Email Spam Filter:
jwSpamSpy
Try it for free!


About spam / "419" / Blog
jwSpamSpy
Recent spam domains
Spam domain blacklist

Software
Links
joewein.de
joewein.net
Contact
Google

 

Beware of Fraud: eBay purchase for Nigeria using BidPay (Western Union)

IMPORTANT UPDATE: On 2005-12-31 BidPay shut down its auction payment service. Any BidPay payment notification that you receive after this date can not be genuine. In February 2006 we came across very similar emails using fake MoneyGram emails.

The following scam targets eBay sellers, who may be tricked into shipping goods to Lagos, Nigeria without any payment. First the criminal contacts the seller (usually via a new eBay account) and offers a high price for an item on sale. He or she will request that the item be shipped to Nigeria via a parcel service (FEDEX, DHL, UPS, EMS) and explains that the buyer will pay via "Western Union Auction Payment (Bidpay)". This is a legitimate company, but that doesn't matter in this case, because it's not actually involved.

The way the scam works is that the seller is told the money will only be released by Western Union / Bidpay when the buyer supplies a tracking number, i.e. when he has already shipped the parcel. To get the seller to ship the parcel, the criminal himself poses as Western Union, sending an email from a free webmail service to the victim using an email address which mentions Western Union or BidPay, for example "onlinebid-pay@accountant.com" or "westernunionmoneyorderpayment@banknotes.com", assuring the seller that Western Union has received payment from the buyer and will release it as soon as he submits the tracking number as proof of shipping. A seller believing this message to be sent from Western Union will lose his merchandise and the shipping costs.

The PayPal version of the scam
Another variant is a fake PayPal payment notification sent by the criminal. Unless a PayPal payment shows up in your actual PayPal account you have not received money! MoneyGram is also mentioned in some scams involving eBay articles to be shipped to Nigeria (see example).

The Western Union MTCN version of the scam
In yet another variant of this scam, the buyer will provide a real Western Union Money Transfer Control Number (MCTN) to the seller, which can be checked on the Western Union website. However the buyer will not tell the seller who sent the money, thereby making it impossible to receive those funds. It's like showing someone a wad of dollar bills but not handing over the money.

The "Ukcitibank" version of the scam
Yet another twist on the same scam is a fake email claiming to be from Citibank UK, informing the seller that the buyer has made the requested payment and has a large account balance with them. The email address of the fake bank can be an MSN PA domain such as "ukcitibank.com".

We have received reports from buyers who backed out of Nigerian mail order deals who received threatening emails supposedly from the FBI but actually sent via a free webmail address (e.g. "w.u_fbi_investigation@public.usa.com"). The scammers told the sellers they were being investigated by the FBI for fraud for not shipping the goods to Nigeria. Don't let yourself be intimidated, contact the police if you have any doubt!

If you receive a fake Western Union / BidPay or PayPal message, look at the email address this was sent from (for example, westernunionmoneyorderpayment@banknotes.com or onlinebid-pay@accountant.com) or any addresses of a "BidPay agent" to contact for questions. If you take this address and replace the left part with the word abuse you get the email address to which to forward such scam emails (for example, abuse@banknotes.com or abuse@accountant.com). Ask the email service to suspend the email account used for this fraud.

See below for examples of such scams. If you have received any such offers, send us copies. Please mark the subject line:

[419] Lagos: eBay

Here is an amusing letter that shows how to creatively deal with such scammers:

jwSpamSpy
Are you sick of spam too? Do you want it stopped now?
Try jwSpamSpy, the spamfilter we use to track the spammers!
Free 30-day trial version available now!

