joewein.de LLC fighting spam and scams on the Internet

Try our spam filter! Free trial for 30 days

"419" Scam – Advance Fee / Fake Lottery Scam

• About the 419 (Advance Fee) scam
• "Is that email a scam?" - Check it online here!
  
• Frequently asked Questions (419 FAQ)
• Phone numbers used by 419 scammers
  (+225 +229 +234 +27 +31 +32 +34 +44 other)
• Company names mentioned in 419 spam:
  1 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
• Support our efforts to stop scams!
  
• How to report 419 spam to us
• What can you do when you receive 419 spam
  
  
• Spam archive, Daily index
  

Victims never receive this non-existent fortune but are tricked into sending their money to the criminals, who remain anonymous. They hide their real identity and location by using fake names and fake postal addresses as well as communicating via anonymous free email accounts and mobile phones.

Read more about such scams here or in our 419 FAQ. Use the Scam-O-Matic to verify suspect emails.

Click here to report a problem with this page.

Some comments by the Scam-O-Matic about the following email:

• This email message is a 419 scam. Please see our 419 FAQ for more details on such scams.
  
• This email lists mobile phone numbers. Use of such numbers is typical for scams because they allow criminals to conceal their true location. They can receive calls in an Internet cafe from where they send you emails, while pretending to be in some office.
  • +2347081253403
• This email lists free webmail addresses. Use of such addresses is typical for scams. Lotteries, banks and any but the smallest of companies do not normally use such addresses. Criminals use them to anonymously send and receive email at Internet cafes.
  • o1@yahoo.com.hk

Fraud email example:

From: "KELLY EZE"<info.optusb24@optusnet.com.au>
Date: Thu, 22 Jan 2009 03:34:16 -0000
Subject: * * SPAM * * ATM PAYMENT UNIT


Spam detection software, running on the system "nscontrol.brasilreal.com"=
, has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.

Content preview: ATM PAYMENT UNIT CBN HEADQUARTERS Email: atmcontractinf=
o1@yahoo.com.hk
CONTRACT #:MAV/NNPC/FGN/MIN/009. TELE:+234-7081253403 Attn: Contract b=
eneficiary
We apologize, for the delay of your payment and all the inconveniences=
and
inflict that we might have indulged you through. From the records of o=
utstanding
contractors due for payment with the federal government of Nigeria you=
r name
and company was discovered as next on the list of the outstanding cont=
ractors
who have not received their payments. [...]=20

Content analysis details: (22.0 points, 4.0 required)

pts rule name description
---- ---------------------- ---------------------------------------------=
-----
0.1 RDNS_NONE Delivered to trusted network by a host with n=
o rDNS
2.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?41.211.226.=
142>]
2.9 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[41.211.226.142 listed in zen.spamhaus.org]
0.5 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
1.2 SPF_NEUTRAL SPF: sender does not match SPF record (neutra=
l)
1.8 SUBJ_ALL_CAPS Subject is all capitals
1.8 MILLION_USD BODY: Talks about millions of dollars
0.7 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE
2.0 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419=
)
1.4 ADVANCE_FEE_3 Appears to be advance fee fraud (Nigerian 419=
)
1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spa=
m
1.5 ADVANCE_FEE_4 Appears to be advance fee fraud (Nigerian 419=
)
4.2 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

Anti-fraud resources:

• What can you do when you receive 419 spam