|
Wedding photographer paid by large cashier's check
This scam that targets professional photographers in the UK, US and maybe other countries is run by criminals in West Africa. It is a variation of a similar scam involving cars and other big ticket items sold in classified ads. The criminal poses as someone arranging a wedding. He contacts a professional photographer to book him for a wedding. Then he/she sends a large cashier's check as payment. The check is larger than the amount of the photography package. The photographer is asked to cash the check and wire the extra amount to a third party, supposedly a wedding planner, a band or other entity associated with the wedding. The check is fake and the victim wires several thousand dollars of his own money to the criminals if he falls for this scam. Please send us any such emails you may have received and we will publish them (withholding your name and email address, of course) to warn other photographers and to assist law enforcement investigating such cases.
How to display message headers in Apple Mail (OS X)
Example email: From: Fred williams [fred_williams005@yahoo.co.uk] To: photographer Sent: Friday, April 15, 2005 1:49 PM Subject: My wedding photographer ! Good day, I am Mr Fred Williams from oxfordshire UK i am getting married to Miss Helen Christy next month on the 27 0f may 2005 at de vere hotel & leisure 2100 Daresbury Park and i needed a special photographer who will take a place at the event next month i will like to know all what it will cost you to get to my location here and the actual amount to take a covarage of 7hour from the chucrh to the recption i really need to know this so that i can contact my father in-law about this cos he his the one paying for this coverage await your response immedaitely. Thanks & God bless Mr Louis Molls Message headers: Received: from [82.206.246.154] by web26901.mail.ukl.yahoo.com via HTTP; Fri, 15 Apr 2005 13:49:06 BST Date: Fri, 15 Apr 2005 13:49:06 +0100 (BST) From: Fred williams <fred_williams005@yahoo.co.uk> Subject: My wedding photographer !
Message headers: Received: from [81.199.84.130] by web26909.mail.ukl.yahoo.com via HTTP; Mon, 18 Apr 2005 13:48:12 BST Date: Mon, 18 Apr 2005 13:48:12 +0100 (BST) From: Fred williams <fred_williams005@yahoo.co.uk> Subject: payment !
"committe wedding [mailto:weddingcommitte@yahoo.com]" From: committe wedding [mailto:weddingcommitte@yahoo.com] To: photographer Sent: Friday, April 08, 2005 12:26 AM Subject: photographer Hi, I am Linda Bryann,the secretary of a wedding committe that has been constituted to see to the smooth running of my boss's son's wedding ceremony. I am saddled with the responsibilty of locating and arranging for a good and experienced wedding photographer and videographer. So,i searched through the net and found you appropriate for the photography of the wedding ceremony. The details of the wedding are as follows: Date of the wedding: 15th of May 2005 Type of wedding: social venue of the wedding:[Church and reception will be held in the same place, london] Time of wedding: 10 A.M. Every other necessary details will be forwarded to you as soon as they are available. So, how much will your service cost me including your transport fare. Lest i forget, our payment is by cheque.So,after telling me the price and your availability, i will need your details to write the cheque. Thanks in anticipation of your favourable response. Bryann. From: Van Kennedy [mailto:vankennedy1@yahoo.co.uk] To: photographer Sent: Wednesday, March 23, 2005 1:51 PM Subject: Your Photographic Service Is Needed Hello, my name is Van Kennedy. I reside in Amsterdam, Netherlands. The reason am contacting you is that my daughter will be getting married soon in the state, on the 7th of May 2005 and I would like you to take care of the Photographs. I came across your advert on the Internet and am impressed with your services. All expenses would be taken care off; perhaps you can give me the total/Quotes charges,plus the Flight cost for you to down to Amsterdam, Netherlands. Hotel accommodation would also be gladly attended to. Please I want the best services from you, because this is my only daughter so I want the best for her. So your best is needed at this occasion. I will like to know where you are currently residing as at now, so that I could start the preparation on how you would be coming down. I look forward to your response. Best Regards
Later email:
Here comes the cheque: From: scott collins [mailto:scott_collins005@yahoo.co.uk] To: Firstname Lastname Sent: Saturday, March 26, 2005 11:44 AM Subject: Re: payment Firstname Lastname , Thanks for the mail , i just contacted my wife about the payment details , she told me that my father in-law has already issued a cheque of 6000 pounds before traveling for his business trip of the photgrapher arrangment and the wedding planner based in U.S since we need to be booked for our photo album, the cheque will be sent to you immedaitely after sending this mail to you , the balance will be sent to wedding planner as intructd by my father in-law , sorry fo the inconviniences. Thanks and await your response S.collins
From: "John Morgan" <johnmorganjohn@yahoo.co.uk> To: "Firstname Lastname" <emailaddress> Sent: Saturday, March 19, 2005 12:00 PM Subject: INFORMATION NEEDED !!!!!!!!!! Hello, Thanks alot for the mail.and i have spoke with my friend that want to pay for the charges and he agree with the Silver Wedding Package 2 Four hours coverage One hundred and fifty photographs taken One Handmade Wedding Album Thirty prints 10 x 8 One 10 x 8 enlargement in mount Price £1,380.00 For the payment of the charges,i have told you in my first mail that the payment will be made out by cheque and my friend are now prepare to made out the cheque of £4,500 for you on my behalf and the excess funds is for my secretary that will come and pick you to the wedding venue and as soon as you received the cheque you will deduct your cost of the charges and the excess funds is for you and the secretary transport that will come and pick you in your location.Do e-mail me with your FULL NAME,FULL CONTACT ADDRESS,PHONE NUMBER,so that i can forward it to my friend to issue out the cheque on my behalf and i will be waiting for the mail.. Regards. John..
