joewein.net   joewein.de LLC
fighting spam and scams on the Internet
Try our spam filter!
 Free trial for 30 days
   jwSpamSpy
Home
About Us
Spam
419/Nigeria
Fraud
Contact

"419" Scam – Advance Fee / Fake Lottery Scam

The so-called "419" scam is a type of fraud dominated by criminals from Nigeria and other countries in Africa. Victims of the scam are promised a large amount of money, such as a lottery prize, inheritance, money sitting in some bank account, etc.

Victims never receive this non-existent fortune but are tricked into sending their money to the criminals, who remain anonymous. They hide their real identity and location by using fake names and fake postal addresses as well as communicating via anonymous free email accounts and mobile phones.

Keep in mind that scammers DO NOT use their real names when defrauding people.
The criminals either abuse names of real people or companies or invent names or addresses.
Any real people or companies mentioned below have NO CONNECTION to the scammers!

Read more about such scams here or in our 419 FAQ. Use the Scam-O-Matic to verify suspect emails.

Click here to report a problem with this page.

 

 

Some comments by the Scam-O-Matic about the following email:

Fraud email example:

From: "FEDAL RESERVE BANK NEW YORK" (may be fake)
Reply-To: <transferdept200@gmail.com>
Date: Tue, 6 Jun 2017 15:21:44 -0700
Subject: FUND RELEASE


*****************************************************************
********************** SPAM REPORT MESSAGE **********************
*****************************************************************

Datagate AntiSPAM detection software has identified this incoming
email as possible spam. The original message report has been
attached to this so you can view it (if it isn't spam) or block
similar future email. If you have any questions, please contact
Datagate PostMaster <antispam@postmaster.datagate.net.uk>.

Content preview: Federal Reserve Bank New York 33, Liberty Street, New York,
NY 10038 USA. Ref.: Final Payment Release Update. [...]

Content analysis details: (9.9 points, 4.9 required)

pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FSL_HELO_NON_FQDN_1 FSL_HELO_NON_FQDN_1
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(adm099609060[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(adm099609060[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
(transferdept2007[at]gmail.com)
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.4 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 FROM_MISSP_TO_UNDISC From misspaced, To undisclosed
0.0 FROM_MISSP_USER From misspaced, from "User"
0.0 DYN_RDNS_SHORT_HELO_HTML Sent by dynamic rDNS, short HELO, and HTML
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
0.4 MIMEOLE_DIRECT_TO_MX MIMEOLE + direct-to-MX
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FILL_THIS_FORM Fill in a form with personal information
0.0 T_FILL_THIS_FORM_LONG Fill in a form with personal information
1.4 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
0.0 MONEY_FRAUD_3 Lots of money and several fraud phrases
0.0 FORM_FRAUD_3 Fill a form and several fraud phrases


Datagate AntiSPAM Service <antispam@postmaster.datagate.net.uk>
---------------------------------------------------------------



Anti-fraud resources: