Mr. Peter Sands [email protected]

Header Analysis Quick Report
Originating IP: 41.71.187.33
Originating ISP: Visafone
City: Lagos
Country of Origin: Nigeria
* For a complete report on this email header goto ipTRACKERonline

Delivered-To: <snipped>
Received: by 10.107.170.28 with SMTP id t28csp862615ioe;
Sat, 6 Jun 2015 17:55:33 -0700 (PDT)
X-Received: by 10.68.142.232 with SMTP id rz8mr11725164pbb.117.1433638533472;
Sat, 06 Jun 2015 17:55:33 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mail.chs-wa.org (mail.chs-wa.org. [64.94.114.47])
by mx.google.com with ESMTP id y5si16927926pas.76.2015.06.06.17.55.33
for <<snipped>>;
Sat, 06 Jun 2015 17:55:33 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate 64.94.114.47 as permitted sender) client-ip=64.94.114.47;
Authentication-Results: mx.google.com;
spf=softfail (google.com: domain of transitioning [email protected] does not designate 64.94.114.47 as permitted sender) [email protected]
Received: from [41.71.187.33] ([41.71.187.33]) by mail.chs-wa.org with Microsoft SMTPSVC(6.0.3790.4675);
Sat, 6 Jun 2015 17:55:31 -0700
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: DID YOU AUTHORIZE MR DAVID HAYES TO CLAIM YOUR FUND?/URGENT!
To: <snipped>
From: [email protected]
Date: Sun, 07 Jun 2015 01:55:19 -0700
Reply-To: [email protected]
X-Antivirus: avast! (VPS 150606-1, 06/06/2015), Outbound message
X-Antivirus-Status: Clean
Return-Path: [email protected]
Message-ID: <[email protected]>
X-OriginalArrivalTime: 07 Jun 2015 00:55:32.0532 (UTC) FILETIME=[A7EC4740:01D0A0BC]

DATE: 06/05/2015
MY DEAR
RE: CHANGE OF OWNERSHIP REQUEST FOR YOUR PAYMENT!
How is your health today?
Reference to the Official letter received on 4Th June 2015 from one MR DAVID HAYES in which he has informed us about your ill health and you are still in the hospital, he has actually requested us to effect change of ownership of your long outstanding payment to his name.
We did ask MR HAYES to provide us with the LETTER OF AUTHORITY from you as evidence that you have authorized him to receive the funds on your behalf which he has not done so, it is in this regards that I personally decided to write to you to verify if his claims were right or wrong because of my previous experiences in maters of this nature, therefore, you need to confirm the following information to us as soon as possible, thus:
(a) If you are sick and in the Hospital as claimed by MR HAYES.
(b) If you have actually given him the mandate to receive the fund on your behalf.
(c) What is your relationship with MR DAVID HAYES?
It is very important that you should reply to this mail urgently as further silence on the matter will be clear evidence that you are in agreement with his request, in this respect, for faster and urgent attention to your matter, do mail directly to my personal E-mail addresses and telephone numbers as stated below.
Thanks and best regards,
MR PETER SANDS
(HEAD OF FINANCIAL CONTROL)
1 ALDERMANBURY SQUARE, LONDON, EC2V 7SB
INTL BANKING SECTION, STANDARD CHARTERED BANK, LONDON (UK)
TEL NO: + 44-703-192-1185
E-MAIL: [email protected]

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

Same From address: [email protected]

from: [email protected]
reply-to: [email protected]
to:
date: Tue, Jun 9, 2015 at 7:30 AM
subject: RE: STANDARD CHARTERED BANK/REPLY URGENTLY!

Header Analysis Quick Report
Originating IP: 41.138.176.227
Originating ISP: Visafone Communications Limited
City: Lagos
Country of Origin: Nigeria
* For a complete report on this email header goto ipTRACKERonline

Delivered-To: <snipped>
Received: by 10.107.170.28 with SMTP id t28csp2160116ioe;
Mon, 8 Jun 2015 21:31:12 -0700 (PDT)
X-Received: by 10.66.216.70 with SMTP id oo6mr35099612pac.24.1433824272751;
Mon, 08 Jun 2015 21:31:12 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mail.chs-wa.org (mail.chs-wa.org. [64.94.114.47])
by mx.google.com with ESMTP id f5si7063451pat.213.2015.06.08.21.31.12
for <<snipped>>;
Mon, 08 Jun 2015 21:31:12 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate 64.94.114.47 as permitted sender) client-ip=64.94.114.47;
Authentication-Results: mx.google.com;
spf=softfail (google.com: domain of transitioning [email protected] does not designate 64.94.114.47 as permitted sender) [email protected]
Received: from [41.138.176.227] ([41.138.176.227]) by mail.chs-wa.org with Microsoft SMTPSVC(6.0.3790.4675);
Mon, 8 Jun 2015 21:31:09 -0700
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: RE: STANDARD CHARTERED BANK/REPLY URGENTLY!
To: <snipped>
From: [email protected]
Date: Tue, 09 Jun 2015 05:30:58 -0700
Reply-To: [email protected]
X-Antivirus: avast! (VPS 150608-1, 06/08/2015), Outbound message
X-Antivirus-Status: Clean
Return-Path: [email protected]
Message-ID: <[email protected]>
X-OriginalArrivalTime: 09 Jun 2015 04:31:10.0024 (UTC) FILETIME=[1C186480:01D0A26D]

DEAR FRIEND
I hope this proposal meets you in a good state of health?
I need your help to transfer and invest US$15,300,000.00 (Fifteen Million, three hundred thousand US Dollars only) that accumulated as undeclared profit made by this branch (Standard Chartered Bank Nigeria) under my management.
All that is required to get the funds transferred out of here is to put your name on the Non-investment account holding the funds. This practically makes you a Non-Resident customer of Standard Chartered Bank.
I will then guide you on how to apply for Closure of the Account and credit transfer of the funds to your designated bank account. You will get 40% of the funds for your role.
If you get back to me with your physical contact address, your photo id and direct telephone number, we will consummate the funds transfer within one week.
My Private email is [email protected]
With regards,
LEKE OGUNLEWE

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus