Scam Email: Jason Max

Just got to love these scams coming in on our turkey day. Given, it is not a holiday in anyone's country but the U.S., but it just goes to show how many of these emails originate from outside the U.S.

This comes out of Australia and I didn't even engage him, so he hasn't gotten to the "meat" of his scam yet. But it has enough the tell-tale signs. I'm posting the full headers so you can see the difference between his "From" and "Reply-to" email address and the actual "Return-path" (shown when you view full headers).

I think they are getting hip to us asking them to come up with specifics and now they are asking what our website is when replying, to make sure they are contacting the right *victim*... I mean store... Very funny of them to do this.

Return-path: [crothing@ju001lcs00.syd.the-server.com.au]
Received: from ju001lcs00.syd.hosting-server.com.au (HELO ju001lcs00.syd.the-server.com.au) ([113.20.10.185])
          by ironport1-mta.cbr1.mail-filtering.com.au with ESMTP;
Received: from crothing by ju001lcs00.syd.the-server.com.au with local (Exim 4.69)    (envelope-from [crothing@ju001lcs00.syd.the-server.com.au])
    id 1PLiZh-0008Tw-E1
   
Subject: ORDER ENQUIRY
From: Jason Max [jasonmax147@gmail.com]
Reply-To: jasonmax147@gmail.com
Message-Id: [E1PLiZh-0008Tw-E1@ju001lcs00.syd.the-server.com.au]

Hello,
 How are you doing, i will like to order some of your products, i will be  making payment via my credit card,i will have a shipping agency pick up my  order from you as soon as payment is cleared, i will like you to include  your web page while replying back to confirm i contacted the right store,i  will like you to treat this mail with good concern and reply earnestly so we  may proceed,
 Thank you
 Jason

Scam Email: Tonya Denise Goodloe

This scam email is almost funny in how desperate and aggressive it is. Really desperate. Way too aggressive.

Subject: Re: [name of piece was inserted here]
From: everestskils@gmail.com

Hello here is the tracking# 1ZRV77900198039307 .Be available on delivery and when it delivers,simply take the check to the Bank and have it cashed instantly or deposit it into your Bank account and withdraw the shipping funds immediately.Deduct your payment and also deduct $100 that is to cover the cost of your running around wish I promised and have rest of the funds wired to the shipper asap so the shipper can make the trip over for the pick up.Here is the shipper information to send the money to via Western Union Money Transfer(Money In Minutes) or Money Gram Money Transfer(Money In Minutes)......

Name; Tonya Denise Goodloe
Address; 16539 South Main Street
City; Los Angeles
State; CA
Zip Code: 90018
Email: acbshipping@yahoo.com

You will also email me them the transfer information,used in sending the payment as it serves as receipt for the pick up.Reply in the following way............

1..Sender's name and address used in sending the money
2..Receiver name and address
3..MTCN # or REFERENCE #...Money transfer control number (10 digits #
on western union receipt)
or Money Gram Reference number (8 digits # on money gram receipt)
4..Actual amount sent
5..A scan copy of western union receipt or on money gram
receipt.(optional)

Please pay off the Transfer charges from the remaining fund after you must have deducted your payment for the purchase and the extra $100. Kindly locate a Western Union store close to you from their website http://www.westernunion.com/info/agentLocator.asp?country=global

*** pay off the transfer charges from the excess fund that is going to shipping company.i will awaiting for the information soonest.***

Your Tracking Information
Status: IN-TRANSIT
Last Scan: 11/20/2010 3:13:00 AM LOCATION SCAN LOUISVILLE, KY US
LOUISVILLE, KY US
Carrier: UPS
Service: NEXT DAY AIR
Expected: 11/22/2010
UPS Tracking Number: 1ZRV77900198039307

You can track it at www.iship.com/trackit

Thank you.

