Scammers Prey on Shoppers in Richmond

Here's a scammer who incredibly is still pounding the pavement the old fashion way:

A scam artist used the photo of a 10-year-old boy to bilk unsuspecting market-goers of their spare cash at several liquor stores along Richmond's Rumrill Boulevard corridor, police said Thursday.

The boy's photo appeared on cardboard boxes, along with a note in Spanish stating that the boy died of brain and heart disease, and asking for donations to help the family send the boy's body to Reyes, Michoacan.

The boy's mother was startled to hear from a friend Thursday morning, inquiring about her son's death -- since he's alive.

"Unfortunately, it's very hard to verify this kind of information," Richmond Police Lt. Mark Gagan said. "In this case, the scam artist capitalized on people's generosity."

A friend of Rosa Valledor saw the photo at Trujillo Market, 1025 13th St., and phoned the mother, who drove down and verified the photo was of her son.

"I was in shock," Valledor said. "I was scared. I had no idea what this person (who used the photo) had access to."

Valledor called police, who found $73.61 in the box, and learned that someone dropped it off two days earlier.

Further investigation at nearby liquor stores turned up tales of at least four other similar boxes, all bearing the boy's image, that began appearing last week.

The scammers picked up all of the other boxes earlier in the week, Gagan said, though surveillance camera footage from a San Pablo store on Rumrill showed a heavyset Latino man with a ponytail, in his 20s or early 30s, picking up one of the boxes.

The photo of the boy, who is autistic, came from the website of the California Autism Foundation, Valledor said.

She immediately called the organization, and the photo was removed.

"Be careful who you donate money to," she said. "It's better you donate to reputable charities and not to boxes left in stores."

Anyone with information about the scam can call Richmond police at 510-620-6643.

The Dark Back Room of a Scammer

I happened upon a fascinating thing last night. I was trying to confirm the identity of a woman who was wanting to register with a message board community I manage. I was googling her name (she turned out to be legit) and I stumbled upon these files that had been left in an unprotected directory. They were kind of program "dumps" from wordpad.exe files and dialogues from Live.com chat sessions. I stumbled upon them because the woman I was searching on - her email was found within one of these dumped files.

When I started looking through these files (and there were many in this unprotected directory), I realized I had stumbled upon the files of a scammer. Spread across a number of files, were all the actual email addresses they were sending their scam out to (I estimated there were about 20,000 email addresses), with the content of the scams. It looked like they sent their scam out via live.com over the course of about 3 days and what was interesting was this scammer was not focused on just one scam within this emailing. They were sending out 3 different types of scams at one time to the list. They had the usual someone died and has a gazillion dollars in a trust and they are looking for beneficiaries scam, they had the they have prize money you've won that they need to send you scam, and they were also the scam of getting people to send money to help a sick and dying relative (the woe-is-me scam).

What was also fascinating to me was there seem to be a dump of chat conversations they were having with their potential victims who had written to them to ask if they were legitimate. One about-to-be victim was asking how does he know this is for real, can they provide proof - and the scammer had a ready-made answer for the victim to move them to next stage of the scam. And there was this whole back-and-forth chat dialogue with a victim where the scammer seem to be pretending to HELP them contact the FBI (and then in a timestamp that was less than 30 seconds later, another 1000 emails of the scam would go out).

I had never seen the underpinnings of a scammer's process like this before. It made me feel sad, and dirty. I needed to take a shower after reading all that. And frustrated, because I know there is no way to actually stop them from sending these emails. All I can do is shine a light on their dark slimey ways and provide one voice to help educate the receivers of these emails to trust their gut and recognize these as scams from the get-go.

So if you are ever wondering why you get so many of these emails? Well, it turns out that it is very likely a single source is sending a bunch of different ones... and then multiple that by all the scammers out there! That's why there are so many.

Scam Email: Eric Acis

Here is an email I received myself this morning. The content is the same ole crap I see under lots of different faked names and email addresses. When I look at the full headers of the email, I see two things:

Return-path: [nobody@air.host-care.com]
and
X-PHP-Script: gtucampus.com/uploads/resume/kam.php for 120.141.49.248

which tells me this scammer used a PHP script called kam.php uploaded to a website that is an ecollege called Gujarat Technical University. Source of the email is Malaysia. If you google kam.php, you will see other computers that have had this php file uploaded to, so all this tells you is the scammer is using hijacked computers to send their email out (which is typical).

