Search This Blog

Sunday, December 19, 2010

Scam Email: Cynthia Brent

I will never understand the mentality of scammers. The below email was just forwarded to me. They placed a fake order and sent 3 different credit cards numbers to use. Did they not think that was going to raise some warning flags??? Also, how lame to not even spell your own faked name correctly below. Again, just another thing to make someone stop in their tracks and say, "whaaa?". "Bellow is my shipping" also doesn't help their case. I guess it is to our great fortune that these guys have so few brain cells.
Subject: I am interested in your products
From: Cinthia Brentboutique []

Dear Sales,

I am Mrs Cynthia Brent the owner of Cynthia Sexy Boutique, and I am interested in your products, kindly pls get back to me if you are interested in selling to me in other for me to make the selection of the products that am interested to buy from your company,

and my method of payment is Visa Or Master Credit card Payment method, and kindly pls don’t hesitate to reply back if you accept my method of payment, and you are also free to call my number bellow to discourse better, Tel;0022504269172,

Bellow is my shipping

327 Platue Rue 146 Abidjan
Ivory-Coast, West Africa,

Best Regards

Mrs Cynthia Brent

Friday, December 17, 2010

Scam Email: Kenny Moore

Daniel and Dennis Moore has morphed into "Ken Moore" (or Kenny Moore) but its the exact duplicate pitch. Even the scammers are adding a holiday greeting!!!

The funny thing about this scammer (I love when they actually send ME one!), is my art labels on my website are two lines - the name and then on the second line, the size and medium and surface. Guess he wasn't even clued in enough to recognize the name of a piece versus the information about the piece.

He says he is Kenny Moore by name. Right. And scammer by night...
FROM: Ken Moore []
SUBJECT: 12h x 12"w, beeswax on wood


I am Kenny Moore by name, i go through your Gallery and i have interest in your work, i will like to know more info about it and the price you want to have it go for.

I will be happy to receive your email with the price info, because i really like it a alot and i want to have it.

I wish you Happy Xmas in Advance.

After all the scam emails I've seen now, I'm just thinking they want to sound that stupid on purpose. Pushing the envelope, so to speak. See if they can get victims even if they sound this stupid.

Saturday, December 11, 2010

Scam Email: Jene Thobela

This name is referenced under other posts - it is likely the same scammer using various fake names at the email service called But lots of people have been getting scam emails under this name so I thought I would bring it to it's own post.

Here's an email I just received:

"Thanks Kathleen for posting the art scam information. After I got this email last month, I bit to get more information and see if they were for real. Then I did an internet search for them and found some similar emails but different names used, and all were scams. Thanks for keeping the artist world a bit safer. My best to you, Brian"

From: Jene Thobela []


Hope this message finds you well.

I saw these creatives works on your web site and i will like you to
get back with more details if they are  still available for purchase.

[names of art pieces inserted here]

I will appreciate an urgent reply.

Best Regards,

This is the example we see all the time of the very brief first email to get you to reply and then they launch into the next phase of the scam (which will be something about they are either located or moving to another country and using a third party shipper) and sometimes they will wait until a third email exchange to get to the core of the scam - they will send you a check overnight and it will have a "little" (ha, ha - not so little) extra money in it and they request you deposit the check and send the "difference" to their shipper.

There is no shipper. It's just them. And their original check (or credit card) is bad.

The scammers keep changing the names and email addresses they use, but really - the content of their emails do not change all that much...

Monday, November 29, 2010

Scam Email: Dennis Moore II

This is a long post but I thought was very enlightening to watch the flow of communication from a scammer trying to work their scam on a potential victim. Fortunately, in this case, all the artist lost was the $10 check bounced fee but the back and forth here is enlightening. Check it out.

from Dennis Moore []
date Wed, Nov 10, 2010 at 1:25 AM
subject: artwork

Good day to you over there, My name is Dennis Moore I'm from Hawaii and i hope this
message finds you well.I was going through your works and my eyes caught this
particular work(he inserted the url to an image from the website), i will
like to have it for my new apartment this month.please let me know if the piece is
available, if yes let me have the detailed price and more information about it. i will be
waiting to read from you.Regards.
Next correspondance after the artist replied and gave detailed information about the piece mentioned:
from Dennis Moore []
date Thu, Nov 11, 2010 at 1:21 AM
subject: Awaiting your message

Thanks for the message,I am very happy to know that the Artwork is
still available for sale. i must tell you i am very much interested in
the immediate purchase and i am willing to pay the asking price .
I will like to let you know that your payment will be in a Certified
Cashiers Check and i will wait till it clears your bank before
telling my shipper to come for the pick up, this will not take time at
all because the payment will be sent out immediately i read back from
you.You don't have to worry about shipment, my shipper will handle it.
This is because i am currently out of the country on a business
proposal. So get back to me with the information needed to send you
the payment
Full Name
Standard Mailing Address
Phone numbers
asking price reconfirmation so that i can proceed with the payment
arrangement, consider it sold get back to me with the details.will
await your message.
The artist replied with the information asked. Here is the next email from our scammer. He was ready to put the hook in for what he's really after - the difference in cash. There is no shipper. It is just them at the other end of Western Union:
from Dennis Moore []
date Fri, Nov 12, 2010 at 1:11 AM
subject Pick up arrangement

Thanks for the details which Ive noted down and have also forwarded it
to my shipper.He's due in the US sometime next week and will
definitely be getting in touch with you for the pickup.The truth is, I
would have handled this much differently if i would be at home but Im
a bit pressed for time myself. Im moving to the UK this month as im
being transferred.As it is, I'm sending you an overdraft which will
include my shippers fees as well.He has asked for an upfront before
coming and since I have no access to a lot of cash, Im trying to kill
two birds with a stone.So, once you've received and cashed the check,
deduct your funds and PLEASE help me send the remaining funds to him
(shipper).I'll forward his contact details to you once you've received
the payment.Now I'm concluding you are a responsible person and I can
therefore entrust you with this arrangement.Ill let you know
Immediately the check is sent out to you so you should be looking out
for it.P.S:I`ll require that a reconfirmation of your address is done
for menow. I await your reply.
The artist actually agrees to forward the money to the shipper and asks how they found out about their artwork:
from Dennis Moore []
date Sat, Nov 13, 2010 at 4:32 PM
subject Re: Pick up arrangement

I got to know your work through a friend meanwhile i will have your payment mailed by
monday and i will give you an update as soon as it get mailed and do notify me as soon as you
receive it.
He figures he has got a victim on the hook and now he is going to reel him in (he almost can't contain himself with the exclamation point...):
from Dennis Moore []
date Wed, Nov 17, 2010 at 1:53 AM

Hello there,
How have you being? hope everything has been going on fine with you.Well, I just want to let
you know the check has been prepared and has been mailed out to you already.I was told at the
post OFFICE that it will be delivered to you by wednesday or friday.
Once you receive the check, deduct your own money and kindly help me send the remaining
balance in cash! to my mover who will be coming over to your place for pick up.He actually,
prefer to receive his money via Western Union Money Transfer,you can walk into any of their
locations around you and send the money to him. Once you have the cash sent to him, kindly get
back to me with all the information which will be needed for the collection
of the money i.e;
Sender's name
Amount sent
and MTCN#
Then will get the info across to him asap. Once he receive the money from you, he will give you
a call and also set up a time and date with you when he would be coming over to your place for
pick up.
Below is the information in sending the money via Western Union;
Henry Thobela
address...Cannon House, 2255 Coventry Road
country..united kingdom
Zip code....B26 3NX
Thanks for your help and understanding and am really sorry for the delay in this transaction so
here is our scammer, hard at work following up on his active potential victims:
from Dennis Moore []
date Sat, Nov 20, 2010 at 4:09 AM
subject Delivered ??

Hello there,
Just checking if you have receive the payment, you can also check your mailing box for the
Will await your message.
Then the artist receives the check and says they will deposit it tomorrow and the scammer writes back and repeats the core part of his scam:
from Dennis Moore []
date Mon, Nov 22, 2010 at 6:20 AM

Thanks for the message and i really appreciate your honesty, the payment can be cashed instant
and you can leave the artwork at Asheville, Nc my mover will go and pick it up from there all i
will need is the standard address where the artwork is locate.
This is how to go about the payment ,you will deduct payment for the Piece and the remaining
funds goes to my mover who will be coming to your place for the pick up i think i have
explained to you so far and the excess on the fund should be sent to my mover via WESTERN
UNION MONEY TRANSFER, all the western union charges should be done on the shippers will have to take cash to the western union office to make the transfer.
He actually, prefer to receive his money via Western Union Money Transfer,you can walk into
any of their locations around you and send the money to him. Once you have the cash sent to
him, kindly get back to me with all the information which will be needed for the collection of the
money i.e;
Sender's name
Amount sent
MTCN(10 digit #)
Then will get the info across to my mover asap and once he receive the money he will give you a
call and also set up a time and date with you when he would be coming over to your place for
pick up.
Below is the information in sending the money via Western Union;
Henry Thobela
address...Cannon House, 2255 Coventry Road
country..united kingdom
Zip code....B26 3NX
Will await for your message.
The artist says the bank has a 6 or 7 day hold on the check and he can't send the art before then:
from Dennis Moore []
date Tue, Nov 23, 2010 at 4:18 PM
subject Re: Delivered ??

Im still waiting to read from you.
Now our little scammer is getting impatient, so he repeats himself - again:
from Dennis Moore []
date Wed, Nov 24, 2010 at 2:58 AM

He actually, prefer to receive his money via Western Union Money Transfer,you can walk into
any of their locations around you and send the money to him. Once you have the cash sent to
him, kindly get back to me with all the information which will be needed for the collection of the
money i.e;
Sender's name
Amount sent
MTCN(10 digit #)
Then will get the info across to my mover asap and once he receive the money he will give you a
call and also set up a time and date with you when he would be coming over to your place for
pick up.
Below is the information in sending the money via Western Union;
Henry Thobela
address...Cannon House, 2255 Coventry Road
country..united kingdom
Zip code....B26 3NX
Have a great day!!
Now our artist tells him the check bounced and what can they do to rectify this. So our scammer makes a final act to just try and get all the money directly by claiming the money was "released" and now the artist has to send it ALL back, of course via Western Union:
from Dennis Moore []
date Thu, Nov 25, 2010 at 3:20 PM

So sorry about that i had to call the issuing bank to act fast cause i was notify that the payment
was release to you and you don't notify me on time that why..
To all the funds back you will have to send $2000 to me directly cause they thought something
Get the money sent to me today so that your account can be balanced.
Here is my information
Dennis Moore
77 pedley rd,
country..united kingdom
Zip code....RM81XQ
As soon as you get the money sent get back to me with the information below.
Senders name a
Will await your message.
The scammer doesn't hear anything from the artist so he writes again:
from Dennis Moore []
date Thu, Nov 25, 2010 at 3:22 PM
subject Awaiting your message

Your account will be fixed up with the money that clears with it,as soon as i get the information
Sorry for the inconveniences.
So the artist offers to accept a credit card payment:
from Dennis Moore []
date Thu, Nov 25, 2010 at 11:31 PM

Im sorry thats the only solution for now and do send the money and let me know when has sent.
The artist finally says he isn't going to do anything and there is no deal and our little scammer moves on to greener pastures and never writes back.

Scam Email: Alexander Trowell

Interesting the way this scammer positioned himself as "in behalf of" but then email was signed by the other "person" anyway. Scammers have very confused minds. But this has all the usual telltale signs of a scam.
From: [] on behalf of Alexander Trowell []
Subject: Sculpture inquiry


I came across your sculpture through your website and i fell in love with your sculptural approach and creativeness i do not reside in the United states which as been a major concern to me on our to purchase your sculpture because i would like to own one or two piece to be placed in my new home in United Kingdom, as a means of beautification and modification of the building. would appreciate it if you can kindly enlight me on how to make this work out. I await your response



Friday, November 26, 2010

Scam Email: Sharon Collins

We've reported on a Ray Collins in the past with the same scam pitch so I'm guessing this is the same person now launching a new slew of scam emails under this name.

Here is an email I just received from an artist:

Hi Kathleen, thanks for putting this resource up!  I’ve had people buy two painting but never 5!  The whole thing didn’t seem right and a quick Google brought up your site…this time the name was

Sharon Collins,

Moving to South Africa, third party shipper etc….

Thanks again,


Thursday, November 25, 2010

Scam Email: Jason Max

Just got to love these scams coming in on our turkey day. Given, it is not a holiday in anyone's country but the U.S., but it just goes to show how many of these emails originate from outside the U.S.

This comes out of Australia and I didn't even engage him, so he hasn't gotten to the "meat" of his scam yet. But it has enough the tell-tale signs. I'm posting the full headers so you can see the difference between his "From" and "Reply-to" email address and the actual "Return-path" (shown when you view full headers).

I think they are getting hip to us asking them to come up with specifics and now they are asking what our website is when replying, to make sure they are contacting the right *victim*... I mean store... Very funny of them to do this.

Return-path: []
Received: from (HELO ([])
          by with ESMTP;
Received: from crothing by with local (Exim 4.69)    (envelope-from [])
    id 1PLiZh-0008Tw-E1
From: Jason Max []
Message-Id: []
 How are you doing, i will like to order some of your products, i will be  making payment via my credit card,i will have a shipping agency pick up my  order from you as soon as payment is cleared, i will like you to include  your web page while replying back to confirm i contacted the right store,i  will like you to treat this mail with good concern and reply earnestly so we  may proceed,
 Thank you

Sunday, November 21, 2010

Scam Email: Tonya Denise Goodloe

This scam email is almost funny in how desperate and aggressive it is. Really desperate. Way too aggressive.

Subject: Re: [name of piece was inserted here]

Hello here is the tracking# 1ZRV77900198039307 .Be available on delivery and when it delivers,simply take the check to the Bank and have it cashed instantly or deposit it into your Bank account and withdraw the shipping funds immediately.Deduct your payment and also deduct $100 that is to cover the cost of your running around wish I promised and have rest of the funds wired to the shipper asap so the shipper can make the trip over for the pick up.Here is the shipper information to send the money to via Western Union Money Transfer(Money In Minutes) or Money Gram Money Transfer(Money In Minutes)......

Name; Tonya Denise Goodloe
Address; 16539 South Main Street
City; Los Angeles
State; CA
Zip Code: 90018

You will also email me them the transfer information,used in sending the payment as it serves as receipt for the pick up.Reply in the following way............

1..Sender's name and address used in sending the money
2..Receiver name and address
3..MTCN # or REFERENCE #...Money transfer control number (10 digits #
on western union receipt)
or Money Gram Reference number (8 digits # on money gram receipt)
4..Actual amount sent
5..A scan copy of western union receipt or on money gram

Please pay off the Transfer charges from the remaining fund after you must have deducted your payment for the purchase and the extra $100. Kindly locate a Western Union store close to you from their website

*** pay off the transfer charges from the excess fund that is going to shipping company.i will awaiting for the information soonest.***

Your Tracking Information
Last Scan: 11/20/2010 3:13:00 AM LOCATION SCAN LOUISVILLE, KY US
Carrier: UPS
Expected: 11/22/2010
UPS Tracking Number: 1ZRV77900198039307

You can track it at

Thank you.

Saturday, November 20, 2010

Scam Email: Edmund Vale

This scammer was bold enough to try and go for a high amount. At least they lost money on sending the bad check via overnight. That always pleases me. Here is what an artist just wrote to me:

I've just had 20 emails and a phone call from a person 1st named Vale Edmund then Edmund Vale: the same "person" who contacted Victoria Fuller!
His email: And his MO is the same: a new office, a friend likes my work, he wanted the most expensive piece and that I'd get a cheque in overnight mail.... I did with $3,000 extra "to cover shipping."

Turns out the shippers will bill him directly and he asks that I return the $3,000 via Western Union. I Googled his name and found your site and Victoria's post about him!

The Federal Reserve Bank refused to cash his check because it was written on a closed account. Western Union told me that scammers often request money transfers through them because apparently the recipient can't be tracked.

Vale's emails were worded exactly as scammers with other names who are reported on this site: "I look forward to reading from you soon."

Scam Email: Kessler Cole

Well, here is another classic scam email. We've seen many versions of faked names using "Cole": Robert Cole, Rose Cole, Alfred Cole, Katty Cole, Thompson Cole, Cole Johnson, etc. Now we can add Kessler Cole to the list. 

While this scammer is waiting for the potential victim to reply once before revealing the next part of the scam (that they are working or living in a foreign country and have a shipping company who will be moving all their possessions or handling the shipment of the artwork; and that they will send a certified check overnight or pay by credit card [which will turn out to be a stolen number but not reported as stolen yet]), they often ask some initial simple question - usually asking for a volume discount, what the prices are, or can they arrange for them to be framed. Then they get you to reply and continue on with the steps of the scam.

This emails demonstrates other classic signs - the period in odd places like at the end of the subject line and after their name at the end of the email, as well as that classic lack of proper space after commas and/or periods in their sentences.

The artist who forwarded this to me also said she has never received an email from an actual art collector who used all capital letters in the subject line, so that is what got her suspicious. It's a valid additional clue." much discounts are you willing to give" also highlights typical poor grammar in scam emails.

