419 Scam Example: "CITY TRUST E-MAIL LOTTERY INTERNATIONAL N.V / Mr Rick Van morgan"
"CITY TRUST E-MAIL LOTTERY INTERNATIONAL N.V / Mr Rick Van morgan" are labels used by a gang in Belgium for a fake lottery fraud (advance fee fraud, "419").
This scam is probably run by the same gang as the "FAMOUS CULTURE LOTTERY / Joe West / Rita Hamilton" scam. It is linked to the Spanish "EUROMILLONES SPANISH SWEEPSTAKES LOTTERY / ONXY SECURITIES AND FINANCE S.A" scam and the Dutch "CISCO WORLD NETWORK" scam.
Example of "CITY TRUST E-MAIL LOTTERY" scam email:
From: "Mrs.van Young." <email@example.com> Sent: Wednesday, 02 February, 2005 21:47 Subject: WINNING NOTIFICATION/FINAL NOTICE CITY TRUST E-MAIL LOTTERY INTERNATIONAL N.V Ref. Number:7683408058/09 Batch Number:57/8703/3PD Credited file Number:EGS56/50071245/25 WINNING NOTIFICATION/FINAL NOTICE We are pleased to inform you of the result of the Lottery Winners International programs held on the 1st febuary 2005. Your e-mail address attached to ticket number 738--134655507--798 with serial number 8052-79 drew lucky numbers 8-10-25-30-32-49 which consequently won in the 1st category. You have therefore been approved for a lump sum pay of 1.000.000(One Million EUROS) in cash credited to file No:EGS56/50071245/25.This is from a total cash prize of (Thirty Million Euro) shared among the thirty international winners in this category. CONGRATULATIONS!!! Due to mix up of some numbers and names we ask that you keep your winning information confidential until your claims has been processed and your money Remitted to you.This is part of our security protocol to avoid double claiming and unwarranted abuse of this program by some participants. All participants were selected through a computer ballot system drawn from over 50,000 company and 70,000,000 individual email addresses and names from all over the world. This promotional program takes place every three years,the lottery was promoted and sponsored by (Coca-Cola and Pepsi).We hope with part of your winning you will take part in our next program 50.000.000 (Fifty Million Euros) international lottery. Your fund is now deposited in a bank under a fixed deposit bond policy insured to you by our financial agent. To file for your claim please contact our fiducial agent,( E.U) Foriegn Operations Manager, Mr Rick Van morgan. Tel:0032-498-786-327 Fax:0032-322-635-56 Email:firstname.lastname@example.org Remember all winning must be claimed not later than 16th of febuary 2005. After this date all unclaimed funds will be included in the next stake. Please note in order to avoid unnecessary delays and complications please remember to quote your reference numbers and batch numbers in all correspondence. Please attach your phone and fax number.Furthermore,should there be any change of address do inform our agent as soon as possible. Congratulations once more from our members of staff and thank you for being part of our promotional program. Sincerely yours, Lotto Co-ordinator. Mrs.van Young. NOTICE!!! This communication is confidential to Mrs.van Young, and is intended solely for the use of the individual or organization to which it is addressed. It may contain privileged or confidential information. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you should not use, copy, alter, or disclose the contents of this message. All information or opinions expressed in this message and/or any attachments are those of the author and are not necessarily those of Mrs.van Young; accepts no responsibility for loss or damage arising from its use. ___________________________________________________________ Book yourself something to look forward to in 2005. Cheap flights - http://www.tiscali.co.uk/travel/flights/ Bargain holidays - http://www.tiscali.co.uk/travel/holidays/ NOTICE!!! This communication is confidential to Mrs.van Young, and is intended solely for the use of the individual or organization to which it is addressed. It may contain privileged or confidential information. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you should not use, copy, alter, or disclose the contents of this message. All information or opinions expressed in this message and/or any attachments are those of the author and are not necessarily those of Mrs.van Young; accepts no responsibility for loss or damage arising from its use. ___________________________________________________________ Book yourself something to look forward to in 2005. Cheap flights - http://www.tiscali.co.uk/travel/flights/ Bargain holidays - http://www.tiscali.co.uk/travel/holidays/
Reponse from the claims agent:
Return-Path: <email@example.com> Received: from 22.214.171.124 (EHLO imo-d02.mx.aol.com) (126.96.36.199) by mta289.mail.scd.yahoo.com with SMTP; Thu, 03 Feb 2005 04:12:16 -0800 Received: from firstname.lastname@example.org by imo-d02.mx.aol.com (mail_out_v37_r3.8.) id r.1c.103fccfe (16239) for <email@example.com>; Thu, 3 Feb 2005 07:12:13 -0500 (EST) Received: from netscape.net (mow-d24.webmail.aol.com [188.8.131.52]) by air-in03.mx.aol.com (v104.17) with ESMTP id MAILININ33-3f6f4202151c216; Thu, 03 Feb 2005 07:12:12 -0500 Date: Thu, 03 Feb 2005 07:12:12 -0500 From: firstname.lastname@example.org (Mr. Rick van Morgan.) To: email@example.com (John) Subject: Claim Application Form (Attached) MIME-Version: 1.0 X-Mailer: Atlas Mailer 2.0 X-AOL-IP: 184.108.40.206 X-AOL-Language: english Content-Type: multipart/mixed; boundary=-------71b5fe744116e48e71b5fe744116e48e Content-Transfer-Encoding: 8bit Content-Length: 44249
Attn:The attached "CLAIM APPLICATION FORM.doc" lists the following address:
CITYFIRM INTERNATIONAL AGENCY (DIPLOMATIC & FINANCIAL MANAGEMENT) APPROVED AGENT GROTEMARKT 26, 1000,BRUSSELS BELGIUM. TELL: 0032- 498-786-327 FAX: 0032-323-498-53 Nr.34/-272 CLAIMS APPLICATION FORM
The author of the document ist listed as "ARAB" and the company as "ARAB & CO.". It was last saved by user "pc-17". The owner and company are the same as in the "ONXY SECURITIES" scam, suggesting direct links between both scams.
inetnum: 220.127.116.11 - 18.104.22.168 netname: TELENET descr: Telenet Operaties N.V. country: BE admin-c: PS396-RIPE tech-c: PS396-RIPE status: ASSIGNED PA mnt-by: TELENET-DBM mnt-lower: TELENET-DBM mnt-domains: TELENET-DBM changed: firstname.lastname@example.org 20041207 source: RIPE route: 22.214.171.124/13 descr: TELENET CUSTOMERS origin: AS6848 mnt-by: TELENET-OPS-MNT changed: email@example.com 20041118 source: RIPE role: Technical Internet address: Telenet Operaties N.V. address: Liersesteenweg 4 address: B-2800 Mechelen address: Belgium e-mail: firstname.lastname@example.org trouble: IMPORTANT: To report intrusion attempts, hacking, trouble: IMPORTANT: spamming, or other unaccepted behavior trouble: IMPORTANT: by a Telenet/Pandora customer, please trouble: IMPORTANT: send a message to email@example.com trouble: IMPORTANT: Voor het rapporteren van inbraakpogingen, trouble: IMPORTANT: hacking, spamming, of ander onaanvaardbaar trouble: IMPORTANT: gedrag van een Telenet/Pandora klant, gelieve trouble: IMPORTANT: een bericht te zenden naar firstname.lastname@example.org admin-c: TI346-ORG tech-c: TI346-ORG nic-hdl: PS396-RIPE mnt-by: TELENET-DBM changed: email@example.com 20000630 source: RIPE