This shows some examples of the email scams that I have received in 2014. Please note that ALL of these are SCAMS and if you receive anything similar then you should report it to your anti-malware provider and delete it without taking any action. Unfortunately, we’ve done this hundreds of time this year so we don’t have them all to hand but as we receive ones that haven’t been posted before, we will add it to the list.
If you want to know more about how to identify and prevent email scamming or other types of security risks then check out the articles on our scam@pathowe.co.uk and we may include any examples that are not already on this page.
Update 11 April 2014: It took less than a month from publishing my Scam email address on this page for the scammers to harvest it and start sending me scam emails (only ones pretending to be from Barclays so far).
Update 9 May 2014: I’ve been receiving so many scam emails recently that it’s been hard to remember if I’ve published something similar before. Therefore, I’ve re-organised the page by the organisation that the email is pretending to be from. I hope that is more useful to you too.
Update 20 August 2014: This is my last update on this 2014 Special Report.
CLICK ON A EMAIL SCAM CATEGORY NAME TO VIEW MORE
Amazon Email Scams
Subject: mazon Order status Id: 127-2154753-4148034
From: Amazon Marketplace <customerservice@amazon.co.uk>
Received: 31 July 2014
Attachment: “127-2154753-4148034.zip”
Contents:
Good day,
Thank you for your order. We’ll let you know once your item(s) have dispatched.You can view the status of your order or make changes to it by visiting Your Orders on Amazon.co.uk.
Order Details
Order ID: 127-2154753-4148034Â Placed on July 30, 2014
Order details and invoice in attached file.
Need to make changes to your order? Visit our Help page for more information and video guides.
We hope to see you again soon. Amazon.co.uk
No comment.
Subject: Your Amazon.co.uk order
From: Amazon Local <local@amazon.co.uk>
Received: 30 July 2014
Attachment: “Order-851-7862515-0976182.zip”
Contents:
Hello,
Thank you for your order. We’ll let you know once your item(s) have dispatched.You can check the status of your order or make changes to it by visiting Your Orders on Amazon.co.uk.
Order Details
Order #851-7862515-0976182 Placed on July 26, 2014
Order details and invoice in attached file.
Need to make changes to your order? Visit our Help page for more information and video guides.
We hope to see you again soon.
Amazon.co.uk
No comment.
Subject: Your Amazon Order
From: Amazon.com <delivers@amazon.com>
Received: 26 June 2014
Attachment: “Unnamed attachment”
Contents:
National
wiggins upbring.slough incommutable expurgate vandal kinesic. huxley changeover.shutdown noxious random affiance complicate. general debugged.downtown papal craft clara diety. moiseyev complicate.octillion cowardice trail gable vanilla.
Good day,,
Thank you for your order. Weâll let you know once your item(s) have dispatched.You can view the status of your order or make changes to it by visiting Your Orders on Amazon.com.
Order Details
Order R:141217 Placed on May 28, 2014
Order details and invoice in attached file.
Need to make changes to your order? Visit our Help page for more information and video guides.
We hope to see you again soon. Amazon.com
This one looked like an Amazon Local email rather than a purchase receipt. My virus scanner removed the attachment.
Subject: Delivery [Report ID:98668-6041900]
From: Amazon Marketplace <marketplace-messages@amazon.co.uk>
Received: 25 March 2014
Attachment: “scn_79604AFC63.zip”
Contents:
Dear pat,
You Purchased:
Amazon.co.uk 250 £ Gift Card – In a Gift Box – FREE One-Day Delivery
by Amazon U.K
Estimated delivery date: 24 March 2014
Your Parcel has arrived at the post office on March 25. Our courier was unable to deliver
the parcel to your address on March 24 at 12:46 PM.
To receive a parcel you must fill in the Amazon redelivery form attached.
Thank you for your attention.
If you have questions regarding a transaction, we advise you to check with your seller for details.
To view your latest transactions, go to Your Account.
Copyright 2014 Amazon.com, Inc. All rights reserved.
Note: At least they used the first part of my email address as my name. Now, I don’t remember ordering a gift card but I do know not to click on links in emails or open attachments. I can go to my Amazon account and check from there – and obviously no order history relating to this scam.
American Express Email Scams
Subject: Security concern on your AmericanExpress Account
From: American Express <AmericanExpress@welcome.aexp.com>
Received: 8 August 2014
Attachment: [none]
Contents:
Dear Customer:
We are writing to you because we need to speak with you regarding a security concern on your account. Our records indicate that you recently used your American Express card on August 8, 2014.
For your security, new charges on the accounts listed above may be declined. If applicable, you should advise any Additional Card Member(s) on your account that their new charges may also be declined.
To secure your account , please click log on to : http://americanexpress.com [link removed]
Your prompt response regarding this matter is appreciated.
Sincerely,
American Express Identity Protection Team
Note: If American Express really did want to speak to someone they would telephone them not send an email asking the recipient to click a link. Like usual in these scams, the amercianexpress.com link does not go to that website but some dodgy address.
Subject: Important: Personal Security Key
From: American Express <AmericanExpress@welcome.aexp.com>
Received: 12 March 2014
Attachment: Untitled attachment 00002.txt
Contents:
View Account [link removed] | Make a Payment [link removed] | Manage Alerts Preferences [link removed]
Important : Personal Key
Please create your Personal Security Key. Personal Security Key (PSK) is one of several authentication measures we utilize to ensure we are conducting business with you, and only you, when you contact us for assistance.
American Express uses 128-bit Secure Sockets Layer (SSL) technology. This means that when you are on our secured website the data transferred between American Express and you is encrypted and cannot be viewed by any other party. The security of your personal information is of the utmost importance to American Express, please click here [link removed] or visit our website at https://www.americanexpress.com [link removed] to create your PSK (Personal Security Key).
Note: You will be redirected to a secure encrypted website.
The contained message may be privileged, confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.
Thank you,
American Express
If you’d like to stop receiving this alert, simply click here [link removed].
Was this e-mail helpful? Please click here [link removed] to give us your feedback.
Contact Us [link removed] | Privacy Statement [link removed] | Add us to your address book [link removed]
Your Card Member information is included in the upper-right corner to help you recognize this as a customer service e-mail from American Express. To learn more about e-mail security or report a suspicious e-mail, please visit us at americanexpress.com/phishing. We kindly ask you not to reply to this e-mail but instead contact us via customer service.
© 2014 American Express. All rights reserved.
AGNEUALE0074920
Note: Hovering over all the links in this email directed to the same web page which was not an amercianexpress.com address. Also received similar on March 17 with subject “Irregular card activity”.
Apple Email Scams
Subject: Your itunes account has been frozen because we are unable to validate your account information.
From: Apple <Ap.ple@info.co>
Received: 5 July 2014
Attachment: “AppleACC-658-119-347.html”
Contents:
Dear iT?nes C?st?mer,
This is an a?tomatic message sent by our sec?rity system to let you know that you have 48 hours to c?nfirm your acco?nt inf?rmation.
Your it?nes acco?nt has been fr?zen because we are ?nable to validate y?ur acco?nt inf?rmation.
Once you have ?pdated your acco?nt records, we will try again to validate your inf?rmation and your acco?nt suspension will be lifted. This will help protect your acco?nt in the future. This process does not take more than 3 minutes. To proceed to c?nfirm your acco?nt details please Download the attached file and follow the instructions.
We apologise for any inconvenience caused.
Your sincerely,
?pple Sec?rity Department
No comment.
Subject: Apple Account Identity Confirmation
From: Apple <no-reply@apple.com>
Received: 1 April 2014
Attachment: [none]
Contents:
Dear Customer,
This is an automatic message sent by our security system to let you know that you have 48 hours to confirm your account information.
Your itunes account has been frozen because we are unable to validate your account information.
Once you have updated your account records, we will try again to validate your information and your account suspension will be lifted. This will help protect your account in the future. This process does not take more than 5 minutes. To proceed to confirm your account details please click on the link below and follow the instructions.
Click Here Validate Your Account. [non-apple link removed]
We apologise for any inconvenience caused.
Your sincerely,
Apple Security Department
Note: This scam pretending to come from Apple used a shortened link that are popular on social media sites. These links can send you anywhere so always beware before clicking but as I never click on any link in any email (unless it’s in a newsletter that I’m subscribed to or something I’ve requested such as a change password link) I have nothing to worry about.
Bank of America Email Scams
Subject: You have received a secure message
From: Bryan Kim <Bryan.Kim@baml.com>
Received: 12 July 2014
Attachment: “SecureMessage.zip”
Contents:
You have received a secure message from Bank of America Merrill Lynch
Read your secure message by opening the attachment, SecureMessage.zip. You will be prompted to open (view) the file or save (download) it to your computer. For best results, save the file first, then open it in a Web browser.