If you are dealing with a Kessler Cole, you can stop wasting your time. It's a scam.
From: Kessler Cole []

  I came across your artworks on internet search,I am interested in purchasing the following artwork from you (name of 2 pieces of artwork inserted here copied and pasted from the artist's website) from you.

Let me know if the artwork is still available and how much discounts you are willing to give?I will await your advise on how to proceed.Have a wonderful day.

Friday, November 19, 2010

Scam Email: Louise Haynes

This scammer just demonstrated no signs of intelligent life on any level. They could not maintain the spelling of their fake name, which went from Louise (in the email signature) or Louis (in the FROM field) to "Loius", which makes no sense. And then you will see in the exchange below that was forwarded to me from an artist, this scammer - who probably sends out hundreds of thousands of these and just has no system for keeping track of what he is doing, signed one of the exchanges as "Robert" and when asked about it made up some lame story that it was his brother (and then proceeded to misspell his own name again as Loius). So ridiculous. Here is the exchange:
FROM: Louis Hayne []
SUBJECT: Interest in your work

        I was going to come over to the United States for christmas holiday and was hoping i could purchase  some of your work in person and as it is i do not think i will be coming to USA  but am highly interested in purchasing some of your piece so am thinking the best thing to do is have you send me some images of the piece you have available or website to which i can see them and i select the one's that interest me and we can work out payment.I hope to read from you soon.


FROM: Loius Haynes []
SUBJECT: Re: Interest in your work

     Thanks for the swift response  i was going through the website link you send to me and i came across the following work

[the name and sizes of 4 art pieces were inserted here]

I am interested in know more about the piece and the cost of each one of them i await to read from you soon.


FROM: Loius Haynes []
SUBJECT: Re: Interest in your work

     yes am loius my brother Robert replied my previous mail i  am so pleased to be able to communicate with you well in such a little period of time,to be sincere with you i had never taught it was going to be easy getting across to you most of your work that have seen so far are attractive with a well defined statement and an artisitc's touch going through the piece you have sent to me i can afford to purchase the following

[2 pieces were inserted here]

I have learned through a friend that i can purchase a cashier cheque online from a United states bank  and have it linked to my account in the UK because a cheque from the United Kingdom will take month's to clear in your bank account the total i will be sending to you is $5300 to cover the cost of the piece and shipping am sure $1000 will cover the cost of shipping.
I will be needing your contact address and phone number to write and send the cheque to you.Hope to read from you soon.

Note My address for shipping
loius Haynes
123 Copeland Road,
Peckham Business Park,
SE15 3SN,
And there was the hook, at the very end of this exchange. Sending a "cashiers check" for $5300 when the art would add up to $4300, saying $1000 should be sufficient for shipping. They send a check that is fraudulent, the artist sends the art worth $4300 and loses both the money and the art. Actually, the typical version of this scam runs with the scammer asking for the overpayment, after shipping costs to be wired to their third party shipper (who doesn't really exist, it's really wired to the scammer) and we really don't know if this particular scammer was still going to get to that part of the scam. I am assuming they were because it is not the art they are after, but the cash.

In any case, this artist realized something was not right, googled the name and found this blog and confirmed the request to purchase his art was not real. So I'm glad to say there was no money lost in this case. Yea!

Friday, November 12, 2010

Scam Email: Ryan Wickham

This scammer was not going to get very far by sending his scam email to "undisclosed". Lazy. And an obvious tip-off to the recipient.

From:    Ryan Wickham []
To:    undisclosed-recipients:;
Subject:    Original Painting

Good Evening,
I saw some of your paintings in your website i am interested in purchasing some of your Original paintings for my mum as a gift for the new year I am a Geologist by profession  and i reside in Manchester United Kingdom.
Since it almost the end of the year i would like to know if you still have some paintings available at the moment i will also appreciate it if you can kindly let me know which section of your website i can see more of your new works. 

Sunday, November 7, 2010

Scam Email: Dennis Moore

We've seen this before but here is the latest, just to put it on record. He skipped putting his name at the end but there is that signature "period" which is very often there, name or not. I am assuming part of the template they use to send these out in volume.
From: Dennis Moore []
Subject: Slipstream

Good day to you over there, My name is Dennis Moore I'm from Seattle and i hope this message finds you well.I was going through your works and my eyes caught this particular work, i will like to have it for my new apartment this month.please let me know if the piece is available, if yes let me have the detailed price and more information about it. i will be waiting to read from you.


Tuesday, November 2, 2010

Scam Email: Paul Watts

Those who are regular followers of this blog will recognize ALL the tell-tale signs of the below scam forwarded to me by an artist. He said he was fortunate not to listen to wife who was encouraging him to proceed with the sale, saying "what could go wrong?" I'm glad he didn't. Always something in our gut tells us there is something not right. I'm glad he googled for more information before proceeding. I have to say, I still find it odd that the software the scammers use to send these emails out seems to often put a period after their name at the end... and the grammar and sentence structure never really gets cleaned up. It's a numbers game. Why make great looking emails when you can catch victims with crappy formatted emails??

First email from scammer:

From: Paul watts []
Subject: Placing an order!!!!

  This mail is to make inquiry on the below question. 1- Do you carry  overseas? (though i already know of a freight forwarder that will pick my
 packages from you,since they ship lesser than any other courier and they  are so effective in shipping my goods to me here in Queensland,Australia
 is estimated to be 3-4days) I have used their services in the past and it  was splendid. 2- Do you accept credit card for payment(my U.S.A Master and
 Visa card to be precise)? Kindly let me know your comments on these,before  i send the items i am interested in purchasing from you.
Second email from scammer:
From: Paul watts []
Subject: ITEMS NEEDED!!!!

Thanks for your prompt response, Please find below for the list of items needed and get back to me with the quote asap.

1/3 size
Tupelo Wood
Padula Base

Tupelo Wood

Gunning Decoy
Tupelo Wood

Please get back to me with the total cost estimate for this order so that i can make my payment via my visa or master credit card.Like i stated in my previuos message i am an American but I live and work here in Australia and I want these products here. Do not worry about the shipping, I will make arrangement for the pick up of these items from your place thru my shipping agency.

Saturday, October 30, 2010

Scam Email: Roberto Bocca

Here is an example scam email just forwarded to me and while it is not art related, I thought it was a great example of how other segments of potential victims are targeted as well. In this particular case, the receiver could very easily recognize it because she was not actually a massage therapist. With us artists, we have a harder time - especially when the scammer takes the time to list the actual titles of some of our work.

But this example still contains the basic flags we've come to see over and over again: "relocation", "certified check", and an offer of a number of massages just enough to get some potential victim all excited about a bunch of business (that is non-existent). Also some of these scam emails actually use a stolen email address and then switch up the reply-to email so they can get the replies themselves (most just grab a disposable email address from yahoo, gmail, or any free email service). This scammer has a particularly long "back story" right up front. We've seen art-related scam emails lately be pretty short up front and then as the potential victim replies, the scammer continue all the same steps of the scam.

From:Roberto bocca []
Subject: Enquiry for a Massage Therapist

Greetings from Milan,

                       My name is Roberto bocca, I live and work as a massage therapist here in Italy . I am 46 yrs old. I have been doing massage since 1991. I do a deep relaxation massage in which the muscles relax without pain.  I also do energy massage that helps people feel great when I am done. I am also certified to do pregnancy massage. I have lots of happy clients here in italy .

I have been looking for a massage therapist for over a week now till i met an old friend yesterday that referred you to me, her name is Serah. She used to live in America before she relocated here with her family, so i decided to contact you to know if you will be able to give my client some massage sessions when she arrives the US.

My clients name is Ms Alice Raffael, she is a model here in Italy. She will be coming to the U.S in 2 weeks time for a modeling job and will be residing in California temporarily until the neccesary arrangement for her job has been made before she leaves. She will be needing 1hr massage session per day, 2 Sessions per week for 6 weeks when she arrives.

Ms Raffael asked me to come with her to the US but i told her i would not be able to go with her to the US as i have a course i will be going for in a week time, so i promised to help her find a good massage therapist in your Area.

Pls tell me a little more about your self, how long have you been a massage therapist? Would you be able to provide her with the massage sessions from the 14th of next month to the 22nd of December, 2 Sessions per week for 6 weeks?

Pls i need you to get back to me with the amount you charge per session and also let me know if she can pay you with a Certified check drawn from a US bank?

Do send your reply to my personal email address {  } for a quick response as i do not check this email always.

Till I read from you remain blessed.

Roberto bocca
622 Via  Mercato,
Milano Italy

Friday, October 29, 2010

Scam Email: Audrey Briggs

Here is the latest email received:

From     Audrey Briggs []
Subject     artworks purchase

Good day to you.

