The Latest Paypal Scam - Be Careful!

 Today I received an email that is in the image below. I have been monitoring and reporting on scams for decades, so I feel like I've seen it all. And mostly I have.

Scams are kind of like viruses - the basics are recognizable but there are an endless variety of always emerging variations - all with the goal to evade identification and trick people into the scam. Get their money. Get their personal information so they can sell that. Money. It's about them stealing your money. However they can.

The Paypal scam has been around a LONG time. They have, in the past, sent a fake email that looked like a real paypal email either sending you a [fake] invoice or saying you've received money [you haven't] in order to get your login details (and then they clean out your Paypal account).

So I wasn't surprised to see this scam email in my inbox. Here, let me show you an image:

I hovered (notice how I said HOVER... never ever ever click on these links in the email) over the FROM email and in the old days, that would look like a fake Paypal email address and I would know right then. But this email looked like a real Paypal email address. 

So I kept looking. The next thing actually gave it away but I decided to open a brand new browser and log into my Paypal account myself. But let me show you what gave it away.

I hovered over that TINY link highlighted in the below image.

That was NOT a Paypal address when I hovered over it so bingo - it's a fake email.

If you call the phone number in the fake email, it is likely NOT a legitimate phone number. It's the scammer themselves. Often they will have a foreign accent (no red flag there for customer support people) but often you will hear traffic and noise because the scammer is just walking somewhere. If you continue with the call, they will tell you oh dear - that sounds like a fake email, give me your login details and I will confirm (at which point they will log into your account and clean it out). 

As Paypal now uses Two-Factor Authentication now (sends a code to your phone on file), the scammers will then tell you - oh dear, sounds like your computer has a virus (or security problem) and they will then shift you to the classic scam that traditionally has been fake "Microsoft Support Technicians". So you can see this is just a variation on that. Don't give your login details to ANYONE.

So at this point, this is a pretty classic fake Paypal scam email. I can just delete it and move on with my life.

But I want you to know more about how this scam has evolved. In some cases, the scammers will actually have an actual Paypal account and use the Paypal system itself to send a made-up invoice but it looks real because it IS coming from the Paypal system. They then follow-up with a fake email so they can put a fake customer support number in the email (and now you are back to the above flow if you call the fake support number and they tell you there is a security problem on your computer). It's tricky because there IS an invoice in your real Paypal account.

The fake follow-up email might look something like this:

Note from Billing Department of PayPal:

There is evidence that your PayPal account has been accessed unlawfully. $1,000. 00 has been debited to your account for the Walmart eGift Card purchase. This transaction will appear in the automatically deducted amount on PayPal activity after 24 hours. If you suspect you did not make this transaction, immediately contact us at the toll-free number [redacted] or visit the PayPal Support Center area for assistance. Our Service Hours: (06:00 a. m. to 06:00 p. m. Pacific Time, Monday through Friday)

So what is the bottom-line of all this and how can you avoid falling for the many variations of this Paypal scam?

1. Never click on ANY links in emails that are suspicious or asking you to log in or provide private information. Hover over links to see if any of the links looks suspicious. Sometimes its the tiny links at the bottom.

2. Never call the support number that you see inside an email. Just NEVER. That is the safest thing. Open a new browser and look up that vendor's site yourself and find their support number on their website in a clean newly opened browser. Take the extra time to do this.

3. Never give your log in information to anyone. Your legitimate vendors will not ask you for your login password ever.

4. Often, you can google certain details of the scam email you've received and often there will be posts out there like this blog post that will help you identify if its a scam email.

Stay safe out there!

Scam Emails and Texts: Corona Virus COVID

You know that scammers are not going to pass up the chance to trick people using the coronavirus (COVID) pandemic. Expect lots more fake and phishing emails for some time to come leveraging this story and playing on people's fears.

Texts are going out also with false information, requests to get more information, and false claims that products address the corona-virus when they don't. Also fake texts and emails promoting things like surgical masks. DON'T REPLY TO THESE TEXTS OR EMAILS.

Emails are being sent that make it look like it's from some official health agency with an attachment, saying to click on the attachment to get more information on coronavirus. DON'T DO IT. Don't give up your private information to answer a questionnaire, take a quiz, or get access to additional virus information. DON'T DO IT.

We may even see, from an art perspective, and our VERY familiar fake buyer scam, mentions of the corona-virus may get incorporated into their scam email 'stories' as to why money needs to be wired to their shippers (fake). DON'T WIRE MONEY TO ANYONE if you are the seller. Don't accept over-payments, no matter what their story is. DON'T DO IT.

The pandemic is real and we must be safe and take care of each other... but not become susceptible to scammers leveraging this for own criminal activities.

Stay safe out there. And stay calm.

Scam Email: 'Save Yourself' Ransom Type Scam

This isn't the usual fake buyer scam we deal with so often on this blog, but I've been getting a lot of these emails lately and I felt it was time to post a warning to help others.

The scam type is called 'ransom scam'. The scammer typically will say they have incriminating photos of you via malware they were able to install on your computer, etc. Then they ask for money before they 'release the photos'.

Here is an example of what I've been getting a bunch of lately from scammers. It lists an actual previous password of mine (which I will obviously not show in the example below) but one of these scam emails to you will actually display a password of yours.

Here is the thing: they haven't likely installed any malware on your computer. How did they get your password? Likely from one of the many many data breeches many online companies have experienced. They did not get it from your computer. And I'm hearing online that the password is likely pretty old - so if you are someone who never changes their password AND/OR someone who uses the same password for various things online - it is time to CHANGE that behavior! There are software programs out there that protect and help you manage many different passwords now... use one of them.

I could tell the password the scammers are using with me was one of my old passwords, no longer in use. But you can see how this scam could work on a lot of vulnerable people.

Don't reply to these emails, don't click on anything... except the delete email button.

But it IS a good reminder to change up your passwords periodically and don't use the same one for everything.

Okay - here is the actual text of one of the many I've been receiving:

From: Save Yourself [SaveYourself07@1741.com]
Subject: You got recorded - [actual password listed here]

Hi, I know one of your passwords is: [actual password listed here]

Your computer was infected with my private malware, your browser wasn't updated / patched, in such case it's enough to just visit some website where my iframe is placed to get automatically infected, if you want to find out more - Google: "Drive-by exploit".

My malware gave me full access to all your accounts (see password above), full control over your computer and it also was possible to spy on you over your webcam.

I collected all your private data and I RECORDED YOU (through your webcam) SATISFYING YOURSELF!

After that I removed my malware to not leave any traces and this email(s) was sent from some hacked server.

I can publish the video of you and all your private data on the whole web, social networks, over email of all contacts.

But you can stop me and only I can help you out in this situation.

The only way to stop me, is to pay exactly 1000$ in bitcoin (BTC).

It's a very good offer, compared to all that horrible shit that will happen if I publish everything!

You can easily buy bitcoin here: www.paxful.com , www.coingate.com , www.coinbase.com , or check for bitcoin ATM near you, or Google for other exchanger.
You can send the bitcoin directly to my wallet, or create your own wallet first here: www.login.blockchain.com/en/#/signup/ , then receive and send to mine.

My bitcoin wallet is: 1Nq84HeDmd2JGyRtjqh32QRG4zoSrp8bdL

Copy and paste my wallet, it's (cAsE-sEnSEtiVE)

I give you 3 days time to pay.

As I got access to this email account, I will know if this email has already been read.
If you get this email multiple times, it's to make sure that you read it, my mailer script is configured like this and after payment you can ignore it.
After receiving the payment, I will remove everything and you can life your live in peace like before.

Next time update your browser before browsing the web!


Mail-Client-ID: 4679663290

Scam Email: Jackson Greene

Hi Katie,

I apologize for not being able to find this on my own. I received a message through my art Website from a Jackson Greene.

Date: Thursday, August 23rd, 2018 at 10:35pm
From: Jackson Greene [mailto:jacksongreene007@yahoo.com]
Sent from IP address 154.66.37.96

Hello There,
My name is Jackson Greene from California. I actually observed my wife has been viewing your website on my laptop and i guess she likes your piece of work. I'm also impressed and amazed to have seen your various works too, You are doing a great job. I would like to purchase one of your Paintings "[name inserted here]", as a surprise to my wife on our anniversary. Also, let me know if you accept CHECK as mode of Payment.

Thanks and best regards
Jackson.

Seems scammy to me, but I couldn’t verify on your Stop Art Scams Blog. Which is a wonderful service you’ve taken on!

The wording includes a sentence like Steven Leavitt’s though. Agreed?

Best,
Dale

Scam Email: Tony Grider

The use of English language looked suspicious to me, as well as the 'cashiers check', so I found your site -- very informative and helpful.  I'll just ignore any future emails from "Tony Grider".  Thanks.

Here's the emails.


