Scam Email: Vivian Peston

Sharon forwarded me a scam email she received. She seemed to have some lingering doubt as to whether it was a scam or not, but it definitely is.

Hi,

I have received an inquiry about my artwork and think this one is a spammer. Might not be, but as there were a few red flags, thought I'd pass this correspondence thread along as the name Vivian Peston did not appear on the list of names on your site.

Sharon

-----Original Message-----
From: Vivian Peston [vivianpeston@yahoo.com]
Sent: Mon, Nov 21, 2011 8:23 pm
Subject: Re: Mailing Info?

Hello Sharon,
Good to hear back from you. Yes, I will like to proceed with the purchase of both “Gramercy Park West Snow” ($900) and “Union Square Winter” ($1200). I really like them and I believe they will make a beautiful home. Kindly take them off your website and consider them sold to me.
Though, I am presently away in Geneva, Switzerland for my twin sister's wedding even though it comes at a time when I was preparing for a big move and also expecting a baby but it means so much to her. I should be back in few days.
Meanwhile, I will like you to forward your name, standard mailing address and phone number so I can inform my husband who is still shuttling between our home in New Jersey and London, United Kingdom on where to forward the payment by (Cashier’s Check). He has just been promoted and transfers to head the plant section of their head office in London.
I will also contact the shipping agent that will be shipping our entire house decorative so he can get in touch with you to arrange for the pickup at your address or studio as soon as you receive the payment and clear your bank.
I will look forward to hearing from you so i can know how best to proceed. Cheers.
Best Regards,
Vivian.

-----Original Message-----
From: Vivian Peston [vivianpeston@yahoo.com]
Sent: Mon, Nov 21, 2011 10:55 am
Subject: Re: Purchase Info..

Hello Sharon,
Thanks so much for your response to my query about those creative works. Yes I will like to proceed with the purchase of both “Gramercy Park West Snow” ($900) and “Union Square Winter” ($1200). They are really nice and I must commend you for the job well done.
Can you please get back with what inspire you to make this nice works as to know how best to proceed with the purchase?
I will look forward to hearing from you.
Best Regards,
Vivian

-----Original Message-----
From: Vivian Peston [vivianpeston@gmail.com]
Sent: Sun, Nov 20, 2011 9:44 am
Subject: Purchase Info..

Hello ,
Hope this message finds you well. I saw these realistic creative artworks on your website ([url as inserted here]). They are really nice and I am interested in them.  Kindly get back to me as soon as you can if they are still available for purchase including their prices. They are titled as;
“Gramercy Park West Snow” and
“Union Square Winter”
I will appreciate your prompt reply.
Best Regards,
Vivian.

Scam Email: Brian Needs Help

Here is a scam we see quite a bit that takes a different approach to getting money out of people. This was forwarded to me by another artist.

In this scam, it is typical that someone's web-based email or facebook account has been hacked (either by phishing and someone accidently giving up their password or just by software that goes through millions of combinations and once in awhile hits it lucky and guesses the correctly combo - particularly when people's passwords are easy to guess). So this scam email looks like it is coming from someone you know. I can relate to this. It happened to me on my hotmail account (and I wouldn't have considered my password easy to guess!)

Then they pretend they are in trouble and need money fast - via Western Union... sound familiar?? Really, scammers would really have to go back to the drawing board if Western Union was just willing to create a system where their transactions were verified and traceable. That they are not is why scammers have earned such a great living utilizing Western Union.

Okay, here's the email (and notice that classic weird period after the sign-off name... that is in almost every scam email and I don't know why - must be the software they use to generate these emails).

Subject: TRAGIC NEWS (they put the name of someone you know here) HELP NEEDED

I'm writing this with tears in my eyes my Family and I came down here to Madrid,Spain for a short vacation,unfortunately we were mugged at the park of the hotel where we stayed all cash,credit card and cell were stolen off us but luckily for us we still have our passports with us.

We've been to the embassy and the Police here but they're not helping issues at all and our flight leaves in less than 3hrs from now but we're having problems settling the hotel bills and the hotel manager won't let us leave until we settle the bills.

Am freaked out at the moment.

Brian.

Scam Email: James Karg

Hi Kathleen - My name is beth and i received this strange e-mail today...a friend told me about recent "art scams" going around, and a quick google search lead me to your site. I was about to fall into the "too good to be true...but i still believe it" trap, but thought i might get your take on it. based on what i've read about these scams so far, it seems like this fella's just blowin' smoke. if you have a chance, i'd love to hear what you think.
Thanks!
Beth

---------- Forwarded message ----------
From: James Karg [jkarg001@gmail.com]
Date: Wed, Nov 2, 2011 at 5:57 AM
Subject: dream monster 3

Good day,

My name is James Karg, I'm from  california and i hope this message finds you well.I was going through your works and my eyes caught this particular work, i will like to have it for my new apartment this month.please let me know if the piece is available, if yes let me have the detailed price and more information about it. i will be waiting to read from you.