I am so excited that I came across of your work on internet search,I 

am interested in purchasing these creative artworks from 

Standing Together,Deep into the Forest,Road to the Ridge,Hidden 
Treasure,Below the Fishin' Hole and Beckoning Route

Let me know their various prices.and how much discounts are you going  to give?I will be happy to have these selected artworks hung in our  new home in South Africa.As well,I want you to take out the shipping  cost.I have been in touch with a shipping firm that will be shipping  other house decoratives.

We are traveling from our Seattle home to our new apartment as soon as 
possible.On Paying for the artworks,I will be glad to pay you with a 
Money Order or Cashier's check in US funds that can be easily cashed 
at your local bank,please let me know on how to proceed for the 
payment of the creative artworks.

I will await your advise on how to proceed.Have a wonderful day.

Take care,
Audrey Briggs

Friday, October 22, 2010

Scam Email: James Peter

We've posted about this one before, but I received another one just this morning so I am posting it again. Nothing different about this one except instead of "Australia" it is "Norway". And scammers lately have been using the method of saying upfront they will pay by credit card - trying to convince people that makes their request more legitimate. But it is not more legitimate. The card will turn out to be stolen - even if it clears as good, because scammers use stolen cards and rely upon that short period of time before it is reported as stolen. But it will end up in a chargeback. Also some scammers say they will pay by credit card but then have some reason later in their emails as to why they will then send a check instead, getting their scam back to the more traditional format. In all formats, they pay more than is owed and ask you to send the difference back (usually to some non-existant shipping company) via Western Union (because once it is claimed from Western Union, there is no getting back or tracing who picked it up).

Okay, this one is short and sweet because he's waiting for me to reply (and I won't) to tell his longer story. The originating server IP is [] out of Oklahoma but scammers often hack into servers from which to send out their hundreds of thousands of emails. So no telling on this one.

Subject: Order Inquiry
From: James []
X-AntiAbuse: Sender Address Domain - []
X-Source-Args: /usr/bin/php /home/girlkwco/public_html/mailer.php


I want to place an order in your store,and i will like to know if you ship to Norway and  my method of payment will be credit card. So please let me know if you can assist me with the order ,And please do not forget to include your web page in your replying back to my mail.I will await your prompt response as soon as you receive this mail.

Purchasing Manager

Saturday, October 16, 2010

Woman's House Posted for Rent on Craigslist a Scam

Those who follow this blog will recognize the familiar warning flags (move quickly to Africa, will send FedEx, etc.) in the content of this but I thought it funny the scammers have taken to Craigslist to see if they can find any victims there. But it's the same format we see over and over again here. Be forewarned!

A Craigslist ad said a local Salinas home was for rent and several people were interested. The only problem, the woman who owns the home had no idea. The homeowner said someone posted her house as a rental on Craigslist as a scam to steal money from people. The house was put up for rent on Craigslist, but when people would knock on the door, they would find out it was all just a scam.

Lorena Ruelas fell victim to the scam and says, "Just went to my car and started crying all the way to Marina. How can people do this, because right now I'm going to be homeless Sunday night because I have no where to go because I was expecting to get the house."

Ruelas is devastated she fell for a scam, but grateful she decided to check out the house before sending any money. And the homeowner, she was shocked when unexpected visitors came peering through her windows knocking on her door asking if the house was for rent.

"I'm a little nervous, didn't see the ad on craigslist, but the emails they sent me say the home was supposed to be abandoned and this person is just telling them they can come look in the windows and check out," said Sarah Ransford who owns the home posted on Craigslist.

Even though part of one email says, "the keys and documents will be send to you via fed ex to the address you have sent to me." A second email adds, "I have to move quickly down to Africa to have my company set up."

"I thought he was sincere cause he said he was looking for the right person someone who would take good care of the property," said Ruelas. As for Ransford, she has a warning.

"It came out of no where, I think especially if you just bought a home or you're selling a home be on alert because they're getting their information from the MLS listings."

The posting is gone from Craigslist and the homeowner called police.

Thursday, October 14, 2010

Scam Email: Daniel Andrews

This guy took his time getting to the core of his scam.
On Thu, Oct 14, 2010 at 12:52 PM, Daniel Andrews
Your Name: Daniel Andrews

Your Email:

Subject: Landscape Painings

Message: Hello, I saw your contact while surfing via the
I will like to know if you have a Landscape or Seascape painting in
stock of
price range not exceeding $700. Get back to me if there is any available
sale. Regards, Daniel Andrews
next email after the artist replied:
On Thu, Oct 14, 2010 at 10:23 PM, Daniel Andrews [] wrote:

Thanks for your prompt response to my request. I am interested in the one
called "Tokyo Tower" under the Kimono series. Please let me know if it is
available and the selling price?


and finally his real intent begins to emerge on the third email:
From: Daniel Andrews []
Date: Fri, Oct 15, 2010 at 11:34 AM
Subject: Re: Landscape Painings


Thanks for your help. I will prefer to have it unframmed. As regards
the payment I will give instruction to my clients there in the united
states to send you a cheque in that amount. And I will be needing the
address, the name to which the cheque will be issued to include your
telephone number. So please get back to me soonest with all this
information. Once i am in receipt of the nessesary infomation we can
set up the transactions.

I will be arranging for a courier pick up at your location as soon as
the check cleared by your bank. That way the painting is secured. So
there is no need for shipping charges.

I await your response soonest.


I think it's a thing about the software the scammers use to generate these emails that SO many of them are signed by their faked name with a period. Just a weird little niggly thing. Fortunately, the artist googled the name, found this blog and enough other emails with the same content to know that her email exchange was, in fact, not with a real customer. At least she won't become a statistic.

Wednesday, October 6, 2010

Scam Email: Rose Duke

This scam email is not art related but completely insidious. Notice that they've faked most of the header information so you think the return address is someone at But the actual reply-to address is different, and sources to a server in Russian (ip number:

From: Rose Duke []
Return-path: []
Reply-To: []
Subject: Your Tax Payment ID: 01037733 has been rejected. Urgent Report information.

Your Federal Tax Payment ID: 010375128 has been rejected. Return Reason Code R21 - The identification number used in the Company Identification Field is not valid. Please, check the information and refer to Code R21 to get details about your company payment in transaction contacts section:[Links to]

 In other way forward information to your accountant adviser.

 EFTPS: The Electronic Federal Tax Payment System PLEASE NOTE: Your tax payment is due regardless of EFTPS online availability. In case of an emergency, you can always make your tax payment by calling the EFTPS.

Monday, October 4, 2010

Scam Email: Sofia Daniel

"Bellow is my shipping".

Boy, did this scammer mess up this email. I suppose the automated software that kicks out their emails didn't get set up correct. Just a sloppy, shoddy scammer effort.

The IP number [] does originate out of the Ivory Coast of South Africa. Notice the reply-to address is different.
From: Sofia Fashions Boutique []
Subject: Dear Sales
To: undisclosed recipients:
Dear Sales

  I am Mrs Sofia Daniel the owner of (Sofia Fashions Boutique) I am interested in your products, kindly pls get back to me so that i can be able to make selections if you are interested in selling to me,

My method of payment is Visa Or Master Credit card Payment method,and kindly pls don’t hesitate to reply back if you accept

my method of payment,

Bellow is my shipping

No 65 Rivera Avenue 404 Abidjan
Ivory-Coast, West Africa,
Best Regards
Mrs Sofia Danie

Thursday, September 30, 2010

Scammers Prey on Shoppers in Richmond

Here's a scammer who incredibly is still pounding the pavement the old fashion way:

A scam artist used the photo of a 10-year-old boy to bilk unsuspecting market-goers of their spare cash at several liquor stores along Richmond's Rumrill Boulevard corridor, police said Thursday.

The boy's photo appeared on cardboard boxes, along with a note in Spanish stating that the boy died of brain and heart disease, and asking for donations to help the family send the boy's body to Reyes, Michoacan.

The boy's mother was startled to hear from a friend Thursday morning, inquiring about her son's death -- since he's alive.

"Unfortunately, it's very hard to verify this kind of information," Richmond Police Lt. Mark Gagan said. "In this case, the scam artist capitalized on people's generosity."

A friend of Rosa Valledor saw the photo at Trujillo Market, 1025 13th St., and phoned the mother, who drove down and verified the photo was of her son.

"I was in shock," Valledor said. "I was scared. I had no idea what this person (who used the photo) had access to."

Valledor called police, who found $73.61 in the box, and learned that someone dropped it off two days earlier.

Further investigation at nearby liquor stores turned up tales of at least four other similar boxes, all bearing the boy's image, that began appearing last week.

The scammers picked up all of the other boxes earlier in the week, Gagan said, though surveillance camera footage from a San Pablo store on Rumrill showed a heavyset Latino man with a ponytail, in his 20s or early 30s, picking up one of the boxes.

The photo of the boy, who is autistic, came from the website of the California Autism Foundation, Valledor said.