Fwd: AWAITING PAYMENT DETAILS......REPLY TODAY
Geri

Begin forwarded message:

From: Tony Grider [tony.grider@aol.com]
Date: August 16, 2018 8:12:36 AM
To:
Subject: AWAITING PAYMENT DETAILS......REPLY TODAY

Hello,

Okay I'll take it and will offer $900 for

Hatteras in Harbor $450
Hatteras Jetty $450

and will proceed straight with cashier's check which will clear instant or the next day to avoid delays, I am located in LAS VEGAS i will handle the shipment once the check as cleared your bank and funds have been made available to you, the shipper broker will come over to your location to pick up and have it delivered safely to me at my residential.


Please email me back the following details below to issue out the check to you.

Full Name that will be on the check
Full Address to send the check to
Cell phone number

  Waiting to read from you.

Thank you.

Tony Grider
tony.grider@aol.com


-----Original Message-----
On Aug 16, 2018, at 06:02 AM, Tony Grider [tony.grider@aol.com] wrote:

 Hello,

 I am interested in your art work, Kindly please get back to me the asking price for these below:

[list of 4 paintings here]

Thank you


Tony Grider
tony.grider@aol.com

Scam Email: Bill Burrus

Hello Kathleen,

Having read your really useful art scam website I’m pretty sure the below is a new name for you, just received!

Kind regards,

Gerard



From: Bill Burrus [mailto:bill.burrus1@gmail.com]
Sent: 13 August 2018 10:58
To:
Subject: Re: [name of 4 paintings right in subject line]

Hi Gerard,

Thanks for your reply, regarding the prices I have seen it with your reply. Yes I am truely interested in purchasing.

I want you to know that I am purchasing the paintings for a Wedding Anniversary and it really need to get to my destination because the date of the Anniversary is around the corner.

Below are the paintings I am interested to purchase.

[name of 3 paintings listed here]

it will be better to discuss the payment and the shipping on Skype either verbally or typing due to the urgent of the Anniversary if possible it will be better to view the artworks on Skype Video.

My location and address of delivering are below..

1476 River Road
Titusville, NJ 08560
USA

Concerning the payment, the payment I am 100% sure about is to send you a Cashiers check or personal check or transfer the cash into your bank account for the total amount, base on the advise given via my bank.

My Skype name is bill.burrus1@gmail.com [mailto:bill.burrus1@gmail.com]  I am available throughout today on Skype to discuss and conclude.

[note: you can bet this scammer will have some reason to never show his face on Skype!]

If you don't have a Skype name kindly go to www.skype.com [http://www.skype.com/]  and register with Skype then download it and fix a time to Skype today.

Cheers,

Bill Burrus

Scam Email: Sean Pringle

Hi Kathleen,

I'm forwarding an email I received yesterday through my art website. My immediate reaction was that it looked like a scam so I didn't respond. When I googled art email scams looking for his email address, I didn't see it. But, I did come across your site and thought it would be helpful to other artists to have his info added to your list.

Thanks so much for helping by sharing this info. Glad we can all work together! If you need anything else, please let me know.

And...I just enjoyed looking at the paintings on your website. Hope all is going well for you!

Thanks again,
Di

---------- Forwarded message ----------
From: Sean Pringle [sean.pringle152@gmail.com]
Date: Thu, Jun 7, 2018 at 6:45 PM
Subject: Artwork:



Hello ,


I'm Sean Pringle from Pontiac, Michigan. I actually observed my wife has
been viewing your website on my laptop and i guess she likes your piece of
work. I'm also impressed and amazed to have seen your various works too,
You are doing a great job. I would like to purchase one of your piece as a
surprise to my wife on our anniversary. Also, let me know if you accept
check as method of payment.


Regards

Sean Pringle

Scam Email: Kevin Waters

They didn't lose the website address. They send out hundreds of thousands of email and are hoping their potential victims will respond and tell them the website. Then the scammer can continue on to the next step of the scam, which is to pretend to want to buy individual pieces and then overpay with a counterfeit check and ask to have the difference wired either back to them or on to some fake shipping company.

---------- Forwarded message ---------
From: Kevin Waters [kwaters671@gmail.com]
Date: Wed, May 9, 2018 at 10:13 PM
Subject: Artwork Inquiry


My name is Kevin Waters from Jacksonvile, Florida. The images on your
website are so fascinating and so vivacious, looking at each piece of work
i can easily see that you added so much dedication in making each work come
out to life, unfortunately i lost the website where i first saw your work
but i was able to save your email address. I will like to purchase some of
your work for my wife as a surprise gift for our 20th anniversary. Please
kindly send pics and prices of some of your art which are ready for
immediate sale within price range $500- $5,000, I could be flexible with
price. I am writing you because i need your assistant to get back to your
website so as to be able to retrieve the details of your work that interest
me or send me images of some of your new works with price.
Best Regards,
--

Scam Email: Megan Sweet

Notice the frequent email changes from the scammer in this below exchange as well as the fake story of why the check was so much more than the amount owed.