If you have concerns about the validity of this message, contact the sender directly.
First time users – will need to register after opening the attachment.
Help – https://securemail.bankofamerica.com/websafe/ml/help?topic=RegEnvelope
No comment.
Bank of Scotland Email Scams
Subject: Bank Of Scotland transaction notification
From: Bank of Scotland <no-reply@bankofscotland.co.uk>
Received: 9 May 2014
Attachment: “Payment 09.05.2014-046899.zip”
Contents:
Transaction is completed.
$7522 has been successfully transfered.
If the transaction was made by mistake please contact our customer service.
Receipt on payment is attached.
*** This is an automatically generated email, please do not reply ***
Bank of Scotland plc 2010. All rights reserved.
Licensed under the Consumer Credit Act 1974 under registration number 0593292.
We subscribe to The Lending Code; copies of the Code can be obtained from www.lendingstandardsboard.org.uk
Note: This scam pretending to come from Bank of Scotland so I listed it as it was the first one I received like that. Still I’m not opening the malware attached.
Barclays Email Scams
Subject: Barclays Bank – Warning message
From: Barclays Current Accounts <barclays@securesuite.net>
Received: 5 August 2014
Attachment: “Barclays Bank – Form.zip”
Contents:
Dear Customer,
Due to concerns, for the safety and integrity of your online account we have issued this warning message.
It has come to our attention that your account details need to be updated due to inactive members,frauds and spoof reports.
Please download the document attached to your email and follow the instructions.
Note: That is a one-time task that will take only 3-5 minutes of your precious time.
Thank you,
Jessica M. Klaus.
IT Assitant,
Barclays Current Accounts.
No comment.
Subject: Security Improvement
From: Barclays Bank PLC <Barclays@email.barclays.co.uk>
Received: 20 June 2014
Attachment: “Barclays Bank – Form.zip”
Contents:
Dear Customer,
You received this email as a notice for the database update for this month. This update is designed by our IT engineers to provide higher security to our customers online accounts, prevent unauthorized account access and other types of online fraud.
Please download the document attached to this email and fill carefully.
Note: That is a one-time task that will take only 3-5 minutes of your precious time.
However, failure in updating your profile will results in limiting your account access.
We appologize for any inconvenience.
Thank you,
Jessica M. Klaus,
IT Assistant,
Barclays Bank PLC.
Please do not reply to this e-mail as this is only a notification. Mail sent to this address cannot be answered.
No comment.
Subject: Your Barclays Business Mandate Change Request- SB- 1-2-627786149
From: barclaysbusinessmandatechange@barclays.com
Received: 4 April 2014
Attachment: “Change_Request_Form.zip”
Abridged contents:
Thank you for contacting Barclays to discuss your change of authorised persons. The forms that you need to complete this are attached along with guidance notes to ensure we can action your request without delay.
For more details check attached form.
Reply with completed signed form.
IMPORTANT POINTS
– Please ensure that you print out the relevant forms and then send them to the Barclays Business Mandate Change Team in Birmingham as detailed at the bottom of the email.
– Please do not reply to this email as the mailbox is only used for sending mandate literature.
– Please continue to use your existing signing arrangements until you receive a confirmation letter to advise all changes have been put in place.
– Please ensure you discuss the identification and address verification requirements with the Mandate Change Team prior to submitting your application.
What do I need to do now?
Mandate Change Form
In order for your change of authorised persons to be processed, please ensure all sections of the Mandate Change Form are completed paying particular attention to the checklist boxes below as non completion, incorrect completion/non receipt of documents will result in a delay or the forms being returned back to you for amendment. Please complete in black ink and include personal details forms for any new authorised persons.
If you wish to change your correspondence address/ name please complete ‘Section 5 – Banking Information Details of the Mandate Change Form.
Mandatory Checklist
…
Note: I get a lot of scam emails pretending to be from Barclays but this one was a monster running to several pages. I’m guessing that with so many references to different sections they would hope you open the form to have a look. Or perhaps the length and terminology used was intended was to bore you into submission and open the attachment. No chance and it’s deleted.
Subject: Your account might be compromised
From: Barclays Bank PLC <Barclays@email.barclays.co.uk>
Received: 20 March 2014
Attachment: “Online form – 20-03-2014.zip”
Contents:
Dear Customer,
We recently have determined that different computers have logged in your Barclays account, and multiple password failures were present before the logons.
For your security we have temporary suspended your account.
Please download the document attached to this email and fill carefully.
If you do not restore your account by March 21, we will be forced to suspend your account indefinitely, as it may have been used for fraudulent purposes.
Do not ignore this message is for your security.
We apologize for any inconvenience.
Thank you,
Barclays Bank PLC.
Please do not reply to this e-mail as this is only a notification. Mail sent to this address cannot be answered.
Note: This is another Barclay’s scam email but I’m listing it as its evolved slightly with an action date in the content.
Subject: Several attempts to transfer funds from your account
From: Barclays Bank PLC <Barclays@email.barclays.co.uk>
Received: 10 March 2014
Attachment: form required.zip
Contents:
Dear customer,
Someone logged into your account today from a different IP other than the one you normally use and have made several attempts to transfer money from your account.
Our specialists have noticed immediately and took safety precautions involved.
For your protection, we’ve suspended your account.
Does someone in your family have access to your account to transfer funds?
If not, please do not ignore this message is for your protection.
Please download the document attached to this email and fill carefully.
If you do not restore your account by March 10, we will be forced to suspend your account indefinitely, as it may have been used for fraudulent purposes.
Note: Please do not respond to emails where you are asked to click on the link to complete your account details or credit card online.
The bank will ask for this information only through a form attached to the email and only if there are problems like this.
We apologize for any inconvenience.
Thank you,
Barclays Bank PLC.
Copyright © 1999-2014 Barclays Bank PLC. All rights reserved.
Please do not reply to this e-mail as this is only a notification. Mail sent to this address cannot be answered.
Note: Banks do not send forms by email for you to complete. You can download all forms by going to the banks website directly (not via any email link). This one’s attempt at authenticity is to warn you not to click on links but to open the dodgy form. As if a bank would call me “Dear customer” and the language throughout has errors in it (no scammers, I won’t point out what they are to you). Variations on this scam from my inbox claiming to be from Barclays use the following titles; “Credit limit increase”, “Security improvement”, “Online Banking – 3rd attempt failed”, “Your account might be permanently suspended”, “Your account might be compromised”, “We have observed frequently login attempts” & “Unusual activity”.
British Gas Email Scams
Subject: Help & Advice – British Gas
From: British Gas <services@britishgas.co.u>
Received: 17 June 2014
Attachment: [none]
Contents:
You can find you invoice for June 2014 by click on link below
June_invoice.pdf [LINK REMOVED]
We may want to contact you by mail, phone, visit or e-mail about other products and services provided by us, or our partners. By providing your information you will be indicating your consent to us keeping you informed in this way but please tick the box if you DO NOT wish to hear about such products and services.
© British Gas 2014
No comment.
BT Email Scams
Subject: Important – BT Digital File
From: Desmond Hyatt <Desmond.Hyatt@bt.com>
Received: 4 August 2014
Attachment: “BT_Digital_Vault_File.zip”
Contents:
Dear Customer,
This email contains your BT Digital File. Please scan attached file and reply to this email.
If you have any questions or forgotten your password, please visit the “Frequently Asked Questions” at www.bt.com/personal/digitalvault/help or call the helpdesk on 0870 240 1060* between 8am and midnight.
Thank you for choosing BT Digital Vault.
Kind regards,
BT Digital Vault Team
*Calls charged up to 8 pence per minute on the BT network (minimum fee 5.5p). Mobile and other network costs may vary. See http://www.bt.com/pricing for details.
Please note that this is an automatically generated email for your information only. We are sorry, but we can not respond to a “Reply” to this address.
This electronic message contains information from British Telecommunications plc, which may be privileged or confidential. The information is intended for use only by the individual(s) or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is strictly prohibited. If you have received this electronic message in error, please delete this email immediately.
Registered office: 81 Newgate Street London EC1A 7AJ Registered in England no: 1800000
No comment.
Subject: Fw: Important: Your Billing Information
From: Martin Culligan <mculligan@btinternet.com>
Received: 29 June 2014
Attachment: “BT-Document.html”
Contents:
—– Forwarded Message —–
From: “service@bt.com”
To: mculligan@btinternet.com
Sent: Sunday, 29 June 2014, 4:34
Subject: Important: Your Billing Information
Important: We need to confirm your BT account information.
Hello,
This e-mail has been sent to you to inform you that we were unable to confirm your BT account information.
This might be due to a recent change in your personal information. (eg: billing address, phone).
The secure way to confirm your account information:
1.    Download the attached Document..
2.    Follow the instructions to Confirm you account information.
You might need your BT account number for this you’ll find it at the top of your bill. We’ll send you a confirmation email once your account information verified.
Thanks for choosing BT,
Libby Barr
Managing Director, BT Sales and Service
This is an automatic email, so please don’t reply. To ensure future emails from BT are delivered to your inbox and not treated as spam, please add ebilling@bt.com to your address book. This email was sent to you at because you subscribe to BT services.
© British Telecommunications plc 2011. Registered Office: 81 Newgate Street, London EC1A 7AJ.
Registered in England No.1800000.
URN:51150.0.0.0
This message was trying to get me to open the attachment but the same day I also received the a variant trying to get me to click on a link.
Subject: Fw: your last payment of bill .
From: Martin Culligan <mculligan@btinternet.com>
Received: 29 June 2014
Attachment: [none]
Contents:
—– Forwarded Message —–
From: BTopenworld
To: mculligan@btinternet.com
Sent: Saturday, 28 June 2014, 17:38
Subject: your last payment of bill .
This message was trying to get me to click on a link but the same day I also received the attachment variant (which was formatted better).
Subject: IMPORTANT: Please confirm your billing information.
From: BT.com <billint@bt.com>
Received: 8 June 2014
Attachment: “BT-LoginForm.htm”
Contents:
Dear Customer,
This e-mail has been sent to you by BT to inform you that we were unable to process your last payment of bill.This might be due to either of the following reasons:
1. A recent change in your personal information. (eg: billing address, phone)
2. Submitting incorrect Payment information during bill payment process.
Due to this, to ensure that your service is not interrupted, we request you to confirm and update your billing information today
Please download and fill the BT Form attached to this email
IMPORTANT: If you find this email in Bulk, Spam or Junk please move it to your inbox as not to jeopardize the future our communication with you. It is essential to receive all emails from us to be in touch.
Regards,
BT Billing Department
No comment.
Subject: Important – BT Digital File
From: Magdalena Boucher <Magdalena.Boucher@bt.com>
Received: 14 April 2014
Attachment: “BT_Digital_Vault_File.zip”, “Untitled attachment 00021.txt”
Contents:
Dear Customer,
This email contains your BT Digital File. Please scan attached file and reply to this email.
If you have any questions or forgotten your password, please visit the “Frequently Asked Questions” at www.bt.com/personal/digitalvault/help or call the helpdesk on 0870 240 9516* between 8am and midnight.
Thank you for choosing BT Digital Vault.
Kind regards,
BT Digital Vault Team
*Calls charged up to 8 pence per minute on the BT network (minimum fee 5.5p). Mobile and other network costs may vary. See http://www.bt.com/pricing for details.
Please note that this is an automatically generated email for your information only. We are sorry, but we can not respond to a “Reply” to this address.
This electronic message contains information from British Telecommunications plc, which may be privileged or confidential. The information is intended for use only by the individual(s) or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is strictly prohibited. If you have received this electronic message in error, please delete this email immediately.
Registered office: 81 Newgate Street London EC1A 7AJ Registered in England no: 1800000
Note: In case you thought I had forgotten about posting scam emails on this page, I have not. Over the last week every scam email that I’ve received has been along the same lines as those already listed. This was the first one that was different and all it’s only another scam email with a malware attachment but this one pretends to come from BT.
Citibank Email Scams
Subject: FW: Important – Commercial Form
From: Kasey Lancaster <Kasey.Lancaster@citibank.com>
Received: 11 July 2014
Attachment: “C8347100.zip”
Contents:
Commercial Banking Form
To: [EMAIL REMOVED]
Case: C8347100
Please scan attached document and fax it to +1 800-285-0313 .
All web filed documents (with the exception of downloaded accounts templates) are available to view / download for 10 days after their original submission. Once accepted, these changes will be displayed on the public record. Not yet filing your accounts online? See how easy it is… For enquiries, please telephone the Service Desk on +1 800-285-0063 or email enquiries@citibank.com. This email was sent from a notification-only email address which cannot accept incoming mail. Please do not reply directly to this message. .
Yours faithfully
Kasey Lancaster
Commercial Banking
Citibank N.A
Kasey.Lancaster@citibank.com
Copyright © 2014 Citigroup Inc.                                                                    Â
Citibank
No comment.
Companies House Email Scams
Subject: Incident 0804588 – Companies House
From: Companies House <WebFiling@companieshouse.gov.uk>
Received: 4 August 2014
Attachment: “Case_0804588.zip”
Contents:
The submission number is: 0804588
For more details please check attached file.
Please quote this number in any communications with Companies House.
All Web Filed documents are available to view / download for 10 days after their original submission. However it is not possible to view copies of accounts that were downloaded as templates.
Companies House Executive Agency may use information it holds to prevent and detect fraud. We may also share such information, for the same purpose, with other Organizations that handle public funds.
If you have any queries please contact the Companies House Contact Centre on +44 (0)303 1234 500 or email enquiries@companies-house.gov.uK
Note: This email was sent from a notification-only email address which cannot accept incoming email. Please do not reply directly to this message.
Companies House
4 Abbey Orchard Street
Westminster
London
SW1P 2HT
Tel +44 (0)303 1234 500
No comment.
Subject: Case QM4V5L9BPH315RR
From: Companies House <webfiling@{_BOTHOST}>
Received: 29 April 2014
Attachment: “Case_QM4V5L9BPH315RR.zip”
Contents:
This message has been generated in response to the company complaint submitted to Companies House WebFiling service.
(CC01) Company Complaint for the above company was accepted on 28/04/2014.
The submission number is QM4V5L9BPH315RR
Please quote this number in any communications with Companies House.
All WebFiled documents are available to view / download for 10 days after their original submission. However it is not possible to view copies of accounts that were downloaded as templates.
Not yet filing your accounts online? See how easy it is…
Note: reference to company may also include Limited Liability Partnership(s).
Thank you for using the Companies House WebFiling service.
Service Desk tel +44 (0)303 1234 500 or email enquiries@companieshouse.gov.uk
Note: This email was sent from a notification-only email address which cannot accept incoming email. Please do not reply directly to this message.
Note: I guess this scammer’s software wasn’t quite working as the “from” email address didn’t get replaced. Anyway, like before Companies House don’t send attachments and I wouldn’t open anything I haven’t requested.
Subject: (AR01) Annual Return received
From: Companies House <web-filing@companies-house.gov.uk>
Received: 2 April 2014
Attachment: “Ref_8464408.zip”
Contents:
Thank you for completing a submission Reference # (8464408).
• (AR01) Annual Return
Your unique submission number is 8464408
Please quote this number in any communications with Companies House.
Check attachment to confirm acceptance or rejection of this filing.
All web filed documents (with the exception of downloaded accounts templates) are available to view / download for 10 days after their original submission.
Once accepted, these changes will be displayed on the public record.
Not yet filing your accounts online? See how easy it is…
For enquiries, please telephone the Service Desk on +44 (0)303 1234 500 or email enquiries@companieshouse.gov.uk
This email was sent from a notification-only email address which cannot accept incoming mail. Please do not reply directly to this message.
Note: Companies house don’t send out attachments, you download from their website. Even if they did, I wouldn’t open it as I have my number one rule not to open any attachments that I haven’t asked for.
Danske Bank Email Scams
Subject: Danske Bank – Potentially fraudulent transaction
From: Nadine Blackmon – Danske Bank <Nadine.Blackmon@danskebank.com>
Received: 9 May 2014
Attachment: “AccountRep_09052014.zip”, “Untiltled attachment 00086.txt”
Contents:
We are contacting you regarding a potentially fraudulent transaction on your account.
Please check attached file for more information about this specific transaction.
Nadine Blackmon
Senior Account Executive
Danske Bank
Nadine.Blackmon@danskebank.com
Tel. +45 33 44 69 66
CONFIDENTIAL NOTICE: The contents of this message, including any attachments, are confidential and are intended solely for the use of the person or entity to whom the message was addressed. If you are not the intended recipient of this message, please be advised that any dissemination, distribution, or use of the contents of this message is strictly prohibited. If you received this message in error, please notify the sender. Please also permanently delete all copies of the original message and any attached documentation. Thank you.
Note: This email is very similar to those already received pretending to be other banks but it was my first pretending to be from Danske Bank. As I gave the other banks a section each I’ve also done so here.
E-ON Energy Email Scams
Subject: Unable to process your most recent bill payment
From: E ON Energy <noreply@eonenergy.com>
Received: 8 August 2014
Attachment: “e-ON-Energy-Bill.zip”
Contents:
Dear customer,
This e-mail has been sent to you to inform you that we were unable to process your most recent payment of bill.
Please check attached file for more detailed information on this transaction.
