Case Study: Advance Fee Scams

Tuesday, July 12, 2011

Mark Baldwin

6648b1abd4a9b964566c3690613f20a6

Advance fee fraud, sometimes called the Nigerian bank scam, is one of the most common scams on the Internet. 

I am sure you all have received an email purportedly from a wealthy person located in Africa or Europe who needs your help transferring money into a bank account.  The reasons vary for requiring your assistance, but they always promise a large sum of money in return for your help. 

Recently I received the following email that was an attempt at advance fee fraud:

From: “Sherer, Renslow [BSD] – MED”
To: “Sherer, Renslow [BSD] – MED”

RE: Beneficiary of £7,500,000.00

Dear Beloved, It is by the grace of God that I write you,I am Mrs. Julie
Meno,i have a project worth 7.5 Million Pounds.contact me juliemeno@globomail.com

The original email came from rsherer@medicine.bsd.uchicago.edu, but with a reply-to of juliemeno@globomail.com.  This is probably a compromised email account that is being used by scammers.  I decided to reply to the email and find out exactly how this particular scam worked.  I sent a short reply indicating my willingness to help and I quickly received the below email:

Dear Beloved,

I am Mrs. Julie Meno, the wife of Mr. Mohammed Saha Meno, both citizens of the United Arab Emirates. My husband worked with the Chevron/Texaco in Russia for twenty years before he died in the year 2003.Since his death, I decided not to re-marry. When my late husband was alive he deposited the sum of 7.5 Million Pounds (Seven Million Five Hundred Thousand Pounds)in a Financial House in Europe.The management just wrote me as the beneficiary that the account is DORMANT and if I, the beneficiary of the funds, do not re-activate the account;the funds will be CONFISCATED or I rather issue a letter of authorization to somebody to receive it on my behalf, since I cannot come over.

Blessings to you beloved. The words in your response have given me great joy. This is a good work of charity project I have placed in your hands. My dear I will only say to you with reason of my throat cancer I am unable to speak but all I want is that the money is first safe in your account before I meet the Lord so that it can be used for the intended purpose. i have told you in confidence that I want the project to be kept very secret and details of my contact with you should not be disclosed to anybody and this is because my husband’s family might want to do everything to gain possession of this money for their own selfish interest.

My dear the financial house in possession of the money is in Europe, the money can be transferred to your account electronically once you activate the DORMANT ACCOUNT and I need the following details below to send LETTER OF AUTHORIZATION to the financial house in Europe that you are now the sole beneficiary see below:

NAME IN FULL:
CONTACT ADDRESS:
DATE OF BIRTH
COUNTRY:
TEL:FAX:
OCCUPATION:

I want you to know now that if the project does not take place it will be your fault as I have done all in my power to see that everything works in the manner that we have discussed.  My dear, I want you to have faith and pray always knowing the task ahead and the bold step. I have taken to give you this money and I need you to do is always stay focused and follow instructions, there is need for prayers as obstacles will arise but all that stand against the success of this transfer and the project proper will fall.

Let me rest and leave you to pray and build your mind towards the task ahead and also always be in contact with me. It is very important that you complete this project in good faith even if I join my husband before time and always know your share of the funds is 20% and the balance must be used for the  project proper which is 80% dispatching it to the list of the charity organizations that I’ll be sending to you.

Regards
Mrs. Julie Meno

In an effort to add authenticity to the email, and to generate sympathy for her cause, there were two photos attached (shown below):

image                                                        image

I responded to the email with some bogus information and indicated  my willingness to help her out in any way possible.  Soon I received another email with a list of charities that she intended to help once she had the money and encouraged me to include some of my own charities that I would like to help. 

Clearly the scammer was trying to appeal to my sense of honor and placate any suspicions I might have regarding this deal.  Again I responded with my willingness to help her with this situation.

Interestingly, the next email I received from the scammer requested that I use a different email address for future correspondence.  I suspect that the previous email account may have been shut down.  The new email address used an Argentinian domain:

Dear Mark Baldwin,

How are you today? I hope you are doing fine and blessed. I have a problem with my email address,  i think i was asked to validate my email address because my mail box was full, but i ignored the mail and now i am having issues with receiving mails but i can send out. I Had no choice but to use an alternative email address, please contact me with this new email  juliemenowebmail@ciudad.com.ar.   i think its much more better.  Please give me updates regarding the previous mail that i sent to you.I have been very weak,but the doctors are taking care of me, i just want this project successful so i can rest. God Bless you. Regards
Mrs. Julie Meno

Finally, on June 24 2011 I received the below email which is the start of the actual attempt to get me to send her money.  The email included two attachments: 1) a “Power of Attorney” naming me as the trustee of the 7.5 million pounds and 2) a deposit certificate from Halifax bank of London with me as the recipient of the 7.5 million pounds.  I am promised 20% of the 7.5 million pounds in return for my assistance with the transaction.

Dear Mark Baldwin,

Attached to this email is the Certificate of Deposit and a Power Of Attorney.

God bless you for your zeal and seriousness to help me out in this charitable course and God will surely bless you and i want you to know that i am a very devoted Christian and do only the things directed by my father. I contacted you purely on divine instruction and i want you to know that so far i prayed about this divine direction to you then God has appointed you for this project to bless you and your family, all i need is absolute trust and honesty when this funds get to you that it will be used to accomplish the purpose for which it was made. When my late husband was alive we were so much in love and fond of ourselves that we combined his first name and my middle name john and Alice to become Joyce which we always used to call ourselves and i will want you to set up a charity home or foundation with this name when the fund has been released to you. Dear you are now my only source of strength and hope and you alone can make me happy if only Joyce dreams come to pass then i shall wait upon the lord with joy in my heart. Please do not disappoint me because you know what it takes to entrust so much money on you.

I have just received a Power Of Attorney from my attorney and I have sent it to the bank regarding my appointing you as my beneficiary and you are now the sole and sole beneficiary to this fund totaling  £7,500,000.00 Pounds Sterling and you have to keep 20% for your services for you and your family.  I attach a copy for you to contact the bank with. As i told you in my last email my health is not too good now which means sometimes it will be difficult for me to be on the Internet and send messages to you but do send me messages and my prayer and blessings is with you. Also as soon as the funds get to you let me know so that i can still advise you on things to do.

The contact details and email of the finance firm is below and you have to contact them immediately via email as i have already issued the authority to them and they will be expecting to hear from you so that they can arrange on how the funds will be transferred to you. You have to provide them with every assistance the bank will need to effect the transfer to enable the funds released to you without delay. I want you to contact the bank stating my deposit File No: Reference: HAL/2010/678/51829/UK for easy trace of my file, and also note that you “MUST” open an offshore online account with this branch of HALIFAX  FINANCIAL HOUSE before my deposit willed to you will be credited in your name and thereafter you can transfer online to local account or anywhere you want in the world, this is because they said that my dormant account can only be reactivated by me, since I cannot go there due to my health, they have advised that the beneficiary setup a new Offshore account as an alternative means. If you follow the instructions from the bank directly within the next 3 working days you will have this funds transferred to you and available for use.

Address and contact email of my bank branch and head office below:

HALIFAX FINANCIAL HOUSE CENTRAL OFFICE:
HEAD OFFICE:  6389 Coburg Road,
Suite 202, Halifax, NS B3H 2A5 UK,London.
Director Of Operations: Mr.Winter Blakes
Email: info@hali-fxbklondon.co.uk
Email:  w.blakes@hali-fxbklondon.co.uk
Tel: (+44)702-409-6780
Fax: +44709-284-9743

Once again, The agreement reached due to the dormancy of my account states that who ever i authorize to inherit this deposit will complete it through the use of an online account that MUST be opened by the new customer, therefore note that your contact with the HALIFAX FINANCIAL will involve the opening of a new private account in your name which automatically credit the deposit into your account. That is the HALIFAX e-banking policy like I was told, so you should be ready to open an account with them upon your contact.

God bless you and your family for what you have chosen to do.

God Bless you.
Julie Meno

image

Next I received an email purportedly from Halifax bank asking me to fill out an online form in order to establish my account into which the 7.5 million pounds would be deposited.  Notice at the bottom of the email there are instructions for staying safe online, including not providing your personal information to unknown people.  This is quite amusing given that this is exactly what they are asking me to do.

HALIFAX FINANCIAL HOUSE . HEAD OFFICE:

6389 Coburg Road,
Suite 202, Halifax, NS B3H 2A5 UK,London.
Tel: (+44)702-409-6780
Fax (+44)709-284-9743
Company Reg no: UK0186483UR82345.

Dear Respected Beneficiary (MARK BALDWIN)

You are welcome to the support department of the Halifax Financial House.

RE: BEQUEATHED £7,500,000.00 TO MARK BALDWIN

Compliment of the day to you, upon the receipt of your mail. We would like you to visit our website online with the link below

WEBSITE:  http://www.hali-fxbklondon.com/fh/ or visit directly to our Online Verification form with this link http://hali-fxbklondon.com/fh/en/i-fund/reg.html

Do endeavor to complete the required information’s on the form and submit. As soon as we receive the details we will send you instructions in other to have your account accessed.

We pledge our efficient banking services.

Yours Faithfully,
Support Department

This message contains confidential information and is intended only for the individual named in the TO Column, of this e-mail. If you have received this and are not the named addressee, Please notify the sender. The sender therefore does not accept liability for any error or omission in the contents of this message, which arises as a result of e-mail transmission.

If you have any questions,please feel free to contact me. On behalf of my bank let me welcome you as one of our most-valued clients.  