Later email:
The following scam targeted a US photographer: On Apr 2, 2005, at 10:16 PM, scott williams wrote: Hello and good day,i came across your work and it was quite impressive,so i decided that i will be needing you services in my forth coming wedding i will want to know how much are your charges and also if it will be possible for you to come over. Thanks On Apr 4, 2005, at 10:05 AM, scott williams wrote: Hello and thanks for your mail,well the wedding will be taken place in the U.K on the 28th of may,i will want to know if it will be possible for you to make it,and also what are your charges like. Thanks Scott On Apr 4, 2005, at 12:48 PM, scott williams wrote: Hello an thanks for your mail,well i will be takeing charge of your travelling fee so i will need you to include it to the total cost i will be paying you for everything. Thanks Scott On April 8, 2005 1:29:03 PM EDT, scott williams <scottwilliams_5000@yahoo.com> wrote:
Received: from [66.178.82.211] by web50107.mail.yahoo.com via HTTP; Fri, 08 Apr 2005 10:29:03 PDT From: scott williams <scottwilliams_5000@yahoo.com> Date: April 8, 2005 1:29:03 PM EDT To: Photographer <emailaddress> Subject: wedding shooting..........................
"Desmond Powel: PHOTOGRAPHER NEEDED URGENTLY" Domain "desmondpowel.com" is a MSN Personal Address domain registered on the same day the spam was sent (technically, the following day, but that is only because of the time zones of the registrar and the spam recipient). The same name also appeared in a scam targetting British photographers. Emails were sent from the same IP at the same provider in Nigeria as in the "Wedding Committee" scam email above. From: "Desmond Powel" <desmond@desmondpowel.com> Date: March 9, 2005 4:49:18 PM EST Subject: PHOTOGRAPHER NEEDED URGENTLY Reply-To: powel234@yahoo.com Hi, My name is Mr. Desmond Powell .I am planning to have my wedding ceremony on April 9, 2005 at Holy Trinity Parish Hall, Marshfield Missouri, 515 East Washington Street, Marshfield MO 65706 . I am looking for a good photographer who will come and do the snap shots on the D-day. I came accross your listing on the net and decided to contact you. I want to know your charges for the following required services if you are to work for between 6 and 8 Hours on that day. We will select the best 100 copies of different snaps photos in both black and white and coloured and in Two main sizes and dimensions which is required for my personal use at home, 1)16" x 12" (405 x 305mm) approx. including post and packaging 2)12" x 10" (305 x 204mm) approx. including post and packaging 3) I want just one Panoramic images size 18" x 6.5" (457mm x165mm) 30 10x8 prints in album.coloured Snapped in the church and at the reception.I want is for me and my wife, Our parents, the officiating ministers and our guests. I will be requiring your service for atleast 6 Hours at both occasions (church and at the reception). The church is Holy Trinity Catholic Church - Marshfield Missouri 515 East Washington Street, Marshfield MO 65706 . If you are out of Missouri, I will pay the transportation charges to and from the party venue so I want you to indicate in your email if you are out of Missouri and state what it will cost you to get transport to Marshfield Missouri so that we both can work it out and also the total amount you will receive for the whole services at the occasion. We will have the photographs snapped at the wedding forwarded to the Publisher of a Magazine Company in U.S so they could feature it in their celebrity journal so due to this, I want the pictures neat and nice. However,I will be making the payment by means of a Check. Let me have your full Names, Address, Phone Number, where the Cheque will be mailed to for the payment.Moreso, should you be out of state, the Hotel accomodation will be provided for by me. Waiting to read from you soon as regards this. Thanks and have nice day. Regards. Desmond Powell The gang running this scam operates from IP address 81.199.84.130. See the following scam bait on http://419eater.org for more emails, some of which mention "Desmond Powel's" wedding:
"Desmond Powel"
"rick benson" Hello, am Mr Rick the best man to be and wedding consultant for mr Mark which is to take place 21st of next month.So all i need from you is to let me know how much it cost for 900 pieces of black and white and cloloured pics on the wedding day and also if u can come over to United Sates of America for the wedding.so i will like u to total the cost of traveling down here and the cost of the cost of everything.where it is taken place is Grayson United Methodist Church 555 Grayson Parkway Grayson, GA 30017 NB i will like to see your current pics you have taken in a wedding. THANKS. Rick Message headers: Received: from [81.199.84.130] by ws5-9.us4.outblaze.com with http for rickben@graffiti.net; Thu, 28 Apr 2005 08:26:38 +0800 From: "rick benson" <rickben@graffiti.net> To: Date: Thu, 28 Apr 2005 08:26:38 +0800 Subject: wedding phortographer X-Originating-Ip: 81.199.84.130
IP addresses used for photographer check scams
WHOIS details for sending network (IP 82.206.246.154):
inetnum: 82.206.246.0 - 82.206.246.255
netname: INTELSAT-GXS-FUS-CUSTBAS3-20040830
descr: FUS BAS Pool at FUS T'port
country: US
admin-c: IRA4-RIPE
tech-c: IRTC1-RIPE
remarks: INFRA-AW
status: ASSIGNED PA
remarks: *************************************************************
remarks: * *
remarks: * For issues of abuse related to this IP address block, *
remarks: * including spam, please send email to Intelsat at: *
remarks: * *
remarks: * abuse@intelsat.com *
remarks: * *
remarks: *************************************************************
mnt-by: AS22351-MNT
mnt-lower: AS22351-MNT
mnt-routes: AS22351-MNT
source: RIPE # Filtered
role: Intelsat Ripe Admin
address: Intelsat Global Service Corporation
address: 3400 International Drive, NW
address: Washington, DC
address: 20008
address: USA
e-mail: noc@intelsat.com
e-mail: bgp@Intelsat.com
admin-c: AT1875-RIPE
tech-c: CQ37-RIPE
nic-hdl: IRA4-RIPE
remarks:
remarks: *************************************************************
remarks: * *
remarks: * This is a generic ROLE object for an Intelsat Admin *
remarks: * Contact person for RIPE matters. Inquiries about RIPE *
remarks: * issues should be directed to the NOC or BGP email-boxes, *
remarks: * which will forward them appropriately. For operational *
remarks: * issues, send an Email or call the Intelsat NOC at: *
remarks: * *
remarks: * noc@intelsat.com *
remarks: * +1 202 944 6792 *
remarks: * *
remarks: * For BGP related issues, send an email to: *
remarks: * *
remarks: * bgp@intelsat.com *
remarks: * *
remarks: * For issues of network abuse, including spam, please send *
remarks: * email to Intelsat at: *
remarks: * *
remarks: * abuse@intelsat.com *
remarks: * *
remarks: *************************************************************
remarks:
source: RIPE # Filtered
role: Intelsat RIPE Technical Contact
address: Intelsat Global Service Corporation
address: 3400 International Drive, NW
address: Washington, DC
address: 20008
address: USA
e-mail: abuse@intelsat.com
e-mail: noc@intelsat.com
e-mail: bgp@Intelsat.com
e-mail: Chuan.Qin@Intelsat.com
e-mail: Augustin.Traore@Intelsat.com
admin-c: IRA4-RIPE
tech-c: CQ37-RIPE
nic-hdl: IRTC1-RIPE
remarks:
remarks: *************************************************************
remarks: * *
remarks: * This is a generic ROLE object for an Intelsat Technical *
remarks: * Contact person for RIPE matters. Inquiries about RIPE *
remarks: * issues should be directed to the NOC or BGP email-boxes, *
remarks: * which will forward them appropriately. For operational *
remarks: * issues, send an Email or call the Intelsat NOC at: *
remarks: * *
remarks: * noc@intelsat.com *
remarks: * +1 202 944 6792 *
remarks: * *
remarks: * For BGP related issues, send an email to: *
remarks: * *
remarks: * bgp@intelsat.com *
remarks: * *
remarks: * For issues of network abuse, including spam, please send *
remarks: * email to Intelsat at: *
remarks: * *
remarks: * abuse@intelsat.com *
remarks: * *
remarks: *************************************************************
remarks:
source: RIPE # Filtered
WHOIS details for sending network (IP 81.199.84.130):
inetnum: 81.199.84.0 - 81.199.87.255
netname: CIDR-COMMUNICATION-01
descr: Internet service provider
country: NG
admin-c: TECH7-RIPE
tech-c: TECH7-RIPE
status: ASSIGNED PA
mnt-by: AS12491-MNT
source: RIPE # Filtered
person: Tech Supernet300
address: 21 Mobolaji Bank
address: Anthony Way Ikeja
address: Lagos
address: Nigeria
phone: + 234 1 4976493
e-mail: admin@supernet300.com
nic-hdl: TECH7-RIPE
source: RIPE # Filtered
WHOIS details for sending network (IP 66.178.82.211):
OrgName: Turner Technologies
OrgID: TURNE-4
Address: 8 Lateef Salami St
City: Ajao
StateProv: Lagos
PostalCode:
Country: NG
NetRange: 66.178.82.192 - 66.178.82.255
CIDR: 66.178.82.192/26
NetName: TURNER-CHNOLOGIES
NetHandle: NET-66-178-82-192-1
Parent: NET-66-178-0-0-1
NetType: Reassigned
Comment:
RegDate: 2004-09-20
Updated: 2004-09-20
OrgTechHandle: KAD3-ARIN
OrgTechName: Adejuyigbe, Kenn
OrgTechPhone: 234 1 816 1185
OrgTechEmail: kenn@turner-tehcnologies.com
This IP seems to be used by a major criminal enterprise, based on its email footprint:
WHOIS details for domain "desmondpowel.com": Request: desmondpowel.com connected to whois.melbourneit.com [203.27.227.114:43] ... Domain Name.......... desmondpowel.com Creation Date........ 2005-03-10 Registration Date.... 2005-03-10 Expiry Date.......... 2006-03-10 Organisation Name.... Desmond Powel Organisation Address. 20, meridith trace Organisation Address. Organisation Address. sharpsburg Organisation Address. 30277 Organisation Address. GA Organisation Address. UNITED STATES Admin Name........... Desmond Powel Admin Address........ 20, meridith trace Admin Address........ Admin Address........ sharpsburg Admin Address........ 30277 Admin Address........ GA Admin Address........ UNITED STATES Admin Email.......... desmond@desmondpowel.com Admin Phone.......... +1.4408573483 Admin Fax............ Tech Name............ MSN NOC Tech Address......... One Microsoft Way Tech Address......... Tech Address......... Redmond Tech Address......... 98052 Tech Address......... WA Tech Address......... UNITED STATES Tech Email........... MSN-PA-TECH@msn.com Tech Phone........... +1.4258828080 Tech Fax............. Name Server.......... pdomns1.msn.com Name Server.......... pdomns2.msn.com The following "wedding committe" sent its email for a wedding in London via a satellite ISP that servers customers in Nigeria and other African countries. From: "Ms Shantelle Moore" <weddingcommitte007@mail.com> Message headers: Received: from [212.247.93.242] by ws1-1.us4.outblaze.com with http for weddingcommitte007@mail.com; Sun, 10 Jul 2005 23:30:13 -0500 From: "Ms Shantelle Moore" <weddingcommitte007@mail.com> To: emailaddress Subject: YOUR SERVICES IS NEEDDED!!! X-Originating-Ip: 212.247.93.242
WHOIS details for sending network (IP 212.247.93.242):
inetnum: 212.247.93.0 - 212.247.93.255
netname: SE-QUARK-NET2
descr: Quark Telecom Consulting Constellation Networks
####################################
In case of improper use, please mail
or
####################################
country: SE
admin-c: TM1360-RIPE
tech-c: TM1360-RIPE
status: ASSIGNED PA
mnt-by: SWIPNET-LIR-MNT
mnt-lower: SWIPNET-LIR-MNT
source: RIPE # Filtered