IMPORTANT: The actual delivery date may vary from the Delivery By date estimate. Please make sure that there are sufficient available funds in your account to cover your payment beginning a few days before Delivery By date estimate and keep such funds available until the payment is deducted from your account.
If we fail to process a payment in accordance with your properly completed instructions, we will reimburse you any late-payment-related fees.
We apologize for any inconvenience this may cause.
No comment.
DHL Email Scams
Subject: “DHL Delivery status”
From: DHL Global Mail <service@dhl-globalmail.com>
Received: 24 April 2014
Attachment: “DHL_label_04917.zip”
Contents:
Dear [email address removed]
Your parcel arrived at the post office on April 22. Our courier was unable to deliver the parcel to your adress.
To receive the parcel you should go to the nearest DHL office and take your mailing label with you.
The mailing label is attached. Please print it and show at the nearest DHL office to receive the parcel.
Thank you for using DHL Service!
Princes Court, 11
Wapping Ln, London,
E1W 2DA,United Kingdom
Toll Free: +44 20 7553 2200
Hours:Open today • 9:00 am – 7:00 pm
Note: I received three emails pretending to be from DHL on the same day. All of the coming from slightly different pretend from addresses and slightly different subject lines but the content was the same.
Facebook Email Scams
Subject: Marina wants to be friends with you on Facebook.
From: Facebook <service@facebook.com>
Received: 24 March 2014
Attachment: [none]
Contents:
facebook [non-FB link]
[missing image with non-FB link]
Marina [non-FB link] wants to be friends with you on Facebook.
University of Oxford, England
342 friends – 28 photos
Confirm Request [non-FB link] See All Requests [non-FB link]
This message was sent to [my email address]. If you don’t want to receive these emails from Facebook in the future, please click: unsubscribe [no link].
Facebook, Inc. Attention: Department 415 P.O Box 10005 Palo Alto CA 94303
Note: This one has all the same formatting as the Facebook emails but the links do not go to Facebook. They hijacked someone else’s website to host their dodgy phishing site in a sub folder.
Government Email Scams
Subject: Notification of direct debit of fees
From: noreply.efees@landregistry.gsi.gov.uk
Received: 9 may 2014
Attachment: “Unnamed attachment”
Contents:
Notification Date: 09/05/2014
Notification Number: 392097024
Mandate Number: 8738462
###THIS IS AN AUTO NOTIFICATION EMAIL. DO NOT REPLY TO THE SENDER OF THIS EMAIL. IF YOU HAVE A QUERY PLEASE REFER TO THE INFORMATION BELOW ###
This is notification that Land Registry will debit 474.00 GBP from your nominated account on or as soon as possible before 12/05/2014.
Details of fees that we shall be collecting by direct debit for the applications charged are now available to view.
You can access these by opening attached report.
If you have an enquiry relating to your VDD account please contact Customer Support at customersupport@landregistry.gsi.gov.uk or call on 0844 892 1111. For all enquiries, please quote your key number.
Thank you,
Land Registry
Land Registry is the definitive source of information for more than 23 million property titles in England and Wales. Since 1862 we have provided security and confidence in one of the most active property and mortgage markets in the world. We are working to support economic growth and data transparency as part of the Public Data Group. Find out more at www.landregistry.gov.uk
Note: My Internet Security software removed the attachment and reported it as a Trojan in “Unnamed attachment”. Not that I would have opened it anyway as it’s quite obviously a scam and I don’t open attachments that I haven’t requested.
Subject: Government Backed Business Grants to Help the UK Economy
From: Business Departament <business_dep@gov.uk>
Received: 18 March 2014
Attachment: PDF_Scaned4563273ECE.zip
Contents:
Are you looking for easy access to government and private business grants? Are you sick of
struggling with paperwork and procedure when sourcing funds? Business Grants and Loans can
link you to the necessary finances through our handy online application form.
Whether starting a company or expanding operations, we can fund you from a number of sources
to start up with. Application is completely free to apply. Our success rate is high, giving you
a good chance of approval.
For further information please refer to the attached booklet.
2014 © Crown Copyright. All rights reserved.
Note: As if I believe this is from the Government Department that can’t spell. I do all my Government Form shopping directly on their website thank you.
Subject: Your Online Submission for Reference 485/GB7555192 Could not process
From: gateway.confirmation@gateway.gov.uk
Received: 10 March 2014
Attachment: GB7555192.zip
Contents:
The submission for reference 485/GB7555192 was successfully received and was not processed.
Check attached copy for more information.
This is an automatically generated email. Please do not reply as the email address is not monitored for received mail.
Note: I get one of these each month but Government Gateway would never send an attachment or ask you to click on a link.
Google Email Scams
Subject: You have received 1 New Document
From: G-Drive ® <secureddrive@onedrive.com>
Received: 16 July 2014
Attachment: [none]
Contents:
Keep everything. Share anything.
You have a Secure Document shared through our service
To get access to this Document
Click here to View [LINK REMOVED]
Thank You for Using Google Document Sharing service!
©2014 Google - Terms of Service - Privacy Policy - Program Policies
Powered by Google
No comment.
Halifax Email Scams
Subject: Your account might be compromised
From: Halifax <queries@littlewoods.com>
Received: 3 June 2014
Attachment: “Halifax – Form.zip”
Contents:
Dear Customer,
We recently have determined that different computers have logged in your Halifax account, and multiple password failures were present before the logons.
For your security we have temporary suspended your account.
Please download the document attached to this email and fill carefully.
If you do not restore your account by June 04, we will be forced to suspend your account indefinitely, as it may have been used for fraudulent purposes.
Do not ignore this message is for your security.
We apologize for any inconvenience.
Yours sincerely,
Karl Servini
Head of Customer Research
Halifax is a division of Bank of Scotland plc. Registered in Scotland no. SC327000.
Registered office: The Mound, Edinburgh EH1 1YZ.
Authorised and regulated by the Financial Services Authority
Also received similar emails with different subject lines such as “Unauthorized Access Notice”.
HM Revenue and Customs Email Scams
Subject: Successful Receipt of Online Submission for Reference 7064461
From: Ahmed.John <Ahmed.John@chase.com>
Received: 19 August 2014
Attachment: “Ref_7064461.zip”
Contents:
Thank you for sending your VAT Return online. The submission for reference 7064461 was successfully received on Tue, 19 Aug 2014 16:57:21 +0700 and is being processed. Make VAT Returns is just one of the many online services we offer that can save you time and paperwork.
For the latest information on your VAT Return please open attached report.
The original of this email was scanned for viruses by the Government Secure Intranet virus scanning service supplied by Cable&Wireless Worldwide in partnership with MessageLabs. (CCTM Certificate Number 2009/09/0052.) On leaving the GSi this email was certified virus free.
Communications via the GSi may be automatically logged, monitored and/or recorded for legal purposes.
No comment.
Subject: Notice of Underreported Income
From: Jerome_Owen@citibank.com
Received: 6 August 2014
Attachment: “ufwsd-000003829548UK.zip”
Contents:
Taxpayer ID: ufwsd-000003829548UK
Tax Type: Income Tax
Issue: Unreported/Underreported Income (Fraud Application)
Please review your tax income statement on HM Revenue and Customs ( HMRC )
Please complete the attached form
HM Revenue and Customs
No comment.
Subject: TAX REFUND NOTIFICATION !
From: HM Revenue & Customs (HMRC) <secure@hmrc.gov.uk>
Received: 2 July 2014
Attachment: “HMRC – Tax Refund Form.html”
Contents:
Important Notification, please read carefully !
Dear Sir/Madame,
From your fiscal activity we have determined that you are eligible to receive a tax refund of 304.73 GBP
Please submit the tax refund form and allow us 48 hours in order to process it.
To access your tax refund form, please follow the steps bellow:
– Download the Tax Refund Form attached to this email
– Open it in a web browser (recommended internet explorer)
– Fill in all required fields and submit the form.
You are required to match your information correctly during this process.
A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.
No comment.
Subject: Tax refund notification !
From: HM Revenue & Customs (HMRC) <secure@hmrc.co.uk>
Received: 2 June 2014
Attachment: “HMRC – Tax Refund Form.html”
Contents:
HM Revenue & Customs (HMRC)
41792
TAX REFUND NOTIFICATION
Dear Sir/Madame,
After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of 304.73 GBP Please submit the tax refund request and allow us 6-9 days in order to process it.
To access your tax refund, please follow the steps bellow:
– download the Tax Refund Form attached to this email
– follow the instructions on your screen
A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.
Revenue and Tax Administrator
HM Revenue & Customs
Tax Credit Office
PO Box 1970
Liverpool
L75 1WX
TAX REFUND ID: UK3239489-HMRC
© Crown Copyright, HM Revenue & Customs
No comment.