Here is the full email:

From: Mr Eric Acis [engericacis@gmail.com]
Subject: Enquiry

Hello,

I am interested in placing an order and i would like to know the following.

 -If you accept credit card and

 -If you ship internationally

I certainly appreciate a prompt reply from you.

Sincerely

Didn't even sign his name. Short and simple until he gets a reply and then the Looong Story will come out he either works or lives in one place and is moving (lately it is to Australia) and he has a third party shipper handling his move and he'll send a check or pay by credit card immediately, please send him your website and list of products so he can choose (which doesn't even make sense, but this is their templated formula of the scam usually).

Scam Email: Jim McCarter

Here's another person just saved from losing money:

OMG thank you so much for all the wonderful information!!

I have been emailing a guy back and forth that placed a very large order of my pepper jelly line.  He wouldn’t answer any questions when I asked him where he’d seen me, etc.  The name he is using is Jim McCarter.  His email address is

Jimandgroupsupplies@yahoo.com

He wants me to send it through Diamond Freights Cargo.  Their email is  customerservices@diamondfreights.com
 
I emailed Diamond freight as he said, they gave me a quote.  I got an email back from Micheal Wheeler with a phone number.   I called the phone number given…it was an Asian man in Atlanta GA, then  I got an email from Micheal and it gave me a huge quote for shipping, and directions saying they only accept payment via Western Union.  Once the payment has been deposited, they would come pick up my product……the red flag went up to me when the deposit was suppose to be made to a Bryan Anderson in Austin TX!!

Then I looked up Diamond truckline…..I talked to one of the head honchos and told him my story.  He said it sounded really hokey to him also but that he was the  truckline, not the cargo company

 I then emailed Jim McCarter back and told him I thought that Diamond Cargo Co. was very fishy to me.  He reassured me that it would be fine….just keep on proceeding with the order.  That is when a friend of mine told me about your scam site.

Thank goodness!!

 So please add Jim McCarter to your list of scammers and his partners in crime Micheal Wheeler and Bryan Anderson.  (prob. All 1 person!

I hope this helps someone……as you did me.

Thank you so much,

Linda

Scam Email: Wuouth Rodrick or Rodrick Wuouth

I don't know where this scammer got this silly name - what is that word, Wuouth??? And the not-too-bright scammer has the name reversed in the email. Anyway, this falls into the SCAM column.

From: Wuouth Rodrick [wuouthrodrick@yahoo.se]
To: undisclosed-recipients:;
Subject: My budget for purchase

Good morning,
            I was searching through google images directory where i came across this sophisticated and attractive work of your's that made me keep starring for moments will love to purchase one or two piece from you and i will appreciate it if you can kindly let me know if you have piece priced between $1000- $2000 because that is my budget.I hope to read from you with weblink of work in my budget or kindly send me images of it.
Regards
Rodrick

Scam Email: Richard Marrino

Here is another person, this time an art dealer, who trusted their instincts and looked up as much as they could about the person before sending any product or money. It had a lot of flags and he caught them all. The lesson for today? Trust your instincts and if it doesn't feel right - google it. Google the name, the email, look at the full headers and you can look up the originating IP and see where it is located. Notice he looked up the shipping company as well (at this point ANY email that mentions using their third-party shipping company is going to be totally suspect to me!).

Here is the message sent to me just now:

I'm an art dealer in New York and have just wasted about a week of negotiations on a supposed sale, that has turned out to be a scam I'm sure.

I did a google map search on the 'client's' address - turns out to be an airport. I did a google map search on the courier, turns out to be a residential address in the UK.

I also did an IP search on the emails, both of which were located in isolated places, nowhere near where the 'client' or 'courier' are located.

Only after these red flags did I do a google for art scams. Thanks for the additional information and confirming my worse fears - fortunately before I acted on any payments etc.

Perpetrators name: Richard Marrino: [richardmarrino@rocketmail.com]

The courier name: Techie Courier 

Scam Email: Clark Elster

We've had previous reports on the use of this name. Before the email associated with Clark Elster was [ckelster2222@gmail.com] and now its [ckelster2222@mybestmail.com]. I've also seen pretty common use of the email service mybestmail.com - so its either the same guy always using that service under different faked names or its just a service easy for a bunch of different scammers to exploit.

