Helix Energy Solutions / Fake Job Scam Fraud

[AlanJones]

Dear XXX,
A check/draft will be mailed to you containing your first month salary and entailments to your official address in XXX.
Telephone number, +447042058553 Fax +448704954878

Thanks,

Richard Bale

Any cheque that is received will be fake and will probably be accompanied by a request to send some money on by Western Union.

All of the emails so far show traits of having been written by a semi-literate African scammer, rather than an educated barrister in the UK.

[AlanJones]

Dear XXX,
Almost all company’s hire foreign staff without face to face but based on work experience over the years contained in their resume.
Telephone number, +447042058553 Fax +448704954878

Thanks,

Richard Bale

Another scammer fantasy that doesn't happen in the real world for real jobs.

The spelling/grammatical/punctuation errors in just those last two messages indicate that the scammer isn't as smart as he probably thinks he is.

Latest incarnation of the scam

Attention: xxxxxx

Your name has been shortlisted/chosen among the lucky Candidates who successfully pass the HELIX ENERGY COMPANY Application process, we appreciate your interest and willingness to work in our Company. We have gone through your profile and qualifications, with reference to online/email interview you had with us, we are pleased to offer you Employment in our reputed organization as NETWORK ENGINEER, because of your Educational background and work experience. Your Job Descriptions shall be made known to you after the training period of 6 months. In this mail there is an attached Document called the Contract Agreement Letter, which you have to print out, sign and return it back to us immediately for other Official Endorsement. Remember that you have only few weeks of enrollment in our company with all the legal formalities being completed including the Visa and Ticket processing period. However, after receiving this Agreement Letter duly signed by you, we shall contact you for Appointment/Offer Letter, added the directions on how to obtain your visa from the UK Immigration Officer in your Country, whom will be processing your working Visa Documents.

NOTE: All Applicants will take care of the Processing Fee of their Work Permit Visa and other relevant Document with UK Immigration Officer in UK Embassy, HELIX ENERGY COMPANY will provide Flight Ticket and House Accommodation and all the Expenses Encored during their Traveling Document procurement will be reimburse within Five(5) days of your Arrival in the United Kingdom upon submission of all their receipt of expenses. Print out this Document and sign after reading it and send it back to us for Office use, waiting to receive this Agreement Letter dully sign as soon as possible.

Best Regard,
Hr Manager
Mr Simon Fraser
Tel: +442036953776
Fax: 2000-454511888
Email: [email protected]
[email protected]
Website: http://www.helixesg.com

Please read carefully because this applies to every job offer you receive! 99% of email job offers are scams! No real company hires you without an in person, face to face interview. An email, online or telephone interview is always a scam! No real company ever charges any money for a job even for a visa or work permit! If they want you to pay and say they will refund the costs, you will just send money to a fake embassy official, travel agency or lawyer who is a really a scammer! Read: http://www.scam-job-emails.tk No real company, government or visa agent ever uses a free or public email address (yahoo.com gmail.com hotmail.com, aol.com, etc.) Email addresses like diplomats.com, counsellor.com, consultant.com, lawyer.com etc. are also free email addresses. Read: http://www.scam-email-addresses.tk No real visa agent ever requests money via wire to a bank account or by Western Union or MoneyGram. Read: http://www.never-wire-money-to-strangers.tk No real company uses a telephone number that begins with +44 70, +44 871, +44 870, +44 844, or +44 845. Those are forwarding numbers which are not in the UK. Read: http://www.scam-telephone-numbers.tk If the company does not have a website or the website does not work, it is a scam! Do not assume a website is legit! Read http://www.scamwebsites.tk There are no exceptions! Don't let a scammers convince you otherwise! A scammer is only as smart as his victim is naive! If something sounds too good to be true, it is a scam! Publicity defeats scammers. Post the scam emails you receive and warn your friends! Always "Google" all telephone numbers, email addresses and websites in any job offer to see if it has already been posted as a scam!