Scam Email: Edmund Vale

This scammer was bold enough to try and go for a high amount. At least they lost money on sending the bad check via overnight. That always pleases me. Here is what an artist just wrote to me:

I've just had 20 emails and a phone call from a person 1st named Vale Edmund then Edmund Vale: the same "person" who contacted Victoria Fuller!

His email: edmundvale@yahoo.co.uk And his MO is the same: a new office, a friend likes my work, he wanted the most expensive piece and that I'd get a cheque in overnight mail.... I did with $3,000 extra "to cover shipping."

Turns out the shippers will bill him directly and he asks that I return the $3,000 via Western Union. I Googled his name and found your site and Victoria's post about him!

The Federal Reserve Bank refused to cash his check because it was written on a closed account. Western Union told me that scammers often request money transfers through them because apparently the recipient can't be tracked.

Vale's emails were worded exactly as scammers with other names who are reported on this site: "I look forward to reading from you soon."

Scam Email: Kessler Cole

Well, here is another classic scam email. We've seen many versions of faked names using "Cole": Robert Cole, Rose Cole, Alfred Cole, Katty Cole, Thompson Cole, Cole Johnson, etc. Now we can add Kessler Cole to the list. 

While this scammer is waiting for the potential victim to reply once before revealing the next part of the scam (that they are working or living in a foreign country and have a shipping company who will be moving all their possessions or handling the shipment of the artwork; and that they will send a certified check overnight or pay by credit card [which will turn out to be a stolen number but not reported as stolen yet]), they often ask some initial simple question - usually asking for a volume discount, what the prices are, or can they arrange for them to be framed. Then they get you to reply and continue on with the steps of the scam.


This emails demonstrates other classic signs - the period in odd places like at the end of the subject line and after their name at the end of the email, as well as that classic lack of proper space after commas and/or periods in their sentences.

The artist who forwarded this to me also said she has never received an email from an actual art collector who used all capital letters in the subject line, so that is what got her suspicious. It's a valid additional clue."...how much discounts are you willing to give" also highlights typical poor grammar in scam emails.


If you are dealing with a Kessler Cole, you can stop wasting your time. It's a scam.

From: Kessler Cole [kessler249@yahoo.com]
Subject: ARTWORK PURCHASE.


Hello,
  I came across your artworks on internet search,I am interested in purchasing the following artwork from you (name of 2 pieces of artwork inserted here copied and pasted from the artist's website) from you.

Let me know if the artwork is still available and how much discounts you are willing to give?I will await your advise on how to proceed.Have a wonderful day.
Regards,
Kessler.

Scam Email: Louise Haynes

This scammer just demonstrated no signs of intelligent life on any level. They could not maintain the spelling of their fake name, which went from Louise (in the email signature) or Louis (in the FROM field) to "Loius", which makes no sense. And then you will see in the exchange below that was forwarded to me from an artist, this scammer - who probably sends out hundreds of thousands of these and just has no system for keeping track of what he is doing, signed one of the exchanges as "Robert" and when asked about it made up some lame story that it was his brother (and then proceeded to misspell his own name again as Loius). So ridiculous. Here is the exchange:

FROM: Louis Hayne [loiushaynes@yahoo.co.uk]
SUBJECT: Interest in your work

Dear
        I was going to come over to the United States for christmas holiday and was hoping i could purchase  some of your work in person and as it is i do not think i will be coming to USA  but am highly interested in purchasing some of your piece so am thinking the best thing to do is have you send me some images of the piece you have available or website to which i can see them and i select the one's that interest me and we can work out payment.I hope to read from you soon.
Regards
Louise

---------------------------------------

FROM: Loius Haynes [loiushaynes@yahoo.co.uk]
SUBJECT: Re: Interest in your work

Dear
     Thanks for the swift response  i was going through the website link you send to me and i came across the following work

[the name and sizes of 4 art pieces were inserted here]

I am interested in know more about the piece and the cost of each one of them i await to read from you soon.
Sincerely
Robert