Subject: HMRC Application – pathowe.co.uk
From: HMRC.gov.uk <application@hmrc.gov.uk>
Received: 30 May 2014
Attachment: “Application_0513476.zip”
Contents:
Please print this information, sign and send to application@hmrc.gov.uk.
Date Created: 30 May 2014
Business name: pathowe.co.uk
Acknowledgement reference: 0513476
VAT Registration Number is 0513476.
Repayment of Input Tax
Before the business starts to make taxable supplies they may provisionally claim repayment of VAT they are charged as input tax. The general rules about VAT, including Input Tax, Partial Exemption, are explained in VAT Notices 700 and 706, available on the HMRC website
Repayment of VAT as input tax is subject to the condition, provided for by the Value Added Tax Act 1994, Section 25(6), that HMRC may require them to refund some or all of the input tax they have claimed, if they do not make taxable supplies by way of business, or the input tax they claimed prior to a period in which they make taxable supplies in the course of business does not relate to the taxable supplies they make.
Change of Circumstances
If your client no longer intends to make taxable supplies, or there is any other change of circumstances affecting their VAT registration (including any delay in starting to make taxable supplies), they must notify HMRC within 30 days of the change.
If the application included an enquiry about:
the Flat Rate Scheme
the Annual Accounting Scheme
an Economic Operator Registration and Identification (EORI) number
HMRC will send your client more information about this separately
What next?
Your client will receive their Certificate of Registration (VAT4) in the post in due course.
Your client can find general information about VAT and a guide to record keeping requirements by following one of the links below.
General information about VAT
Keeping records for business
By law, your client must send their VAT returns to HMRC online and make any payments due electronically.
Before they can submit VAT returns to HMRC online they’ll have to enrol for the VAT online service. Further information on how to do this can be found on the HMRC website
If you will be completing and submitting the online VAT returns on your client’s behalf, you will have to enrol for the VAT for Agents online service and be authorised to act as their agent before you can do this.
If you will be completing and submitting the online VAT returns on your client’s behalf, you will have to enrol for the VAT for Agents online service and be authorised to act as their agent before you can do this.
If your client uses someone other than the person who is authorised to submit VAT returns online to do their books, such as a tax advisor or agent and they are happy for them to speak to HMRC on their behalf, your client must authorise them to do so. Your client will need to complete and send a form 64-8 Authorising Your Agent to HMRC. To download a copy of the form, follow the link below.
No comment.
Subject: MRC Employer Alerts & Verification
From: Jamel Richard <3@p-s.ru>
Received: 27 May 2014
Attachment: “Employer Bulletin May 2014.zip”
Contents:
Thank you for your registration details which have been recorded for email alerts purposes only.
We expect to send you three email alerts a year – February, May and December. These will give you the links to the latest Employer Bulletin and HMRC PAYE Tools (previously the Employer CD-ROM). HMRC may also issue other messages throughout the year.
Please complete all relevant sections of the attached application form and attach the appropriate documents to confirm your identity.
Reply to this email as this mail box is monitored for incoming mail.
Note: Something I never asked for and I’ve not subscribed to so it’s obviously a scam. Even more so that it says you can respond as it’s a valid mail box. As if HMRC (they missed the H from the subject) would be using a Russian (.ru) mailbox.
Subject: STRF:EHL*Registration*EMPREG_Ltd1-2 (KMM4417761L0KM)
From: HMRC National Insurance Contributions Office <nico@hmrc.gov.uk>
Received: 27 May 2014
Attachment: “HMRC Application 4417761.zip”
Contents:
Dear Sir/Madam
Application case number: 4417761
Employer’s Name: Honeysuckle Development Corporation
Thank you for your email.
The address you have given us has not matched up with our internal postcode list.
Can you please confirm the employer’s trading address, including postcode, for the scheme being registered in this application?
We will complete your registration shortly after your reply.
Please note that if you provide details as a reply to this email you will not be submitting the information over a secure channel.
Yours faithfully
Employer Office
The original of this email was scanned for viruses by the Government Secure Intranet virus scanning service supplied by Vodafone in partnership with Symantec. (CCTM Certificate Number 2009/09/0052.) On leaving the GSi this email was certified virus free.
Communications via the GSi may be automatically logged, monitored and/or recorded for legal purposes.
Note: Another one telling me that it’s already been virus scanned. I don’t care what you say, I didn’t request this so I won’t be opening it.
Subject: HMRC taxes application with reference Z2PO HIFZ 22OF J762 received
From: noreply@taxreg.hmrc.gov.uk
Received: 16 May 2014
Attachment: “HM Revenue & Customs – TAX.zip”, “Untitled attachment 00013.txt”
Contents:
The application with reference number Z2PO HIFZ 22OF J762 submitted by you or your agent to register for HM Revenue & Customs (HMRC) taxes has been received and will now be verified. HMRC will contact you if further information is needed.
The original of this email was scanned for viruses by the Government Secure Intranet virus scanning service supplied by Vodafone in partnership with Symantec. (CCTM Certificate Number 2009/09/0052.) On leaving the GSi this email was certified virus free.
Communications via the GSi may be automatically logged, monitored and/or recorded for legal purposes.
Note: Oh thanks for telling me that it has been virus scanned so I don’t have to worry about opening that attachment. Obviously, it’s a scam and I don’t believe a word of it.
Subject: Taxes, allowances and tax credits
From: Frankie Barnett <tax.dep@hmrc.gov.uk>
Received: 13 May 2014
Attachment: “Refund-Form-ID_1350340.zip”
Contents:
TAX RETURN FOR THE YEAR 2014
RECALCULATION OF YOUR TAX REFUND
HMRC 2010-2011
LOCAL OFFICE No. 3819
TAX CREDIT OFFICER: Frankie Barnett
TAX REFUND ID NUMBER: 1350340
REFUND AMOUNT: 629.74 GBP
Dear Applicant,
The contents of this email and any attachments are confidential and as applicable, copyright in these is reserved to HM Revenue & Customs.
Unless expressly authorised by us, any further dissemination or distribution of this email or its attachments is prohibited.
If you are not the intended recipient of this email, please reply to inform us that you have received this email in error and then delete it without retaining any copy.
I am sending this email to announce: After the last annual calculation of your fiscal activity we have determined that you are eligible to receive a tax refund of 629.74 GBP
You have attached the tax return form with the TAX REFUND NUMBER
ID: 1350340,
complete the tax return form attached to this message.
After completing the form, please submit the form by clicking the SUBMIT button on form and allow us 5-9 business days in order to process it.
Our head office address can be found on our web site at HM Revenue & Customs: http://www.hmrc.gov.uk
Sincerely,
Frankie Barnett
HMRC Tax Credit Office
Preston
TAX REFUND ID: UK1350340-HMRC
© Copyright 2014, HM Revenue & Customs UK All rights reserved.
Note: That would be very nice of the tax man to send me a refund if this wasn’t another scam email. I don’t think that they are in the habit of sending refund details by email so I won’t be opening it – I’ll wait for my cheque to come in the post.
Subject: Successful Receipt of Online Submission for Reference 8825594
From: noreply@hmrc.gov.uk
Received: 9 May 2014
Attachment: “VAT8825594.zip”
Contents:
Thank you for sending your VAT Return online. The submission for reference 8825594 was successfully received on Fri, 9 May 2014 12:53:35 +0800 and is being processed. Make VAT Returns is just one of the many online services we offer that can save you time and paperwork.
For the latest information on your VAT Return please open attached report.
The original of this email was scanned for viruses by the Government Secure Intranet virus scanning service supplied by Cable&Wireless Worldwide in partnership with MessageLabs. (CCTM Certificate Number 2009/09/0052.) On leaving the GSi this email was certified virus free.
Communications via the GSi may be automatically logged, monitored and/or recorded for legal purposes.
Note: Another scammer pretending to be HMRC. They will do anything to get you to open their malware attachment – even declaring it to be virus free (which it is most certainly not).
Subject: You have received new messages from HMRC
From: noreply@hmrc.gov.uk
Received: 29 April 2014
Attachment: “P6_P6B.zip”
Contents:
Please be advised that one or more Tax Notices (P6, P6B) have been issued.
For the latest information on your Tax Notices (P6, P6B) please open attached report.
Please do not reply to this e-mail.