In any case, here is an email I received this morning.

Hello Kathleen,

I just wanted to thank you for posting the information about the scammers. I received an email from a guy called Clark last night saying he was interested in purchasing two of my paintings. I didn't doubt about it at all because I never had fraudulent purchase in my mind (I thought that only happened to famous artists). Besides, he mentioned the names of my pieces. I responded to his email saying one of the paintings was not available and I told him about a few other similar ones he might be interested in. He replied, said, he was glad that all the pieces were available, and he would send me a cashier's check, he was going to go abroad soon for a business proposal, he would have a shipping agent to pick up the artworks....

I felt a little bit weird about his reply. While I was just about to tell him again that one of the pieces was not available, I googled his email address and found your site! His email is  [ckelster2222@mybestmail.com]

Thank you, thank you so much for fighting back. You're not alone.

Best regards

Scam Email: Susan Watson

You can see how close people get to falling for these scams. The Susan Watson scam email has been rampant. That's because some people actually fell for it, and if the scammers are making money, you can bet they are going to send out their email is droves! But the content is typically the same structure - it doesn't matter if they have actually identified your art items by name, and it doesn't matter that they offer to send a check FedEx or even pay by credit card. It is a scam.

But lately I'm loving this idea of getting the scammers to actually FedEx or overnight that check - so they spend a little money at that end. If enough receivers of their email do this - I'm guessing they'd have to switch strategies fast - because it would start to actually cost them money! I wonder what would happen if we said, "Oh dear, I seem to have misplaced the check, can you overnight another one?" Make them pay double.

And even if they start calling you to get that "difference" sent back to them, just tell them the phone call is being recorded for the authorities and act like you actually *want* to keep them on the phone. They'll hang up quick.

Hmmm... maybe this is the small satisfaction we can get from the frustration we feel over these constant and persistent and SO annoying emails.

Anyway, here is an email from an artist I received today.

Hi Kathleen

I found your site today, after nearly falling victim to the art scam. It was the bed-rest woman, with the husband, moving to Johannesburg. Of course, I only spoke to the man by phone, so who knows if there WAS a woman. She mentioned pieces off my web site by name.

I was stupid enough to fall for the "the check, made out by a third party, accidently included shipping charges", that I would need to refund. Fortunately, my bank flagged it as fraud the day after I deposited it,  but in the back of my mind, I was going to speak to them anyway, as it did ring a "scam bell" in my head.  And of course, I haven't sent out artwork, so I'm good there. I thought it was odd that the woman emailed me every day, and the guy called me again today (he WAS very nice the first time, and DID sound African, and far away). when I called him out on the scam, he hung up.

They made it seem more legitimate by sending the check UPS Overnight, and I did save the label, which also was suspicious. The return address was:

Montana State Library
1515 E. 6th Ave
Helena MT 59601

I may call ups to let them know scams are being sent through their service.

The other info

Susan Watson [swatson.landslide@gmail.com]

and let's not forget:

HARVESTFIELD FREIGHT AND LOGISTICS SERVICES Ltd. [h_field.freighter@live.com]

I feel as though I've dodged a bullet, and at least I cost THEM overnight service charges. Thanks for the great info.

Adrienne

Scam Email: Orson Aguilar

Same content as we've been seeing recently under lots of different names - SO many scammers are moving or working in Australia lately! [smile]

From: Orson Aguilar [orsonalar2@gmail.com]
Subject: Order Inquiry....

Hi,

I am Orson Aguilar and I'll like to order some items from your store but before we proceed I'll like to ask the following questions.

Do you ship to Australia?
Do you do Mail Order?
Do you accept credit card as for Payment?

I await your urgent response so we can proceed.

Orson

Second email:

From: Orson Aguilar [orsonalar2@gmail.com]
Subject: Re: Order Inquiry....

Thanks for your response concerning my order.

I would be happy if you can email/attach me the lists of pieces you have in
stock now along with their prices, so that I can choose.

Regards

Orson

Web Users Hit by Sex Movie Worm

This is not a scam, but a worm. A worm is different. No one is trying to solicit and trick you into sending them money and your artwork. A worm is just a piece of software that does something annoying and then has the sole goal of just spreading itself to as many people as possible.