Regards.

James.

Scam Email: Cynthia Hilson

Here is an email I received this morning from an artist:

Good work Kathleen. Thanks for taking the time to compile the scam list. Just received my first scam this morning from:

Cynthia Hilson [cynthilson@gmail.com]

The original email is below.

Received: from unknown (HELO cloudmark1) (10.49.16.75)
From: "Cynthia Hilson" [cynthilson@gmail.com]
Subject: artworks purchase
Date sent: Sun, 30 Oct 2011 06:06:00 -0400

Good day to you.

I am so excited that I came across of your work on internet search,I am interested in purchasing these creative artworks from you.....................

The Valley,Logging Road,Green Apples,Creole Cabin and Portrait of a Jug

Let me know their various prices.and how much discounts are you going to give?I will be happy to have these selected artworks hung in our new home in South Africa.As well,I want you to take out the shipping cost.I have been in touch with a shipping firm that will be shipping other house decoratives.

We are traveling from our Seattle home to our new apartment as soon as possible.On Paying for the artworks,I will be glad to pay you with a Money Order or Cashier`s check in US funds that can be easily cashed at your local bank,please let me know on how to proceed for the payment of the creative artworks.

I will await your advise on how to proceed.Have a wonderful day.

Take care,
Cynthia Hilson

Scam Email: Lynda James

Scammers choosing James as part of their fake name seems like a really common thing. Clearly they don't use a name randomizer. Ooops. Mustn't give them any additional ideas.

Here is one an artist forwarded to me this morning:

Time Submitted: Mon, 24 Oct 11 04:14:54 +0100
From IP: 41.205.173.195

NAME = Lynda
EMAIL = lynda.jameshop@gmail.com
EMAILCONFIRMATION = lynda.jameshop@gmail.com
TELEPHONE = 4755875436
COMMENT = Good Day,

I'm Lynda James from Norway.I want to place an order and i know the difficulties encountered when shipping internationally,But that will not be a problem because i am registered with a shipping company which i'v used severally times without any delay nor damage.
Before i place the order,i want to inform you that i will be making the payment with my Mc/Visa cards because as for now i can only make payment with my US credit card account information,so if it's okay by you kindly get back to me with the contact details and please reconfirm your website so as to know if i'm right with the site.I awaiting your swift response so as to list out the items needed.

Lynda-J-Supperstore
Strandgaten 34,
N-5817 BERGEN,
Norway.
Telephone: 4755875436
Telefax: 4755875427

Warmest Regards,
Lynda James. 

Scam Email: Ricky Tetteh

Ah yes, this is exactly the kind of language I use when I talk about my art with clients..... NOT!

And what is with the signature?? The fake name has the middle initial AFTER the last name? So lame.

Return-path: [oforidankwa05@gmail.com]
Delivery-date: Wed, 05 Oct 2011 19:07:22 -0500
Received: from mail-gx0-f171.google.com ([209.85.161.171]:60236)
Sender: oforidankwa05@gmail.com
Date: Thu, 6 Oct 2011 00:41:21 +0100
X-Google-Sender-Auth: pXWfyzBrIfvo4RaNYio4MyOMB6I
Message-ID:
Subject: Supply Inquiry
From: Amason Ventures Ltd
To: undisclosed-recipients:;

Dear Sir

There is an on-going tender for the purchase of your products in large quantity, I will like to know if you can handle the supply order of your company's product to the Government of Ghana in West Africa. I am a commission agent.

Please Can you furnish us in full details about the standard of your products.We will appreciate it more if you can give us with detail specification/price lists to avoid making a wrong choice of product.

Please Reply directly to myemail:amasonventuresltd@msn.com

Ricky Tetteh E.
amasonventuresltd@msn.com

Scam Email: Patrick Doe

This came from the same servers I saw on a different scam email I posted Monday, so clearly the same scammer is exploiting the same server to send out their massive mailings. And will likely continue to do so until the owners of those servers realize what is going on and plug the security hole.

Return-path: [dientito@gitserver2net.gitserver2.net]
Delivery-date: Wed, 05 Oct 2011 09:25:28 -0500
Received: from gitserver2net.gitserver2.net ([173.192.23.66]:55184)
Subject: Order Enquiry
From: Patrick Doe [patdoe@blumail.org]
MIME-Version: 1.0
Content-Type: text/html
Message-Id: [E1RBSPX-00059d-Pc@gitserver2net.gitserver2.net]
Date: Wed, 05 Oct 2011 09:25:27 -0500

Hello, This mail is to make inquiry on the below question. 1- Do you carry overseas? (though i already know of a freight forwarder that will pick my packages from you,since they ship lesser than any other courier and they are so effective in shipping my goods to me here in Giza, Cairo, Egypt is estimated to be Next Day Service and 3-4days) I have used their services in the past and it was splendid. 2- Do you accept credit card for payment(U.S.A Master and Visa card to be precise)? Kindly let me know your comments on these, before i send the items I am interested in purchasing from you.

Patrick Doe
Store Owner

Scam Email: John Cool

Got two scam emails in succession last night, one at 12:34 am and the second at 12:57 am. It was probably the same scammer sending out a massive mailing because both had similar characteristics - generic fake first name with no last name, both signed just "purchasing manager", and the email content and format basically identical, and sent so close together in time. So I'll post both of them below.

first one received:

Return-path: [dientito@gitserver2net.gitserver2.net]
Delivery-date: Mon, 03 Oct 2011 02:34:37 -0500
Received: from gitserver2net.gitserver2.net ([173.192.23.66]:58112) Mexico
Subject: Order List
From: john [johncool461@gmail.com]
X-AntiAbuse: Sender Address Domain - gitserver2net.gitserver2.net

Good day,

We browsed through your web page and we are interested in ordering some of your products,we are located in Finland,we will like to know if you have the items in stocks,so kindly get back to me with the right contact person email,phone # and confirmation of website so that we can place my order quickly, and i want to know if you have your own personal shipper or can the order be picked up at your store,please advise so that we can proceed by going ahead to place the order.

Regards
Purchasing Manager

 second one received:

Return-path: [anonymous@megatron.webapptron.com]
Delivery-date: Mon, 03 Oct 2011 02:57:18 -0500
Received: from [209.216.201.191] (port=55203 helo=megatron.webapptron.com)
Received: (qmail 25906 invoked by uid 48); 29 Sep 2011 18:10:06 -0700
Date: 29 Sep 2011 18:10:06 -0700
Message-ID: [20110930011006.25882.qmail@megatron.webapptron.com]
Subject: Email order
From: smith [sec@yahoo.com]
Reply-To: smithpayne91@yahoo.com

Good day,

We browsed through your web page and we are interested in ordering some of your products,we are located in Norway,we will like to know if you have the items in stocks,so kindly get back to me with the right contact person email,phone # and confirmation of website so that we can place my order quickly, and i want to know if you have your own personal shipper or can the order be picked up at your store,please advise so that we can proceed by going ahead to place the order.

Regards

Purchasing Manager

Scam Email: Thomas Morris

This interesting thing to note about the scam below that was forwarded to me is that the scammer got really confused about his faked name. Is he Thomas Morris like in his From field, or Abbot Morris like in his email address, or just "Morris" like how he signed off on his email (who in their right mind would sign their email by just their last name... this scammer is making it easy to spot this as fake).

Here is the email I received this morning:

kathleen-- I and another artist friend received the following email this morning. The only difference was the subject line--each was the  name of a piece we had made...gotten off of our website.

I was suspicious and googled the name and came upon your blog. Thank you for what you are doing to help us all!

Rory

Begin forwarded message:

> From: Thomas Morris [abbotmorris1@gmail.com]
> Date: September 26, 2011 5:21:01 AM CDT
> To: Rory
> Subject: Legacy II
>
> Hello,
>
> Happy new day, I have interest in this your piece of work i came
> across through my searching and i really
> want to make a request if you still have it available for purchase,
> meanwhile email the price you are willing to sale it.
>
> I hope to read more about the piece from you,
>
> Your's Morris.

Scam Email: Bill Richard

Notice the ugly altered "Return-path" on this scammer's email. They were somehow able to route their scam via AOL servers while altering all the headers to reveal any legitimate source of the email.

They've taken to always lately asking the person for their website address in initial emails like this. That way they can send out hundreds of thousands of these and not break a sweat trying to personalize anything. If someone does reply and actually does provide their website address, then the scammer can customize and personalize all other emails from the content they find on the website, making it seem like a legitimate purchase. But who would be purchasing from your "store" without first going to it on the internet. Doesn't make sense. But still people fall for it. Don't you.

I've also noticed lately a trend towards scammers just putting a first name only. Weird. Though in this particular scam email, I can tell their faked last name as well within their email address - which is disposable. The rest of the content of this scam email is the same ole same ole crap.