My friend has received appointment letter today 8th Dec, 2014 from [email protected]. Can someone please tel if it is a valid email address from Helix Energy Solutions

[whois.godaddy.com]
Domain Name: HELIXESGROUP.COM
Registry Domain ID: 1878976869_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: http://www.godaddy.com
Update Date: 2014-10-05 11:21:17
Creation Date: 2014-10-05 11:21:17
Registrar Registration Expiration Date: 2015-10-05 11:21:17
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146
Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Phone: +1.480-624-2505
Reseller: Google Inc.
Domain Status: clientTransferProhibited
Domain Status: clientUpdateProhibited
Domain Status: clientRenewProhibited
Domain Status: clientDeleteProhibited
Registry Registrant ID:
Registrant Name: Registration Private
Registrant Organization: Domains By Proxy, LLC
Registrant Street: DomainsByProxy.com
Registrant Street: 14747 N Northsight Blvd Suite 111, PMB 309
Registrant City: Scottsdale
Registrant State/Province: Arizona
Registrant Postal Code: 85260
Registrant Country: United States
Registrant Phone: +1.4806242599
Registrant Phone Ext:
Registrant Fax: +1.4806242598
Registrant Fax Ext:
Registrant Email: [email protected]

Looks like a fake domain to me. Please post the email with complete headers, excluding your friend's name and address.

from: Helix Energy <[email protected]>
date: Mon, Dec 8, 2014 at 2:07 PM
subject: SIGN THE CONTRACT AGREEMENT/OFFER LETTER AND RETURN A COPY OF IT BACK TO US
mailed-by: helixesgroup.com

This is an Affirmation that your experiences and qualifications were found suitably qualified for the requirements of Helix Energy Solutions Group. The attached document embodies the approved Terms for the purpose of this contract. Now, you have to contact the Diplomatic personnel appointed by the US Embassy in India with the copy of appointment letter attached to this email for the procurement of your Valid Visa and work permit papers as we are having a contract agreement with them for easy acquisition of our employees necessary valid traveling documents. You are required to contact the Diplomat mentioned below for the acquisition of your U.S work permit papers which would enable you to live and work here in United States. Sign the Contract/agreement document and send a copy to him. You must inform him that you have gotten an appointment letter from us(Helix Energy Solutions Group, United States).

THE DESIGNATED DIPLOMATIC PERSONNEL CONTACT DETAILS IS STATED BELOW:

NAME: Diplomat Thomas Lewis
ADDRESS: US Embassy Mumbai, India.
PHONE: +917030683340
EMAIL: [email protected]

Diplomat Thomas Lewis will process our expatriates valid travel papers from U.S Embassy in Mumbai. We have sent all document required for your two years work permit visa to the United States Embassy in Mumbai for Visa Application. This Diplomat is appointed by the Embassy of United States to process our selected candidate's visa in India to avoid refusal or denial of Visa by the Visa Issuing Authority. We urge you to comply and cooperate with him so that he can assist you to secure your Valid US Employment Visa.

Note: You are to bear your visa processing expenses upfront to prove your seriousness and commitment to work with our reputable organization. We shall proceed by securing your accommodation here in United States at the company's staff apartment, book your flight ticket and transfer it to you as soon as your visa has been stamped. Also remember that any expenses you make on the process of registering your documents shall be reimbursed back to you on joining as you submit your expenses report. Be informed that once your visa processing is completed, the hard copy of your appointment letter/contract agreement will be delivered to you via DHL Courier Service. We look forward to receive the signed copy of the Contract agreement for our confirmation to your acceptance of our Job Offer with the terms and conditions therein. Contact the Diplomat immediately to start your visa processing because you have to resume for the job on/before 19th of Jan 2015 [19/01/2015]. You are required to Update us with the process between you and the Diplomat in case of advice where necessary. Looking forward to receive the signed copy of your Appointment Letter Soon.

Best Regards,
Mr. David Scott
Human Resources
Helix Energy Solutions Group, USA.
Tel: +12532431930, +12532432060

------------------------------------------------------------------------------
This is the full email content with headers included

Those aren't complete headers. Please post the complete headers so that we can kill the domain.

An address ending in usa.com is not an official address of anyone working at an embassy or consulate.

I recently got a mail stating as follows:

Is this a valid email id?
can anyone please clarify me?

From: "Helix Energy" <[email protected]>
Date: 2 Dec 2014 06:16
Subject: KINDLY COMPLETE OUR EMPLOYMENT APPLICATION FORM AND SCAN IT BACK TO US
Dear Applicant,
We acknowledge your interest in employment at Helix Energy Solutions Group. We are in receipt of your resume/cv which was submitted for job application and the said has also been reviewed by our Employment Relations Board.
Your resume was found suitable for working in our organization due to your educational background and Profile.
Kindly complete our Employment Application Form attached to this E-mail and scan it back to us along with your qualification certificates for further job selection process.
Read and fill the Job Application form carefully,also respond early for our kind perusal. Required documents are:

* OUR JOB APPLICATION FORM[ATTACHED TO THIS E-MAIL]
* EDUCATIONAL/QUALIFICATION CERTIFICATES
* WORK EXPERIENCE CERTIFICATE[IF ANY]
* INTERNATIONAL PASSPORT
* ID PROOF[NATIONAL IDENTITY CARD OR DRIVING LICENSE]
NOTE: After your Job Application and Interview Form has been reviewed by our Employment Relations Board,selected candidates will be contacted for their Job Appointment/Offer Letter which would enable them to obtain their U.S Work permit visa for their job here in United States. The Job Appointment/Offer Letter will indicate the job role, benefits and Salary amount.
Mind you,our management, Helix Energy Solutions Group will apply for our selected candidates Visa[s] on their behalf by sending all documents required for two years work permit visa to the corresponding U.S Embassy in their respective country for Visa Application.
* You are required to send all the documents stated above for further job application process in our esteem organization.
Thanks
Management.

The email was written by a West African, not an American. It's a scam.

Again, we need complete headers to kill the email-only domain.

Thanks a lot Vonpaso for the timely help. Here is the complete header


Delivered-To: (removed-dotti)
Received: by 10.107.26.200 with SMTP id a191csp40810ioa;
Wed, 3 Dec 2014 09:30:17 -0800 (PST)
X-Received: by 10.170.210.69 with SMTP id b66mr8072643ykf.35.1417627816018;
Wed, 03 Dec 2014 09:30:16 -0800 (PST)
Return-Path: <[email protected]>
Received: from mail-qg0-f66.google.com (mail-qg0-f66.google.com. [209.85.192.66])
by mx.google.com with ESMTPS id m6si18631053qao.130.2014.12.03.09.30.15
for <Removed Mike W>
(version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
Wed, 03 Dec 2014 09:30:15 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 209.85.192.66 as permitted sender) client-ip=209.85.192.66;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 209.85.192.66 as permitted sender) [email protected]
Received: by mail-qg0-f66.google.com with SMTP id a108so2586026qge.1
for <[email protected]>; Wed, 03 Dec 2014 09:30:15 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20130820;
h=x-gm-message-state:mime-version:date:message-id:subject:from:to
:content-type;
bh=ZlMKfRgykMwEeFsm8wsWZwyXulo+q2UydbWnLCLG+so=;
b=bEF0wKHEFziJ6dK3HcwTROFayfX8O6BEwti47KJII+nBVzF8FzMDacswjZAyBqwPZU
oUpcmab8a72zTUKuWBQx4EgbSSQHPn62/2FbDkg94SeQB2QqrRVWXlta2gB4Y5/x4rss
VqmwpBLaOjH/IoIiJWQMX17wSXuRsNiwwYM9ZXIebOXNKcJH0j81k/QD63j0pL3pmW6d
5H+fjc1fc0KIjnmBwWjzE+RYTiMejtvySaumFyPIx9ougXdI3eq+FTFG7/nNeaqE/7j6
1U+tLbnfCkjlaxWT8lDDT5ET3gN98KOwgtXaR+DokEhBsNWgBvEKz8A2+bBhbmFkm3XF
0X3A==
X-Gm-Message-State: ALoCoQmW4PynYijHe/03890PxSnI+Zach2T/Xhw5wvylG18Ere9ZbpTfrrvOosjbINNdHlGVl4qF
MIME-Version: 1.0
X-Received: by 10.224.68.8 with SMTP id t8mr9788288qai.51.1417627815552; Wed,
03 Dec 2014 09:30:15 -0800 (PST)
Received: by 10.96.165.67 with HTTP; Wed, 3 Dec 2014 09:30:15 -0800 (PST)
X-Originating-IP: [1.39.22.5]
Date: Wed, 3 Dec 2014 23:00:15 +0530
Message-ID: <CAMgFKNnYzgF8J9njeVR5CKgeJgVzMzkd9hCXAQR67mYWngqL0A@mail.gmail.com>
Subject: YOUR SUBMITTED CREDENTIALS IS UNDER REVIEW BY OUR EMPLOYMENT
RELATIONS BOARD
From: Helix Energy <[email protected]>
To: <removed Mike W>
Content-Type: multipart/alternative; boundary=001a11c2e2e05ee2020509533257