Example notification (from "bedfordsuperstore"):

Dear seller,
I really want to buy this item and i need a seller who is ready  to sell,i
will be paying 750euro for this item and you will ship it to my client in
Nigeria.
(1)I will be paying you by western Union Auction Payment(Bidpay).
(2)You will ship the item by FEDEX,DHL,UPS,EMS.
(3)You will ship the item to my client immediately you recieve my payment
approval from the western union.
If you agree with these stated terms,send me your full name and address so
that i can go to the western union office immeidately to make payment for
the item.
please please scammers stay off!!!!!!!!!!
Robert Dallas
Here is another one by the same scammer:
dear seller, i want to really buy this item and i want 
you to ship the item to my client in Nigeria. i will be paying 600euro 
for the item and i want you to calculate the shipping cost and the item 
price together. i will be paying with Western Union Auction Payment(bidpay) 
and i want you to ship the item via UPS,FEDEX,DHL OR EMS. you will ship 
the item to my client immediately you recieve my payment approval from 
western union. if you agree with these terms,send me your full name and 
address for immedaiate payment at the western union office. 
Scammers keep off 
Dallas Robert 

When contacted by email (bedfordsuperstore@nyc.com) the scammer replied:

Dear seller,
Immediately i go to the western union office to make payment for the
item,they will send you a notification that my payment has been approved
and they will send you a number which you will use to rack your money,the
payment will be delivered to the address you will provide.
And once you have track your money and you have seen that your money is
confirmed then you will give me the tracking number to the item.
Or would you like it if i pay you by MONEY GRAM?
If you still want to sell to me send me your full name and address so that
i can go and make payment for the item as soon as possible.
Hope to hear from you soon.



Visit New York City online. Special offers on hotels, shops, attractions, and more. 
Plus FREE @nyc.com or @newyorkcity.com E-Mail! 
http://www.NewYorkCity.com       http://www.NYC.com

Here is the fake "Western Union" money notification which is actually sent from a free webmail account instead of from Western Union:


Dear  B. E. Trueger,
Bidpay®Online Payments hereby congratulates you and also want 
to inform you that the ® Money OrderSM sent to you from Robert 
Dallas has been Approved. 

Item information
®Money OrderSM   :750 EUROS 

Auction Item             :Keyboard YAMAHA PortaSound Model PS-3
Auction site               : Ebay

 

Seller Contact Address: 

Name: victimname

Addresses: victimstreet

postal code: victimzip

city: victimcity

country: victimcountry

Identification Number: 42-782-719.M


Shipping information Via DHL:

NAME:SEGUN ABIODUN

ADDRESS:25,ABIMBOLA ODUNSI STREET,OFF COKER RD
ORIMOLADE BUS/STOP,IFAKO,OGBA

CITY:LAGOS

COUNTRY:NIGERIA



This money order has been approved and will be sent out TODAY 
to the address provided by the buyer and you should expect it 
in 4-7 business days after postage has being confirmed.
You CAN NOW send the items to the buyer,Moreover the above ®
Pin Number will be asked for before the delivery of the Money 
OrderSM, you will also identify your self with your ®drivers 
licence or your ®Social security number. 

N.B NOTE THAT THE MONEY ORDER WILL NOT GET TO YOUR RESIDENT IF 
SHIPMENT TRACKING NUMBER IS NOT SENT TO US IN THE NEXT 24HRS 
FOR SHIPMENT VERIFICATION IN OTHER TO SECURE BOTH THE SELLER 
AND THE BUYER. 

And if you have any question, feel free to contact our customer 
service at (westernunionbidpayment@personalmanager.com).

TO CONFIRM YOUR PAYMENT CLICK  BELOW 

https://netsage.finali.com/netsage?customer=wuap&iid=esell-appr&
num=22813469&status=appr&date=20050330country=UK 

If the Link above does not work: 
Type in or copy and paste this link into your Web browser,Make 
sure you copy this link exactly and do not add extra spaces.

Thank you for using Western Union ® Online Payments. We look 
forward to serving your online payment needs in the future.

Sincerely,
Western Union Online Payments.