She immediately called the organization, and the photo was removed.

"Be careful who you donate money to," she said. "It's better you donate to reputable charities and not to boxes left in stores."

Anyone with information about the scam can call Richmond police at 510-620-6643.

Tuesday, September 28, 2010

The Dark Back Room of a Scammer

I happened upon a fascinating thing last night. I was trying to confirm the identity of a woman who was wanting to register with a message board community I manage. I was googling her name (she turned out to be legit) and I stumbled upon these files that had been left in an unprotected directory. They were kind of program "dumps" from wordpad.exe files and dialogues from chat sessions. I stumbled upon them because the woman I was searching on - her email was found within one of these dumped files.

When I started looking through these files (and there were many in this unprotected directory), I realized I had stumbled upon the files of a scammer. Spread across a number of files, were all the actual email addresses they were sending their scam out to (I estimated there were about 20,000 email addresses), with the content of the scams. It looked like they sent their scam out via over the course of about 3 days and what was interesting was this scammer was not focused on just one scam within this emailing. They were sending out 3 different types of scams at one time to the list. They had the usual someone died and has a gazillion dollars in a trust and they are looking for beneficiaries scam, they had the they have prize money you've won that they need to send you scam, and they were also the scam of getting people to send money to help a sick and dying relative (the woe-is-me scam).

What was also fascinating to me was there seem to be a dump of chat conversations they were having with their potential victims who had written to them to ask if they were legitimate. One about-to-be victim was asking how does he know this is for real, can they provide proof - and the scammer had a ready-made answer for the victim to move them to next stage of the scam. And there was this whole back-and-forth chat dialogue with a victim where the scammer seem to be pretending to HELP them contact the FBI (and then in a timestamp that was less than 30 seconds later, another 1000 emails of the scam would go out).

I had never seen the underpinnings of a scammer's process like this before. It made me feel sad, and dirty. I needed to take a shower after reading all that. And frustrated, because I know there is no way to actually stop them from sending these emails. All I can do is shine a light on their dark slimey ways and provide one voice to help educate the receivers of these emails to trust their gut and recognize these as scams from the get-go.

So if you are ever wondering why you get so many of these emails? Well, it turns out that it is very likely a single source is sending a bunch of different ones... and then multiple that by all the scammers out there! That's why there are so many.

Scam Email: Eric Acis

Here is an email I received myself this morning. The content is the same ole crap I see under lots of different faked names and email addresses. When I look at the full headers of the email, I see two things:

Return-path: []
X-PHP-Script: for

which tells me this scammer used a PHP script called kam.php uploaded to a website that is an ecollege called Gujarat Technical University. Source of the email is Malaysia. If you google kam.php, you will see other computers that have had this php file uploaded to, so all this tells you is the scammer is using hijacked computers to send their email out (which is typical).

Here is the full email:

From: Mr Eric Acis []
Subject: Enquiry


I am interested in placing an order and i would like to know the following.

 -If you accept credit card and

 -If you ship internationally

I certainly appreciate a prompt reply from you.


Didn't even sign his name. Short and simple until he gets a reply and then the Looong Story will come out he either works or lives in one place and is moving (lately it is to Australia) and he has a third party shipper handling his move and he'll send a check or pay by credit card immediately, please send him your website and list of products so he can choose (which doesn't even make sense, but this is their templated formula of the scam usually).

Saturday, September 25, 2010

Scam Email: Jim McCarter

Here's another person just saved from losing money:

OMG thank you so much for all the wonderful information!!

I have been emailing a guy back and forth that placed a very large order of my pepper jelly line.  He wouldn’t answer any questions when I asked him where he’d seen me, etc.  The name he is using is Jim McCarter.  His email address is

He wants me to send it through Diamond Freights Cargo.  Their email is
I emailed Diamond freight as he said, they gave me a quote.  I got an email back from Micheal Wheeler with a phone number.   I called the phone number given…it was an Asian man in Atlanta GA, then  I got an email from Micheal and it gave me a huge quote for shipping, and directions saying they only accept payment via Western Union.  Once the payment has been deposited, they would come pick up my product……the red flag went up to me when the deposit was suppose to be made to a Bryan Anderson in Austin TX!!

Then I looked up Diamond truckline…..I talked to one of the head honchos and told him my story.  He said it sounded really hokey to him also but that he was the  truckline, not the cargo company

 I then emailed Jim McCarter back and told him I thought that Diamond Cargo Co. was very fishy to me.  He reassured me that it would be fine….just keep on proceeding with the order.  That is when a friend of mine told me about your scam site.

Thank goodness!!

 So please add Jim McCarter to your list of scammers and his partners in crime Micheal Wheeler and Bryan Anderson.  (prob. All 1 person!

I hope this helps someone……as you did me.

Thank you so much,


Scam Email: Wuouth Rodrick or Rodrick Wuouth

I don't know where this scammer got this silly name - what is that word, Wuouth??? And the not-too-bright scammer has the name reversed in the email. Anyway, this falls into the SCAM column.

From: Wuouth Rodrick []
To: undisclosed-recipients:;
Subject: My budget for purchase

Good morning,
            I was searching through google images directory where i came across this sophisticated and attractive work of your's that made me keep starring for moments will love to purchase one or two piece from you and i will appreciate it if you can kindly let me know if you have piece priced between $1000- $2000 because that is my budget.I hope to read from you with weblink of work in my budget or kindly send me images of it.

Wednesday, September 22, 2010

Scam Email: Richard Marrino

Here is another person, this time an art dealer, who trusted their instincts and looked up as much as they could about the person before sending any product or money. It had a lot of flags and he caught them all. The lesson for today? Trust your instincts and if it doesn't feel right - google it. Google the name, the email, look at the full headers and you can look up the originating IP and see where it is located. Notice he looked up the shipping company as well (at this point ANY email that mentions using their third-party shipping company is going to be totally suspect to me!).

Here is the message sent to me just now:
I'm an art dealer in New York and have just wasted about a week of negotiations on a supposed sale, that has turned out to be a scam I'm sure.

I did a google map search on the 'client's' address - turns out to be an airport. I did a google map search on the courier, turns out to be a residential address in the UK.

I also did an IP search on the emails, both of which were located in isolated places, nowhere near where the 'client' or 'courier' are located.

Only after these red flags did I do a google for art scams. Thanks for the additional information and confirming my worse fears - fortunately before I acted on any payments etc.

Perpetrators name: Richard Marrino: []

The courier name: Techie Courier 

Tuesday, September 21, 2010

Scam Email: Clark Elster

We've had previous reports on the use of this name. Before the email associated with Clark Elster was [] and now its []. I've also seen pretty common use of the email service - so its either the same guy always using that service under different faked names or its just a service easy for a bunch of different scammers to exploit.

In any case, here is an email I received this morning.

Hello Kathleen,

I just wanted to thank you for posting the information about the scammers. I received an email from a guy called Clark last night saying he was interested in purchasing two of my paintings. I didn't doubt about it at all because I never had fraudulent purchase in my mind (I thought that only happened to famous artists). Besides, he mentioned the names of my pieces. I responded to his email saying one of the paintings was not available and I told him about a few other similar ones he might be interested in. He replied, said, he was glad that all the pieces were available, and he would send me a cashier's check, he was going to go abroad soon for a business proposal, he would have a shipping agent to pick up the artworks....

I felt a little bit weird about his reply. While I was just about to tell him again that one of the pieces was not available, I googled his email address and found your site! His email is  []

Thank you, thank you so much for fighting back. You're not alone.

Best regards

Friday, September 17, 2010

Scam Email: Susan Watson

You can see how close people get to falling for these scams. The Susan Watson scam email has been rampant. That's because some people actually fell for it, and if the scammers are making money, you can bet they are going to send out their email is droves! But the content is typically the same structure - it doesn't matter if they have actually identified your art items by name, and it doesn't matter that they offer to send a check FedEx or even pay by credit card. It is a scam.

But lately I'm loving this idea of getting the scammers to actually FedEx or overnight that check - so they spend a little money at that end. If enough receivers of their email do this - I'm guessing they'd have to switch strategies fast - because it would start to actually cost them money! I wonder what would happen if we said, "Oh dear, I seem to have misplaced the check, can you overnight another one?" Make them pay double.

And even if they start calling you to get that "difference" sent back to them, just tell them the phone call is being recorded for the authorities and act like you actually *want* to keep them on the phone. They'll hang up quick.

Hmmm... maybe this is the small satisfaction we can get from the frustration we feel over these constant and persistent and SO annoying emails.

Anyway, here is an email from an artist I received today.
Hi Kathleen

I found your site today, after nearly falling victim to the art scam. It was the bed-rest woman, with the husband, moving to Johannesburg. Of course, I only spoke to the man by phone, so who knows if there WAS a woman. She mentioned pieces off my web site by name.

