joewein.de LLC fighting spam and scams on the Internet

Try our spam filter! Free trial for 30 days

"419" Scam – Advance Fee / Fake Lottery Scam

• About the 419 (Advance Fee) scam
• "Is that email a scam?" - Check it online here!
  
• Frequently asked Questions (419 FAQ)
• Phone numbers used by 419 scammers
  (+225 +229 +234 +27 +31 +32 +34 +44 other)
• Company names mentioned in 419 spam:
  1 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
• Support our efforts to stop scams!
  
• How to report 419 spam to us
• What can you do when you receive 419 spam
  
  
• Spam archive, Daily index
  

Victims never receive this non-existent fortune but are tricked into sending their money to the criminals, who remain anonymous. They hide their real identity and location by using fake names and fake postal addresses as well as communicating via anonymous free email accounts and mobile phones.

Read more about such scams here or in our 419 FAQ. Use the Scam-O-Matic to verify suspect emails.

Click here to report a problem with this page.

Some comments by the Scam-O-Matic about the following email:

• The following fake company names, fake addresses, non-existent institutions/documents or other details have appeared in scams before:
  • "uk national lottery" (can only win this lottery if you bought a ticket)
• The following phrases in this message should put you on alert:
  • "claim agent" (real lotteries do not use a "claim agent" / "fiduciary agent")
• This email message is a fake lottery scam. Consider the following facts about real lotteries:
  
  1. They don't notify winners by email.
  2. You can't win without first buying a lottery ticket.
  3. They don't randomly select email addresses to award prizes to.
  4. They don't use free email accounts (Yahoo, Hotmail, etc) to communicate with you.
  5. They don't tell you to call a mobile phone number.
  6. They don't tell you to keep your winnings secret.
  7. They will never ask a winner to pay any fees to receive a prize!

Fraud email example:

From: "British Lottery Board"<nemig@tugab.bg>
Reply-To: <claimspayment2008@yahoo.co.uk>
Date: Sat, 6 Sep 2008 11:43:14 +0200
Subject: *****SPAM***** British Lottery Board 2008 Notification.


Spam detection software, running on the system "mail.tugab.bg", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
The administrator of that system for details.

Content preview: British Lottery Award Promotion Programme Headquarters:=
1a,
Bexon Court Carlton Nottingham shire Nottingham NG4 1SQ Essex United K=
ingdom.
We announce today the 5th of September, 2008 , external draw No 2056 o=
f the
UK National Lottery held on the 30th of August, 2008 in the United Kin=
gdom
. Your email address attached to ticket Number 207/510054/UKNL, with S=
erial
number 099010, won in the 2nd Category. You are therefore to claim a t=
otal
sum of =A3550,000.00 (five hundred and fifty thousand pounds Sterling =
) in
cash credited to file UKNL/9023118308/MB/03. To file for your claim, pl=
ease
contact our claim Agent: [...]=20

Content analysis details: (15.9 points, 5.0 required)

pts rule name description
---- ---------------------- ---------------------------------------------=
-----
0.9 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
[41.246.23.171 listed in zen.spamhaus.org]
0.9 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP add=
ress
[41.246.23.171 listed in dnsbl.sorbs.net]
0.0 MISSING_MID Missing Message-Id: header
1.3 MISSING_HEADERS Missing To: header
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
[score: 0.5031]
1.5 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.6 KAM_LOTTO2 Highly Likely to be a e-Lotto Scam Email
0.0 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email
1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419=
)
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.1 RDNS_NONE Delivered to trusted network by a host with n=
o rDNS
3.1 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
2.8 DOS_OE_TO_MX Delivered direct to MX with OE headers
-0.3 AWL AWL: From: address is in the auto white-list

The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.

Anti-fraud resources:

• What can you do when you receive 419 spam