More instructions from the scammer:

Dear seller,
I have paid for the item and i know by now you should have recieve my
payment from the western union.
I want you to please remove the invoice of the item when shipping it and
also you should declare the item as a EASTER DONATION.
Also you shouldnt write down the exact amount of price i bought the item
from you,This will reduce the rate of custom charges when the item get to
my client,they wont charge him much.
And also i will like you to give me the tracking number for the item since
your money has been approved.
Hope to hear from you soon and also to do more business with you.

From: <westernunionbidpayment@personalmanager.com>
To: emailaddress
Subject: APPROVED MONEY ORDER(8180658433 ) REPLY TO THIS EMAIL
Reply-To: westernunionbidpayment@personalmanager.com
X-Mailer: SeeqMail 4.0 (authenticated
    westernunionbidpayment@personalmanager.com)
X-Origin: 213.181.81.125
X-Uidl: 1112178921603078762
Date: Wed, 30 Mar 2005 02:35:21 -0800

WHOIS details for sending network (IP 213.181.81.125):

     inetnum:      213.181.64.0 - 213.181.95.255
     org:          ORG-BL4-RIPE
     netname:      NG-BROADBANDTECH-20000327
     descr:        BT Limited
     descr:        PROVIDER Local Registry
     country:      NG
     admin-c:      IO243-RIPE
     tech-c:       IO243-RIPE
     status:       ALLOCATED PA
     notify:       bt@micro.com.ng
     mnt-by:       RIPE-NCC-HM-MNT
     mnt-routes:   BT-LIMITED-MNT
     mnt-lower:    BT-LIMITED-MNT
     changed:      hostmaster@ripe.net 20000327
     changed:      hostmaster@ripe.net 20001003
     changed:      hostmaster@ripe.net 20010507
     changed:      hostmaster@ripe.net 20010704
     changed:      lir-help@ripe.net 20011214
     changed:      hostmaster@ripe.net 20020419
     changed:      hostmaster@ripe.net 20020423
     changed:      hostmaster@ripe.net 20020613
     changed:      hostmaster@ripe.net 20030211
     changed:      hostmaster@ripe.net 20040406
     source:       RIPE
     
     organisation: ORG-BL4-RIPE
     org-name:     BT Limited
     org-type:     LIR
     address:      BT Limited
     address:      8B Ademola Street,
     address:      Off Awolowo Road,
     address:      S. W. Ikoyi,
     address:      Lagos, Nigeria.
     phone:        +234 1 2693192
     fax-no:       +234 1 2693192
     e-mail:       bt@micro.com.ng
     admin-c:      IO243-RIPE
     admin-c:      IO243-RIPE
     mnt-ref:      BT-LIMITED-MNT
     mnt-ref:      RIPE-NCC-HM-MNT
     mnt-by:       RIPE-NCC-HM-MNT
     changed:      hostmaster@ripe.net 20040415
     source:       RIPE
     
     person:       Israel Oyeleke
     address:      BT Limited
     address:      8B Ademola Street
     address:      Ikoyi S.W.
     address:      Lagos, Nigeria
     phone:        +234 1 2673532
     fax-no:       +234 1 2673203
     e-mail:       i.oyeleke@moneynett.com
     nic-hdl:      IO243-RIPE
     notify:       i.oyeleke@moneynett.com
     changed:      ifiok@btlimited.com 20010605
     changed:      ifiok_moses@yahoo.com 20030917
     source:       RIPE