I was stupid enough to fall for the "the check, made out by a third party, accidently included shipping charges", that I would need to refund. Fortunately, my bank flagged it as fraud the day after I deposited it,  but in the back of my mind, I was going to speak to them anyway, as it did ring a "scam bell" in my head.  And of course, I haven't sent out artwork, so I'm good there. I thought it was odd that the woman emailed me every day, and the guy called me again today (he WAS very nice the first time, and DID sound African, and far away). when I called him out on the scam, he hung up.

They made it seem more legitimate by sending the check UPS Overnight, and I did save the label, which also was suspicious. The return address was:

Montana State Library
1515 E. 6th Ave
Helena MT 59601

I may call ups to let them know scams are being sent through their service.

The other info

Susan Watson []

and let's not forget:


I feel as though I've dodged a bullet, and at least I cost THEM overnight service charges. Thanks for the great info.


Scam Email: Orson Aguilar

Same content as we've been seeing recently under lots of different names - SO many scammers are moving or working in Australia lately! [smile]
From: Orson Aguilar []
Subject: Order Inquiry....


I am Orson Aguilar and I'll like to order some items from your store but before we proceed I'll like to ask the following questions.

Do you ship to Australia?
Do you do Mail Order?
Do you accept credit card as for Payment?

I await your urgent response so we can proceed.

Second email:
From: Orson Aguilar []
Subject: Re: Order Inquiry....

Thanks for your response concerning my order.

I would be happy if you can email/attach me the lists of pieces you have in
stock now along with their prices, so that I can choose.



Saturday, September 11, 2010

Web Users Hit by Sex Movie Worm

This is not a scam, but a worm. A worm is different. No one is trying to solicit and trick you into sending them money and your artwork. A worm is just a piece of software that does something annoying and then has the sole goal of just spreading itself to as many people as possible.

And this one IS spreading (through large corporations, no surprise that workers on the clock are clicking on a link supposedly to free sex images), so I felt an alert was in order so you don't become one of the people helping to spread it.

The email is entitled "Here you have" and holds within a link that appears to direct users to a PDF document.

In fact the link contains no documents but, if clicked, will enable the virus to access the user's Outlook address book and email itself to every contact contained within.

Whether you have Outlook or not, it will also attempt to disable any security programs by deleting them, allowing it to remain hidden on the computer's hard drive.

The website on which the worm was based was shut down on Thursday evening, but it is expected that other forms of the virus will continue to spread.

Friday, September 10, 2010

Scam Email: Terry Williams

We are seeing a lot of alerts on this very same scam, with different emails and names. Look at the content of the email - this basic content of the email doesn't change all that much. As I mentioned in a previous post, in the last round that this particular email was floating around, some people actually fell for it and lost money, so the scammers are highly motivated to try and catch more "flies". Do NOT be one of them!

First Email:
Hello Sales,
Good morning and its nice contacting you,am  here in Australia for a
business transaction....i came across your  websites while browsing and found out
you have the best quality of  products...i will like to make an order
from your store to my shop  abroad in United Kingdom....
I will like to know if you ship abroad and  also if payment by credit card
is okay by you...hope to read back from you  so as for me to give you the
list of the items  needed..
Terry Williams
Williams Goods Ltd
343  Bold Street,Liverpool L1 4DS,United  Kingdom
Second email after artist replied:
Subj: Re: Order Inquiry!!!!!!

Thanks for the response and am sorry for  the late in reply it was due to
my tight schedule in business and no problem  with the means of payment you
suggested i will kindly want to have the  websites address so as for me to
select the items needed,i had lost it and  couldnt get it in my file..
Poor scammer, couldn't even get the faked name right at the end of the reply. And hey - I actually used a similar ploy with a scammer as this one used in the reply - I had said I had lost the original email and which pieces of artwork were they interested in - knowing they would never be able to match up what they had originally said. Now they are using the oh, dear - lost the information, please give it to me again ploy.

Okay, people - these scam emails really do look all alike after awhile. Familiarize yourself with the basic structure and get good at recognizing them when they FIRST come in. Let's have no more victims on this round, okay???

Scam Email: Lynda Diamond II

This scam email is back in circulation. It was using either or but the content of the email is exactly the same. This email is no different, only slight variation in the name and email. People fell for this one and lost money in the last round of this being sent out and that is why the scammers keep sending out a lot of them and don't change it up very much at all.
From: Lynda Diamond []
Subject: Placing an Order!!!!

Hello, I am lynda diamond, an American but I live and work here in Australia. I would like to place an order for some items from you, but I will like to know what you have available in stock. Let me have your website address so I can view the products you have presently in stock and if there is any special pricing I need to know about. Lastly regarding payment I will be sending you my credit card for the full payment charges for my order. In order to avoid any form of delays can you let me know the type of credit cards you accept? I hope to hear from you as soon as possible so we can proceed with the Order. Regards Lynda

Thursday, September 9, 2010

Scam Email: Rose Williams

I love when I get scam emails directly in my box. Bold of them to just put aside the fact that I am going to post everything I can figure out about their email immediately, that it is my mission to post their ass on the internet for others to find. If only it was their REAL ass...but I digress. Here is the email that just came in:

To: undisclosed recipients
From: Rose Williams []
Subject: Hello


is everything with you, I picked interest on you when i saw your email.
I really want to have a good friendship with you. Beside i have
something very vital to disclose with you, but I found it difficult to
express myself here, since it's a public site. I will be very happy, If
you can get back to me, through my e-mail Is  So we can get to know
each other better,and i well give you my pictures and also tell you
more about me ok

Rose .

Wednesday, September 8, 2010

Scam Email: James Timothy

Here is an email I received from another artist today. This email, sent through an online art message board system rather than email, has the standard signs of really poor grammer and sentence structure, but curiously makes a points of saying they will only pay via paypal. Typically this is a hard way to scam someone because PayPal works hard to have this not happen through them (they validate credit cards, the try and get people to only transact with validated account holders, etc). So I'm not sure how the story would change after a few emails were exchanged. Also makes no sense to pick an item up (didn't even bother to find out if he was geographically able to do this), unless that's their method for getting the goods before a credit card could be reported as stolen. So there are a few things about the content of this email I don't completely get, but just given the sentence structure and misspellings and the email address format is VERY similar to many scam emails we've seen (the name, a dot, a 3 digit number, @ gmail or yahoo), I'm falling on the side of this just not being for real. And who buys something online like with, with this kind of email and then at the end ask to see pictures - it's art! Why would they even want to make an offer if they don't know what it looks like?

Hi there ,

I'm James Timothy from Calgary, i will like to make an offer for this Item,and please i can only pay using PayPal, and after payments has been made ,i will arrange for pick up of the item.Will more than appreciate your reply to my private email address . Thanks and God bless

N.B-please attach some pictures,if any.

James T.

Stranded in the UK Scam

My friend had this happen last night. I've seen it before with other people. Here's how it works.

The hackers get access to your yahoo or hotmail or gmail account. How do they get access? They've either tricked you into clicking on a link and providing them the password OR some just get access by using software that is constantly trying combinations of passwords and it alerts them when they've hit a correct combination and can then get into your account.

Once they have access, they send out an email (see the example below) to everyone in your address book. The tricky part is the email is actually coming from YOU, because they have sending it out from your account.

If you read the below email you'll notice the goal of the scam is to get you to reply to them and send them money. Here is catch: the reply email looks almost identical to the victim's account they've hacked but IS different - thus all replies will go to them. In my friend's case the reply-to address was just one letter different.

What to do if you've been hacked like this? Change your password immediately (and make it harder to guess) and then send out an email to everyone in your address book and put in the subject line something to alert your people not to respond to the previous email. Not much more you can do...

Subject: Worst Case!!! (Need help)

I'm am in a deep mess right now and i need your help.I am in tears as i am writing you now,sorry I didn't inform you about my trip,I had a trip to the United Kingdom(Buckinghamshire) and a bizarre thing happened to me.I was mugged at gun point last night, it happened at the park of the Hotel were i lodged but thank God i wasn't hurt, the muggers carted away with all my belongings excluded my passport. Cell,c-card,cash and some important documents are all gone.I was able to make contact with the Uk Police and i was directed to the Embassy, but they seems to be taking things too slow.

I need your help so urgently.. My flight leaves pretty soon but i am having problems sorting out the hotel bills and also need getting my ticket straightened out. I need your help. I need a quick loan from you to get things fixed out here, promise to refund as soon as i get back home. Your support and assistance will go a long way here.please reply asap so i can tell you what to do and how to get the money to me via western union..Hope to read from you soon.


Tuesday, September 7, 2010

Tax Rebate Scam in the UK

In the UK, about 4.3 million people are due tax refunds due to computer error and the scammers jumped all over this and are now sending tons of emails out to look like it's from the HMRC and asking for your bank info so they can send the rebate.

