This is the “Real Deal”

When one is flushing out an email scammer, and doesn’t have time to draw the scammer out, one turns to Google for help.

I received an attempted email scam recently, which only had scant hallmarks of a scam, but could have cost us a lot of cash in any event. As I only found the merest clue on Google, it looks as if nobody else has yet flushed this incarnation of this guy out – so I will.

At our business email, I received a fairly innocuous email that said this:

Hello,

I need to know if you have the below items for sale and also the last asking price.

[list of our stock inserted here]

Do get back to me about this because we really need it urgently.

Thanks and i await your utmost response.

Regards,

Craig.

+44 703 188 3026

This email came from craigmatthewsimms@yahoo.com

We are in the UK, and that is a UK mobile number. However, something about that grammar didn’t smell right. (I wont spell out exactly what as I don’t want to train scammers).

So I checked the headers in his email, his IP address is 86.96.59.104 which traces to an Emirates Telecommunications Corporation connection in Sharjah in the UAE. Maybe a British guy in the UAE you think? Innocent up to now you think? Lets keep digging…..

I replied our hopeful purchaser advising him we didn’t supply to his country. I got this reply:

Thanks for the reply and about the phone number am currently here to open a new branch and we would be operating from here also you would not be shipping here we would make the payment and after all is been settled our shipper will come over for pick up. My phone is roaming now Thats why.
If this is okay by you please do get back to me so we can conclude on this.

Regards,

Craig.
Yup. Definitely not British English grammar. I decided not to participate further with this one. However, thinking he might have one on the hook, he sent me a further email pestering for contact. Good luck with that…..

So here is the tell tale line before we investigate further: our shipper will come over for pick up

So here is how this would go: Scammer places large order, and wants to arrange his own couriers to pick up. Scammer then “pays” either by cheque/draft (which is fake) or using stolen credit card data. You release the goods to his courier, shortly thereafter you learn the cheque/draft is fake or the credit card payment gets reversed. You cannot halt the consignment delivery because it was picked up by people unknown. Slick huh?

However, I am not one to be judge, jury and executioner [before the event] without further evidence. So what does Google tell us? His email, email address and IP number Googles clean. But what of that +44 703 188 3026 phone number? Google yields one entry on that and it is here. On that link we get the information that this phone number is connected to another email address: lambart7@gmail.com. Googling that new email address finds it in a list of published email addresses on this site.

Lo and behold, the trail leads us to modelling scams. Likely operated by Nigerians, or perhaps the UAE. Busted!

Naturally, if Craig emails you in his honky plonky non-British grammar, politely decline his polite offer to patronise your business or simply ignore his email. But don’t tell him how you found out, better not to teach these people.

Phishing fraudsters pretending to be from Paypal email me most days. Sometimes, they even have my real name (eBay transactions with the Muslim community is usually to blame for the name getting out there). However, you likely landed here after Googling “notice@security.org” or “patrick1178@btconnect.com”

Paypal do not send out emails from a “security.org” address – certainly not a fake one. The domain security.org is a site about lock-picking Medeco locks (whatever they are). Nothing to do with Paypal anyway.

This email comes addressed to “Dear Paypal Customer” – which is wrong. Paypal know your name. If they are writing to you, they will use it.

Apart from the bullsh*t domain, wrong email and not knowing the name of the customer, this one has other howlers: Sending attachments – Paypal don’t do that. Specifying which browser you must open the attachment with – yeah, Paypal don’t do that either. That just means the virus they are sending you only works in insecure browsers. Spelling mistakes: A true sign of a non-English speaking scammer. I wont highlight them so they cannot correct them when they read this.

So, here is the email:

Dear PayPal Customer,

You have added patrick1178@btconnect.com as a new email address for your Paypal account.

If you did not authorize this change, check with family members and others who may have access to your account first. If you still feel that an unauthorized person has changed your email, submit the form attached to your email in order to keep your original email and restore your Paypal account.

NOTE: The form needs to be opened in a modern browser which has javascript enabled (ex: Internet Explorer 7, Firefox 3, Safari 3, Opera 9)

Please understand that this is a security measure intended to help protect you and your account. We apologize for any inconvenience.

If you choose to ignore our request, you leave us no choice but to temporary suspend your account.

Sincerely, PayPal Account Review Department.

Please do not reply to this e-mail. Mail sent to this address cannot be answered. For assistance, log in to your PayPal account and choose the “Help” link in the footer of any page.

Copyright © 1999-2011 PayPal. All rights reserved.