GOOD DAY SELLER,
HOW ARE YOU DOING,I WILL LIKE TO CONTINUE THE PURCHASE YOUR ITEM,I AM READY TO PAY FOR THE ITEM AND INCLUDING THE SHIPMENT COST OF THE ITEM SENDING IT THROUGH UPS OR FEDEX, I AM BUYING IT FOR MY FIANCEE IN NIGERIA AS A BIRTHDAY GIFT, AS I WILL NOT BE ABLE TO BE THERE DUE TO THE DISTANCE, WELL AS FOR THE PAYMENT I WILL BE PAYING THROUGH WESTERN UNION BIDPAY. BECAUSE I AM A REGISTERED BIDPAY MEMBER AND I HAVE BEEN USING IT FOR THE PAST 2 YEARS IT'S VERY SECURED, IF YOU DON'T HAVE A BIDPAY ACCOUNT THERE'S NO PROBLEM, THE PAYMENT WILL PROCEED IT'S NOT COMPULSORY THAT THE SELLER HAS AN ACCOUNT. SO I WILL MAKE THE PAYMENT THROUGH BIDPAY AS SOON AS I GET YOUR NAME AND ADDRESS,YOU WANT FOR THE DELIVERY OF YOUR MONEY BY THE BIDPAY AGENTS. THEY BIDPAY WILL SEND A PAYMENT NOTIFICATION TO YOU AS SOON AS THE PAYMENT IS BEEN DEDUCTED FROM MY ACCOUNT. SO LET ME HAVE YOUR INFOS ASAP WITH THE TOTAL COST OF THE ITEM AND SHIPPING TO MY FIANCEE. AND HERE IS THE SHIPPING ADDRESS I WANT YOU TO SHIP THE PACKAGE TO IN NIGERIA ONCE YOU GET YOUR PAYMENT.
Name------- MAT AZIZA
Address-----No.4,Sunday Oyawoye Street off Isuti Road
Oremeji Bus stop Egan town.Igando
City---------- Igando/Lagos
State-------- Lagos
Country---- Nigeria
Zipcode-----23401
REGARDS.


Message headers:

Received: from [81.199.84.22] by ws5-1.us4.outblaze.com with http for
 1richkid@fastermail.com; Thu, 23 Jun 2005 15:20:55 +0800
From: "Richard Black" <1richkid@fastermail.com>
To: emailaddress
Date: Thu, 23 Jun 2005 15:20:55 +0800
Subject: eBay-object: IBM THINKPAD R51 Model
X-Originating-Ip: 81.199.84.22

WHOIS details for sending network (IP 81.199.84.22):

     inetnum:      81.199.84.0 - 81.199.87.255
     netname:      CIDR-COMMUNICATION-01
     descr:        Internet service provider
     country:      NG
     admin-c:      TECH7-RIPE
     tech-c:       TECH7-RIPE
     status:       ASSIGNED PA
     mnt-by:       AS12491-MNT
     source:       RIPE # Filtered
     
     person:       Tech Supernet300
     address:      21 Mobolaji Bank
     address:      Anthony Way Ikeja
     address:      Lagos
     address:      Nigeria
     phone:        + 234 1 4976493
     e-mail:       admin@supernet300.com
     nic-hdl:      TECH7-RIPE
     source:       RIPE # Filtered


Other BidPay scam details:

See abuse contact list for whom to notify of criminal use of such email addresses.

  • biolaadewale_3@yahoo.com (Apr 21, 2005)
    Receiver Name: BIOLA ADEWALE.
    Shipping Address: No 16 Ojoo Road
    City: Ibadan
    State: Oyo State
    Postal Code: 23402
    Country: Nigeria
    

  • derek williams (derek3@fastermail.com, May 11, 2005)
    abbey akintunde
    11 adejobi street oke koto
    agege
    lagos
    23401
    

  • Bidpayaccounts@etn.org (Janet Colman):
    SHIPPING INFORMATION:
    Name       : Tunde Collins.
    Address    : No,58 Old Lebanon Street Dugbe
    City       : Ibadan
    State      : Oyo State
    Zipcode    : 20001
    Country    : Nigeria
    

  • western_union_approved@publicaccounting.com
    Other accounts: consultpinglee4bidpays@accountant.com,
    cynthia4westernsocitiesp@consultant.com
    Fraudster: "Jane Maria" (janemaria@usa.com, hollargydey@yahoo.com)
    Name::::Olajide Durosomo
    Shipping Address::Jakande estate blk 94 flt 4 oke-afa
    City:::::Isolo
    State::::LAgos
    Country:::Nigeria
    Zipcode:::23401
    
  • rev_scottbarcaley@yahoo.com
    orderbybidpay@writeme.com

    c/oNelson Brown
    Match Ministries
    333, Emmanuel Osakwe street
    Egbeda,Lagos
    Nigeria 23401
    234-8045294954

  • bidpay.customercare@ny.com

  • From: "Western Union" <bidpay@westernuniononline-bidpay.com>
    JOHN CHUCKS
    69 NEW LAGOS ROAD,
    NEW BENIN,
    BENIN CITY,
    EDO STATE,
    NIGERIA.
    