This would NEVER happen via email so if you get one of these DO NOT click on any of the links or provide any financial information from a link within an email.

Monday, September 6, 2010

Scam Email: Dillon Adams

Here's another one, though a time ago we already had reported this one as Dale Adams.

From: Dillon Adams [] IP:

We own a store here in Australia and willing to purchase from you but before we proceed we want to be sure your email is correct and also to confirm if you can follow our order up via email since we will want the transaction to be done via email. We know of a freight forwarder that will pick of the order at your end since they are less expensive compare to UPS,FEDEX,USPS AND DHL. Beside they are perfect in delivery to the remote area we are in AU. Payment mode will be credit card, USA BILLED Mastercard (NO PAYPAL). Confirm this email before we proceed to send the quote of order.

Kind regards,
Dillon Adams & Group. 

Sunday, September 5, 2010

A Scam of the Scam

Can you image how embarrassed and ashamed a victim would feel falling for this one? A scam that is basically targeting people saying they are compensating people who have fallen victim to the Nigerian scam, explaining the scam and all? A scam about a scam. Very despicable behavior.


Hello, Sir/Madam
REF/PAYMENTS CODE: FGN/PHBPLC/06654/011 ($965,000 USD)
This is to bring to your notice that we are delegated from the UNITED NATIONS INTERNATIONAL FRAUD MONITORING UNIT, I wish to notify you that the office of the Nigerian presidency has been authorized to pay out to 50 innocent victims of the widely know internet scam called Advanced Fee Fraud aka (419) the sum of US$965,000(Nine Hundred and sixty Five Thousand Dollars Only each).You have been listed and approved for this payment as one of the scammed victims.
On these faithful recommendations, we want you to know that during the last U.N. meeting held at Abuja, Nigeria, as it has come to an alarming proportion based on reports from different victims, some of these victims have almost lost their lives, families, properties, and friends. The most alarming aspect of the issue was on the amount money lost by these various innocent individuals to scams artists operating in syndicates all over the world today, and in other to compensate victims, the UNITED NATIONS Body in conjunction with the newly elected government in Nigerian has agreed to pay 50 victims $965,000 dollars each.
CODE: FGN/PHBPLC/06654/011
1) Your full name and residential address
2) Your direct phone number
3) Your file reference number
4) Your nominated account details where your funds will be transferred into
Best Regards,
Office Nig

Thursday, September 2, 2010

Scam Email: Ray Collins

We've seen the content of this spam over and over again, but this one is under a different name so I am posting an alert.

I just received this one-looks very suspicious. The e-mail doesn't  match the name.

Thanks for taking the time to compile the list.

The scam email I received:


Good day to you over there, My name is Ray Collins and i hope this  message finds you well.I was going through your works and my eyes  caught your very first work in your portfolio on [url inserted here]. I am interested in purchasing this  work for my new resident. Kindly get back to me with the detailed  price, availability and more information of the piece.

I hope to read back from you as soon as possible.
Kind regards,

Wednesday, September 1, 2010

Scam Email: Frank Mayfield II

I hate when I get emails like the one below. My stomach just sinks. And I know I have to keep working at posting these. All the scammers need are a few success cases to make all their efforts worthwhile and I just need to keep posting all their efforts to make it harder for them to catch artists unaware.

Because the artist below had actual financial loss, he did one thing right - immediately contact the bank. And now he can also use the links I have in the upper right column for reporting the online crime to the FBI and the Internet Crime Report Center. The artwork doesn't come back, by the way. Not sure what scammers do with the art but it doesn't come back. And given the scammer using the Frank Mayfield name had a success this week, we can all be sure we'll be seeing more of this one this week.

I have an earlier blog post on Frank Mayfield, with the contents of the actual scam email. Use the search bar at the top of my blog for Frank Mayfield and you'll find the earlier alert as well. I felt like this report deserved its own post to being up to the top of the list.
Dear Kathleen. I am sending you this email as I have unfortunately fallen for a scam that I later found posted by you. Feeling terrifically naive and stupid, but If there is anything I can do to help you get this guy. I would like to help as much as I can. I really don't know if there's anything I can do, It is the Frank mayfield scam. I contacted police and there is nothing they can do and had no suggestion beyond going to the bank where I cashed the money and alerting them. Which I promptly did. I now am just waiting to hear back from the bank as to whether the travellers checks I cashed were stolen or counterfeit. Is there anywhere I can report this to, or  should report this to.? Actually sent portrait, I imagine it will come back to me. Are you aware of anyone else who fell for this particular scam that I could perhaps contact? My god I feel dumb !
Don't feel dumb. Really ALL scams and cons are set up to make the victims feel ashamed and dumb. Think of all the celebrities and really smart people who fell for the Bernie Madoff scam and then felt ashamed and dumb. It's how these work. It's not about you. With the proper information, you would have known better and acted differently. I'll just keep posting these, and adding them to my facebook page for spreading the word about scams and hopefully these will keep showing up in the Google results and then I have to just get more and more artists to know to google the name first if something doesn't seem right.

So so sorry this happened to you. Report it to links above and stay on your bank and hopefully our report of your experience will help others avoid the same fate. Thanks for sharing your unfortunate experience.

Monday, August 30, 2010

Scam Email: Airlines Travel Reservations

While not specifically art-related, artists are often on the move and making reservations and this scam email looked SO real, I thought it was worth sharing for educational purposes.

This type of email is called "phishing" because the intent is to try and get you to click on the link in the email, log in with your personal information on some site, and then they get your log in to use themselves and do all kinds of damage, in this case probably book flights online for themselves with your valid credit card information.

This phishing emails are tough! They look so real. The most common ones look like they are coming from a bank and that your account has been temporarily frozen and you need to log in to confirm your identity. Yikes! In the below scam email, Qatar Airways *is* actually at the url of And the booking and cancelling urls look logical. But they are not. If you open a brand new browser window and manually type in and look at what their real booking url is, its different. No https at the beginning and no urls. But the fake urls look real and look logical so they will catch some people unaware. And notice the "From" email. If you are not paying attention, it won't stick out but it is not from

Of course, phishing emails rely on trying to trick only a population of people who are either currently or have recently used that service. If you've never dealt with Qatar Airways, you will be suspicious - but hopefully not unaware enough to click on the link in the email to check it out - the scammers are counting on that as well.

How do you avoid these phishing emails? When it comes to logging into a site and or "confirming" or "cancelling" personal information - never never never never (one  more time!) never do this by clicking on a link in an email. Period. And DO NOT manually type the SAME url from the email into a new browser. You'll land on the same falsified website that probably looks just like the real one. Google the company or site and go to the site manually from a google search (or whatever search engine you use). Or look up their phone number and do really important things via the phone.

From: "Qatar Airways"
Date: August 29, 2010 6:51:43 AM PDT
Subject: Booking confirmation email

Thanks for the purchase!

Your booking is confirmed.
Booking number: K4QCTI

Your credit card has been charged for $438.60 (USD)

Please print the itinerary/receipt for your reference.
Sign in to and print it by clicking the link below

To cancel your booking online, please click the link below:
On board you will be offered:
– Beverages;
– Food;
– Daily press.

Thank you for choosing Qatar Airways and we look forward to welcoming you
on board.

Best regards,
Qatar Airways

Scam Email: Paul Moore

We've seen this scam email before - under the name of Paul Peter. Exactly same content but change of name and change of gmail account to receive replies. Here is what another artist wrote me this morning:

This is the second of this type letter I have receive which is clearly a scam. The other was from someone with the last name Rice , which is listed as the name of  an art scammer. Note that this letter doesn`t name the piece except in the “subject”. I didn`t respond. Thanks for your efforts to halt this crime. Should this be reported ? If so, where?

Scam Email Sent:
From: Paul Moore []
Sent: Sunday, August 29, 2010 5:46 PM
Subject: Ruffles, Acrylic


Good day to you over there, My name is Paul Moore I'm from Seattle  and i hope this message finds you well.I was going through your works and my eyes caught...., i will like to have it for my new apartment this month. please let me know if the piece is available, if yes let me have the detailed price and more information about it. i will be waiting to read from you.

Tuesday, August 24, 2010

iTunes Hack - It's Not What You Think

People are seeing thousands of dollars being taken from their PayPal account apparently via the iTunes Store. At first, it was thought to be an iTunes hack. But it is probably not. The more likely culprit is that your paypal account got "phished" via a scam email - you know, the kind that look like they are from PayPal but they actually are not? And then you click on the link in the email to "log in" or "reactivate" your account - but you are at a fake site that looks like PayPal and yet it is not. And now the "phisher" has your paypal account info and can proceed to buy things with that account.

One customer said his account was charged over $4700 in the iTunes store and when he called PayPal he was told a large number of iTunes accounts were compromised. People who were scammed say that the receipt claims it was for the purchase (at $99.99 a time - a clever move by the scammers, aiming to get it underneath the credit card "suspicion" level and also below the automatic level where the merchant has to bear the cost of reversing the payment) of "CastleCraft, Dragon Crystals (10000 Pack), Seller: Freeverse, Inc)". There is no product called "Dragon Crystals" and they don't come in 10,000 packs.

It is now emerging that it was their paypal accounts that were compromised (and I guess the hackers just really like iTunes). Not iTunes.

This can not be said enough (and so we say it again): be absolutely sure before you enter critical data such as your username and password onto any site. And when logging into a site, never go to the site from an email login link - put the real site url in your browser 'location' field and go there independently of any links in an email and then log in.

Monday, August 23, 2010

Scam Email: Smith Paul

I just love when I get these myself in my own email box. Then I can look at the full headers and see all kinds of things. Let's begin with the actual lame scam email:

From: Smith Paul []
Subject: Mail Order

Hello Sales, Top of the day to you. I am Smith Paul, I would like to place an order from your store but before i proceed, i would like to know if you can ship to AUSTRALIA and accept credit card as a method of payment, If you do kindly get back to me with your valid website address for selection of items needed. I await to read from you today. Regards Smith Paul
Now look at the full headers and see what you can see:
Return-path: []
Delivery-date: Mon, 23 Aug 2010 15:53:26 -0500
Received: from ([]:59448)
(envelope-from [])    id 1One1G-0004cI-KY
Subject: Mail Order
From: Smith Paul []
Message-Id: []
Date: Mon, 23 Aug 2010 15:36:48 -0500
X-AntiAbuse: Primary Hostname -
X-AntiAbuse: Sender Address Domain -
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php /home/alfuraih/public_html/aa.php
You'll notice that this scammer is using php software to send these emails and it even has the folder address on his server computer where the software lives that is generating these scam emails. You'll notice the actual server origin is registered to, which no surprise is a foreign entity. You'll notice the actual IP of the originating server that sent the email:

He probably doesn't even get that he probably got his faked name backwards...

Saturday, August 21, 2010

Scam Email: Patricia Fenton

We've been receiving a number of reports now that perhaps the scammer previously sending email as Barbara Santos is now sending the same scam email as Patricia Fenton. Here's a consistent clue with this spammer - they always seem to be using the email service called

Hi Kathleen,
Thanks again for having your Stop Art Scams Blog. Here is the address that was used on my emails from "Patricia Fenton" [] Thanks again-- and let me know if there is anything else that I can do to help fight these scammers!

Wednesday, August 18, 2010

Scammers Make DDoS Threats to Website Owners

An artist friend got an email along these lines so I wanted to post this alert to others.

A group of scammers is trying to trick website owners into sending them money by threatening to launch crippling Distributed Denial of Service (DDoS) attacks.

According to security researchers from Symantec who intercepted the fake messages, the scammers are sending them to email addresses they gather from domain whois information.

The rogue emails come with subjects of "Hosting – Important Updates and Information" to make it look as if they appear from the recipient's domain registrar and contain intentional spelling mistakes to avoid spam filters.

"We hold a huge network of Distributed Denial Of Service Attack, allowing to suspend any website. We have been watching [domain_name] and were able to find out that you have spent pretty money much for its advancement and we want to to offer you to spend a little more yet.

"Just as little as 200 bucks as a voluntary donation to our fund will keep your web site away from DDOS attack," part of the message signed by the "Top Manager of ZeleniyHach project," reads.

The scammers claim that if the money are not sent to them in the form of a Webmoney Payment Check within 48 hours, another zero is added to the sum, making it $2,000.

"Attempts of gathering personal information or money by using tactics similar to those mentioned here are very common in scam attacks. Symantec recommends that users ignore emails from unknown senders […]," Symantec's Samir Patil, writes.

Even though Symantec assures users that this is just a scam, DDoS-based extortion does exist and has been used by cybercriminals before.

However, buying DDoS services from a botnet runner to attack the competition's services is a much more common occurrence.

According to a Kaspersky Lab report on the underground economy released last year, botnet owners charge between fifty to several thousands dollars for launching DDoS attacks, depending on length and target.

Tuesday, August 17, 2010

Scam Email: Martin Robert

Here is a scammer that can't decide on what fake name to settle on, got lazy and rather than have it look like it was going to one person (who he supposedly saw your web site and liked some "products"), just sent it to a group distribution list, and clearly could not get his command of the English language together. Like not even close (how's that for grammar...)

From: roberts martins []
Subject: info


My name is Martin Robert, Am American, but lives and work here in Cyprus .I run

a company  here in Cyprus.

I recently viewed your web page and i was caught up in ordering some of your

products,we are located in Cyprus,i will like to know if you have the items in



  So kindly get back to me with the right contact person email,phone  number

and confirmation of your website so that i can place my order quickly,i want you

to know that i have my own personal shipping agent that will come for the pick

up at your store,please advise so that i
can proceed by going ahead to place the order.

I am waiting anxiously to hear back from you.

Best regard.

From the desk of Purchasing Manager,

Email :

Martin Robert

Monday, August 16, 2010

Scam Email: Lynda Diamond

We've seen this particular email content a *lot* lately, with just the name and email changed up. But the content remains basically unchanged. Also, we've reported in the past on a Linda Diamond [] so this particular scammer does seem fond of just creating new accounts on

From: "" []
Subject: Placing an Order!!!

Hello Sir/Madam, I am lynda diamond, an American but I live and work here in Australia. I will like to place an order for some items from you, but I will like to know what you have available in stock . Let me have your website address so I can view the products you have presently in stock and if there is any special pricing I need to know about. Lastly regarding payment I will be sending you my credit card for the full payment charges for my order . In order to avoid any form of delays can you let me know the type of credit cards you accept? I hope to hear from you as soon as possible so we can proceed with the Order Regards Lynda

Thursday, August 12, 2010

Scam Email: Paul Sanders

Okay "Paul", you are going to have to put a little more effort into your illegal activities than this!
From:    Paul Sanders (
Subject: Please respond for more details.‏


I am Paul Sanders, I am ill and would die having been diagnosed with
cancer disease.
I want to distribute my funds to charities in your country through you.
Please respond for more details.


Paul Sanders

Wednesday, August 11, 2010

Scam Email: Paul

Here is a scammer reported today that doesn't even reference a last name. Perhaps as more reports come in, we'll be enlightened as to what fake last name this scammer is using, but for now, it's just "Paul".
From: Paul []
Subject: Order Inquiry

Good day,

We browsed through your web page and we are interested in ordering some of your products,we are located in Norway,we will like to know if you have the items in stocks,so kindly get back to me with the right contact person email,phone # and confirmation of website so that we can place my order quickly, and i want to know if you have your own personal shipper or can the order be picked up at your store,please advise so that we can proceed by going ahead to place the order.

Purchasing Manager

Scam Email: Alice Drew - Still Sending Email

We anticipated that the "Alice Drew" scammer would not go away, given we know this particular scammer successfully got money out of some artists last week.

It seems the key to my making their lives miserable is to post their names and emails as widely as I can and then just educate as many artists as I can to google the name BEFORE they send any money or artwork. And these alerts will be showing up in google results. That seems to be the key that is beginning to work.

The twist I didn't like about the below email was it would appear Alice Drew is going through Facebook pages and emailing artists. Ack!

Here is an email I received this morning from an artist:

Thanks to your site and list of scammers I caught this one before it went too far!

It seemed too good to be true and very strange. Sure is!

Thanks for the site, saved me!!

See here:

First Email:

On Sat, Aug 7, 2010 at 12:13 AM, Alice Drew [] wrote:
I am Alice drew, an American but I live and work here in Australia. I want to place an order in your store,and i will like to know if you ship to Australia,my method of payment will be credit card. So please let me know if i can proceed with the order,And please do not forget to get back to me with the website address where most of your product can be seen. So I will be able to make my choice of items and get back to you with list of items needed.I will await your prompt response as soon as you receive this mail

Thanks with regards

Second Email:

Thanks for getting back to me on time, Please find below for the list of items needed and get back to me with the quote asap.

Edward Ruscha
Sweets, Meats, Sheets
6 color screenprint with varnish overprint
32 3/4 x 25 7/8 inches
83 × 66 cm
Edition 3/55

The Lost Night, Graphite on paper, 43 x 78 Inches

Please get back to me with the total cost estimate for this order so that i can make my payment via my visa or master credit card.
Like i stated in my previuos message i am an American but I live and work here in Australia and I want these products here.
Do not worry about the shipping, I will make arrangement for the pick up of these items from your place thru my shipping agency.