Has someone offered you a huge sum of money or a valuable consignment? It's a 419 or advance fee fraud - find out how they work, and what to do to be safe.
#26358 by Ana Maria Wed Apr 14, 2010 7:59 am
I am sure that this is a scam, but I must confess that for a moment I wanted to believe that it was true. I have allready written back saying that I will inform the authorities and that she will be tracked down through her IP adress and that if she is innocent, she has nothing to lose. I will post here all her e-mails. This is the first one:

"Hello and good day,

I am Mrs Sarah Joebloughes from Florida USA, am 40 years old. I have long been searching for an Aupair, I found your profile on the easyaupair.com,I like the fact that you are a foreigner,I have a mixed background so I accept any race, tribe, religion,and so I decided to send you this email so as to let you know that I am interested in you working for me as my nanny/aupair .My Daughter who is four is just a distraction so to say, as I am a very busy woman. This implies that striking the balance between my child care and up bringing,my personal life and my job has been very difficult,to this effect I urgently need the help of a Nanny/Aupair. I am a single parent, so I need someone like you to take good care of her...I will pay you $2400USD monthly. I will like to know this few things about you, do not worry about the questions,I only just want to know,regardless of the questions, I think you are my sure bet:
Have you any experience working with kid’s ?
Whats your highest schooling qualification ?
Do you smoke ?
Can you help with housework ?
Do you like pets ?
Do you have a driving license ?
What are your interests ?
How many children would you feel comfortable with ?
How would you discipline a child playing and with reasons?
Please do note that you and I will take care of everything concerning your travel document procurement if you will work for me. This is so because I have been scammed so many times and so I have learnt my lessons.
I will be waiting for your sincere reply.
Regards,
Sarah Joebloughes."

The second one, after my responding to the first:

"Hello,
Thanks for your reply, I must commend you on your answers to my questions. that has given you a sharp edge to have the job. If you will work for me I must inform you that all your papers for immigration into the United States of America must be ready by April,the year 2010 .This will give me and you an assurance that you will surely work for me here. This is my sincere opinion. I live in Hollywood city, a city in Florida. You can work for me for as long as you want, so long as you are of good conduct. I will want you to get back to me with your full address details ( personal & professional ) my daughter is intelligent and nice. All I want you to do is to take good care of her and be a good example to her, also I need someone trustworthy, honest and has experience working with kids because I will not be at home with Blair and she will be staying alone with you due to the nature of my job. A good sense of humor is essential and you will be treated as part of the family from the minute you arrive. My daughter's name is Blair she likes outdoor games and our family is a little demanding at times but fun loving and energetic. The Au pair will have access to the internet,television,video and access to cable channels in the room.You will have your own double room with separate bath and shower facilities. I would expect the Au pair to work for 35hrs per week Mon-Fri with weekends off. You can start doing some other things in the United States,as soon as I am good with you, you will have to do a few housework.And as you can imagine, my job is time consuming especially when you have a toddler to care for more and try to get in touch with me back through my mail,so that we could discuss further, your full name and home address will be needed for other necessary things you will be needed to travel to United States, those information will be needed.
I hope to hear back from you as soon as possible.I also attached a picture of my Baby Blair,her late Dad and myself.
Warm wishes,
Mrs Sarah Joebloughes."
And the last one:

"Hello,
How are you today ?I really hope you are fine and well,and if so I really am happy for you.I really want to say I appreciate your regards for me and to that effect I want to assure you that you have the job as long as you are ready to process your documents with the shortest possible time.
With respect to the questions you asked,Blair does not really have a schedule,besides waking up and getting ready for school,coming back from school,observing siester,carrying out her homework and playing for a short time or going out for a nice evening work with an elderly person.She likes been out in the open playing,likes cakes and ice cream.Her Bedtime stories include Peter Pan,Snow White,Rapunzel and Hansel AND Gretel.About your Hair cut I strongly believe you look good presently.
I strongly believe we are compatible that is why I contacted you in the first place.
Hope to hear from you soonest.
Best Wishes,
Mrs Sarah Joebloughes."
What do you think?
Advertisement

#26359 by Chris Fuller Wed Apr 14, 2010 8:18 am
Hello and welcome, Ana Maria.

It very much looks like a scam. The writer is using words that an American would not normally use, but are used by West African scammers. Are you able to post the header information? (Make sure that you delete your own name and email address out of it first.) We might be able to tell from the header information which country these emails were sent from.
#26361 by GomerPyle Wed Apr 14, 2010 8:32 am
There are some cultural giveaways in what the person says that no Western parent would say about their children.

I don't want to educate any smart scammers who visit this site to improve their skills, but the whole tone of the mail doesn't make it sound like a realistic offer. I also note that it's been posted on a lot of au-pair sites that have now removed it.

Non-EU citizens should go here to find out about obtaining a visa to work as an au pair in the UK
http://www.ukvisas.gov.uk/en/doineedvisa/
Whenever payment is requested by Western Union you're dealing with a scammer
#26377 by Ana Maria Wed Apr 14, 2010 11:52 am
I will post the headers also. I am curious where was the e-mail sent from. I am not sure about what I should have taken out from the it, so I just deleted my adress and just other things, I hope it's ok.
Thank you for your answers so far. It believe that something should be done against these people, because think about the ones who really get scammed, and I it is not only about the money, but personal security may be at stake.