---------------------------------------

FROM: Loius Haynes [loiushaynes@yahoo.co.uk]
SUBJECT: Re: Interest in your work

Dear
     yes am loius my brother Robert replied my previous mail i  am so pleased to be able to communicate with you well in such a little period of time,to be sincere with you i had never taught it was going to be easy getting across to you most of your work that have seen so far are attractive with a well defined statement and an artisitc's touch going through the piece you have sent to me i can afford to purchase the following

[2 pieces were inserted here]

I have learned through a friend that i can purchase a cashier cheque online from a United states bank  and have it linked to my account in the UK because a cheque from the United Kingdom will take month's to clear in your bank account the total i will be sending to you is $5300 to cover the cost of the piece and shipping am sure $1000 will cover the cost of shipping.
I will be needing your contact address and phone number to write and send the cheque to you.Hope to read from you soon.
Regards
Louis

Note My address for shipping
loius Haynes
123 Copeland Road,
Peckham Business Park,
SE15 3SN,
London.
+447023017686

And there was the hook, at the very end of this exchange. Sending a "cashiers check" for $5300 when the art would add up to $4300, saying $1000 should be sufficient for shipping. They send a check that is fraudulent, the artist sends the art worth $4300 and loses both the money and the art. Actually, the typical version of this scam runs with the scammer asking for the overpayment, after shipping costs to be wired to their third party shipper (who doesn't really exist, it's really wired to the scammer) and we really don't know if this particular scammer was still going to get to that part of the scam. I am assuming they were because it is not the art they are after, but the cash.

In any case, this artist realized something was not right, googled the name and found this blog and confirmed the request to purchase his art was not real. So I'm glad to say there was no money lost in this case. Yea!

Scam Email: Ryan Wickham

This scammer was not going to get very far by sending his scam email to "undisclosed". Lazy. And an obvious tip-off to the recipient.

From:    Ryan Wickham [wickhamryan@yahoo.co.uk]
To:    undisclosed-recipients:;
Subject:    Original Painting

Good Evening,

I saw some of your paintings in your website i am interested in purchasing some of your Original paintings for my mum as a gift for the new year I am a Geologist by profession  and i reside in Manchester United Kingdom.

Since it almost the end of the year i would like to know if you still have some paintings available at the moment i will also appreciate it if you can kindly let me know which section of your website i can see more of your new works. 

Regards

Ryan

Scam Email: Dennis Moore

We've seen this before but here is the latest, just to put it on record. He skipped putting his name at the end but there is that signature "period" which is very often there, name or not. I am assuming part of the template they use to send these out in volume.

From: Dennis Moore [mmmoreec@gmail.com]
Subject: Slipstream

Hello,
Good day to you over there, My name is Dennis Moore I'm from Seattle and i hope this message finds you well.I was going through your works and my eyes caught this particular work, i will like to have it for my new apartment this month.please let me know if the piece is available, if yes let me have the detailed price and more information about it. i will be waiting to read from you.

Regards.

Scam Email: Paul Watts

Those who are regular followers of this blog will recognize ALL the tell-tale signs of the below scam forwarded to me by an artist. He said he was fortunate not to listen to wife who was encouraging him to proceed with the sale, saying "what could go wrong?" I'm glad he didn't. Always something in our gut tells us there is something not right. I'm glad he googled for more information before proceeding. I have to say, I still find it odd that the software the scammers use to send these emails out seems to often put a period after their name at the end... and the grammar and sentence structure never really gets cleaned up. It's a numbers game. Why make great looking emails when you can catch victims with crappy formatted emails??

First email from scammer:

From: Paul watts [mailto:paulwattss@live.com]
Subject: Placing an order!!!!

 Hi,
  This mail is to make inquiry on the below question. 1- Do you carry  overseas? (though i already know of a freight forwarder that will pick my
 packages from you,since they ship lesser than any other courier and they  are so effective in shipping my goods to me here in Queensland,Australia
 is estimated to be 3-4days) I have used their services in the past and it  was splendid. 2- Do you accept credit card for payment(my U.S.A Master and
 Visa card to be precise)? Kindly let me know your comments on these,before  i send the items i am interested in purchasing from you.
  Paul.

Second email from scammer:

From: Paul watts [paulwattss@live.com]
Subject: ITEMS NEEDED!!!!

Hello,
Thanks for your prompt response, Please find below for the list of items needed and get back to me with the quote asap.

KITE,
BLACK-SHOULDERED
1/3 size
Decorative
Tupelo Wood
Oils
Padula Base
QTY:1

RED_BREASTED
MERGANSER DRAKE
Smoothie
Tupelo Wood
Acrylics
QTY:1

MALLARD DRAKE
Gunning Decoy
Tupelo Wood
Acrylics
QTY:1

Please get back to me with the total cost estimate for this order so that i can make my payment via my visa or master credit card.Like i stated in my previuos message i am an American but I live and work here in Australia and I want these products here. Do not worry about the shipping, I will make arrangement for the pick up of these items from your place thru my shipping agency.
PLEASE LET ME KNOW THE GRAND TOTAL WEIGHT OF THESE ITEMS FOR SHIPPING REASON.
Paul.

Scam Email: Roberto Bocca

Here is an example scam email just forwarded to me and while it is not art related, I thought it was a great example of how other segments of potential victims are targeted as well. In this particular case, the receiver could very easily recognize it because she was not actually a massage therapist. With us artists, we have a harder time - especially when the scammer takes the time to list the actual titles of some of our work.

But this example still contains the basic flags we've come to see over and over again: "relocation", "certified check", and an offer of a number of massages just enough to get some potential victim all excited about a bunch of business (that is non-existent). Also some of these scam emails actually use a stolen email address and then switch up the reply-to email so they can get the replies themselves (most just grab a disposable email address from yahoo, gmail, live.com or any free email service). This scammer has a particularly long "back story" right up front. We've seen art-related scam emails lately be pretty short up front and then as the potential victim replies, the scammer continue all the same steps of the scam.

From:Roberto bocca [mailto:therapiabocca@suomi24.fi]
Subject: Enquiry for a Massage Therapist

Greetings from Milan,

                       My name is Roberto bocca, I live and work as a massage therapist here in Italy . I am 46 yrs old. I have been doing massage since 1991. I do a deep relaxation massage in which the muscles relax without pain.  I also do energy massage that helps people feel great when I am done. I am also certified to do pregnancy massage. I have lots of happy clients here in italy .

I have been looking for a massage therapist for over a week now till i met an old friend yesterday that referred you to me, her name is Serah. She used to live in America before she relocated here with her family, so i decided to contact you to know if you will be able to give my client some massage sessions when she arrives the US.

My clients name is Ms Alice Raffael, she is a model here in Italy. She will be coming to the U.S in 2 weeks time for a modeling job and will be residing in California temporarily until the neccesary arrangement for her job has been made before she leaves. She will be needing 1hr massage session per day, 2 Sessions per week for 6 weeks when she arrives.

Ms Raffael asked me to come with her to the US but i told her i would not be able to go with her to the US as i have a course i will be going for in a week time, so i promised to help her find a good massage therapist in your Area.

Pls tell me a little more about your self, how long have you been a massage therapist? Would you be able to provide her with the massage sessions from the 14th of next month to the 22nd of December, 2 Sessions per week for 6 weeks?

Pls i need you to get back to me with the amount you charge per session and also let me know if she can pay you with a Certified check drawn from a US bank?

Do send your reply to my personal email address {  roberto.bocca@yahoo.it  } for a quick response as i do not check this email always.

Till I read from you remain blessed.

Roberto bocca
622 Via  Mercato,
1,56129
Milano Italy

Scam Email: Audrey Briggs

Here is the latest email received:

From     Audrey Briggs [audriggs@gmail.com]
Subject     artworks purchase

Good day to you.

I am so excited that I came across of your work on internet search,I 

am interested in purchasing these creative artworks from 
you.....................

