email scams

Nigerian Email Scams

Malware Patrol’s spam traps and honeypots capture messages and malicious URLs from all sorts of email scams and spam. One of the most well known is called the 419 or Nigerian scam.

In 419 email scams, the sender suddenly contacts victims, most of the time through text or email messages. They create elaborate stories about extremely large amounts of money supposedly “trapped” in a bank or suitcase found at an airport with a reason as to why it can’t go through customs and was left behind. The criminal then offers a slice of the cash, but first, the victim must send money for a made-up reason.

Email scam artists may ask for bank account details or other personal information to “help transfer money“ and later use this information to clean out funds. As soon as the first payment is made, the recipient starts coming up with additional reasons why more money is needed, at an increasing amount, to cover government restrictions, taxes, etc. Eventually, the scammer bleeds the victim dry and takes as much as they can. For some, this turns out to be nearly everything they have.

Origins and Warning Signs of Nigerian Email Scams

The commonly known “Nigerian 419” email scams originated in Nigeria. The name refers to the country’s criminal code, section 419, which prohibits this illegal activity and includes laws written for the handling of people found guilty of this violation. Because of their success, these email scams now come from all over the world.

The warning signs of this scam vary depending on the perpetrator and the style of choice. Unfortunately, scam artists have become very cunning over the years, finding many ways to lend credibility to their exaggerated stories.

One of the most noticeable trademarks of 419 email scams is the elaborate scenario created by the sender. The miscreant creates reasons such as a government agency, or other organization that requires the payment of an advance fee to release the “trapped” funds, or at least get the process moving. The process starts when contact is initiated by someone the victim doesn’t know, typically through text messages, emails, phone, social media, and, very rarely, face to face. Poor grammar and email formatting are also signatures of these schemes, but that doesn’t apply to every scammer as some have high level writing skills. Another warning sign is the offer of large sums of money in exchange for sending a small amount of cash their way, which later turns into increasing payments.

How to Protect Yourself from 419 Email Scams:

To protect yourself from 419 email scams, look for the warning signs:

• If you are contacted and believe it is a scam, do not respond. If you respond you are giving the criminal a chance to work their finesse and play on your emotions. At the same time your information is being collected and distributed to other scammers, basically stating that you are someone who responds and has potential to be lured into a scam again.

• Never send money or give credit card or online account details, or copies of personal documents to anyone you don’t know and trust.

• Avoid any arrangement with a stranger that ask for up-front payments through any means, such as money orders, wire transfers, pre-loaded cards, etc.

• No matter the promises made you will not receive the money that is offered. Money laundering is a criminal offense. If someone is claiming to be from a particular organization, investigate the organization and verify the person’s identity.

• Do not use any of the information the scammer provides to you. Do the search on the organization independently and, if available, call the institution to find out if that person really works there or not. Verify that the information on their site matches the information provided by the scammer.

• Copy the message contents if sent through text message or email and do an Internet search on it to help determine if it is a recurrently used scam.

• Remember, if it sounds too good to be true, it probably is.

Following are some examples of 419 email scams our systems collected in May 2018. You can notice the bad grammar and poor writing style, as well as the uniqueness of each email and how they were crafted around different reasons. Yet, all of them require victims to pay money for some reason in order to receive the promised fortune.

 

Examples of Nigerian email scams collected by our spamtraps and honeypots in May 2018

From: “Mr. Kennedy Uzoka” info@ubk.org>
Date: Wed, 02 May 2018 09:22:45

UNITED BANK FOR AFRICA – AFRICA’S GLOBAL BANK
HEAD OFFICE ADDRESS UBA HOUSE 57 MARINA P.O. BOX 2406 LAGOS NIGERIA
PHONE: +234 802 263 0701

On behalf of the board and management of International Monetary Funds (IMF). In conjunction with African Union (A.U) has directed us to pay you one Million five hundred thousand united state dollars ($1.500, 000.00) in Cash through means of diplomatic courier service hand delivery. We have been working towards the eradication of fraudsters and scam Artists in Africa with the help of African Union (A.U) United Nations (UN),Europea Union (EU) and FBI. We have been able to track down some scam artist in various parts of African countries which includes (Nigeria, Republic of Benin, Ghana and Senegal with cote ‘ivoire ) and they are all in Government custody now, they will appear at International Criminal Court (ICC) soon for Justice. Note: You have to stop communicating with the impostors right now and you have to stop sending money to them and stop responding to their emails, we are acting according to the Directive from UN, FBI, HLS, so any email you send to them will be monitored. Take note: Three thousand united state dollars (usd$3,000) have been Mapped out for all expenses in taxes and other documents that matters.

Kindly forward your home address and direct phone number to this email: mrknuzokauba@yahoo.com / mrkzukauba@gmail.com

Regards,
Kennedy Uzoka Director cash processing unit united bank for Africa. (U.B.A).
PHONE: +234 802 263 0701
FAX: 234 674 478 8273
Email: mrkuzokauba@yahoo.com / mrkzukauba@gmail.com

Reply-To: markchristopher46@yahoo.com
From: “Mr Roland de Marcellus” Info@essentialits.com
Subject: U.S DEPARTMENT OF STATE.

U.S Department of State 2201 C Street NW Washington, DC 20520.

Dear Beneficiary

Your ATM Visa Card will be shipped through USPS to your Address. I am Mr Roland de Marcellus, Acting Deputy Assistant Secretary of State for International Finance & Development (BUREAU OF ECONOMIC AND BUSINESS AFFAIRS). This is to inform you officially that after our investigations with the Federal Bureau of Investigation (FBI), Central Intelligence Agency (CIA) and other Security Agencies in the Country for the year 2017 and 2018, we discovered that you have not yet received your over due fund. I have made it my first point of call since taking office to settle all Outstanding Payments accrued to Individuals or Corporations with respect to local and overseas contract payment, Debt Rescheduling and Outstanding Compensation payment. This is to make sure all Outstanding payments are settled this fiscal year 2018. On Behalf of the entire staff of the U.S. Department of State and the United Nations in collaboration with World Bank, we apologize for the delay of your contract payment, Winning or Inheritance funds from most of African Countries and all the inconveniences you encountered while pursuing this payment. However, from the records of outstanding beneficiaries due for payment with the U.S Secretary of State, your name was discovered as next on the list of beneficiaries who has not yet received their payments. I have your file here in my office and it says that you are yet to receive your funds valued at US$1,850,000.00 (One Million, Eight Hundred And Fifty Thousand United States Dollars). This Funds will now be delivered to your designated address on your preferred payment option. We have perfected all modules on how to bring this fund to your designated address without any problem, but be aware that the United Nations and the United States Government has only authorized my office to release the Sum of US$1,850,000.00 to you as true beneficiary of the Funds. Note that your loaded ATM Visa Card will be mailed to you through Priority Mail Express (USPS) to your designated address immediately you admit full compliance to this email. Due to my busy schedules you are advised to kindly get in contact with our correspondent Mr Mark Christopher with the below details enclosed to help ensure safe mailing of your ATM Visa Card:

– Your Full Name:
– Your Contact House Address:
– Name of City of Residence:
– Country of Residence:
– Direct Mobile Telephone Number:
– ID Card, DL or Passport Copy:
– Age and Occupation:

Contact Mr Mark Christopher immediately by emailing the address below:

– Name: Mr Mark Christopher.
– Email: markchristopher46@yahoo.com
– Telephone: +1 (407) 479-7352

He is obliged to treat your case with utmost urgency as soon as you contact him and fill out your correct details including all reachable phone numbers for him to get in touch with you via phone and email.

NOTE: Every documentation proof for your fund have been packaged and sealed to be mailed together with your Visa Card to your address. Therefore, the only obligation required of you by the laws of the Government of United States and the financial Monetary Policy of the Supreme Court, states that; you as a beneficiary must officially obtain the irrevocable LEGAL STAY OF PROCEED from the Supreme Court of USA, as a means to justify the legitimacy, transparency and clean bill of funds from USA so that by the time your funds gets to you, no authority will question the funds as it has been legally certified free from all financial Malpractices and facets. The LEGAL STAY OF PROCEED is valued at a cost of ($550) please take note of that. As soon as the above mentioned $550 is received, The LEGAL STAY OF PROCEED will be secured on your behalf immediately. I need all the compliance that I can get from you to ensure we get this project accomplished. Personally, I am very sorry for the delay you have gone through in the past years. Thanks for adhering to this instructions which are meant for your sole benefit, once again accept my congratulations in advance. Thanks for your cooperation as your quick response to this email notice with adherence to the above instructions is highly anticipated.