All rubbish of course. DO NOT open the attachment called “PersonalProfileForm-payPal.htm” – that is full of viruses! If you did, change your Paypal passwords immediately and do a virus check on your computer.

So lets see where this fake email was sent from:

It comes from the IP 96.57.179.66 which is traced to a company called Allen Linen in North Brunswick in the USA.

Here is their contact details:

Allen Linen Supply
407 20th Ave.
Paterson, NJ 07513
Phone: (973) 742-6131
linenguy@allenlinen.com

Why not contact them and ask why someone is sending phishing emails off their server? That is surely a crime in the land of the free.

However, more digging reveals that “109.203-211-146.static.qala.com.sg” is the sender. That resolves to someone in Barnaul in Russia but has Singapore tags on it. The plot thickens when “www.edenhotelsandresorts.com 203.211.146.108″ is introduced into the mix – also from the email headers. That does trace to Singapore. The site www.edenhotelsandresorts.com doesn’t work and also traces to Singapore. Here is teh domain info:

Domain Name:edenhotelsandresorts.com
Record last updated at 2011-09-20 06:05:47
Record created on 1/18/2006
Record expired on 01/18/2014

Domain servers in listed order:
ns1.webdesignwebdev.com ns2.webdesignwebdev.com

Administrator:
Unit 107, Marina Residence, No.8, Kabaaye Pagoda Rd
Yangon
YGN,
MM
Mayangone

name:(Eden Group Co., Ltd.)
mail:() +95.01650624
+95.01650624
Eden Group Company Limited
Technical Contactor:
#3/1, Myanmar Info-Tech, Universities Hlaing Campus
Yangon
YGN,
MM
11052

name:(Zaw HTUT)
mail:() +95.01652250
+1.7079880300
Myanmars.NET
Billing Contactor:
Unit 107, Marina Residence, No.8, Kabaaye Pagoda Rd
Yangon
YGN,
MM
Mayangone

name:(Eden Group Co., Ltd.)
mail:() +95.01650624
+95.01650624
Eden Group Company Limited

Registration Service Provider:
name: Myanmars.NET
tel: +95.01652250
fax: +1.7079880300
web:http://www.myanmars.net

So what we have here is likely a scammer from Singapore routing through a proxy server in Russia, and again through another via an innocent linen company in the US to send you his Paypal scam email. Now don’t go writing about his scheme on the internet will you? Dammit…….. I just did!

Looking for a local number for DPD Geopost? Here they are:

Delivery firm DPD is doing very nicely, judging by its latest accounts says the Daily Mirror.

It’s owned by Geopost UK (ultimate parent company is La Poste in France), which last year made a £34million profit, £20m was trousered by shareholders, and the top director got £465,000

They don’t publish local phone numbers except a dratted 0844 number. I hate those, so here they are:

Customer Services: Dont ring 0845 930 0100 – Try: 0121 569 1390 or 0121 525 4065.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 0113 292 5600- – Leeds depot. Also: 0113 292 5643.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01622 714606- – Maidstone depot. Also: 01622 714630 /643 /646.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 0116 250 1606- – Leicester depot.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 0141 305 3600- – Glasgow depot. Also: 0141 305 3643.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 0161 956 5640- – Salford depot.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01745 357800- – Abergele depot. Also: 01745 357843.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01772 662600- – Preston depot. Also: 01772 662643 /646.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01933 414606- – Rushden depot.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01904 527606- – York depot. Also 01904 527643 & 01904 476606.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01733 842643- – Peterborough depot. Saville Road, Westwood, Peterborough, PE3 7PR. Also: 01733 842606 /646.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 023 8025 8600- – Southampton depot.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 0115 977 7600- – Nottingham depot.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 0161 777 4606- – Manchester depot.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 020 8498 8600- – Woodford Green depot.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01392 449600- – Exeter depot. Also: 01392 449643.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 020 8453 9500- – Park Royal depot.
Frogmore Industrial Est, Acton Lane, Acton, NW10 7NQ.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 0191 402 5600- – Newcastle upon Tyne depot.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01582 470600- – Dunstable depot. Also: 01582 470606 /643.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01322 625600- – Dartford depot. Also: 01322 625643 /646.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01245 232056- – Chelmsford depot. Montrose House, Montrose Road, Dukes Park Ind Est, CM2 6TE.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01925 605600- – Warrington depot. Also: 01925 605606 /646 /647.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 0118 923 2600- – Reading depot.

*DPD- – 0844 824 0505- 01- 313354043- Edinburgh depot.

*DPD- – 0844 824 0505- 01- 215002500- Edinburgh customer service.