---------- Forwarded message ----------
From: Megan sweet [sweermeg09@gmail.com]
Date: Mon, Apr 23, 2018 at 7:57 AM
Subject: Re: Artwork
To: Christy


Dear Christy,

I am so excited and can't wait to have the piece in our home. I hope to
give it a very good home and enjoy the piece for many years.
Regarding the check, Just find out my husband made a terrible mistake and
overpaid you because he didn't have full details of the transaction, been
busy when he sent it. I am very sorry for the confusion but I will like you
to go ahead and deposit the check, deduct the cost of the piece inclusive
the shipping . I spoke with my husband and he will like you to send the
difference back to his chief accountant. Pls get Two (2) Money gram or post
office (USPS) money orders of (1) $1000 USD each & (1) $400 totaling $1400,
you might be required to pay extra fee for the purchase of the money orders
and money orders should be left blank, include purchase receipt and use
FedEx Overnight. The money orders should be sent to the address below.

Attn: Mr Karl
9915 198TH ST

HOLLIS NY 11423

-3321

FedEx or UPS First Overnight delivery cost about $45. Overnight shipping
FedEx charges can be deducted from the money remaining. I'll appreciate if
you take care of this as soon as possible and advise with the tracking
number. Please acknowledge this email. Thank you.
Cheers,
Megan


On Fri, Apr 20, 2018 at 2:40 PM, Christy wrote:

> Good afternoon, Megan,
>
> I hope that you are enjoying your Friday?
>
> I just got your check and was rather astonished to see that it was 4 times
> the expected amount! I was going to send your prints, but now I feel that
> we should resolve this. Here are some ideas:
>
> 1. I can destroy the check and you can send me another for $800
>
> 2. You can choose 6 more prints. This would give you 3 more in each
> series, or from different ones. Whichever you like best, of course.
>
> 3. I can have the images matted and framed,  but I'm pretty sure that,
> even with shipping, it would not cost $2400, so you could either choose an
> additional 2 prints or I could destroy the check and you could send me a
> new one for the new amount.
>
> Please let me know what you would like to do.
>
> All the best,
> Christy
>
>
> On Thu, Apr 19, 2018 at 10:31 AM, Christy
> wrote:
>
>> Hello Megan,
>>
>> I am sorry that you were struggling with your health! I hope that you are
>> feeling better.
>>
>> Thank you for sending the check and the tracking info. I am planning to
>> send your prints either today or tomorrow and will send the shipping
>> information when I do.
>>
>> Thank you again for your interest in my work!
>>
>> All the best,
>> Christy
>>
>> On Thu, Apr 19, 2018, 9:51 AM Megan sweet [sweermeg09@gmail.com] wrote:
>>
>>> Good morning Christy,
>>> Hope this message finds you well. Apologies I have not been able to get
>>> in touch for a very long time as i have been battling with health issue.
>>> Just to confirm that payment was sent by my husband on Tuesday via USPS
>>> with tracking number 9405503699300216219950 and he was advise you will have
>>> it deliver today or latest Friday please be on the look out for it.  Kindly
>>> acknowledge receipt of this email as soon as possible.
>>>
>>> Cheers,
>>> Megan
>>>
>>> On Thu, Apr 5, 2018 at 12:52 PM, Christy
>>> wrote:
>>>
>>>> Hi Megan,
>>>>
>>>> Thanks so much!
>>>>
>>>> I'll get the prints ready to send to you!
>>>>
>>>> On Thu, Apr 5, 2018 at 9:09 AM, Megan sweet [sweermeg09@gmail.com]
>>>> wrote:
>>>>
>>>>> Hi Christy,
>>>>>
>>>>> Awesome , the price is okay for the piece . May I confirm if payment
>>>>> could be mailed to you by check to your address, Unfortunately I'm unable
>>>>> to complete this transaction by credit card or Paypal . If you can email me
>>>>> your full name,address for payment that will be helpful
>>>>>
>>>>> Thank you
>>>>>
>>>>> On Fri, Mar 30, 2018 at 7:45 AM, Christy
>>>>> wrote:
>>>>>
>>>>>> Hi Megan,
>>>>>>
>>>>>> Now I must apologize to you!
>>>>>>
>>>>>> I have been thinking a lot about this, as I did not have prices
>>>>>> listed on Saatchi. Is $400 per print an acceptable amount for you?
>>>>>>
>>>>>> About the pieces; I started combining negatives when I first started
>>>>>> working in photography back in the 1990's. I don't consider myself a
>>>>>> serious traveler, but when I am able to make trips, I try to take as many
>>>>>> images as possible. These images from Greece came around because of the
>>>>>> landscape itself; the desolate rocks contrasting with the beauty of the
>>>>>> sunset. Greece itself is very inspiring; I draw a lot from the philosophy,
>>>>>> the poetry and the ancient dramas. A lot of who we are, as people in the
>>>>>> West, comes directly from the Greek thinkers. I try to pay them some subtle
>>>>>> homage, particularly in the titles. I'm glad that you enjoy them!
>>>>>>
>>>>>> As payment goes, it might be better to send a PayPal, if possible?
>>>>>>
>>>>>> Let me know what you think, and thank you again for your interest in
>>>>>> my work!
>>>>>>
>>>>>> All the best,
>>>>>> Christy
>>>>>>
>>>>>> On Wed, Mar 14, 2018 at 2:22 PM, Megan sweet [sweermeg09@gmail.com]
>>>>>> wrote:
>>>>>>
>>>>>>> Hi Christy,
>>>>>>>
>>>>>>> Apologies for not getting back to you sooner,It's nice to hear back
>>>>>>> from you. I will like to proceed with the purchase of the 2 pieces (Buried
>>>>>>> in the Sky & Beginning and End), would mind telling me what your
>>>>>>> inspiration behind this piece. I think it is a lovely work and I hope to
>>>>>>> give it a good home. I am presently away on vacation but I should be back
>>>>>>> in few days. Pls confirm it listed price
>>>>>>>
>>>>>>> 19621 Doris Lane
>>>>>>>
>>>>>>> N. FortMyers, FL Lee 33917
>>>>>>>
>>>>>>> Meanwhile, can you please confirm your mailing address and phone
>>>>>>> number so I may inform my husband on where to forward the payment. I can
>>>>>>> have him send the payment asap. About shipping, you can handle it from your
>>>>>>> side to my mailing address above, either by USPS, or FedEx, UPS postal
>>>>>>> service
>>>>>>>
>>>>>>> I will look forward to hearing from you so I can know how best to
>>>>>>> proceed.
>>>>>>> Cheers.
>>>>>>> Megan
>>>>>>>
>>>>>>> On Fri, Feb 2, 2018 at 4:49 AM, Christy
>>>>>>> wrote:
>>>>>>>
>>>>>>>> Hi Megan,
>>>>>>>>
>>>>>>>> Thank you for your kind words! Here's a link to my Saatchi page:
>>>>>>>>>>>>>>>>
>>>>>>>> Most of the works are for sale. I am open to discussion about
>>>>>>>> process if you see something you really like.
>>>>>>>>
>>>>>>>> All the best,
>>>>>>>> Christy
>>>>>>>>
>>>>>>>> On Thu, Feb 1, 2018 at 4:47 AM, Megan Sweet [vinesdd494@gmail.com]
>>>>>>>> wrote:
>>>>>>>>
>>>>>>>>> Hello,
>>>>>>>>> I came across your web page , I like your inspiration as an
>>>>>>>>> artist. How about you email me your recent work on sale for me to look
>>>>>>>>> through?
>>>>>>>>> Cheers,
>>>>>>>>> Megan
>>>>>>>>>

Scam Email: Renata and Robert Dennis

Hi Kathleen -

In the spirit of trying to keep scammers from taking the joy of receiving an actual purchase order for our art, here an email I received that looks pretty fishy to me - down to the email address:


Renata [info9842@gmail.com]
May 7 (1 day ago)
to bcc: me

*Good Day,How is everything with you? I picked interest in your artwork and
decided to write you. I will like to know if your artwork can be purchased
and shipped internationally?.I can email the artwork of interest and
payment will be completed in full once you confirm my purchase order with a
quotation.Kindly let me know when you are in office and ready to take my
artwork order also let me know if you accept either PayPal / Stripe
International Payment or Visa Card or Master Card for payment?Furthermore
you can email me your recently updated website or art price list in your
response.Best Regards.*

------

I responded confirming that I did ship worldwide and for her to go to my website and click on the "Buy Art" link where most of my pieces (with the exception of two new original works) are available for sale direct from the website. She then responded with a link to the exact 2 pieces that are not
available for sale online. Adding more "weird" to this interaction, I noticed that at the bottom of her message, there seemed to be another email from a "Robert" (same period after the name that "Renata." uses) requesting nanny services (LOL):

--
Hello,
     My name is Robert Dennis from Kansas, I will like to know if you
render nanny service? If yes kindly get back to me 7858160171.

