• Security Alert from the board of trustee
• RE: Hello
• I AM WAITING TO HEAR FROM YOU SOONEXT
• RE: CHANGE OF YOUR BANK A/C DETAILS/ REPLY ASAP!
• CONTACT MY SECREATARY
• FROM THE DESK MR MUHAMMED OMAR
• Strictly Confidential
• Your Winnings
• CONTACT ME URGENTLY
• From: Central Bank ATM CARD
• Dear e-mail owner
• RELEASE OF YOUR FUND VALUED 8.3M DOLLARS
• Your Payment
• CONTACT MR WILL FREEMAN
• IMMEDIATE DELIVARY OF YOUR FUNDS

These are just a handful of the many, many different email subjects lines associated with scams that have one purpose…to steal someone’s money and/or identity.  If you have ever read these types of scam emails, you have may noticed that many of them ask for the following types of information:

1) YOUR FULL NAME:
2) FULL ADDRESS OF YOUR CITY, STATE AND COUNTRY:
3) PHONE, FAX AND MOBILE:
4) COMPANY NAME, POSITION AND ADDRESS:
5) BANK INFORMATIONS:
a) BANK NAME:
b) BANK ADRESS:
c) ACCOUNT NUMBER:
d) SWIFT CODE/
e) ROUTING NUMBER:
6) PROFESSION,AGE AND MARITAL STATUS:
7) A COPY OF YOUR INT’L PASSPORT/DRIVERS LICENSE

As people become more savvy, the scammers have to come up with new ways to trick their victims; well, here is a new scam we received.  As you will see, it doesn’t follow the typical promise stating that someone left you millions of dollars or you just won a lottery somewhere; instead, the scammers are using a new angle, stating that FedEx has a package waiting for you and all you have to do is complete a form to receive the package.  Here is the scam:

From:     Add Contact
FedEx Online Management Team
“FedEx Online Management Team” <fedex012@msn.com>
Subject:     NOTIFICATION

Customer Service:Dear Customer,We have been waiting for you to contact us for your Package that is been registered with us for shipping to your residential location. We had thought that your sender gave you our contact details. It may interest you to know that a letter is also added to your package. However, we cannot quote it’s content to you via email for privacy reasons. We understand that the content of your package itself is a Bank Draft worth of $900,000.00 USD. As you know, FedEx do not ship money in CASH or in CHEQUES but Bank Drafts are shippable. The package is registered with us for mailing by your colleague as claimed, and your colleague explained that he is from the United States but he is here in Vietnam for a three(3) month Survey Project as he works with a construction firm in Vietnam Asia. We are sending you this email because your package is been registered on a Special Order. What you have to do now, is to contact our Delivery Department for immediate dispatchment of your package to your residencial address. Note that as soon as our Delivery Team confirms your informations, it will take only one working day (24Hrs) for your package to arrive it designated destination.For your information, the VAT & Shipping charges as well as Insurance fees have been paid by your colleague before your package was registered.Note that the payment that is made on the Insurance, Premium & Clearance Certificates, are to certify that the Bank Draft is not a Drug Affiliated Fund (DAF) neither is it funds to sponsor Terrorism in your country.

This will help you avoid any form of query from the Monetary Authority of your country. However, you will have to pay a sum of £100 which is equivalent to $199.432 USD to the FedEx Delivery Department being full payment for the Security Keeping Fee of the FedEx company as stated in our privacy terms & condition page. Also be informed that your colleague wished to pay for the Security Keeping charges, but we do not accept such payments considering the fact that all items & packages that is registered with us have a time limitation and we cannot accept payment without knowing when you will be picking up the package or even respond to us. So we cannot take the risk to have accepted such a payment incase of any possible demurrage. Kindly note that your colleague did not leave us with any further information. We hope that you respond to us as soon as possible because if you fail to respond until the expiry date of the foremost package, we may refer the package to the British Commission for Welfare as the package do not have a return address. Kindly contact the delivery department (FedEx Delivery Post) with the details given below:Contact Person: Mr. Chu Van Duong.Email: fedexdeliveriesvn@yahoo.com.vn
Kindly complete the below form and send it to the email address given above. This is mandatory to reconfirm your Postal address and telephone numbers.FULL NAMES:TELEPHONE:POSTAL ADDRESS:CITY:STATE:COUNTRY:As soon as your details are received, our delivery team will give you the neccessary payment procedure so that you can effect the payment for the Security Keeping Fees. As soon as they confirm your payment of £100 GBP which is equivalent to $199.432 USD, they shall immediately dispatch your package to the designated address. It usually takes 24 hours being an over night delivery service. Note that we were not instructed to email you,but due to the high priority of your package we had to inform you as your sender did not leave us with his phone number because he stated that he just arrived England and he wasnt on phone yet. We indeed personally sealed your Bank Draft and we found your email contact in the attached letter as the recipient of the foremost package. Ensure to contact the delivery department with the email addressand ensure to fill the above form as well to enable successful reconfirmation.All responses must be forwarded to: fedexdeliveriesvn@yahoo.com.vnYours Faithfully,Mrs. Margaret Blaire.FedEx Online Management Team.All rights reserved. © 1995-2008 FedEx.

Scammers rely on human greed to get some poor soul to take their bait.  If you think about this particular email…how many times has FedEx sent you an email requesting that you complete an online form to receive a package?  I would be will to bet the answer is “NEVER!”.  Also, check out the horrible grammar; how long would FedEx be in business if they sent such poorly written correspondence?

The point here is simple…any time you receive an unsolicited email and the sender is requesting information from you; delete it!  It’s evil!

Royal Dutch Shell plc.
SHELL GROUP INTERNATIONAL UK .
Shell Centre London
SE1 7NA.
(Registration 70339411).
REGISTERED UNDER THE DATA PROTECTION ACT.
REF NO: HLP/200-26937
BATCH: 2008MJL-01

Attention: Winner,

We wish to heartily congratulate you on your emergence as a 2008 SHELL GROUP AWARDS-INTERNATIONAL PROGRAMS winner.
Your email which drew the winning number, of our yearly cash give away Promotions, was selected via our Random Computer Selection System (RCSS) and attached to file reference number (HLP/200-26937).
We write to hereby inform you that a prize of GBP 2,500,000.00 Pounds Sterling in cash are pending your redemption.
The verification department has already proceeded with the verification process of your winnings. We would instruct you on how to receive your prize money as soon as your claims have been verified.
To Proceed you are adviced to contact our paying bank personnel to activate an account so your cheque will be cashed and deposited at:

NEW ACCOUNTS DEPT.
LYOLDS TSB BANK PLC
ACCOUNT OFFICER:JAN PHILIP
TEL: +44 7005-947-384
EMAIL: newaccountdept01@yahoo.co.uk

Kindest Regards,
Steph Wilson
Shell Group International ,
United Kingdom .

If you receive emails such as this, check this site to see if you can find it:

http://www.scamwarning.org/

Chances are…you probably will.

Scammers are hedging their bets that human greed will make it worth their effort to try and steal money from the unfortunate few that take the bait.

DEAR CLIENT RE: CHANGE OF YOUR BANK ACCOUNT DETAILS.
We have received an official notification on Friday 2ND MAY 2008 from MR EARIC E HOPE who claimed that you have authorized him to handle everything concerning the release of your payment as you are now in the Hospital taking care of your illness but in consideration to the nature of our activities here, we deem it necessary that we should get in touch with you first for confirmation before we can proceed with his request, therefore, we need your prompt instruction to proceed with him in this matter or not. Below are the Bank details that he has forwarded to us for the purpose of remitting the fund to him, thus:- HSBC BANK USA, N.A.
P.O. BOX 2013, BUFFALO, NY 14240 USA
1-800-975-HSBC (1-800-975-4722)
A/C NO: 253128218
ROUTING NUMBER: 022000020
A/C NAME: MR EARIC E HOPE. NOTE: The release of the fund will be fixed as soon as we receive your prompt response to this message therefore, it is very important that you should get in touch with us for immediate confirmation. If you need further information, feel free to get in touch with us while it is very important that you should call our Financial Officer, MR HARRISON LEYTTON on telephone number + 44 207060 1652 EXT 4 as soon as you receive this message.
Thanks and best regards.
Miss Hilda Duchess.
(Secretary/Financial Co-ordinator)
ANFIELD FINANCE & INVESTMENT CO LTD.

As the recipient of this email, you should ask yourself why was it sent to more than one address, when it appears it is written for an individual? Common sense questions like this would indicate this email is obviously a scam and besides, in our case, “info@pc-armor.com” is not a real person…so how could “info” be in the hospital?

The bottom line is this: when you receive any email that sounds too good to be true, it probably is! A good rule of thumb to remember is when someone wants to give you money, or they need more information from you, it is most likely a scam. When you receive such emails, question everything before replying or doing whatever it is they want you to do. A little investigative work can go a long way in protecting you and your assets!

We have been busy working on a new look and some new offerings to PC-Armor, so we haven’t been writing any new blog stories lately. However, there are some things you might want to keep an eye out for…

First, the NCAA Basketball Championships are now in full swing and you can expect to see a ton of emails with subjects related to this tournament. We had many, many spams come into the PC-Armor blog as comments today and some of the key words in the spam messages you might look for are: Online Sports Book, March Madness, Final Four Betting, Basketball Betting, and NCAA.