*DPD- – 0844 824 0505- 0141 305 3643- – This is the Cambuslang branch at Glasgow.

*DPD- 0871 244 4442- 0844 824 0505- 020 8978 3843- – Park Royal/Acton Depot.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01792 704640- – Swansea depot.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01872 574643- – Truro (Goonhaven) depot. Also: 01872 574606 /642.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01452 727150- – Gloucester depot. Also: 01452 727193 /196.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01293 893646- – Crawley depot. Also: 01293 893647.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01635 812643- – Newbury depot. Also: 01635 812606.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 020 8243 3606- – Croydon depot. Also: 020 8243 3643.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01202 850300- – Bournemouth depot.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01228 829606- – Carlisle depot.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01698 811235- – Glasgow 2 depot.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 0131 335 4000- – Edinburgh depot. Also: 0131 335 4043 /4045.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 0117 941 5600- – Bristol depot. Also: 0117 941 5643.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01782 578646- – Stoke on Trent depot. Also: 01782 578605.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 020 7394 3926- – London Bridge depot. Mandela Way, London, SE1 5SE. Also: 020 7394 3949.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 020 7391 8643- – King’s Cross depot. Also: 020 7391 8606.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 0114 257 2643- – Sheffield depot.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 020 8601 7643- – Wembley depot.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 029 2077 2600- – Cardiff depot. Also: 029 2077 2643.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01224 878686- – Aberdeen depot.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01842 855643- – Thetford depot. Also: 01842 855646.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 028 9044 9700- – Belfast depot.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01698 811235- – Glasgow 2 depot.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 020 8243 3641- – London South (Croydon) depot. Also 0208 243 3643.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 020 8978 3843- – Park Royal depot.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 01726 892600- – Roche, Cornwall depot.

*DPD (GEOPOST)- 0871 244 4442- 0844 824 0505- 01224 216143- – ABERDEEN DEPOT.

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 0191 402 5643- – Newcastle upon Tyne depot.

*DPD (Geopost)- – 0844 824 0505- 0117 937 3474- – Yate Depot.

*DPD Crawley Depot (for Brighton & Hove)- – 0844 824 0505- 01293 893647

*DPD (Geopost)- 0871 244 4442- 0844 824 0505- 028 8772 9306- – OMAGH DEPOT.

*DPD (Geopost)- – 0844 824 0505- 01726 892643- – St Austell branch.

Do you know any other DPD telephone numbers? Add them below using the comment box.

I get a lot of spam. Predictably much of it Russian bride related. However, these clowns are spamming one of our site addresses.

Not just the odd one either. I am getting several a day from all different addresses. But they all point to the same site: dateritme.ru

So, it narked me off deleting this crap (which passes the spam filters incidentally) and I spent 5 minutes researching them.

Here is another one I got just now:

Hello dear, do you remember how we communicated with you? Long ago you could not see, I am Marina – with Russia, do you remember me? “Come to my page – let’s talk, I’m waiting!
dateritme.ru

Rocket science it isn’t. But, it is worth noting for the benefit of Googlers.

So here is the data:

Header Analysis Quick Report
Originating IP: 81.3.27.99
Originating ISP: Hostway Deutschland GmbH
City: n/a
Country of Origin: Germany

It appears to come from Germany, but in there also is this IP in the headers: 46.100.166.212 which originates in Iran. Neither IP shows a city, so I am thinking they are likely just spamming proxies.

The reply email address is: allison.lewin@keller-verlag.de – again German. The domain keller-verlag.de traces to this:

Domain: keller-verlag.de
Nserver: ns1.s-dns.de
Nserver: ns2.s-dns.de
Status: connect
Changed: 2008-02-12T22:13:29+01:00
[Tech-C]
Type: PERSON
Name: Edeltraud Kreft
Address: THUECOM Medien GmbH
Address: Zittauer Str. 30
PostalCode: 99091
City: Erfurt
CountryCode: DE
Phone: +49 361 730 8800
Fax: +49 361 730 8820
Email:
Changed: 2001-10-05T19:18:36+02:00
[Zone-C]
Type: PERSON
Name: Edeltraud Kreft
Address: THUECOM Medien GmbH
Address: Zittauer Str. 30
PostalCode: 99091
City: Erfurt
CountryCode: DE
Phone: +49 361 730 8800
Fax: +49 361 730 8820
Email: kreft@thuecom.de[/quote]
The domain dateritme.ru only gives us this:
[quote]domain: DATERITME.RU
nserver: ns1.reg.ru.
nserver: ns2.reg.ru.
state: REGISTERED, DELEGATED, UNVERIFIED
person: Private Person
e-mail: audrawajmi@mail.com
registrar: REGRU-REG-RIPN
created: 2011.10.15
paid-till: 2012.10.15
source: TCI

That is a commercial site pretending to be a private individual.