Where you locate?

Regard.

Robert.

----

So yes, even as I write this I see scam written all over it. Thank you for your site and consider this my contribution in the fight against these idiots who rather spend time and energy trying to make money on honest people who are trying to spend their time and energy being honest abiding citizens with a dream to live of what their passionate about!

Thank you

Scam Email: David Morton

An email I received from a reader:

I wanted to share an art scammers name, email, telephone number and information with you.  I am an artist and I was contacted by a "Mr. David Morton".  The initial email read as follows:

"I am so excited that I came across your work on Internet search, I am interested in purchasing some creative artworks from you let me know their various prices. And how much discounts are you going to give? Looking forward to hearing from you soon.

Thanks and best regards!

Mr. David"


I thought it was suspicious, but I had never heard of an art scam so I emailed him back.  We exchanged a few emails and he had me send a list of all the available work that I had.  He picked out one piece that he said would be an anniversary gift for his "wife".  He asked if he could pay me
an extra amount to cover private shipping because he was moving to Canada and he wanted to keep the painting as a surprise for his "wife".  This is when red flags started showing up for me.  I wanted to catch this lowlife so I entertained his emails and he sent me a check via priority mail.  The check was from a company called Ausenco Engineering USA South IN. located at 1320 Willow Pass Road in Concord, CA, 94520.

In a few days, the check came and I immediately got an email instructing me to deposit the check.  I took it to my bank where they immediately flagged it as fraudulent.  "Mr. David" continued to insist that he was interested in purchasing the piece.  He continued to text me until I had enough of this loser conman.

As an artist, I love painting and I love having my pieces in people's homes.  This is why this is such a sick and twisted scam.  These scammers will never understand true beauty and art and I hope everyone becomes aware of these scams.

Thank you for your blog and for fighting these scammers!  I'll include a summary list of this conman's information.


Here is a summary of this scammers info:


Fake name: Mr. David Morton
Fake Profession: Ocean Engineer at Ausenco Engineering
email: samdavid.morton01@gmail.com
phone numbers: (720)-538-4635 (David's phone),
(409)-600-9495 ("Shipper's Number")
Shippers name and address: Carol Brashear, City: Ravensdale Wa., Zip code: 98051

Scam Email: Fake PayPal Payment

Here is a good one to watch out for!

The fake email wants you to believe someone sent you a large amount of money via PayPal and that PayPal recommends you withdraw it.

No one sent you money and PayPal is definitely not recommending anything.

The scammer wants you to click on the link, where the link (I won't share it so it won't be active, and I delinked it below in the example) looks something like this:

http://[scammer_domain_here].com/click.php?[my_email_was_inserted_here]

That can NOT be good. Do NOT click on that link!!! Delete the email and move on. Don't be a victim.

Subject: Lauri just sent you $3,182.00 USD with Paypal. Paypal recommends to withdraw it now.

From: Lauri [obligationwaqyf@pornoroutine.io]

Lauri just sent you $3,182.00 USD with Paypal. 

Click here to continue 

Best of luck! 
Lauri 

Scam Email: Michael Kleemann

Kathleen,

I have a website which I'm still working on, from which I sell the odd painting. While I do illustrate scientific journals, I also do "gallery art" or whatever you call it, but I keep it all simple.no galleries, no reproductions, low prices, direct transactions and so on.

Anyway, last October a "Michael Kleemann" contacted me, purporting to be a businessman in Texas, on the cusp of moving to Turkey.   He wondered if I had any other paintings to offer but the then relatively few for sale on my website (I still have only posted a fraction of what is available). Not knowing what his interest was, I just said that I did and sent him a few samples.

He choose the [name of piece], and the [name of piece]. The former is framed, so I told him the shipping would therefore be more expensive than if it weren't framed and made some sort of general conversation about my love of Texas, and southwestern birds.   But I admit alarm bells were already ringing in my head as most first-time buyers express their interest in birds or comment on art or whatever, and Michael Kleemann was very terse, polite, but nothing personal.

He said that because he was moving he was in a state of flux and would it be okay if me mailed me the money in advance, with enough to pay the shipper at the door.

I had explained that I normally use a specific courier because I it is a local family-run company that I've dealt with, favourably, for years.

He instead said that he'd have his movers in Canada do the actual shipping.

That seemed strange, but hey, maybe he was a wealthy Texas business guy with all kinds of flunkies working for him, and a finger in many different corporate pots.

So I said, well, okay, fine.

But nothing happened.

