When one is flushing out an email scammer, and doesn’t have time to draw the scammer out, one turns to Google for help.
I received an attempted email scam recently, which only had scant hallmarks of a scam, but could have cost us a lot of cash in any event. As I only found the merest clue on Google, it looks as if nobody else has yet flushed this incarnation of this guy out – so I will.
At our business email, I received a fairly innocuous email that said this:
I need to know if you have the below items for sale and also the last asking price.
[list of our stock inserted here]
Do get back to me about this because we really need it urgently.
Thanks and i await your utmost response.
+44 703 188 3026
This email came from email@example.com
We are in the UK, and that is a UK mobile number. However, something about that grammar didn’t smell right. (I wont spell out exactly what as I don’t want to train scammers).
So I checked the headers in his email, his IP address is 22.214.171.124 which traces to an Emirates Telecommunications Corporation connection in Sharjah in the UAE. Maybe a British guy in the UAE you think? Innocent up to now you think? Lets keep digging…..
I replied our hopeful purchaser advising him we didn’t supply to his country. I got this reply:
Thanks for the reply and about the phone number am currently here to open a new branch and we would be operating from here also you would not be shipping here we would make the payment and after all is been settled our shipper will come over for pick up. My phone is roaming now Thats why.
If this is okay by you please do get back to me so we can conclude on this.
Yup. Definitely not British English grammar. I decided not to participate further with this one. However, thinking he might have one on the hook, he sent me a further email pestering for contact. Good luck with that…..
So here is the tell tale line before we investigate further: our shipper will come over for pick up
So here is how this would go: Scammer places large order, and wants to arrange his own couriers to pick up. Scammer then “pays” either by cheque/draft (which is fake) or using stolen credit card data. You release the goods to his courier, shortly thereafter you learn the cheque/draft is fake or the credit card payment gets reversed. You cannot halt the consignment delivery because it was picked up by people unknown. Slick huh?
However, I am not one to be judge, jury and executioner [before the event] without further evidence. So what does Google tell us? His email, email address and IP number Googles clean. But what of that +44 703 188 3026 phone number? Google yields one entry on that and it is here. On that link we get the information that this phone number is connected to another email address: firstname.lastname@example.org. Googling that new email address finds it in a list of published email addresses on this site.
Lo and behold, the trail leads us to modelling scams. Likely operated by Nigerians, or perhaps the UAE. Busted!
Naturally, if Craig emails you in his honky plonky non-British grammar, politely decline his polite offer to patronise your business or simply ignore his email. But don’t tell him how you found out, better not to teach these people.