Used car scam ?

I emailed in response to a used car listing on Craigslist and received the following response via e-mail:

---Begin E-mail---

Hi,

If you are interested in my 98 Ford Taurus, it is in perfect condition, with no need for additional repairs, no scratches, dings, special marks whatsoever. It has 62K miles and the VIN # is : <deleted>. It has a clear title ready to be signed and notarized on your name. I have the pictures hosted on the net and you can see them at : <deleted>. The car is located <deleted> .
The price is $2,950 including shipping costs anywhere in the continental US. There are no other costs regarding this transaction.
The transaction will be closed only through a 3rd party and this way we will both be protected. My time is limited due to my job in the army so I decided to use a service from Worldpay. To begin the transaction I'll need your full name and shipping address, I will forward the details of our transaction to Worldpay and then you will receive an invoice from them. The car will be shipped insured to your location with DAS and you will have 5 days for inspection.

Best regards,

---End email---

My gut feeling is that this is a scam, and there's no way I'm paying any money for a car I've never seen, but I suppose it could be legit. Any comments?

Here is as much of the header as gMail will let me see:


from <deleted>
to <deleted>
date Aug 15, 2007 9:04 AM
subject Re: Your Taurus SHO
signed-by yahoo.com
mailed-by yahoo.com


FYI, the location given for the car was over 2000 miles away from both me, and the Craigslist posting area.

It certainly sounds like a scam, it usually involves sending money to a fake shipping company, rather than letting you use a company of your choice. Without more details it's hard to confirm.

100% scam. That email is complete scammerspeak from start to finish. Craigslist is, unfortunately, infested with this type of thing. I see that they mentioned Worldpay, which is becoming a popular scammer MO. Worldpay is not an escrow service and will not "hold" your money until a product is delivered. From their website:

WorldPay makes no representation or warranty in relation to any third party products and services that you may buy through WorldPay's customers.

Its a good idea to run the VIN through carfax.com to see where they say the car is. The last car scam I dealt with showed that the car was sitting at a dealership about 2500 miles from where the scammer claimed it was. Googling the VIN can also lead to interesting results.

If you want to know where this person really is, you can get the full headers of the email by clicking the drop down on the far right at the top of the mail message and choosing "show original". Copy the headers, remove your email address, and post them here.

Welcome to ScamWarners, and congrats for not falling for this all-to-common scam!

Also, any time the word "transaction" is used, I get suspicious. Classic lads speak (i.e., scammer argot). I count it 4 times in that e-mail.

Full header and email follows:


Delivered-To: <deleted>
Received: by 10.100.11.16 with SMTP id 16cs486538ank;
Wed, 15 Aug 2007 09:04:50 -0700 (PDT)
Received: by 10.90.115.9 with SMTP id n9mr837708agc.1187193888477;
Wed, 15 Aug 2007 09:04:48 -0700 (PDT)
Return-Path: <schlangerasmussen>
Received: from web59005.mail.re1.yahoo.com (web59005.mail.re1.yahoo.com [66.196.101.1])
by mx.google.com with SMTP id 20si14489672agd.2007.08.15.09.04.47;
Wed, 15 Aug 2007 09:04:48 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 66.196.101.1 as permitted sender) client-ip=66.196.101.1;
DomainKey-Status: good (test mode)
Received: (qmail 43837 invoked by uid 60001); 15 Aug 2007 16:04:47 -0000
Mod edit - edited to remove domain key to prevent forum blowout - SP
Received: from [172.132.132.171] by web59005.mail.re1.yahoo.com via HTTP; Wed, 15 Aug 2007 09:04:47 PDT
Date: Wed, 15 Aug 2007 09:04:47 -0700 (PDT)
From: Schlange Rasmussen <schlangerasmussen>
Subject: Re: Your Taurus SHO
To: <deleted>
In-Reply-To: <bcd185cd0708131852m31169e38r2192a61f85d4628b>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-2057604046-1187193887=:43153"
Content-Transfer-Encoding: 8bit
Message-ID: <236931>

--0-2057604046-1187193887=:43153
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit

Hi,

If you are interested in my 98 Ford Taurus, it is in perfect condition, with no need for additional repairs, no scratches, dings, special marks whatsoever. It has 62K miles and the VIN # is : 1FAFP54N2WA230978. It has a clear title ready to be signed and notarized on your name. I have the pictures hosted on the net and you can see them at : http://s220.photobucket.com/albums/dd10 ... rasmussen/. The car is located Herndon Virginia .
The price is $2,950 including shipping costs anywhere in the continental US. There are no other costs regarding this transaction.
The transaction will be closed only through a 3rd party and this way we will both be protected. My time is limited due to my job in the army so I decided to use a service from Worldpay. To begin the transaction I'll need your full name and shipping address, I will forward the details of our transaction to Worldpay and then you will receive an invoice from them. The car will be shipped insured to your location with DAS and you will have 5 days for inspection.

Best regards,

Schlange Rasmussen

Craigslist ad here:

http://ventura.craigslist.org/car/396297743.html

He has the same advert on Craigslist, here:

http://providence.craigslist.org/car/396289242.html

Unfortunately, the scammer has AOL as his ISP, so the IP's in the header all revert back to Reston, Virginia, because that is where the AOL server is based and all AOL IP's originate from there, so there is no way to pin him down to a location.

IP address Who-Is result:

http://www.dnsstuff.com/tools/whois.ch? ... 32.132.171

Wow that car located in Herndon Virginia really gets around . Here's the ad for Bakersfield, California:
http://bakersfield.craigslist.org/car/396188689.html

I'm also rather curious as to why the car has no license plate in the pics. Rather odd for a used car being sold by the owner.

[Edit] Lookee what I found:
CLICKY
Looks like most of the ads have already been flagged for removal, but that frikkin car was advertised on pretty much every craigslist in the US.

Also, these emails look familiar to me for some reason:
http://forum.419eater.com/forum/viewtopic.php?p=939678
CLICKY
(Scroll down to the 07-12-2007, 11:23 PM post)
CLICKY
(Scroll to the 08-05-07, 05:37 AM post)
I found 8 examples of that exact email, and there are probably more.

Wow, that's really something. Typical sale price for that car is between $4,500 and 5,500, so I knew either something was wrong with the car, or it was a scam. Having already had an enlightening discussion with "Jimmy Brown" in response to a Craigslist ad I figured it was probably the latter. Thanks for the confirmation, though. I had no idea this type of thing was that widespread.

(Jimmy [email protected] wants to buy my old junker car! Isn't that great?)

--Quote---

Thanks for the prompt response and i will love to make an instant purchase.My Bank will be mailing (overnight) a certified check from my account to cover the cost ,while you hold on my behalf. Once you have this, my mover will come pickup at your place.I will be needing the following information to issue out the payment . . .
1.Name to be on the check
2.Home address
3.Telephone
** Please note that the payment will be overnight by the Bank to your address and its bound to be delivered within 2 to 3 days.I have taken a close look at the advert and am completely satisfied i really need this and would appreciates that you help save this for me till the payment arrives.Furthermore do remove the posting from CRAIGSLIST.COM as am definitely buying it from you and it would be sad for me to have the payment in the mail only to be alerted it as been sold when the check does arrives. **

--End Quote--

Jimmy must think I was born yesterday. You'd think he could at least copy a template with better English.

I was unable to view your Whois info, apparently dnsstuff.com wants me to sign up. But I got pretty much the same info from samspade.org. http://samspade.org/whois/172.132.132.171

Thanks guys, this site is very helpful and it looks like it could be a lot of fun, as well.

I had no idea this type of thing was that widespread.

Most people don't. That's one big reason this scam still works, and an even bigger reason to post such scam mails/names/email addresses on sites like this, so that people can find them before sending money!

i will love to make an instant purchase.My Bank will be mailing (overnight) a certified check from my account to cover the cost ,while you hold on my behalf.

As you surmised, this is the other side of purchase scams. The check is fake, and will be for more than the amount of the car. The scammer will say that the "extra" is to cover the shipping, and ask you to send it to his "shipper" after the check "clears".

It works because banks give account holders provisional access to the funds from deposited checks long before the check actually clears or bounces. When the check bounces (and it ALWAYS bounces), the bank takes the money back, often leaving the victim thousands of dollars in debt.