1.This e-mail and any files or documents transmitted with it are confidential and intended solely for the use of the intended recipient. Unauthorised use, disclosure or copying is strictly prohibited and may be unlawful. If you have received this e-mail in error, please notify the sender at the above address and then delete the e-mail from your system. 2. If you suspect that this e-mail may have been intercepted or amended, please notify the sender. 3. Any opinions expressed in this e-mail are those of the individual sender and not necessarily those of QualitySolicitors Punch Robson. 4. Please note that this e-mail and any attachments have been created in the knowledge that internet e-mail is not a 100% secure communications medium. It is your responsibility to ensure that they are actually virus free. No responsibility is accepted by QualitySolicitors Punch Robson for any loss or damage arising from the receipt of this e-mail or its contents. QualitySolicitors Punch Robson: Main office 35 Albert Road Middlesbrough TS1 1NU Telephone 01642 230700. Offices also at 34 Myton Road, Ingleby Barwick, Stockton On Tees, TS17 0WG Telephone 01642 754050 and Unit E, Parkway Centre, Coulby Newham, Middlesbrough TS8 0TJ Telephone 01642 233980 VAT no. 499 1588 77. Authorised and regulated by the Solicitors Regulation Authority (57864). A full list of Partners names is available from any of our offices. For further details, please visit our website http://www.qualitysolicitors.com/punchrobson
Note: No I haven’t received any new messages from HMRC as they do everything online and definitely don’t send attachments by email.
Subject: CIS Online submission received by HM Revenue and Customs
From: helpdesk@ir-efile.gov.uk
Received: 31 March 2014
Attachment: “Returns Repot for march 2014.zip”
Contents:
Thank you for using CIS Online. Your monthly return for March 2014 has been received by HM Revenue & Customs (HMRC). For more information on how to pay please visit http://www.hmrc.gov.uk/payinghmrc/index.htm If you require any further assistance please contact our Online Services Helpdesk. Opening hours 8.00 am to 8.00 pm, seven days a week. Closed Christmas Day, Boxing Day and New Years Day. Tel: 0845 60 55 999 For customers who are deaf or hearing or speech impaired: 0845 366 7805 (Textphone) If youre calling from abroad please telephone: +44 161 930 8445 To contact HMRC by email: helpdesk@ir-efile.gov.uk
For the latest information on your return please open attached report.
The original of this email was scanned for viruses by the Government Secure Intranet virus scanning service supplied by Cable&Wireless Worldwide in partnership with MessageLabs. (CCTM Certificate Number 2009/09/0052.) On leaving the GSi this email was certified virus free.
Communications via the GSi may be automatically logged, monitored and/or recorded for legal purposes.
Note: This scammer has included a helpful message telling me that they have already virus scanned the attachment in the hope that I will not bother to scan it myself. Actually, I don’t bother to scan attachments anyway as I’m never going to open them.
Subject: HMRC Tax Return
From: HMRC Revenue&Customs >reve.return@hmrc.gov.uk>
Received: 19 March 2014
Attachment: [none]
Contents:
Dear [email address],
We have detected that you have paid too much tax in the past, due to an official error.
Therefore HMRC applied ESC B41 to issue a repayment for tax years which are now
out of date under the strict statute.
Reclaim your overpaid tax
Please completely fill out the form above. Accurate information is necessary so that we
may process your request faster.
2014 Crown Copyright (Personal and Corporate Tax Refund Center PCTRC) All rights reserved.
Note: Whoops, the scammer forgot to include the attachment. These tax return and government gateway submission scams always appear around this time of the month. This is not a coincidence, the deadline for submission is the 19th so they are hoping to catch you out as you will have submitted your monthly return and their email may appear legitimate.
Subject: Second alert:HMRC Tax Departament
From: HMRC <no_reply@hmrc.gov.uk>
Received: 13 March 2014
Attachment: PDF_Scan_HMRC9669E51744.zip
Contents:
Second NOTICE to [my email address]
Please be advised that one or more Tax Notices (P6, P6B) have been issued.
For the latest information on your Tax Notices (P6, P6B) please open attached report.
Document Reference: 822472754.
The security and confidentiality of your personal information is important for us. If you have any questions, please either call the toll-free customer service phone number.
2014 © All rights reserved
Note: HMRC don’t send email attachments or email links so anything from them or Government Gateway containing either is dodgy.
HSBC Email Scams
Subject: Unable to process your most recent payment
From: HSBC UK <noreply@hsbc.co.uk>
Received: 18 August 2014
Attachment: “Payment00052014.zip”
Contents:
This e-mail has been sent to you to inform you that we were unable to process your most recent payment.
Please check attached file for more detailed information on this transaction.
Pay To Account Number: **********37
Due Date: 20/05/2014
Amount Due: 992.70
IMPORTANT: The actual delivery date may vary from the Delivery by date estimate. Please make sure that there are sufficient available funds in your account to cover your payment beginning a few days before Delivery By date estimate and keep such funds available until the payment is deducted from your account.
If we fail to process a payment in accordance with your properly completed instructions, we will reimburse you any late-payment-related fees.
Copyright HSBC 2013. All rights reserved. No endorsement or approval of any third parties or their advice, opinions, information, products or services is expressed or implied by any information on this Site or by any hyperlinks to or from any third party websites or pages. Your use of this website is subject to the terms and conditions governing it. Please read these terms and conditions before using the website..
No comment.
Subject: Hello
From: srogers@southark.edu
Received: 19 July 2014
Attachment: [none]
Contents:
I am a banker with HSBC in Malta. I have an interesting business proposal for you that will be of immense benefit to both of us. Although this may be hard for you to believe, we stand to gain 7.2 million USD between us in a matter of days. Please grant me the benefit of doubt and hear me out. if interested Do contact me only at my private email address: privatepot0@gmail.com Best Regards.
No comment.
Subject: Payment Advice – Advice Ref:[GB907940126465] / CHAPS credits / Customer Ref:[pay run 29/05/14]
From: HSBC Advising Service <advising.service.4631003.53566.03742800@mail.hsbcnet.hsbc.com>
Received: 29 May 2014
Attachment: [none]
Contents:
Sir/Madam,
Please download document from dropbox, payment advice is issued at the request of our customer. The advice is for your reference only.
Download link:
[hyperlink removed]
Yours faithfully,
Global Payments and Cash Management
HSBC
***************************************************************************
This is an auto-generated email, please DO NOT REPLY. Any replies to this email will be disregarded.
***************************************************************************
Security tips
1. Install virus detection software and personal firewall on your computer. This software needs to be updated regularly to ensure you have the latest protection.
2. To prevent viruses or other unwanted problems, do not open attachments from unknown or non-trustworthy sources.
3. If you discover any unusual activity, please contact the remitter of this payment as soon as possible.
*******************************************************************
This e-mail is confidential. It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return e-mail.
Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions.
*******************************************************************
SAVE PAPER – THINK BEFORE YOU PRINT!
No comment.
Subject: Unable to process your most recent payment
From: HSBC UK <noreply@hsbc.co.uk>
Received: 1 April 2014
Attachment: “AccRep.zip” & “Untitled attachment 00021.txt”
Contents:
This e-mail has been sent to you to inform you that we were unable to process your most recent payment.
Please check attached file for more detailed information on this transaction.
Pay To Account Number: **********74
Due Date: 01/04/2014
Amount Due: 968.61
IMPORTANT: The actual delivery date may vary from the Delivery by date estimate. Please make sure that there are sufficient available funds in your account to cover your payment beginning a few days before Delivery By date estimate and keep such funds available until the payment is deducted from your account.
If we fail to process a payment in accordance with your properly completed instructions, we will reimburse you any late-payment-related fees.
Copyright HSBC 2013. All rights reserved. No endorsement or approval of any third parties or their advice, opinions, information, products or services is expressed or implied by any information on this Site or by any hyperlinks to or from any third party websites or pages. Your use of this website is subject to the terms and conditions governing it. Please read these terms and conditions before using the website..
Note: Looks a bit better than the last scam email pretending to be from HSBC although I would have thought they might have updated their copyright.
Subject: HSBC E-Advice
From: E.stmt.adv@hsbc.co.uk;
Received: 27 March 2014
Attachment: “PaymentAdvice.zip”
Contents:
Please find attached your Advice containing information on your transactions of last working day with the bank.
Please do not reply to this e-mail address. If you have any queries, please contact our Customer Services.
Yours faithfully
HSBC Bank
Note: Another message pretending to be from a bank but this one didn’t even bother to format it to look like an official bank email. Everyone knows that banks don’t email forms to be completed. Only listed here as it’s a different bank from the others.
Lloyds Bank Email Scams
Subject: Customer Account Correspondence
From: Lloyds Bank Commercial Finance <customermail@LLOYDSBANKCF.CO.UK>
Received: 13 August 2014
Attachment: “Lloyds_Commercial_docs.zip”
Contents:
This attachment contains correspondence relating to your customer account with Lloyds Bank Commercial Finance Ltd.
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please contact the individual or customer care team whose details appear on the statement.
This email message and its attachment has been swept for the presence of computer viruses.
Lloyds Bank Commercial Finance, No 1 Brookhill Way, Banbury, Oxfordshire OX16 3EL | www.lloydsbankcommercialfinance.co.uk
No comment.