And this one IS spreading (through large corporations, no surprise that workers on the clock are clicking on a link supposedly to free sex images), so I felt an alert was in order so you don't become one of the people helping to spread it.

The email is entitled "Here you have" and holds within a link that appears to direct users to a PDF document.

In fact the link contains no documents but, if clicked, will enable the virus to access the user's Outlook address book and email itself to every contact contained within.

Whether you have Outlook or not, it will also attempt to disable any security programs by deleting them, allowing it to remain hidden on the computer's hard drive.

The website on which the worm was based was shut down on Thursday evening, but it is expected that other forms of the virus will continue to spread.

Scam Email: Terry Williams

We are seeing a lot of alerts on this very same scam, with different emails and names. Look at the content of the email - this basic content of the email doesn't change all that much. As I mentioned in a previous post, in the last round that this particular email was floating around, some people actually fell for it and lost money, so the scammers are highly motivated to try and catch more "flies". Do NOT be one of them!

First Email:

Hello Sales,
Good morning and its nice contacting you,am  here in Australia for a
business transaction....i came across your  websites while browsing and found out
you have the best quality of  products...i will like to make an order
from your store to my shop  abroad in United Kingdom....
I will like to know if you ship abroad and  also if payment by credit card
is okay by you...hope to read back from you  so as for me to give you the
list of the items  needed..
Regards,
Terry Williams
CEO
Williams Goods Ltd
343  Bold Street,Liverpool L1 4DS,United  Kingdom

Second email after artist replied:

From: terrywilliams03@gmail.com
Subj: Re: Order Inquiry!!!!!!

Hello,
Thanks for the response and am sorry for  the late in reply it was due to
my tight schedule in business and no problem  with the means of payment you
suggested i will kindly want to have the  websites address so as for me to
select the items needed,i had lost it and  couldnt get it in my file..
Regards,
Teery

Poor scammer, couldn't even get the faked name right at the end of the reply. And hey - I actually used a similar ploy with a scammer as this one used in the reply - I had said I had lost the original email and which pieces of artwork were they interested in - knowing they would never be able to match up what they had originally said. Now they are using the oh, dear - lost the information, please give it to me again ploy.

Okay, people - these scam emails really do look all alike after awhile. Familiarize yourself with the basic structure and get good at recognizing them when they FIRST come in. Let's have no more victims on this round, okay???

Scam Email: Lynda Diamond II

This scam email is back in circulation. It was using either linda.diamond@live.com or linda.diamond1@live.com but the content of the email is exactly the same. This email is no different, only slight variation in the name and email. People fell for this one and lost money in the last round of this being sent out and that is why the scammers keep sending out a lot of them and don't change it up very much at all.

From: Lynda Diamond [lyndiamond@live.com]
Subject: Placing an Order!!!!

Hello, I am lynda diamond, an American but I live and work here in Australia. I would like to place an order for some items from you, but I will like to know what you have available in stock. Let me have your website address so I can view the products you have presently in stock and if there is any special pricing I need to know about. Lastly regarding payment I will be sending you my credit card for the full payment charges for my order. In order to avoid any form of delays can you let me know the type of credit cards you accept? I hope to hear from you as soon as possible so we can proceed with the Order. Regards Lynda

Scam Email: Rose Williams

I love when I get scam emails directly in my box. Bold of them to just put aside the fact that I am going to post everything I can figure out about their email immediately, that it is my mission to post their ass on the internet for others to find. If only it was their REAL ass...but I digress. Here is the email that just came in:

To: undisclosed recipients
From: Rose Williams [rose4jones58@yahoo.co.uk]
Reply-To: rose4williams6@yahoo.co.uk
Subject: Hello

Hello,

How
is everything with you, I picked interest on you when i saw your email.
I really want to have a good friendship with you. Beside i have
something very vital to disclose with you, but I found it difficult to
express myself here, since it's a public site. I will be very happy, If
you can get back to me, through my e-mail Is  So we can get to know
each other better,and i well give you my pictures and also tell you
more about me ok

Rose .