Yours Sincerely,
Mr Roland de Marcellus.

From: “Mr. Paul Afkiri” info@adb.org
Date: Wed, 23 May 2018 05:26:11
Reply-To: paulafkiri@gmail.com

Hello Dear ,

I am Mr.Paul Afkiri. I work with the African Development Bank Plc, Benin Republic. I write to bring you this notice that the International Monetary Funds (IMF) through my Bank had selected your email address among the Scam victims listed to be Compensated. A total sum of $2,500.000.00 ( Two Million Five Hundred Thousands United State Dollars ) was Approved in your name to be delivered to you within 2 days by Cash through Diplomatic Courier Services. PLEASE NOTE: ( $5000.00) was removed from your Compensation Entitlement Funds for logistics. Therefore what you should be expecting to receive is a cash of $2,495,000.00 ( Two Million Four Hundred and Ninety Five Thousand United States Dollars ). Therefore you are advised to revert back for more details and guideline.

Thanks,
Mr. Paul Afkiri.
African Development Bank Plc, Benin Republic.

From: “Mr.Saleh Dunoma” uba@info,com>
Date: Fri, 18 May 2018 08:51:07
Reply-To: saleh.dunomafaan33@gmail.com

UNITED BANK FOR AFRICA – AFRICA’S GLOBAL BANK HEAD OFFICE ADDRESS UBA HOUSE 57 MARINA P.O. BOX 2406 LAGOS NIGERIA
PHONE: +2347O16847115
FAX: 234 674 478 8273

I Am Mr. SALEH DUNOMA the director cash processing united bank for African the international monetary fund (I.M.F.) in conjunction with Organization of African Unity (O.A.U) is compensating all the scam victims with $5.500.000.000USD, and your email address was found in the scam victim’s, the united bank for African and Federal Reserve Bank has been mandated by the (I.M.F) to pay your compensation ($5.500, 000.00USD) in cash through means of diplomatic courier service hand delivery, Take note that Three thousand united state dollars (usd$3,000) have been mapped out for all expenses in taxes and other documents that matters.

Therefore, do forward your home address, direct phone to this email, saleh.dunonmafaan33@gmail.com Contact phone number, +2347016847115, Please reply direct to this email: saleh.dunomafaan33@gmail.com

Regards,
Mr SALEH DUNOMA
Director cash processing united bank for Africa. (U.B.A).
PHONE: +234 7016847115

Reply-To: wc4953936@gmail.com
From: “Wayne Clifford”demo@bigzdemo.com
Subject: Hello i have an important message?
Date: Mon, 21 May 2018 10:01:37

Hello,

I am Mr. Wayne Clifford the Assistant Director Inspection Unit United Nations Inspection Agent in Hartsfield Atlanta International Airport Georgia USA. During my recent withheld package routine check at the Airport Storage Vault, I discovered an abandoned shipment from a Diplomat from London and when scanned it revealed an undisclosed sum of money in two Metal Trunk Boxes weighing approximately 25kg each. The consignment was abandoned because the Contents of the consignment was not properly declared by the consignee as “MONEY” rather it was declared as personal effect to avoid interogation and also the inability of the diplomat to pay for the United States Non Inspection Charges which is about $3,800 USD. On my assumption, each of the boxes will contain more than $1 Million to $1.5 Million each and the consignment is still left in our Storage House here at the Hartsfield Atlanta International Airport Georgia till date. The details of the consignment including your name, your email address and the official document from the United Nations office in Geneva are tagged on the Metal Trunk boxes. However, to enable me confirm if you are the actual recipient of this consignment as the assistant director of the Inspection Unit, I will advise you provide your current Phone Number and Full Address, to enable me cross check if it corresponds with the address on the official documents including the name of nearest Airport around your city.

Please note that this consignment is supposed to have been returned to the United States Treasury Department as unclaimed delivery due to the delays in concluding the clearance processes so as a result of this, I will not be able to receive your details on my official email account. So in order words to enable me cross check your details, I will advise you send the required details to my private email address which is ( 2434393656@qq.com) for quick processing and response.

Once I confirm Lastly, be informed that the reason I have taken it upon myself to contact you personally about this abandoned consignment is because I want us to transact this business and share the money equally since the consignment has not yet been returned to the United States Treasury Department after being abandoned by the diplomat so immediately the confirmation is made, I will pay for the United States Non Inspection Fee and arrange for the boxes to be delivered to your doorstep Or I can bring it by myself to avoid any more trouble. But I will share it 50%/50% with you. But you have to assure me of my 50% share.

Below is my direct telephone number but if you are unable to reach me know that I am on inspection just email me and make sure you include your mobile number so that I can give you a call. I wait to hear from you urgently if you are still alive.

Mr. Wayne Clifford Assistance Inspection Director
Hartsfield Atlanta International Airport
574 Airport South Pkwy
Atlanta, GA 30349-8642

I only Recieved Text only due to this is confidential between i and you Tel:860-896-7664 wc4953936@gmail.com

Mail from: goodg9700@gmail.com
From The Police Command Headquarters. 176.107.181.163
From: “Inspector Ibrahim Idris” goodg9700@gmail.com
Date: Mon, 07 May 2018 01:55:47
Reply-To: inspectorgeneralofficer@gmail.com

Image result for arrested by police in nigeria
Police Command Headquarters Address: Garki 2, Abuja
Motto: Fighting Faud In Africa
Hot-line: Call: +234-7087578596
Email: inspectorgeneralofficer1@secretary.net

My Dear:

Congratulations,

This notification email is coming to you from Police Command Headquarters and please immediately you receive this message do let us know by responding back, because we need to carry on with this important work accordingly, we are writing to let you know that we have three gentlemen arrested in the Western Union/Money Gram yesterday name Eze John and Augustine Oge also fake Diplomat, and one of them came from Accra-Ghana and through our investigation we discovered your email address from one of them, which proved that they have scammed you before, The fact is that one of them made us clear that they did scammed you. Please this office don’t have much time for this issue for now. As you can see, we are very busy based on the mandate given to us by the present Government to arrest most of this hoodlums who have engaged themselves in scamming foreigners. be kind enough to reach us with all your contact details , you are also advised to send down your office address, your phone number and the list of amount you have spent to this internet scammer in Africa so far, first thing tomorrow morning we will lead them to court and from the court they will be sent to jail and court will reverse back all your money you have lost in the past including the recovered money/cars properties. These individuals in our custody have confessed they have other syndicates communicating and scamming people in other parts of the world like, USA, Canada, Europe and Asia. Desist from any suspicious emails or phone calls from any of these places and report such to us.

You are hereby advised to email us back immediate with the needed details, including the amount they collected from you, if you don’t know the exact amount you have spent under internet scammer’s control, do advise us with your past experience with those scammers, but if you don’t know the specific amount you have spent, do tell us that you don’t know the amount so that the court will charge the Countries how much they will pay you as your Conmpensation. Please all we need is the truth and if you never spent any money to the scammers just make us clear. send the email here inspectorgeneralofficer1@secretary.net also call me as soon as you send the e-mail so that you will be given an immediate respnonse:

Direct Hot-line: Call:+234-7087578596

We wait to have the details from you as soon as you get this mail. On what ever happened at the Court tomorrow, we will let you know. you can reach us any time, please don’t forward this email to any person from Africa to avoid them using it to do their bad work on the name of West Africa Interpol Service please.

Thanks,
Inspector Ibrahim Idris Kpotum
The Inspector-General of Police (IGP).C.T.
Police Command Headquarters

IOCs – indicators of compromise detected in these campaigns

Scammer’s email addresses

2434393656@qq.com
demo@bigzdemo.com
info@adb.org
Info@essentialits.com
info@ubk.org
inspectorgeneralofficer@gmail.com
inspectorgeneralofficer1@secretary.net
markchristopher46@yahoo.com
mrkuzokauba@yahoo.com
mrkzukauba@gmail.com
paulafkiri@gmail.com
saleh.dunomafaan33@gmail.com
wc4953936@gmail.com

Scammer’s phone and fax numbers

+1 (407) 479-7352
+1 (860) 896-7664
+234 674-478-8273
+234 701-684-7115
+234 708-757-8596
+234 802-263-0701

IP addresses of email senders

142.147.97.162
176.107.181.163
177.66.192.182
37.49.224.191
37.49.227.15
37.49.227.163
37.49.227.224
86.43.89.238