Secondly, I received 4 new spams on my personal email account today with the subject of “Referral Notice” and all of them were from an overseas source. The body contained the following text:

–Registered and USDA/FDA apprv.–

Compliant Email Notification:Referral based

We are pleased that you were referred
to us. We would like to invite you to
our special website only available to
existing customers. As a referral we
are extending this oppourtunity for
you to become a customer. Please
see how our products can be of
assistance to you

Peter W. Johnson
New Customer Manager

http://registeredfda[dot]com

Well, I searched the domain name on DNSStuff.com and found that the domain was registered on March 14, 2008 to a company located in China. Anyone who reads security articles, blogs, or other computer security-related sources, understands that many malicious sites are located in China.

Obviously, I did not click the link for the following reasons:

1. It was registered 3 days ago. Many malicious sites are registered just before emails from the domain start flooding inboxes.

2. It is located in China and I simply would prefer to not risk an infection from a domain hosted in a country where many malicious sites originate.

3. The email states it is USDA/FDA approved. Why would the US Government be approving emails from China?

4. They are extending an “opportunity” for me to become a customer. Who are they and what is their product?  Also, they have extended this “special” website to “existing” customers…how many existing customers can they accumulate in just 3 days?

5. The sending email address was spoofed and the address the email was supposedly sent to was not my address. I left this information out; but what is important here is that I checked and nothing made sense.

As always, question all emails; no matter how legitimate they may appear.  You may save yourself time and money in the long run by taking a few extra steps to ensure an email is legitimate and preventing an infection or compromise!

Well I researched the originating IP address and it came from the Russian Federation in Moscow and one interesting piece in the email was the disclaimer at the end of the message stating:

“You are receiving this e-mail because you subscribed to MSN Featured Offers. Microsoft respects your privacy. If you do not wish to receive this MSN Featured Offers e-mail, please click the link below. This will not unsubscribe you from e-mail communications from third-party advertisers that may appear in MSN Feature Offers. This shall not constitute an offer by MSN. MSN shall not be responsible or liable for the advertisers’ content nor any of the goods or service advertised. Prices and item availability subject to change without notice.”

Somehow, I don’t believe any Microsoft featured offer would be coming from the Russian Federation…

Your best protection would be to simply delete all email offers without opening them, and make sure you clean your deleted items folder.

If you follow the SAN Internet Storm Center Diary or the F-Secure Weblog, you will find that there is a spike in malicious activity tied to Valentine’s Day.

Protect yourself and steer away from any offer that looks too good to be true…because it probably is!

Received: from mta10.adelphia.net[1] ([IP Address Removed]) by vms169119.mailsrvcs.net

(Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006))

with ESMTP id <0JSM000TKR04J8N2@vms169119.mailsrvcs.net> for

[Removed]@verizon.net; Thu, 06 Dec 2007 07:33:40 -0600 (CST)

Received: from web34 ([68.168.75.141])

by mta10.adelphia.net (InterMail vM.6.01.05.02 201-2131-123-102-20050715)

with ESMTP id <20071206133339.JGVE16909.mta10.adelphia.net@web34>; Thu,

06 Dec 2007 08:33:39 -0500

Date: Thu, 06 Dec 2007 05:33:39 -0800

From: MICROSOFT AWARD PROMO 2007 <mic-msn01@adelphia.net>[2]

Subject: CONGRATULATION

X-Originating-IP: [IP Address Removed]

Bcc:

Reply-to: [Removed]@yahoo.com.cn[3]

Message-id: <22510592.1196948019494.JavaMail.root@web34>

MIME-version: 1.0

Content-type: text/plain; charset=utf-8

Content-transfer-encoding: 7bit

X-Priority: 3 (Normal)

Sensitivity: Normal

CONGRATULATION

You are No(5)you won

(1,000.000)One Million Great

Britain Pounds[4] MICROSOFT AWARD PROMO

Batch No: 452006/14/FIFA06/FL To claim your winnings you are expected

to contact your agent Mr Dan [Removed] via email immediately within

24hrs

with the following details below.[5]

 

1.Full name……………………….

2.Country…………………………

3.Contact Address………………….

4.Telephone Number…………………

5.Fax Number………………………

6.Marital Status…………………..

7.Occupation………………………

8.Age…………………………….

9.Sex…………………………….

Mr.Fred [Removed]

Head Winning Claims Dept.

Email: [Removed]@yahoo.com.cn

Sincerely,

Mr.Fred [Removed]

Microsoft Promotion Team

---

 

[1] Should have come from Microsoft.com if it were legitimate

 

[2] Again, email address would be been from “@microsoft.com” if it were legitimate

 

[3] Did you notice the domain? It is “.cn”, which is China. Do you think Microsoft would be send emails from Yahoo in China?