Scam Email: James Timothy

Here is an email I received from another artist today. This email, sent through an online art message board system rather than email, has the standard signs of really poor grammer and sentence structure, but curiously makes a points of saying they will only pay via paypal. Typically this is a hard way to scam someone because PayPal works hard to have this not happen through them (they validate credit cards, the try and get people to only transact with validated account holders, etc). So I'm not sure how the story would change after a few emails were exchanged. Also makes no sense to pick an item up (didn't even bother to find out if he was geographically able to do this), unless that's their method for getting the goods before a credit card could be reported as stolen. So there are a few things about the content of this email I don't completely get, but just given the sentence structure and misspellings and the email address format is VERY similar to many scam emails we've seen (the name, a dot, a 3 digit number, @ gmail or yahoo), I'm falling on the side of this just not being for real. And who buys something online like with, with this kind of email and then at the end ask to see pictures - it's art! Why would they even want to make an offer if they don't know what it looks like?

Hi there ,

I'm James Timothy from Calgary, i will like to make an offer for this Item,and please i can only pay using PayPal, and after payments has been made ,i will arrange for pick up of the item.Will more than appreciate your reply to my private email address james.timothy009@gmail.com . Thanks and God bless

N.B-please attach some pictures,if any.

James T.

Stranded in the UK Scam

My friend had this happen last night. I've seen it before with other people. Here's how it works.

The hackers get access to your yahoo or hotmail or gmail account. How do they get access? They've either tricked you into clicking on a link and providing them the password OR some just get access by using software that is constantly trying combinations of passwords and it alerts them when they've hit a correct combination and can then get into your account.

Once they have access, they send out an email (see the example below) to everyone in your address book. The tricky part is the email is actually coming from YOU, because they have sending it out from your account.

If you read the below email you'll notice the goal of the scam is to get you to reply to them and send them money. Here is catch: the reply email looks almost identical to the victim's account they've hacked but IS different - thus all replies will go to them. In my friend's case the reply-to address was just one letter different.

What to do if you've been hacked like this? Change your password immediately (and make it harder to guess) and then send out an email to everyone in your address book and put in the subject line something to alert your people not to respond to the previous email. Not much more you can do...

Subject: Worst Case!!! (Need help)

I'm am in a deep mess right now and i need your help.I am in tears as i am writing you now,sorry I didn't inform you about my trip,I had a trip to the United Kingdom(Buckinghamshire) and a bizarre thing happened to me.I was mugged at gun point last night, it happened at the park of the Hotel were i lodged but thank God i wasn't hurt, the muggers carted away with all my belongings excluded my passport. Cell,c-card,cash and some important documents are all gone.I was able to make contact with the Uk Police and i was directed to the Embassy, but they seems to be taking things too slow.

I need your help so urgently.. My flight leaves pretty soon but i am having problems sorting out the hotel bills and also need getting my ticket straightened out. I need your help. I need a quick loan from you to get things fixed out here, promise to refund as soon as i get back home. Your support and assistance will go a long way here.please reply asap so i can tell you what to do and how to get the money to me via western union..Hope to read from you soon.

Sherry

Tax Rebate Scam in the UK

In the UK, about 4.3 million people are due tax refunds due to computer error and the scammers jumped all over this and are now sending tons of emails out to look like it's from the HMRC and asking for your bank info so they can send the rebate.

This would NEVER happen via email so if you get one of these DO NOT click on any of the links or provide any financial information from a link within an email.

Scam Email: Dillon Adams

Here's another one, though a time ago we already had reported this one as Dale Adams.

From: Dillon Adams [dillonadams.group@yahoo.com] IP: 41.138.182.120

Hello,
We own a store here in Australia and willing to purchase from you but before we proceed we want to be sure your email is correct and also to confirm if you can follow our order up via email since we will want the transaction to be done via email. We know of a freight forwarder that will pick of the order at your end since they are less expensive compare to UPS,FEDEX,USPS AND DHL. Beside they are perfect in delivery to the remote area we are in AU. Payment mode will be credit card, USA BILLED Mastercard (NO PAYPAL). Confirm this email before we proceed to send the quote of order.

Kind regards,
Dillon Adams & Group. 

A Scam of the Scam

Can you image how embarrassed and ashamed a victim would feel falling for this one? A scam that is basically targeting people saying they are compensating people who have fallen victim to the Nigerian scam, explaining the scam and all? A scam about a scam. Very despicable behavior.