Return-path: (bjlhjkhjkjkhjhjk@fgfgfgdgdfdfg.com)
 by chakra.lunarbreeze.com with smtp (Exim 4.69)
 (envelope-from )
X-Originating-IP: 172.191.3.109 (AOL-172BLK)
X-Sender: bjlhjkhjkjkhjhjk@fgfgfgdgdfdfg.com
From: Bill (billrichard2010@ymail.com)
Subject: Order Inquiry

Hello Sales Dept,

I want to place an order in your store,and I will like to know if you ship to Portugal and my payment will be remitted via Visa/Master Card issued in US bank. So please let me know if you can assist me with the order,and please do not forget to include your website in your reply.Your quick response will be highly appreciated,I will be very glad if you treat this email with good concern.

Regards,
Bill Richard

Scam Email: John Cool

I got two of these, the second one coming only 9 minutes after getting the first one, both identical. This scammer decided not to even bother with a fake name.

Return-path: [geaveens@charon.e-dentify.nl]
Delivery-date: Wed, 07 Sep 2011 09:43:16 -0500
Received: from [94.100.20.18] (port=55062 helo=charon.e-dentify.nl)   
    (envelope-from )
    id 1R1JLQ-0004W7-AV
Received: from geaveens by charon.e-dentify.nl with local (Exim 4.69)
    (envelope-from )
    id 1R1JL8-0001lD-8q
Subject: Order Inquiry
From: john [johncool461@gmail.com]
Reply-To:
 johncool461@gmail.com
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 8bit
Message-Id: [E1R1JL8-0001lD-8q@charon.e-dentify.nl]
Date: Wed, 07 Sep 2011 16:42:58 +0200
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Originator/Caller UID/GID - [700 696] / [47 12]
X-AntiAbuse: Sender Address Domain - charon.e-dentify.nl

Good day,

We browsed through your web page and we are interested in ordering some of your products,we are located in Finland,we will like to know if you have the items in stocks,so kindly get back to me with the right contact person email,phone # and confirmation of website so that we can place my order quickly, and i want to know if you have your own personal shipper or can the order be picked up at your store,please advise so that we can proceed by going ahead to place the order.

Regards
Purchasing Manager

Scam Email: Campbell Kelly or John Campbell

This scammer just couldn't decide who his fake identity was. Started out as Mr. Campbell Kelly but then quickly dissolved into John Campbell. He also forgot to change the FROM email address to match what was in the body of the email but I never said scammers were the brightest batch in the room...

Return-path: [senior@host.supremevaluesserver.com]
From: Campbell Kelly [johniemark891@gmail.com]
Subject: Email Order

Dear Sales,

How are you today, my name is Mr CAMPBELL KELLY the

owner of China Gold Pandora Store.
I will like to order for some items in your store,but

before i proceed i will like to know if you can supply

and ship to CHINE and if you accept CREDIT CARDS as

payment.
Kindly advise me ASAP, so i can proceed with the list

of needed items.

Store Name:China Gold Pandora Store

No.2 Metro Road,Yinzhou District, Ningbo City, Zhejiang

Province

POSTAL Code:570923

Country:China

Phone:+86 09 7726  6540

E-MAIL:campbellkelly64@gmail.com

Thanks

JOHN CAMPBELL

Scam Email: Linda Scott

This scam is not art related but an artist forwarded it to me. Egads! This scammer went on and on and one, hoping their story would somehow convinced their intended victim they were for "real". And they didn't even get to the heart of the scam, which is their deposit check would be for more than was required and they would likely then ask the difference be sent to their shipping company, via Western Union. And therein lies the scam. The check will be fraudulent but your money is good, and once picked up by the scammers from Western Union, is completely untraceable.

I'm posting this because it may get the award for the longest lamest "backstory" offered up by a scammer.

Hello,

Thanks very much for e-mailing me back ,i really appreciate it, am also sorry for getting back to you late.. I am Linda Scott by name and live in Seattle, WA. I would have been kind of happy if we can meet before making any plans, but am very busy and i have a lot of things to do right now.. I will really appreciate it if you can tell me more about the place and tell me little about you because my uncle is presently very sick, and i have to travel to Finland to see him but i want to secure the place down before going. He was involved in a car crash with his new car some weeks back and now ill seriously, I need to check on him and take good care of him.