Then, last Monday, my stepdaughter said there was a folder leaning up against the front door.  It was from UPS.  It contained a single check (or "cheque" as we write it up here) and it was $3,599.00.   An odd sum.  I had no idea what it was for.  It was a company cheque, and the company was in Manitoba, as was the credit union it was drawn on.  Google showed both existed.but the company manufactures medical equipment.   I have only sold two or three paintings to Manitobans, none recently, no one there owes me anything and I don't produce a darn thing that would be of interest to a manufacturer of medical imaging equipment.

Then I remembered Michael Kleemann.  Could this be the money he had mentioned?   If so, it was way too much, approximately twice what would have been necessary for the arrangements we had made.

Sure enough, I got an e-mail from him after all that time, with an apology for the delay in getting back to me.

The next morning I phoned the company named on the cheque.  "It's fake," I was told by the guy before I had fully explained the situation.  "And I bet it's for more than had been agreed upon."  It was.  It turns out that a lot of these cheques were out there and the company quite annoyed, but helpless to do anything.

It took nearly two days to get a live person cop on the line, but I did this morning, and he opened a file, taking down all the particulars, which will then be distributed to fraud departments worldwide.  

Michael Kleemann (obviously an alias) could be anywhere.  He did write to me the name of the "shipper" (a "company" based in Alberta) and a "tracking number" and so on, but the cop also advised me not to open any more e-mails from Michael Kleemann, as they could include viruses (it appears not, thank goodness, but that could change), and certainly not to respond to him again (my last message was designed to keep him interested as I hoped the police might be able to find him by intercepting the shippers, and I'm more than happy to be part of a "sting" if we can catch this crook.  
But I will take his advice.   I do have a viewing pane so when Michael Kleemann wrote to me this morning that, okay, he'd wait until the new year (I told him I'd be away until then) I was able to read it even if I didn't open the message.  

But the other thing the cop told me was that by virtue of my having responded, this person, or one of his or her colleagues, may try another scam, so I am now more on guard than before.

Frankly, it was a rather clumsy effort, but I HAVE sold art (and developed online friendships) from "cold" contacts, usually word-of-mouth, but a few times via my website, and I have sent art off to first-time-buyers before receiving payment.  A sophisticated businessman I'm not.

I've never been cheated, but obviously I now will modify that practice for the first-time buyers.  

I don't know if any of this will help anyone avoid being taken, but I felt better to tell you all then not.

I will forward his e-mails to you one by one, under separate e-mails (I'm not very computer-adept so it's the only way I know to do it).  


Cheers,
Barry

Scam Email: Holmes Raines

Hi Kathleen,

I'm an artist.
I received this email. I did not find anything about the person online, but it smells suspicious.
Thank you Kathleen,
Best regards,


holmesraines02@gmail.com

Wrote:

Hello,
Good day to you over there, My name is Holmes Raines I'm from Leipzig and i
hope this message finds you well.I was going through your works and my eyes
caught The thinker 60x80cm Oil on canvas, i will like to have it for my new
apartment this Month. please let me know if the piece is available, if yes
let me have the detailed price and more information about it. i will be
waiting to read from you asap.

Holmes Raines.

Scam Email: Jonathan Hashri

It is interesting to me that I can dig through the some of the oldest messages on this blog and in my email and the below email template can be found, basically unchanged word for word, from years and years ago.

But really, that's bad news, because if the format and wording of some of these scam emails have basically not changed in so many years, it means it must work at attracting victims. Which of course, I hate.

Or this could just be a really lazy scammer who is using some basic old scam template to see how well it still can work.

In this case, they kind of make it generic enough that you'd want to write back to them to get a little more information and then they have collected their list of more "qualified" potential victims.

But us artists know real buyers do not ask their initial question this way if they are interested in buying a piece.

-----Original Message-----
From: jonathan hashri [mailto:jonathan59hash@gmail.com]
Sent: Thursday, November 19, 2015 12:18 PM
To:
Subject: info

Hello,

Saw images of your paintings online, which really caught my attention. I am interested in purchasing paintings from your collection, can you please get back to me with the price range, sizes of your paintings, so i know how to go about my purchase.

Await your prompt reply.

Regards.

Scam Email: Todd Rieck

Dear Kathleen,

Thanks for your awesome art-scammers blacklist.  Here's unfortunately another one for you. The bad english from someone with an ultra-american name, combined with the clumsy non-knowledge of art and the mention of a cashier's check, give me 100% certainty.  Won't be wasting any more time here!  The IP address from the initial incoming email is also included.

Thanks for all you do and wishing you great success and lots of REAL collectors.  Hope it's okay to send this to you here; I couldn't get onto the website for some reason.



Name: Todd Rieck
E-Mail: todrieck@gmail.com
Message:


Dear M___,

Thank you for your email and more information about "______(DRAWING) ".

I am purchasing this for myself and my family purpose, I know my wife
will definitely like it because she like everything about Art.  Please
email me more details I need to know about the pieces.

Concerning the payment. I based in Illinois and that's where it will
be ship too. The payment I am 100% sure about is to send you a
Cashier's Check or Bank Draft for the total cost.

I will be expecting your email concerning this.

Cheers,
Todd


Sender IP: 207.244.83.214

Scam Email: Valdmir and Rebecca

Kathleen,

trick? or real?  trick!!!!  ;) d

Begin forwarded message:

From: Valdmir And Rebecca [bc5820823@gmail.com]

Date: November 11, 2015 9:51:23 AM PST

To: 

Subject: Art Inquiry

Hi,
Hope this message finds you well. I saw these creative works on your
website and I will like you to get back with more details if they are
still available for purchase.

Blue Heaven            36”x36”

I will appreciate an urgent reply.

Best Regards,

Rebeca

Never a good sign when they can't remember how to spell their fake name....

Scam Email: Michael Draxler

Kathleen,

I just received this email this morning and I knew it was a scam the moment I read it. I’ve seen a few similar to this one over the years.

No signature, bad English, certified check, and last but not least, they want to pick it up instead of having me ship it. 

Thought you might want to add the name to the list. 

Begin forwarded message:

> From: "Michael Draxler" [micdrax@europe.com]

> Subject: Lovers

> Date: November 11, 2015 at 8:09:46 AM MST

> To: 

> 

> Do you still have The Lovers available for sale as i am highly interested in it and do you accept certified check as a mode of payment and also if pick up is acceptable, hope to read from you soon

Scam Email: Greg Hembree

This was an obvious miss on the scammer's part but they could care less - they play a numbers game. They send out thousands of these emails seeking that small percentage that reply so that they can funnel those people closer to the heart of the scam - stealing their money by pretending to overpay and asking the "extra" be sent via wire (either back to them or to some non-existent shipper).

Heartbreaking and annoying for this husband, though.

Hey Kathleen....my name is Craig. My late wife was a very accomplished artist before cancer took her at a young age. This person below is clearly a scammer. He emailed her account. It's clearly a scam. I did not email back. Thanks for your blog post on the topic of scammers. Feel free to add this scum bag to your list.
Thanks...you have a great site and blog....
Craig 

Sent from my iPad
> On Oct 14, 2015, at 5:43 PM, Greg Hembree [greghembree01111@gmail.com] wrote:
>
> Hello,
>  I actually observed my wife has been viewing your website (piece in subject field above) on my laptop and i guess she likes that piece, I must also say you are doing a great job. I would like to know what inspired that work. I am very much interested in the purchase to surprise my wife. Kindly confirm the availability for immediate sales.
>
>  Peace and blessings,
>  Greg

Scam Email: James Chavez

Yes, even someone who hosts a blog and Facebook page about scammers, warning people how not to fall victim, receives these stupid emails as well.

To entertain myself, I removed the name of my art piece from the subject line and replied and asked which piece they were interested in. Now they won't be able to match what they said before. They may decide who cares and just pick another piece and see if I fall for it. Obviously I won't.

So I wonder to myself - are we all getting smarter? Are we googling names and emails before we send anyone money for any reason (particularly when WE are the seller!)? Are we making the scammer's life a harder one?

While I ponder this, here is the email I just received:

From: james chavez (jameschavez@gmail.com)
Subject: [Name of Piece] 

Greetings!
My name is James chavaz from south carolina. I actually observed my wife
has been viewing your website on my laptop and i guess she likes your piece
of work, I'm also impressed and amazed to have seen your various works too,
: )  You are doing a great job. I would like to receive further information
about your piece of work and what inspires you.

I am very much interested in the purchase of the piece (in subject field
above) to surprise my wife. Kindly confirm the availability for immediate
sales.
Thanks and best regards,
James.

In so many ways these emails haven't change over the years. Lately, it's a little less about them moving to some obscure country or that they are out of the country on "assignment" but you'll always know it's a scam if they overpay the amount (saying some scenario about a shipper) and ask the "difference" be sent via wire transfer. Your transferred money will be good but their money will be a counterfeit check or stolen credit card. That's the crux of the scam. They could care less about your art and they disappear with your money long before it even gets to the shipping stage.

So never accept over-payments, no matter what and NEVER ever ever wire money to anyone when you are the seller. No matter what their story is.




'Nuff said.