From: OFFICE OF THE NIGERIAN PRESIDENCY [office@nig.com]
Subject: YOUR SCAMMED VICTIMS COMPENSATION HAS BEEN APPROVED

Hello, Sir/Madam
REF/PAYMENTS CODE: FGN/PHBPLC/06654/011 ($965,000 USD)
    
This is to bring to your notice that we are delegated from the UNITED NATIONS INTERNATIONAL FRAUD MONITORING UNIT, I wish to notify you that the office of the Nigerian presidency has been authorized to pay out to 50 innocent victims of the widely know internet scam called Advanced Fee Fraud aka (419) the sum of US$965,000(Nine Hundred and sixty Five Thousand Dollars Only each).You have been listed and approved for this payment as one of the scammed victims.
    
On these faithful recommendations, we want you to know that during the last U.N. meeting held at Abuja, Nigeria, as it has come to an alarming proportion based on reports from different victims, some of these victims have almost lost their lives, families, properties, and friends. The most alarming aspect of the issue was on the amount money lost by these various innocent individuals to scams artists operating in syndicates all over the world today, and in other to compensate victims, the UNITED NATIONS Body in conjunction with the newly elected government in Nigerian has agreed to pay 50 victims $965,000 dollars each.
    
    
SCAMMED VICTIM/REF/PAYMENTS
CODE: FGN/PHBPLC/06654/011
1) Your full name and residential address
2) Your direct phone number
3) Your file reference number
4) Your nominated account details where your funds will be transferred into
    
    
Best Regards,
Office Nig
    

Scam Email: Ray Collins

We've seen the content of this spam over and over again, but this one is under a different name so I am posting an alert.

I just received this one-looks very suspicious. The e-mail doesn't  match the name. ralph.gregg2010@inbox.com

Thanks for taking the time to compile the list.

The scam email I received:

Hello,

Good day to you over there, My name is Ray Collins and i hope this  message finds you well.I was going through your works and my eyes  caught your very first work in your portfolio on [url inserted here]. I am interested in purchasing this  work for my new resident. Kindly get back to me with the detailed  price, availability and more information of the piece.

I hope to read back from you as soon as possible.
Kind regards,
Ray.

Scam Email: Frank Mayfield II

I hate when I get emails like the one below. My stomach just sinks. And I know I have to keep working at posting these. All the scammers need are a few success cases to make all their efforts worthwhile and I just need to keep posting all their efforts to make it harder for them to catch artists unaware.

Because the artist below had actual financial loss, he did one thing right - immediately contact the bank. And now he can also use the links I have in the upper right column for reporting the online crime to the FBI and the Internet Crime Report Center. The artwork doesn't come back, by the way. Not sure what scammers do with the art but it doesn't come back. And given the scammer using the Frank Mayfield name had a success this week, we can all be sure we'll be seeing more of this one this week.

I have an earlier blog post on Frank Mayfield, with the contents of the actual scam email. Use the search bar at the top of my blog for Frank Mayfield and you'll find the earlier alert as well. I felt like this report deserved its own post to being up to the top of the list.

Dear Kathleen. I am sending you this email as I have unfortunately fallen for a scam that I later found posted by you. Feeling terrifically naive and stupid, but If there is anything I can do to help you get this guy. I would like to help as much as I can. I really don't know if there's anything I can do, It is the Frank mayfield scam. I contacted police and there is nothing they can do and had no suggestion beyond going to the bank where I cashed the money and alerting them. Which I promptly did. I now am just waiting to hear back from the bank as to whether the travellers checks I cashed were stolen or counterfeit. Is there anywhere I can report this to, or  should report this to.? Actually sent portrait, I imagine it will come back to me. Are you aware of anyone else who fell for this particular scam that I could perhaps contact? My god I feel dumb !

Don't feel dumb. Really ALL scams and cons are set up to make the victims feel ashamed and dumb. Think of all the celebrities and really smart people who fell for the Bernie Madoff scam and then felt ashamed and dumb. It's how these work. It's not about you. With the proper information, you would have known better and acted differently. I'll just keep posting these, and adding them to my facebook page for spreading the word about scams and hopefully these will keep showing up in the Google results and then I have to just get more and more artists to know to google the name first if something doesn't seem right.

So so sorry this happened to you. Report it to links above and stay on your bank and hopefully our report of your experience will help others avoid the same fate. Thanks for sharing your unfortunate experience.