--001a11c2e2e05ee2020509533257
Content-Type: text/plain; charset=UTF-8

Dear Applicant,

We are in receipt of your Job Application and Interview forms
which was completed by you. Kindly note that our employment relations board
will be verifying the authenticity of your submitted job application
credentials. Once we are done with verification process and you`re selected
here in our organization by the Employment Relations Board,our Human
Resources Manager would contact you regarding your job offer status.

Thanks
Management.

Thanks! helixesgroup.com is in the process of being reported for fraud.

Hi Vonpaso. Again my frnd is in a job process with Newcrest and the email is from [email protected]. can you please check whether it is a valid email id. Thanks in advance

It's registered by Domain Privacy for one year and has no IP address. Highly likely to be a scam. Please post the email with complete headers, removing your friend's name and address.

Thanks a lot. Here is the complete header
----------------------------------------------------------


Delivered-To:
Received: by 10.107.18.38 with SMTP id a38csp618732ioj;
Sun, 14 Dec 2014 20:07:40 -0800 (PST)
X-Received: by 10.70.56.72 with SMTP id y8mr1203300pdp.45.1418616459377;
Sun, 14 Dec 2014 20:07:39 -0800 (PST)
Return-Path: <[email protected]>
Received: from sender1.zohomail.com (sender1.zohomail.com. [74.201.84.156])
by mx.google.com with ESMTPS id jd1si11973073pbd.208.2014.12.14.20.07.38
for <>
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Sun, 14 Dec 2014 20:07:39 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 74.201.84.156 as permitted sender) client-ip=74.201.84.156;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 74.201.84.156 as permitted sender) [email protected]
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=zapps768; d=zoho.com;
h=date:from:to:message-id:in-reply-to:references:subject:mime-version:content-type:user-agent:sender;
b=qqRgCRs6HTjko3Ra8cohshJRq6SRdQ6+1vzDDLgBE7OwMBMiJGBknHuPunGNT3b4CuahDVQW+tjV
12ifl8yleb7gW21Kqv4yB3f6iyDGEo26NsffS2mG3VbgH1Cc2dci
Received: from mail.zoho.com by mx.zohomail.com
with SMTP id 1418616455764378.65376852925465; Sun, 14 Dec 2014 20:07:35 -0800 (PST)
Received: from [91.121.203.195] by mail.zoho.com
with HTTP;Sun, 14 Dec 2014 20:07:35 -0800 (PST)
Date: Mon, 15 Dec 2014 04:07:35 +0000
From: New Crest <[email protected]>
To: <>
Message-ID: <[email protected]>
In-Reply-To: <[email protected]>
References: <[email protected]> <[email protected]> <[email protected]> <[email protected]>
Subject: INSTRUMENTATION CONTROL ENGINEERING M.O.U FROM NEW CREST AUSTRALIA
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_Part_260805_1099129671.1418616455569"
X-Priority: Medium
User-Agent: Zoho Mail
X-Mailer: Zoho Mail
Sender: [email protected]
X-Zoho-Virus-Status: 1

------=_Part_260805_1099129671.1418616455569
Content-Type: multipart/alternative;
boundary="----=_Part_260806_1730584084.1418616455569"

------=_Part_260806_1730584084.1418616455569
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Dear Successful candidateWe are happy to inform you, we found your resume s=
elected, we oblige you to go through our contract agreement letter if the m=
ode of the job is good for you, kindly sign the agreement Letter and scan u=
s copy of memorandum of understanding through email attachment, we try to c=
all your given number several times, but net work respond to us either you=
are switch of or our of net work coverage, it will be our pleasure if you =
can call us after sending your M.O.U, right from from reliable source we al=
ready view your application, that is why we select you, all your respond ar=
e to be according to our company policy, also all answer must be accurate n=
ot in partial
We hope to hear from you as soon as possible
Don=E2=80=99t forget to write us your position
1. Position applied for
2. Full name
Regards=20
Peter Hey
Tel: +61384004438