 

[4] Why would Microsoft be awarding a prize in British Pounds instead of American Dollars?

[5] And then there’s the kicker…the true giveaway that this is a scam; they are asking for personal information! As we have stated umpteen times - never, ever, give out your personal information to anyone asking for it. Unless of course, you do not mind becoming a victim of identity theft!

Now, if you notice the references to certain aspects of the email, it is obvious this is a scam intended to steal the user’s personal identity.  Just remember, a little investigative work and common sense can go a long way in protecting your personal information.

http://www.f-secure.com/weblog/archives/00001314.html

Check out the links to both sites in the article, because they have some excellent information and examples to help you avoid becoming a victim to these types of scams.

While checking the Email for “info@pc-armor.com” today, I came across what appears to be a Nigerian Scam.  Before I show you the body of the Email, I would like to quote a warning by the FTC that is posted on their website at:

http://www.ftc.gov/bcp/conline/pubs/alerts/nigeralrt.shtm

 “If you’re tempted to respond to an offer, the FTC suggests you stop and ask yourself two important questions: Why would a perfect stranger pick you — also a perfect stranger — to share a fortune with, and why would you share your personal or business information, including your bank account numbers or your company letterhead, with someone you don’t know? And the U.S. Department of State cautions against traveling to the destination mentioned in the letters. According to State Department reports, people who have responded to these “advance-fee” solicitations have been beaten, subjected to threats and extortion, and in some cases, murdered.

If you receive an offer via email from someone claiming to need your help getting money out of Nigeria — or any other country, for that matter — forward it to the FTC at spam@uce.gov.

If you have lost money to one of these schemes, call your local Secret Service field office. Local field offices are listed in the Blue Pages of your telephone directory.”

Or course, the FTC site has more information about such scams, but I wanted you to see the important questions to ask yourself and what to do if you receive anything like the following example, which would be to forward the entire email to “spam@uce.gov” and then delete the message.  Now, let’s see what the body of one of these emails might look like…

Dear friend,

I know this will come to you as a surprise because you dont know me. I am (named removed for your protection) I work in the Citibank International Plc as the Head Of the Packaging and Courrier service Dept. During the air-lift of some Royal Luggages to Middle east, I decided to include additional Luggages Containing $15M(Fiftheen Million US Dollars)Only for my own Benefit though it was Labelled Security “Equipment” for security reasons.

I am Obliged to contact you to assist me in getting this luggage cleared and delivered to you from the agent as I have agreed on the Following terms.
1) Relevant Documents to claim this luggage will be procured in your name to enable the agent clear and deliver it to your mailing address.
2) That you will be entitled to a share of 30% of the total Money.
3) That 10% of the total money will be set aside for any expenses.
4) That 60% of the money will be for me.

If this business Transaction/Terms is ok by you, do Furnish me with your full names,Mailing Address,Your Personal Telephone/Fax Numbers for Communication and Onward Transfer to the agent in Middle East. You can reach me at my private email address: (Email address removed for your protection)

Note that this Business Transaction is 100% risk free as all relevant documents to back up the claim of the luggage will be provide for you hence we advice you to keep the entire transaction close to yourself until you must have received the luggage,for security reasons.Other modalities will be discussed as soon as you get back to me. Use this code when replying: (Secret Code Removed for your protection)/CitiBank.

Yours Faithfully,
(named removed for your protection)
Courier Dept(Citibank Plc).
+(Probably a Fraudulent Telephone Number, Removed for your protection)

Not only does the Email ask for personal information, it has numerous spelling and grammatical errors; which are dead giveaways to fraudulent scams!  It is important to understand that NO LEGITIMATE BUSINESS WILL EVER ASK YOU TO DIVULGE ANY OF YOUR PERSONAL INFORMATION IN AN UNSOLICITED MANNER, and that includes Email, Regular Mail, by Telephone, or in person.  As long as you can remember that very simple concept, you will avoid becoming a victim of such scams, because you didn’t take the bait!  The best thing you can do if you ever receive scams such as this, would be to forward the entire email to “spam@uce.gov“, as well as the investigative department of the company the email is imitating.

Common Sense will go a long way in protecting your financial security and personal identity.

PC-Armor.com

“The original Psycho Card is back, and someone sent it to you. Click here
to view it online. http://xxx.xxx.xxx.xxx/” (I changed the IP for your protection)

I checked out the originating IP address and it came from Cairo, Egypt.  I don’t know anyone in Egypt…

The IP address it wants me to click to retrieve the card is located in Arlington, Texas.

Be safe out there and be absolutely certain ALL emails are safe BEFORE you open and click anything within the body of the message!

This example was definitely malicious!