The site dateritme.ru is hosted in Turkey at 31.210.103.7

The name “audrawajmi” doesn’t sound either Russian or German. Turkish or Iranian? Maybe. So dateritme.ru is a Russian domain, with the owners ID falsely withheld, hosted in Turkey, likely operated from Germany by Turks or Iranians.

Not the best place to seek out a Russian wife methinks!

If you are Googling for information on Skye Bank PLC email scam, here it is. Thisis the scam email being sent out:

An advance-fee fraud is a confidence trick in which the target is persuaded to advance sums of money in the hope of realizing a significantly larger gain. Among the variations on this type of scam are the Nigerian Letter (also called the 419 fraud, Nigerian scam, Nigerian bank scam, or Nigerian money offer), the Spanish Prisoner and the the black money scam.

INSTRUCTIONS TO CREDIT YOUR ACCOUNT WITH US$10,000,000.00 (TEN MILLION UNITED STATES DOLLARS) ONLY.

Dear Valued Customer,

The Skye Bank Plc: is a finance company based here in Nigeria; we represent some African governments to offset their debts that have arrived from contract jobs, inheritance, and major trade funds. These countries include Ghana, Togo, Benin, Cameroun, and South Africa etc.

I would want you to know and understand that I do not know you in person neither have I in anyway transacted with you before but I am contacting you on the information given to me by the governing body of this bank and in reference to the enabling act of the World Bank/ IMF payment prerequisites.

Presently, I have your email address on my file for immediate PAYMENT CONTACT, which was approved by the accountant general, as all claims for this quarter of the fiscal year approved are paid out through our bank.

You are required to contact, Senior Manager, Currency Control Unit/Remittance for your claims. You are advised to attach to your email with the below information to enable the completion of your fund wire transfer:

Beneficiary’s Full name:
Address:
Tel:

Please Contact:

Mr. Akowonjo Jones
Senior Manager: Remittance/Currency Control Unit,
For: Skye Bank Plc,
E-mail:skyebank@yahoo.cn

We are very sorry for the delay on proceed please accept our apologies.

Yours Faithfully

Mrs. Elizabeth Johnson
Secretary to: Foreign Operations
For: Skye Bank Plc

Here is the IP trace information:

Header Analysis Quick Report
Originating IP: 113.161.68.11
Originating ISP: VietNam Post and Telecom Corporation
City: Ho Chi Minh City
Country of Origin: Vietnam

Nigerian scammers take on many forms and contact many small businesses.

They will typically use stolen credit card details, pretend to be big importer/exporters of whatever you sell and happily place a big order. Well, wouldn’t you place a big order if you were getting it for free? A new idea is to use their stolen cards to arrange their own couriers. That way, when it leaves your premises, you have no right of recall when the payment is reversed by the bank hours later; when the fraud is detected.

They like to try to rip off small businesses because they imagine small business owners will not be au fait with 714 and other Nigerian scams. Well, some small business owners are educated on such things, and some of them run blogs like this.

I guess that’s a fail for Mr Nbogo or whatever this scammer is called. His email address is: poohloves28@msn.com

So here was his introductory email:

Hello,

This mail is to make inquiry on the below question.

1- Do you carry overseas? (though i already know of a freight forwarder that will pick my packages from you,since they ship lesser than any other courier and they are so effective in shipping my goods to me here in Melbourne Victoria,Australia is estimated to be 3-4days) I have used their services in the past and it was splendid.

2- Do you accept credit card for payment(my U.S.A Master and Visa card to be precise)?

Kindly let me know your comments on these, before i send the items i am interested in purchasing from you.

Sam Woods
Owner
The girl who handles orders in our shop smelled a rat immediately and left it for me to reply to.

So our hero is in Australia and has US credit cards and very grim English? Hmmm…….. so lets head on over to http://www.iptrackeronline.com/header.php and check out where his email came from.

Whoops!

Header Analysis Quick Report
Originating IP: 41.184.24.44
Originating ISP: IPNX Nigeria Ltd
City: Ikeja
Country of Origin: Nigeria

Doesn’t sound like an Australian with an American credit card does it?

Of course not. This is an attempted Nigerian scam. So we sent him this reply:

Hello,

Your IP address and bad English tells me that you are not in Australia; rather that you are in Nigeria. Ikeja to be exact.

We do not ship to Africa. More especially, we do not ship to Nigerians with allegedly American credit cards who pretend to be in Australia.