I am staying in CHRMC Children's Hospital Seattle staff Quarters now

The address is below:

4800 Sandpoint Way NE Seattle, WA 98105

I am moving cause of my job, am a medical Humanitarian nurse for united Nations. I work for CHRMC Children's Hospital in Seattle but will be working in a local clinic over there, More about me, am a neat type of person, honest, humble and responsible. I like honest, responsible and hardworking people while i hate the lazy, messy and uncaring people....well am a quiet and gentle going person to live with....I am 27 yrs old female, 5.4 in height ,i like tourism and i don't keep late at nights neither i will have overnight guest around but am ok if you do..

I was born and brought up in Finland, i studied there i had my university education right there while staying with my uncle.. I lived all my life in Finland before coming down to Seattle, WA have been living with my uncle from age 13 ...Then i was member of the Red Cross Association it really sounds interesting for me...

Am sure You 'll really like the person that i am ,because i will also do the dishing if you like I work when i am to and relax when i am to, I also like sharing my thoughts also....paying rent on time will not be a problem as i will also be making the rent fee before the month ends....

I do not have any pet, i really like dog and cat but have none of it now, so there is no problem about that.

I must confess am comfortable with the price and I will want to secure the place down before my arrival so i will want you to tell me all about the place as i can't see it before my arrival but the pictures...I also will want you to know that i have my car that i will be coming over with little of my furniture.

please let me know if there will be room for them. With all that I've said above I have told you more about me and more picture of mine will be attach in the next email Let me also know how i can go about securing the place down before my arrival as i will also be busy from next week and let me know if you can take off the ad off the site as i am going to secure the place with a deposit

Feel free to ask me any question and as I've said i am looking to move in by the availability of the place but want to secured it now

Thanks..

Scam Email: Ballet Ryan

Here is a note I received from another artist:

Friday, I had an email that I was suspect of the content. Today I am sure! Someone is trying to scam me. This is my second scammer email in the past year and a half that I have had. Luckily, I have been on my toes.

First Email:

From: ballet ryan (balleyryan@gmail.com)
Subject: Enquiry

Hello [my name],

My name is Ballet Ryan and am from South Carolina and Was going through your works and love this piece.
What's your final price for it and am really interested in purchasing the piece.

Thanks and i await your response.

Ryan.

Second Email:

From: ballet ryan (balleyryan@gmail.com)
Subject: Re: Enquiry

Hello [my name],
Thanks for your prompt reply.I really appreciate your detailed breakdown and frankness on this.
Unfortunately, Im on my way to Mexico on an official trip(I'm a marketing Executive) and wont be back for another two weeks, I
would have come to inspect the piece personally. Im taking your word for true on It though .
Im okay with the price, I think it worth it anyway. If you'd like to know, Im relocating to the UK soon and I'm trying to gather some
good stuff for my new abode. Im buying yours amongst others,quickly! before someone else grabs it.So, I'll arrange to send you payment ASAP as i will be responsible for the shipping (payment) of the piece to my new abode in UK.
However, I'll have to notify my shipper who's helping me move my stuff from the US,to get set for the pickup of the piece from your
place as I MIGHT be delayed in Mexico depending on how things goes.
Thanks,
PS: In the mean time, kindly get back to me with your contact address and also your phone# so I can get certified check prepared
and have it sent out to you ASAP.

Scam Email: Jasmine Anthony

The thing I found odd about this scam email is how the scammer seems to have used a "reply" to paste in to their main email (notice all the carets at the beginning of the lines). They also put their intended victim's email in the BCC field (I saw this when I looked at the full headers). I guess they were trying to cut some corners but it seems odd. The content is all the usual stuff we see over and over again.

From: Jasmine Anthony (jasminefashionboutique@googlemail.com)
To: jasminefashionboutique@googlemail.com
Subject: Enquiry

>
> Dear Sales,
>
> I got your contact through an international fashion network.
>
> My name is Mrs Jasmine Anthony, a store owner in Ivory Coast, Africa.
> I'm really interested in your product and would like to be one of your
> international customers.
> My business is five years old and steadily growing. We purchase all
> kind of women clothing,jeans, t-shirts , jewelries & accessories etc
> and resell them to our local customers and it has been very profitable
> for me.
>
> If you are considering selling to me, then send me some of your scan
> collections with the wholesale prices.
>
> Ordering should be easy as I could just note down the style
> numbers and e-mail you my order list. I do hope you'll accept my Visa
> or Master credit cards  as my only payment option and also hope you can
> ship Internationally
> to Ivory Coast.
>
> I look forward to hearing from you soon.
>
> Thank you,
>
> Mrs Jasmine Anthony - Owner
> Jasmine Fshion Boutique
> Rue 47 Immeuble Diallo-Avenue Houdaille
> Abidjan-Ivory Coast.
> My Company Reg N°: R.C N° 2856516-CC.N°020567896