X-Apparently-To: Tue, 13 Apr 2010 15:27:20 -0700
Return-Path: <[email protected]>
X-Originating-IP: [98.136.167.96]
Received: from 127.0.0.1 (HELO web113716.mail.gq1.yahoo.com) (98.136.167.96) by mta1099.mail.ac4.yahoo.com with SMTP; Tue, 13 Apr 2010 15:27:20 -0700
Received: (qmail 59200 invoked by uid 60001); 13 Apr 2010 22:27:18 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1271197638; bh=aBPdBJa7q9ss+mQhX/CbAbh0KUjMoIULqGtbxPlzQaU=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=YpwEinM0IIx4pn15bPh2ctmN+ELbfEr8V+F12WFmUNUX2HqzChyLX88+JRnDnWayMrMdY1VY6gCwqM4nXXODMdC4PEX5ChWDdQNUVX7m7Ghv3aWq263pjp3/ss3GnYVM/Dpdn8l0QBwE8jhhX7wg74zZZvD9uEm/7SF4ML1WQzI=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=oSosSzA7e3R9IZSxv0h+lD8sVQCTY+94aMyhztM9UBknhQTH0YJ1FhoKG8jxIIw9NbgGQYqLrLnBLrErjU1brG2r3Y9CKHA85o4dUzjFaGgOQBo/IwPjYfikz+chRm2PNTF0wAhWKenJqN8B5hFbpIl8M56/wICZ79E/BarwoY0=;
Message-ID: <[email protected]>
Received: from [41.206.15.1] by web113716.mail.gq1.yahoo.com via HTTP; Tue, 13 Apr 2010 15:27:18 PDT
X-Mailer: YahooMailClassic/10.1.9 YahooMailWebService/0.8.100.260964
Date: Tue, 13 Apr 2010 15:27:18 -0700 (PDT)
From: This sender is DomainKeys verified
sarah Joebloughes <[email protected]>
Add sender to Contacts
Subject: Re: NANNY/AUPAIR URGENTLY NEEDED
In-Reply-To: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-949403568-1271197638=:58488"
Content-Length: 2538
#26384 by Crispy Duck Wed Apr 14, 2010 12:08 pm
I am curious where was the e-mail sent from.


From the headers:

Received: from [41.206.15.1]


41.206.15.1 Nigeria - MTN Nigeria :D
#26388 by GomerPyle Wed Apr 14, 2010 12:19 pm
The same ip comes up in this thread

job scam here

viewtopic.php?f=34&t=4627&p=23198

and here - romanc scam

http://www.anti-scam-forum.net/openThre ... 340887.htm

and here standard 419 scam

http://www.antifraudintl.org/showthread.php?t=16866

gold and diamond selling scam here

http://www.foreign-trade.com/openforum/ ... ID=1783239

someone trying to register on a money changing forum got blocked with that ip here

http://www.exchangemoneyplace.com/repor ... unba1.html

lottery scam here

http://www.aus-scambaiters.com/forum/sh ... php?t=9495

and so on.

Could be the same scammer or just an internet cafe that's infested with them and they go online using the same connection. It's such a diverse spread of scam formats being used it isn't beyond the realms of possibility it's an organised scam gang purposely covering every scam angle to try and make the best income. Scammers usually stick to the scams they're familiar with. Getting such a wide diversity of examples from one ip is quite unusual.

There's not a lot that can be done other than to be cautious and protect yourself. We help, inform and guide where we can.

Non-EU citizens should go here to find out about obtaining a visa to work as an au pair in the UK
http://www.ukvisas.gov.uk/en/doineedvisa/
Whenever payment is requested by Western Union you're dealing with a scammer
#26393 by Ana Maria Wed Apr 14, 2010 12:29 pm
I just looked for the IP Adress myself on the internet and localized it somewhere in Sunnyvale, California. The person who sent the e-mail pretended to be from Hollywood, Florida, therefore in the other side of the USA. I was also able to find a postal code and to view a certain building. It is amaizing the fact that I could wander all around the building as if I was there. It would be somehow helpful if you could confirm the information I just found. Thank you !
#26396 by Crispy Duck Wed Apr 14, 2010 12:34 pm
The Sunnyvale IP is actually Yahoo.

The important part of the header is the last "Received from:"

You can check for yourself by pasting the whole header in the panel at http://headertool.apelord.com/ then click on the "Check headers" button.

The last IP in the list is the originating one!
#26398 by Ana Maria Wed Apr 14, 2010 12:41 pm
You are right, of course, it's Nigeria.
Aren't there any legal methods to investigate such scamming attempts?
Or they could be made public, there must be something to be done.
What do you think ?
#26401 by Crispy Duck Wed Apr 14, 2010 12:51 pm
As Gomer said, they are sitting in an inet cafe in NIGERIA which is not the least corrupt City in the world! No US, UK or other Country's law enforcement agency has jurisdiction there, so little can be done to catch the scammers.

Their own police force etc is fairly powerless to act (indeed, there are reports of SOME of them being corrupt enough to not investigate known activities!).

All that can be done is to try educating innocent people about scams, which is what we are attempting here & in the media, where possible! Look at viewforum.php?f=2 where there are details of how the word is being spread.

Who is online

Users browsing this forum: No registered users and 188 guests