  • PROF KOH HON
    From: PAYMENT@WESTERNUNION.COM
        <westernunionworldwideservice@businessconnection.com>
    To: emailaddress
    Subject: Delivery Notification **Order WS3803**Reply Needed
    Reply-To: westernunionworldwideservice@businessconnection.com
    X-Mailer: SeeqMail 4.0 (authenticated
        westernunionworldwideservice@businessconnection.com)
    X-Origin: 80.179.103.162
    X-Uidl: 1119026358856927404
    Date: Fri, 17 Jun 2005 09:39:18 -0700
    


Fake PayPal payment notifications from Nigeria
A similar scam exists where a fake PayPal payment notification is sent from a free webmail account to the seller.

See abuse contact list for whom to notify of criminal use of such email addresses.

Example:

  • Email address: paypalcashaccountapproved@business1.com
  • Date: Thu, 14 Apr 2005 21:50:52 -0700
  • Sending IP: 192.116.123.7
  • Credit card expiry date: 2/2005 (i.e. expired)
  • Credit card billing address: Pennsylvania, USA
  • Shipping address:
    Name       :Tobi Olafioye
    Address    :25 Abimbola odunsi street
    City          : Ifako Ijaiye
    State        : Lagos
    Zipcode   : 23401
    Country  :  Nigeria
  • Customer suport: Paypalcashonlineapproved@accountant.com

Fake PayPal payment notification:

  • Email address: service@paypal.com <paypalconfirmation2@consultant.com>
  • Date: Fri, 13 May 2005 08:01:58 -0500
  • Sending IP: 81.199.243.131
  • Amount: £4,440.00
  • Credit card billing address: Pennsylvania, USA
  • Shipping address:
    Idowu Adeleke
    Address: #17 folarin street,
                    mushin, lagos state,
                    Nigeria, 23401.
    

Fake PayPal payment notification:

  • Buyer email address: mammal@patmail.com
  • Fake PayPal email address: paypal_customer_care@mail.com
  • Shipping address:
    Name      :Waheed Imran,
    Address : N0 10 Olubunmi Ibitoye Street Ososani Oke-Ado,
    City         : Ibadan,
    State       :OyoState,
    Country : Nigeria...
    Zipcode : 23402....
    


MoneyGram scam:

  • Email address: andy stomson <andystomson@yahoo.com>
  • Received: from [81.199.6.131] by web60723.mail.yahoo.com
     via HTTP; Tue, 24 May 2005 03:01:00 PDT
    Date: Tue, 24 May 2005 03:01:00 -0700 (PDT)
    From: andy stomson <andystomson@yahoo.com>
    Subject: my order (urgent reply )
  • receiver's name : muse alala 
    address : block 122 flat 6, l.c.h.e, oke afa, isolo , lagos , nigeria , 
    city : isolo 
    state: lagos 
    zipcode: 23401
    country : nigeria 
    
    receiver's name : akanji bamiwa
    address : block 218 flat 4 l.c.h.e oke afa isolo , lagos , nigeria , 
    city : isolo 
    state: lagos 
    zipcode: 23401
    country : nigeria 
    


Fake MoneyGram email scam

From: "Moneygram Moneytransfer" <immediatelycash@thetransfer.net>
To: <emailaddress>
Sent: Thursday, 09 February, 2006 19:50
Subject: ***APPROVED MONEYGRAM PAYMENT CONFIRMATION***DO REPLY IMMEDIATELY***

