience is named Christine). Check it out:

From: Kristen Carson [krison.landslide@gmail.com]
Subject: Payment sent via UPS # J2283026797

Hi Christine,
I hope this email finds you well and I`ll want to first thank you for your patience and understanding all this while regarding this purchase,I`m very happy to inform you that the payment has been sent out yesterday by a creditor client of my husband`s who promised to send the payment since my husband had been indispensable to be home in the last couple of months,but there are one or two faults with the payment,though it`s not really a fault but I just think it`ll be a wise thing to inform you before it arrives so that you can be sure it`s actually the payment for my purchase.

One,he erroneously included The Shipper`s payment with your payment as he could not really understand what my arrangements were with you and two,while in Seattle,he misplaced your mailing address to mail the payment,and he was also unable to see me since I was in the hospital for bed rest as advised by the doctors because of my new baby.The payment was sent via UPS with tracking number:J2283026797 and according to him the payment should be delivered to you today.

Therefore,upon arrival I`ll want you to deposit the check and once processed by your bank remove your asking price and forward the rest of the money to the Freight company from which arrangement will be made for the shippings of our housewares from Seattle and to also pickup my shipments from you to be shipped to Jo-burg.

I`m very sorry for the inconvenience,I was in the hospital for bed rest as advised by the doctors as I`m carrying another baby that is almost due so it was never a deliberate thing.I hope you understand what I`m going through to with my husband away and still carrying another baby.I do hope we can finalise the transaction as soon as possible so I can join my husband in our new home.

I`ll look forward to hearing back from you so I can know that you got the email.
Have a pleasant day and best wishes,
Kristine

Scam Email: Wong Anderson

I have been receiving several reports this morning on this scammer, so he seems to have hit a bunch of artists.

From: Wong Anderson [wonganderson1@hotmail.com]

Subject: Order Inquiry

Hello, This mail is to make inquiry on the below question. 1- Do you carry overseas? (though i already know of a freight forwarder that will pick my packages from you,since they ship lesser than any other courier and they are so effective in shipping my goods to me here in Queensland,Australia is estimated to be 3-4days) I have used their services in the past and it was splendid. 2- Do you accept credit card for payment(my U.S.A Master and Visa card to be precise)? Kindly let me know your comments on these, before i send the items i am interested in purchasing from you. Wong Anderson

US Art Dealer Jailed in Celebrity Investor Scam

It kills me when the scammer is pretending to be an art dealer. We artists have it hard enough. We don't need scammers destroying the confidence in the system for collectors to collect art. $120 million scammed from celebrities. That's a lot of money. But I'm glad this guy was caught. For that kind of money, I'm guessing he'll be scamming again when he gets out of prison.

A US judge on Tuesday sentenced a New York art dealer to up to 18 years prison and a hefty fine for stealing 120 million dollars from big-name investors, including American tennis star John McEnroe.

Lawrence Salander, 61, admitted in March to cheating his clients between 2004 and 2007 by selling art that he did not own, or convincing them to invest in fraudulent schemes, the Manhattan district attorney said in a statement.

One of the victims was Hollywood actor Robert De Niro's father.

With the profits Salander bought a luxurious Manhattan residence and a private airplane.

Salander and his gallery will also "be responsible for paying approximately 120 million dollars in restitution to the 30 victims," the statement read.

The judge sentenced Salander to between six and 18 years prison, with the time spent in prison dependant on good behavior.

McEnroe lost two million dollars when he bought what Salander fraudulently claimed were two pieces by Arshile Gorky, a US artist of Armenian origin.

Salander's "widespread fraud and calculated betrayal created ripples that spread from individual victims to the broader art world," said Manhattan District Attorney Cyrus Vance.

Scammers Target Job Seekers

Okay, this isn't art related, but artists very often need secondary jobs to get by, so I thought it would be good to post this alert:

The Better Business Bureau is warning people about a scam that is targeting job seekers. The scammers hire unsuspecting job hunters and then try to take their money.

Carmen Prather, a graduate student at UNCG, was in need of a job. She turned to Craig's List and eventually found one.

“I was supposedly chosen to be a personal assistant to a photography company and it turned out to be a huge scam,” said Prather

She said there were clues along the way like she had never met her new employer and talked only through email. She said that the first hint that something was wrong was when she had to deposit a check without ever having met her employer or spoke to them over the telephone.

Prather didn't deposit the check and called the Better Business Bureau. Officials said it's a growing problem.

“The level of the scammers is getting higher, they're doing a better job on their end, and I think also with the way the economy is people are also more susceptible,” President and CEO of the Better Business Bureau of Central N.C., Kevin Hinterberger said.

Prather says she learned a very valuable lesson when it comes to job hunting. “Just be very suspicious of everything, check everything twice,” said Prather.