Better luck next time with your attempted scam.

Kind regards,
Mr White.

We will never stop these people; but at least we can share their info for Google as I have done here and reply and laugh at them.

Hello. I’m Kseniya. Im the lonely women. I do not have man’s attention. I want to find men serious relationship. If it is interesting to you, write me please on my e-mail: kloputera@yahoo.com. It will be very good if you answer me. Yours Kseniya

If you are Googling for the addresses gasilery@yahoo.com, jenna_32kt@yahoo.com or karopera@yahoo.com you are in the right place.

We all get many of these things a day, but some people wonder if they are real and go Googling.

This is a typical spammy email that purports to come from a Russian woman. It probably actually comes from some big hairy guy. For sure, the sender is nowhere near Russia. The sender of this email is in either Poland, or more likely France. The purpose is to engage lonely guys in chat and eventually ask for money under some false pretext. Sick mother, internet access, translation, etc.

Tracing the IP addresses tells us it comes from one of two IP’s. 87.205.180.223 which is a Polish Netia SA IP, or more likely 2.0.0.23 which is a French France Telecom IP.

Here is the body of the email:

Good day!!! I’m Tatyana. I am the lonely women. I don’t have man’s heat. I want to find men for family creation. If it is interesting to you, answer me please on my email: gasilery@yahoo.com. I very much wait for your letter. I am send you my photo. Kisssss Tatyana.

Here is the fake photo that came with it:

Probably the photo is stolen. That could be anyone. Most likely just a regular girl who had her photo stolen off MyDot or somewhere. She likely doesn’t know her photo is being used in this scam.

The email title was “best regards my friend”

Russian women DO NOT send out random rubbish like this to complete strangers. If you want to know everything there is to know about how real Russian women communicate with foreigners, and how to build a relationship with one, pick up a copy of the Russian Bride Guide and learn the real facts.

Do not get sucked into corresponding with male scammers such as are likely the writers of this unconvincing tome.

Watch out for emails claiming to be from DVLA asking you to verify your driving licence details via an online link – it’s a scam. DVLA has not sent any such email, so if you get one delete it immediately.

This is a phishing exercise. Phishing is a way of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication. Communications purporting to be from popular social web sites, auction sites, online payment processors or IT administrators are commonly used to lure the unsuspecting public. Phishing is typically carried out by e-mail or instant messaging, and it often directs users to enter details at a fake website whose look and feel are almost identical to the legitimate one. Phishing is an example of social engineering techniques used to fool users, and exploits the poor usability of current web security technologies. Attempts to deal with the growing number of reported phishing incidents include legislation, user training, public awareness, and technical security measures.

The DVLA email we are discussing today appears to be an attempt to trick drivers into providing personal details. If you get the email below, do not respond to it and delete it immediately.

From: DVLA

Subject: Update Your License Details

We are currrently upgrading our database and all drivers are required to update and verify there driver’s license details.To complete your license verification with us, you are required to fill out the form in the link below.

{Fake link}

Drivers that refuses to upgrade his or her details within two weeks of receiving this verification email will lose his or her driver’s License and will have to take a fresh driving test.

We sincerely apologise for any inconviniences this might have caused you.

Thank you for your co-operation.

(c) Driver and Vehicle Licensing Agency Swansea SA6 7JL

Observe the mistakes in the email.

The word “licence” has the incorrect American spelling of “license”

The word “inconviniences” is wrong – it should be “inconveniences”.

The term “a fresh driving test” is not British English. That is also American/International English. In the UK, bread is fresh; driving tests are not.

The line “We sincerely apologise for any inconviniences [sic] this might have caused you” – that is past tense. This would have indicated you have done it already. A British English speaker might say, “We sincerely aplogise for any inconvenience this may cause you”.

The line “Drivers that refuses to upgrade his or her details” is wrong. What’s with the extra “s”? Maybe Mr Nbogo meant “Drivers that refuse”? Also, one doesn’t “upgrade” his details; one upgrades a database. He probably means update.

At least they didn’t put a “z” in apologise. They tried a little! The scammers need to go back to school before they pretend to be British.

Probably this e-mail is from African scammers. Do not reply to it. Do not open the link in it. Simply delete it.

If you have opened the link – virus sweep your computer immediately. If you have filled in any details, refer to this advisory on the DVLA website and get in touch with them. You may need a new licence number.

Paypal and Credit Card Chargeback Scammer:

Jeff Smith (Check Ride)
13632 NE 177th PL
Woodinville, WA 98072
United States

jeffsmith@check-ride.com