person: Timothy Mahoney
address: Quark Telecom Consulting Constellation Networks
address: Virkesvagen 13
address: 238 37 Oxie
address: Sweden
e-mail: tmahoney@constellationnetcorp.com
phone: +46 40 529441
nic-hdl: TM1360-RIPE
source: RIPE # Filtered
% Information related to 'TM1360-RIPE'
route: 212.247.0.0/16
descr: SWIPNET
#####################################################
In case of improper use originating from our network,
please mail or
####################################################
origin: AS1257
mnt-by: AS1257-MNT
source: RIPE # Filtered
"cole smith" hiring a musician using a fake check issued by qchex A similar scam targets musicians instead of photographers. Here is one such email: From: "cole smith" <colesmith_002@yahoo.com> Message headers: Received: from [195.166.235.66] by web33910.mail.mud.yahoo.com via HTTP; Sat, 30 Jul 2005 14:18:26 PDT Date: Sat, 30 Jul 2005 14:18:26 -0700 (PDT) From: cole smith <colesmith_002@yahoo.com> Subject: the info
WHOIS details for sending network (IP 195.166.235.66):
inetnum: 195.166.224.0 - 195.166.255.255
org: ORG-LNL1-AFRINIC
netname: NG-LINKSERVE-971217
descr: Linkserve Nigeria Limited
descr: PROVIDER
country: NG
admin-c: CO445-AFRINIC
tech-c: OC5192-AFRINIC
status: ALLOCATED PA
notify: chima@linkserve.net
notify: obinna@linkserve.net
mnt-by: AFRINIC-HM-MNT
mnt-lower: MNT-LKS-AS8770
mnt-domains: MNT-LKS-AS8770
changed: hostmaster@ripe.net 19971022
changed: hostmaster@ripe.net 20040706
changed: hostmaster@ripe.net 20040922
changed: hostmaster@ripe.net 20040922
changed: hostmaster@ripe.net 20040927
changed: hostmaster@ripe.net 20041122
changed: hostmaster@afrinic.net 20050205
remarks: data has been transferred from RIPE Whois Database 20050221
source: AFRINIC
organisation: ORG-LNL1-AFRINIC
org-name: Linkserve Nigeria Limited
country: NG
org-type: LIR
address: Plot 308 Adeola Odeku Street
address: N/A
address: Victoria Island
address: Nigeria
phone: +234 1 2623900
phone: +234 1 2623901
fax-no: +234 1 2623906
e-mail: chima@linkserve.net
admin-c: CO445-AFRINIC
admin-c: OC5192-AFRINIC
mnt-ref: AS8770-MNT
mnt-ref: AFRINIC-HM-MNT
mnt-ref: MNT-LKS-AS8770
notify: obinna@linkserve.net
mnt-by: AFRINIC-HM-MNT
changed: hostmaster@ripe.net 20040415
changed: bitbucket@ripe.net 20040514
changed: bitbucket@ripe.net 20040820
changed: bitbucket@ripe.net 20040903
changed: hostmaster@ripe.net 20040903
changed: bitbucket@ripe.net 20040903
changed: bitbucket@ripe.net 20040906
changed: bitbucket@ripe.net 20040922
changed: hostmaster@ripe.net 20040922
changed: bitbucket@ripe.net 20040927
changed: bitbucket@ripe.net 20040927
changed: bitbucket@ripe.net 20041005
changed: bitbucket@ripe.net 20041006
changed: bitbucket@ripe.net 20041007
changed: bitbucket@ripe.net 20041012
changed: bitbucket@ripe.net 20041012
changed: bitbucket@ripe.net 20041012
changed: bitbucket@ripe.net 20041022
changed: bitbucket@ripe.net 20041117
changed: bitbucket@ripe.net 20041117
changed: bitbucket@ripe.net 20041117
changed: bitbucket@ripe.net 20041201
changed: hostmaster@afrinic.net 20050205
remarks: data has been transferred from RIPE Whois Database 20050221
source: AFRINIC
person: chima onyekwere
address: Linkserve plot 308 adeola Odeku street, Victoria Island
notify: chima@linkserve.net
phone: +234 1 262 3900
nic-hdl: co445-AFRINIC
changed: hostmaster@ripe.net 20041117
changed: hostmaster@afrinic.net 20050205
remarks: data has been transferred from RIPE Whois Database 20050221
source: AFRINIC
person: Obinna Chukwujekwu
address: 308 Adeola Odeku Street
phone: +234 1 2624802
nic-hdl: OC5192-AFRINIC
mnt-by: MNT-LKS-AS8770
changed: obinna@linkserve.net 20040927
changed: hostmaster@afrinic.net 20050205
remarks: data has been transferred from RIPE Whois Database 20050221
source: AFRINIC
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||