Dear Firstname Lastname ,

Moneygram Online Auction Payments hereby congratulates you and at the same time informing you once again that the Money OrderSM sent to you from ***Mr Larry Kentt*** has been Approved,it will be transfered into your account shortly.® Money OrderSM : €350.00[EURO]


Cost of item with Shipping : €350,00

Total Cost: € 350,00

Auction Item: Playstation2

Quantities of item : (1)
SHIPPMENT INFORMATION FOR THE SHIPPING

Name: Larry Demola

Address: P.o.Box 2895 dugbe City: Ibadan
State: Oyo state
Zip code: 23402
Country: Nigeria

Email : larrykentt2@hotmail.com



PLEASE VERIFY THE FOLLOWING NAME AND ACCOUNT DETAILS (as entered by the buyer) IS ONCE AGAIN CORRECT.


NAME: Firstname Lastname


Country: Countryname

Email: emailaddress



Account Details

Name: Firstname Lastname

Bank Name:Bankname

Account Number: xxxx.xx.xxx

IBAN: CCXX BBBB NNNN NNNN NN

BIC: BBBBCCXX

Country:Countryname





MONEY TRANSFER CODE

***Withheld***

This order has been approved,and the money will be sent into the seller's bank account immediately,the shipment verification is confirmed

BUYER SHIPPING OPTIONS:

TPG POST SHIPPING


***PLEASE NOTE***
The Money OrderSM will NOT be dispatched until shipment has been verified. This measure is taken in order to protect both seller and buyer interests and to reduce the occurrence of fraudulent activities.

***SHIPMENT VERIFICATION***
You can have the shipment confirmed/verified in any of the following ways:
1.Contact moneygram stating the TRACKING NUMBER AND SENDING THE SCANNED RECEIPT of the shipment (immediatelycash@thetransfer.net)

***PLEASE NOTE***
Due to the fact that Moneygram processes thousands of orders daily, Moneygram RECOMMENDS contacting the Customer Support Representative that has been assigned to this particular Order directly.This ensures speedy verification of shipment as well as prompt dispatch the Money OrderSM.Send tracking details to: (immediatelycash@thetransfer.net)

2.You must not give the buyer the shipment BARCODE NUMBER that you will collect in the postoffice until we inform you to do so.
======================================================================
======================================================================
Once shippment has been verified, You will receive a " ORDER CONFIRMATION" email from money gram® informing you that the Money OrderSM has been dispatched.You will also receive "8 DIGIT Moneygram® PIN" in this email.
======================================================================
======================================================================

***CUSTOMER SUPPORT***
If you have any questions, Please feel free to contact the Customer Support Representative that has been assigned to this particular Order at: (immediatelycash@thetransfer.net)
Thank you for using Money gram® Auction Payments. We look forward to serving your online auction payment needs better in the future.

Sincerely,

Money gram Online Auction Payments.
An Alternate Way to Pay for Auctions!Money gram® is a fast, reliable way to pay or get paid for your online auctions.


From a "Ukcitibank" version of the scam

Hello,
Thank you for your patience and understanding so far,let me inform you that i have been to Ukcitibank this morning, the receipt must have receive them by now.

So if you have receive the payment receipt let me know and make sure that you ship out the item immediately you receive from them and mail the tracking number to their customer unit for verification once,the shippment address is below;

Name: Aina Emmanuel Adeyemi
Address: 32,kolawole str okoro okeitunu Mokola
City: Ibadan
State: Oyo
Country: Nigeria
Zip code: 23402
Email: adeaina2003@yahoo.com

Please Ship the item to our branch in Nigeria today also inform me when you contact Ukcitibank customer care unit with tracking number so that i can Monitor them to activate your account immediately.

Regards
Bruce Payne


Here is an amusing letter that shows how someone creatively dealt with such scammers:

jwSpamSpy
Are you sick of spam too? Do you want it stopped now?
Try jwSpamSpy, the spamfilter we use to track the spammers!
Free 30-day trial version available now!