Yours Faithfully

Mr. Winter Blakes
Director Of Operations
Halifax Financial House

**ABOUT US**
News Alert: Stay Safe Online It’s easy to protect yourself online if you follow these simple steps:

1.Never divulge your full PIN or Password
2.Never respond to an e-mail that asks for your confidential or personal security information
3.Install and maintain anti-virus software
4.Install and activate a Personal Firewall
5. Keep your computer software up to date

I went to the online form mentioned in the email expecting that it might be a malicious website that would attempt to install malware on my machine, but found that it is actually a fake banking site designed to trick visitors into providing their financial information.  Unfortunately, it no longer appears to be online and I did not take a screen-shot prior to writing this article. 

However, I did look at the page source when it was still online and noticed that they had used Httrack website copier to create their fake banking site.  It was very poorly done with many of the links not working properly and the source code not cleaned up at all, making it obvious as a phony banking site.

The next email I received from “Halifax Bank” was a request to wire them $600, which is the minimum amount required to open an account. 

At this point I imagine they were anxiously waiting for the money to come in:

We received your Online application details. Be informed that we will have Mr. Mohamed Saha Meno’s account activated from it’s dormant state and move the funds into your account which you will be operating in our bank because you cannot make transfer from his dormant account.

Once you have received your account details upon meeting our account requirements, The sum of Seven Million, Five Hundred Thousand Great British Pounds Sterling would be added to your initial deposit for you to make transfer.

We he have also attached our account opening form which you are to fill and send back to us along with the payment details for your account initial deposit.  The Initial deposit for an Online Banking Pro Tem  Account  is £373.500 GBP = $600 USD.  Payment for the Pro Tem  account (Initial deposit) should be sent through Western Union to our account officer with the following information in our payment head office.

Name:   Adrien Addison
Address: 6389 Coburg Road,
Suite 202, Halifax, NS B3H 2A5 UK,London

On receiving the payment receipt, you are required to send a copy of the payment receipt to this office so it could be filled for official references.

The payment details sent should include the following:
1. Name of sender.
2. Address of sender.
3. Amount sent.
4. Money Transfer Control Number. (M.T.C.N)

We anticipate a swift response from you in other to activate all services required to make your transfer. Note that The initial deposit remains in your account and will be added to your funds.For any help and problems do not hesitate to contact us.

Yours Faithfully,
Support Department

This message contains confidential information and is intended only for the individual named in the TO Column, of this e-mail. If you have received this and are not the named addressee, Please notify the sender. The sender therefore does not accept liability for any error or omission in the contents of this message, which arises as a result of e-mail transmission. If you have any questions,please feel free to contact me. On behalf of my bank let me welcome you as one of our most-valued clients.  

Yours Faithfully

========================================================
Mr. Winter Blakes
Director Of Operations
Halifax Financial House

**ABOUT US**
News Alert: Stay Safe Online It’s easy to protect yourself online if you follow these simple steps:

1.Never divulge your full PIN or Password
2.Never respond to an e-mail that asks for your confidential or personal security information
3.Install and maintain anti-virus software
4.Install and activate a Personal Firewall
5. Keep your computer software up to date

At this point my ruse had run its course as I was not about to send them any money.  I responded that I did not have the $600 to fund the account and ask Julie Meno if perhaps she could loan me the money to fund the account.  The last email I received from her is below:

Dear Mark Baldwin,

I received your mail, but you alone know that i am disabled and all i have right now i do not have them in my possession any longer since my late husband’s relatives took over because of my disability.  This involves just the both of of us, and if you do not do something about getting this funds, its either the bank would informed them later after i die or the British Government would take over it.

Now that i have been able to give you all you need, why not take this as a personal project. We are talking about a huge funds here,and i do not see why you cannot go extra length in making sure this funds get’s to your account and then you alone can dedicate without anyone given you instructions.  But everything is a matter of choice. Just get back to me because i do not have any way of assisting you financially, i already explained that to you.

Mrs. Julie Meno

Scams such as these are very prevalent on the Internet and gullible people frequently fall prey to these.  It should go without saying that if a deal seems to good to be true, it is. 

To avoid these types of scams, simply delete any emails you receive from unknown sources, especially ones promising money or other goods.  Never give out personal information and don’t follow links in emails from unknown senders. 

Check out the FBI’s website for a list of useful tips for avoiding becoming a victim of Internet fraud.

Cross-posted from InfosecStuff
Possibly Related Articles:
6972
Impersonation
Information Security
Email Identity Theft fraud malware Social Engineering Advanced Fee Fraud Nigerian Scams
Post Rating I Like this!
Bdd5942b986a243fd2d84461611aec6a
Anup Shetty Nice Scambaiting!
There are sites dedicated for this - www.419eater.com is one of the best. Has great resources and information for creating awareness against such scammers!
1310542765
B6f0893230292b638a6419bf566dbda6
cliff sull Does this mean my Nigerian Lottery win will never turn up ?
1310569194
6648b1abd4a9b964566c3690613f20a6
Mark Baldwin Anup. Thanks for sharing that website. I was not aware of that.
1310573496
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.