Standing Together,Deep into the Forest,Road to the Ridge,Hidden 
Treasure,Below the Fishin' Hole and Beckoning Route

Let me know their various prices.and how much discounts are you going  to give?I will be happy to have these selected artworks hung in our  new home in South Africa.As well,I want you to take out the shipping  cost.I have been in touch with a shipping firm that will be shipping  other house decoratives.

We are traveling from our Seattle home to our new apartment as soon as 
possible.On Paying for the artworks,I will be glad to pay you with a 
Money Order or Cashier's check in US funds that can be easily cashed 
at your local bank,please let me know on how to proceed for the 
payment of the creative artworks.

I will await your advise on how to proceed.Have a wonderful day.

Take care,
Audrey Briggs

Scam Email: James Peter

We've posted about this one before, but I received another one just this morning so I am posting it again. Nothing different about this one except instead of "Australia" it is "Norway". And scammers lately have been using the method of saying upfront they will pay by credit card - trying to convince people that makes their request more legitimate. But it is not more legitimate. The card will turn out to be stolen - even if it clears as good, because scammers use stolen cards and rely upon that short period of time before it is reported as stolen. But it will end up in a chargeback. Also some scammers say they will pay by credit card but then have some reason later in their emails as to why they will then send a check instead, getting their scam back to the more traditional format. In all formats, they pay more than is owed and ask you to send the difference back (usually to some non-existant shipping company) via Western Union (because once it is claimed from Western Union, there is no getting back or tracing who picked it up).

Okay, this one is short and sweet because he's waiting for me to reply (and I won't) to tell his longer story. The originating server IP is 67.220.201.146 [server.girlkw.com] out of Oklahoma but scammers often hack into servers from which to send out their hundreds of thousands of emails. So no telling on this one.

Subject: Order Inquiry
From: James [jamespeter147@gmail.com]
X-AntiAbuse: Sender Address Domain - server.girlkw.com [67.220.201.146]
X-Source-Args: /usr/bin/php /home/girlkwco/public_html/mailer.php

Hello,

I want to place an order in your store,and i will like to know if you ship to Norway and  my method of payment will be credit card. So please let me know if you can assist me with the order ,And please do not forget to include your web page in your replying back to my mail.I will await your prompt response as soon as you receive this mail.

Regards
Purchasing Manager

Woman's House Posted for Rent on Craigslist a Scam

Those who follow this blog will recognize the familiar warning flags (move quickly to Africa, will send FedEx, etc.) in the content of this but I thought it funny the scammers have taken to Craigslist to see if they can find any victims there. But it's the same format we see over and over again here. Be forewarned!

A Craigslist ad said a local Salinas home was for rent and several people were interested. The only problem, the woman who owns the home had no idea. The homeowner said someone posted her house as a rental on Craigslist as a scam to steal money from people. The house was put up for rent on Craigslist, but when people would knock on the door, they would find out it was all just a scam.

Lorena Ruelas fell victim to the scam and says, "Just went to my car and started crying all the way to Marina. How can people do this, because right now I'm going to be homeless Sunday night because I have no where to go because I was expecting to get the house."

Ruelas is devastated she fell for a scam, but grateful she decided to check out the house before sending any money. And the homeowner, she was shocked when unexpected visitors came peering through her windows knocking on her door asking if the house was for rent.

"I'm a little nervous, didn't see the ad on craigslist, but the emails they sent me say the home was supposed to be abandoned and this person is just telling them they can come look in the windows and check out," said Sarah Ransford who owns the home posted on Craigslist.

Even though part of one email says, "the keys and documents will be send to you via fed ex to the address you have sent to me." A second email adds, "I have to move quickly down to Africa to have my company set up."

"I thought he was sincere cause he said he was looking for the right person someone who would take good care of the property," said Ruelas. As for Ransford, she has a warning.

"It came out of no where, I think especially if you just bought a home or you're selling a home be on alert because they're getting their information from the MLS listings."

The posting is gone from Craigslist and the homeowner called police.

Scam Email: Daniel Andrews

This guy took his time getting to the core of his scam.

On Thu, Oct 14, 2010 at 12:52 PM, Daniel Andrews
wrote:
Your Name: Daniel Andrews

Your Email: d.andrews207@gmail.com

Subject: Landscape Painings

Message: Hello, I saw your contact while surfing via the
internet.
I will like to know if you have a Landscape or Seascape painting in
stock of
price range not exceeding $700. Get back to me if there is any available
for
sale. Regards, Daniel Andrews

next email after the artist replied:

On Thu, Oct 14, 2010 at 10:23 PM, Daniel Andrews [d.andrews207@gmail.com] wrote:
Hi,

Thanks for your prompt response to my request. I am interested in the one
called "Tokyo Tower" under the Kimono series. Please let me know if it is
available and the selling price?

Regards,

Daniel

and finally his real intent begins to emerge on the third email:

From: Daniel Andrews [d.andrews207@gmail.com]
Date: Fri, Oct 15, 2010 at 11:34 AM
Subject: Re: Landscape Painings

Hi,

Thanks for your help. I will prefer to have it unframmed. As regards
the payment I will give instruction to my clients there in the united
states to send you a cheque in that amount. And I will be needing the
address, the name to which the cheque will be issued to include your
telephone number. So please get back to me soonest with all this
information. Once i am in receipt of the nessesary infomation we can
set up the transactions.

I will be arranging for a courier pick up at your location as soon as
the check cleared by your bank. That way the painting is secured. So
there is no need for shipping charges.

I await your response soonest.

Regards,

Daniel.

I think it's a thing about the software the scammers use to generate these emails that SO many of them are signed by their faked name with a period. Just a weird little niggly thing. Fortunately, the artist googled the name, found this blog and enough other emails with the same content to know that her email exchange was, in fact, not with a real customer. At least she won't become a statistic.

Scam Email: Rose Duke

This scam email is not art related but completely insidious. Notice that they've faked most of the header information so you think the return address is someone at Target.com. But the actual reply-to address is different, and sources to a server in Russian (ip number: 178.44.243.148).

From: Rose Duke [RoseDuke77231@gmail.com]
Return-path: [emily.reid@target.com]
Reply-To: [q3icky@rodman-tech.com]
Subject: Your Tax Payment ID: 01037733 has been rejected. Urgent Report information.

Your Federal Tax Payment ID: 010375128 has been rejected. Return Reason Code R21 - The identification number used in the Company Identification Field is not valid. Please, check the information and refer to Code R21 to get details about your company payment in transaction contacts section:

http://eftps.gov/R21[Links to http://eftpsID3512.com/contacts/s3]

 In other way forward information to your accountant adviser.

 EFTPS: The Electronic Federal Tax Payment System PLEASE NOTE: Your tax payment is due regardless of EFTPS online availability. In case of an emergency, you can always make your tax payment by calling the EFTPS.

Scam Email: Sofia Daniel

"Bellow is my shipping".

Boy, did this scammer mess up this email. I suppose the automated software that kicks out their emails didn't get set up correct. Just a sloppy, shoddy scammer effort.

The IP number [41.189.39.242] does originate out of the Ivory Coast of South Africa. Notice the reply-to address is different.

From: Sofia Fashions Boutique [shiran_505@yahoo.com]
Reply-To: md721490@gmail.com
Subject: Dear Sales
To: undisclosed recipients:

Dear Sales

  I am Mrs Sofia Daniel the owner of (Sofia Fashions Boutique) I am interested in your products, kindly pls get back to me so that i can be able to make selections if you are interested in selling to me,

My method of payment is Visa Or Master Credit card Payment method,and kindly pls don’t hesitate to reply back if you accept

my method of payment,

Bellow is my shipping

No 65 Rivera Avenue 404 Abidjan
Ivory-Coast, West Africa,
Tel;0022567129751           
Best Regards
Mrs Sofia Danie