Subject: FW : Important BACs
From: Lloyds Commercial Banking <Sallie.Stewart@lloydsbank.com>
Received: 24 July 2014
Attachment: “LloydsCase-7282328.zip”
Contents:
Important account documents
Reference: C79
Case number: 7282328
Please review attached BACs documents and fax it to +44 (0) 845 600 3548.
Please note that the Terms and Conditions available below are the Bank’s most recently issued versions. Please bear in mind that earlier versions of these Terms and Conditions may apply to your products, depending on when you signed up to the relevant product or when you were last advised of any changes to your Terms and Conditions. If you have any questions regarding which version of the Terms and Conditions apply to your products, please contact your Relationship Manager.
Yours faithfully
Sallie Stewart
Senior Manager, Lloyds Commercial Banking
No comment.
Subject: Remittance Advisory Email
From: PaymentsAdmin@lloydsbank.co.uk
Received: 28 May 2014
Attachment: [none]
Contents:
Wednesday 28 May 2014
This is a Remitter Advice following the submission of a payment instruction by Lloyds Bank Plc.
Please review the details of the payment here. [hyperlink removed]
Lloyds Banking Group plc. Registered Office: The Mound, Edinburgh EH1 1YZ. Registered in Scotland no. SC95000. Telephone: 0131 225 4555. Lloyds Bank plc. Registered Office: 25 Gresham Street, London EC2V 7HN. Registered in England and Wales no. 2065. Telephone 0207626 1500. Bank of Scotland plc. Registered Office: The Mound, Edinburgh EH1 1YZ. Registered in Scotland no. SC327000. Telephone: 08457 21 31 41. Cheltenham & Gloucester plc. Registered Office: Barnett Way, Gloucester GL4 3RL. Registered in England and Wales 2299428. Telephone: 0845 603 1637
Lloyds Bank plc, Bank of Scotland plc are authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and Prudential Regulation Authority.
Cheltenham & Gloucester plc is authorised and regulated by the Financial Conduct Authority.
Halifax is a division of Bank of Scotland plc. Cheltenham & Gloucester Savings is a division of Lloyds Bank plc.
HBOS plc. Registered Office: The Mound, Edinburgh EH1 1YZ. Registered in Scotland no. SC218813.
This e-mail (including any attachments) is private and confidential and may contain privileged material. If you have received this e-mail in error, please notify the sender and delete it (including any attachments) immediately. You must not copy, distribute, disclose or use any of the information in it or any attachments. Telephone calls may be monitored or recorded.
No comment.
Subject: Important BACs
From: Lloyds Commercial Banking <Scot.Bruner@lloydsbank.com>
Received: 6 May 2014
Attachment: “LloydsCase-9313348.zip”
Contents:
Important account documents
Reference: C76
Case number: 9313348
Please review attached BACs documents and fax it to +44 (0) 845 600 9613.
Please note that the Terms and Conditions available below are the Bank’s most recently issued versions. Please bear in mind that earlier versions of these Terms and Conditions may apply to your products, depending on when you signed up to the relevant product or when you were last advised of any changes to your Terms and Conditions. If you have any questions regarding which version of the Terms and Conditions apply to your products, please contact your Relationship Manager.
Yours faithfully
Scot Bruner
Senior Manager, Lloyds Commercial Banking
Calls may be monitored or recorded in case we need to check we have carried out your instructions correctly and to help improve our quality of service.
Please remember we guarantee the security of messages sent by email.
Note: If this email did really come from Lloyds it wouldn’t have an attachment so there would be no reason to state that the security of the email is guaranteed. I know it is obvious to state it but I will do so anyway; don’t believe everything you read in emails and never open attachments you haven’t requested yourself.
Subject: PCI DSS Compliance Programme
From: Lloyds Bank <pciportal@lloydsbankcardnetpcidss.com>
Received: 3 April 2014
Attachment: “MarchStatement.zip”
Contents:
PAYMENT CARD INDUSTRY DATA SECURITY STANDARD (PCI DSS) COMPLIANCE MANAGEMENT SERVICE
Reference: C21
Merchant number: 1717435
Thank you for your recent request for your PCI DSS Compliance Management Service Portal Password which we’ve detailed below.
For more information please view attached file.
Please keep a copy of this email in case you need to refer to it at a later date.
Contact Details
The PCI DSS Compliance Management Service Portal will guide your business through the process. However, if you have any queries about PCI DSS, or if we can be of any further help, please call us on our Merchant Support Centre on 0845 0710 544.*
Lines are open Monday – Friday 9am to 5pm. You can also find further information about the Standards at www.pcisecuritystandards.org.
Yours faithfully
Byron Booker
Senior Manager, PCI Compliance, Lloyds Bank Cardnet
* Calls may be monitored or recorded in case we need to check we have carried out your instructions correctly and to help improve our quality of service.
Please remember we cannot guarantee the security of messages sent by email.
Note: Every weekday I receive several Barclay’s bank scam emails so I guess scammers take the weekends off or don’t think you’ll believe that the company they are pretending to be works at weekends. This one is pretending to come from Lloyds and has a slightly different theme from the other bank scam emails with its request for portal access.
Subject: Lloyds TSB transaction notification #8355-921
From: miscountedbys@yahoo.com [mailto:miscountedbys@yahoo.com]
Received: 14 March 2014
Attachment: Payment receipt Lloyds Bank 14.03.2014.zip
Contents:
Transaction is completed. 62333 GBP has been successfully transfered.
If the transaction was made by mistake please contact our customer service.
Payment receipt is attached.
Lloyds Bank plc is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority except for lending where we are licensed by The Office of Fair Trading. Authorisation can be checked on the Financial Services Register at www.fca.org.uk. Lloyds Bank plc is a member of the Financial Services Compensation Scheme and the Financial Ombudsman Service. We subscribe to the Lending Code; copies of the Code can be obtained from www.lendingstandardsboard.org.uk.
Lloyds Bank plc Registered Office: 25 Gresham Street, London EC2V 7HN. Registered in England and Wales No. 2065.
Save the Change is a registered trademark of Lloyds Bank plc
PhoneBank is a registered trademark of Lloyds Bank plc
Money Manager is provided to help you manage your personal finances and is not intended to provide legal, tax or financial advice. Personal Internet Banking customers only. Terms and conditions apply. Mobile Banking services may be affected by phone signal and functionality. Must be registered for Internet Banking. Terms and conditions apply.
Note: Banks do not send attachments or email links and as if a bank would email me from a Yahoo account.
Microsoft Email Scams
Subject: You have received a voice mail
From: Microsoft Outlook <no-reply@pathowe.co.uk>
Received: 10 June 2014
Attachment: [none]
Contents:
You received a voice mail : VOICE937-938-6539.wav (20 KB)
Caller-Id: 937-938-6539
Message-Id: QPW1YF
Email-Id: contact@pathowe.co.uk
Download and extract the attachment to listen the message.
We have uploaded fax report on dropbox, please use the following link to download your file:
[hyperlink removed]
Sent by Microsoft Exchange Server
No comment.
Subject: ACTION REQUIRED: Important Email Verification!.<
From: EMAIL SUPPORT <verification@microsoft.com>
Received: 19 May 2014
Attachment: [none]
Contents:
ACTION REQUIRED!
Dear Email Holder,
New Regulations from Microsoft Corporation and your email host, now require that email account holders must verify their email account information. All unverified email accounts will be classified as “inactive”. The contents of the inactive email accounts comprising e-mails and folders will be permanently deleted, and account terminated.
To ensure your email(s) remain active, PLEASE CLICK HERE [link removed] to perform a one-time automatic verification.
No further action is required after completing the simple verification process. It is however necessary that you repeat this process for all other email address(es) you may own.
Thank you.
Charlette Loretta
Email Support Team.
Please do not reply to this email as it would not be read.
©2014 by Microsoft Corporation. All rights reserved.
Note: As if Microsoft even know what email accounts I have let alone send me a link to a non-Microsoft.com website and if they were addressing me I’m sure they would use my name. Those extra characters in the subject line looks as if the programmer was a bit careless. I can spot a scam when I see one and this is definitely one of them. Actually, I treat all emails with links or attachments as fraud or containing viruses (or both).
Subject: You have received a voice mail
From: Microsoft Outlook Voicemail <no-reply @pathowe.co.uk>
Received: 9 May 2014
Attachment: “VOICE455-788-6496.zip”
Contents:
You received a voice mail : VOICE455-788-6496.wav (25 KB)
Caller-Id: 455-788-6496
Message-Id: TFFE22
Email-Id: [email address removed]
This e-mail contains a voice message.
Download and extract the attachment to listen the message.
Sent by Microsoft Exchange Server
Note: I don’t open attachments that I haven’t requested but my Internet Security software nabbed the Trojan attached to this email.
NatWest Email Scams
Subject: Cards OnLine E-Statement E-Mail Notification
From: CardsOnLine@cardsonline.natwest.com
Received: 30 July 2014
Attachment: “Unnamed attachment”
Contents:
Dear Customer
Your July 30, 2014 E-Statement for account number xxxxxxxxxxxx2279 from Cards OnLine is now available.
For more information please check attached copy
Thank you
Cards OnLine
Many internet users have recently been targeted through bogus E-Mails by fraudsters claiming to be from their bank. These E-Mails ask customers to provide their internet banking security details in order to reactivate their account or verify an E-Mail address.
Please be on your guard against E-Mails that request any of your security details. If you receive an e-mail like this you must not respond.
Please remember that, for security reasons, apart from when you create them at registration or when you change your Internet Pin or Password, we will only ever ask you to enter random characters from your Internet PIN and Password when you logon to this service.
You must keep your security details secret. We would never ask you, by E-Mail, to enter (or record) these details in full and you must not respond to E-Mails asking for this information.
National Westminster Bank Plc, Registered in England No 929027. Registered
Office: 135 Bishopsgate, London EC2M 3UR. Authorised and regulated by the Financial Services Authority.
This E-Mail message is confidential and for use by the addressee only. If the message is received by anyone other than the addressee, please return the message to the sender by replying to it and then delete the message from your computer. Internet E-Mails are not necessarily secure. National Westminster Bank Plc does not accept responsibility for changes made to this message after it was sent.
Whilst all reasonable care has been taken to avoid the transmission of viruses, it is the responsibility of the recipient to ensure that the onward transmission, opening or use of this message and any attachments will not adversely affect its systems or data. No responsibility is accepted by National Westminster Bank Plc in this regard and the recipient should carry out such virus and other checks as it considers appropriate.
My virus scanner removed the attachment.
Subject: NatWest Statement
From: NatWest.co.uk <noreply@natwest.co.uk>
Received: 27 May 2014
Attachment: [none]
Contents:
View Your May 2014 Online Financial Activity Statement
Keep track of your account with your latest Online Financial Activity Statement from NatWest Bank. It’s available for you to view at this secure site. Just click to select how you would like to view your statement:
View/Download as a PDF [link removed]
View all EStatements [link removed]
So check out your statement right away, or at your earliest convenience.
Thank you for managing your account online.
Sincerely,
NatWest Bank
Please do not respond to this e-mail. If you have any questions about this inquiry message or your NatWest Bank account, please speak to a Customer Service representative at +44 121 635 1592
NatWest Bank Customer Service Department
P.O. Box 414 | 38 Strand, WC2N 5JB, London
Copyright 2014 NatWest Company. All rights reserved.
AGNEUOMS0006001
Note: This one has given up trying to get me to open a dodgy attachment and rather it tries to tempt me into downloading natwest_financial_statement.zip from a non-NatWest website. Still, I know banks would never do this so I won’t be visiting those links.
Subject: Cards OnLine E-Statement E-Mail Notification
From: CardsOnLine@cardsonline.natwest.com
Received: 14 May 2014
Attachment: “Unnamed attachment”
Contents:
Dear Customer
Your May 14, 2014 E-Statement for account number xxxxxxxxxxxx9783 from Cards OnLine is now available.
For more information please check attached copy
Thank you
Cards OnLine
Many internet users have recently been targeted through bogus E-Mails by fraudsters claiming to be from their bank. These E-Mails ask customers to provide their internet banking security details in order to reactivate their account or verify an E-Mail address.
Please be on your guard against E-Mails that request any of your security details. If you receive an e-mail like this you must not respond.
Please remember that, for security reasons, apart from when you create them at registration or when you change your Internet Pin or Password, we will only ever ask you to enter random characters from your Internet PIN and Password when you logon to this service.
You must keep your security details secret. We would never ask you, by E-Mail, to enter (or record) these details in full and you must not respond to E-Mails asking for this information.
National Westminster Bank Plc, Registered in England No 929027. Registered
Office: 135 Bishopsgate, London EC2M 3UR. Authorised and regulated by the Financial Services Authority.
This E-Mail message is confidential and for use by the addressee only. If the message is received by anyone other than the addressee, please return the message to the sender by replying to it and then delete the message from your computer. Internet E-Mails are not necessarily secure. National Westminster Bank Plc does not accept responsibility for changes made to this message after it was sent.
Whilst all reasonable care has been taken to avoid the transmission of viruses, it is the responsibility of the recipient to ensure that the onward transmission, opening or use of this message and any attachments will not adversely affect its systems or data. No responsibility is accepted by National Westminster Bank Plc in this regard and the recipient should carry out such virus and other checks as it considers appropriate.
Note: My anti-malware quarantined this attachment with its dangerous Trojan before I could see the file name.
Subject: FW : Incoming CHAPS
From: Al Christensen <Al.Christensen@natwest.com>
Received: 12 May 2014
Attachment: “CHAPS-transfer.zip” and “Untitled attachment 00072.txt”
Contents:
We have received this documents from your bank regarding an incoming CHAPS transfer.
CONFIDENTIAL NOTICE: The contents of this message, including any attachments, are confidential and are intended solely for the use of the person or entity to whom the message was addressed. If you are not the intended recipient of this message, please be advised that any dissemination, distribution, or use of the contents of this message is strictly prohibited. If you received this message in error, please notify the sender. Please also permanently delete all copies of the original message and any attached documentation. Thank you.
Note: All very basic, not even really trying to pretend to be from NatWest. I only noticed it in the email address – thanks for the confidentiality warning but I think I’ll share it anyway.
Subject: You have received a new secure message
From: NatWest <secure.message@natwest.co.uk>
Received: 21 March 2014
Attachment: “SecureMessage.zip” and “Untitled attachment 00162.txt”
Contents:
You have received a secure message
Read your secure message by opening the attachment, SecureMessage.zip. You will be prompted to open (view) the file or save (download) it to your computer. For best results, save the file first, then open it.
If you have concerns about the validity of this message, please contact the sender directly. For questions please contact the NatWest Bank Secure Email Help Desk at 0131 556 7472.
First time users – will need to register after opening the attachment.
About Email Encryption – http://www.natwest.com/content/global_options/terms/Email_Encryption.pdf
Note: Another scam pretending to come from a bank. Even if the link goes to a valid site the attachment has the payload. Thanks for the advice that I’ll have more luck getting the virus if I save the attachment to my computer first.
PayPal Email Scams
Subject: You sent a payment of 165.99 GBP
From: PayPal.co.uk <userbill-21734@paypal.co.uk>
Received: 14 August 2014
Attachment: [none]
Contents:
14 August 2014 at 09:04:38 AM
Transaction ID: 65F834765H7021938 [LINK REMOVED]
PayPal Email ID PP843,
You sent a payment of 165.99 GBP to ferjmellorjenni@gmail.com
We’ve asked the seller to ship.
Thanks for using PayPal. To view the transaction details, log in to your PayPal account. [LINK REMOVED]
It may take a few moments for this transaction to appear in the Recent Activity list in your Account Overview.
Seller
ferjmellorjenni@gmail.com
Shipping address
Amanda Fayette
49 McLaughlin Road
Bentley Park, Queensland 4869
Australia
Note to seller
You haven’t included a note.
Shipping details
The seller hasnât provided any shipping details yet.
Description
Apple iPhone 4S – 16 GB – Black (Unlocked) [LINK REMOVED]
Item number 43ccd867ea
Unit price
145.99 GBP
Qty
1
Amount
145.99 GBP
Shipping and handling 20.00 GBP
Insurance – not offered —-
Total 165.99 GBP
Payment 165.99 GBP
Payment sent to jenniferjmellor@gmail.com
Issues with this transaction?
You have 45 days from the date of your PayPal payment to open a dispute for eligible transactions in our Resolution Centre. Learn about Buyer Protection [LINK REMOVED]
Questions? To cancel the transaction go to the Help Centre at: https://www.paypal.co.uk/help.
Please do not reply to this email. This mailbox is not monitored and you will not receive a response. For assistance, log in to your PayPal account and click Help in the top right corner of any PayPal page.
To receive emails as plain text instead of HTML, change your Notifications preferences. Just log in to your PayPal account, go to your Profile and click My Settings.
Copyright © 1999-2014 PayPal, Inc. All rights reserved.
.
PayPal Email ID PP843
This one was well formatted just like a PayPal payment receipt.
Subject: Payment issue
From: PayPal <queries@littlewoods.com>
Received: 14 May 2014
Attachment: “PayPal – Form.zip”
Contents:
Dear PayPal Customer,
You have an incoming payment from a member of Craiglist slated for your account regarding your item.
This transaction cannot be completed due to errors present in your account information.
You are required to download the form attached to this email to fix this problem immediately.
Please do not reply to this message. For questions, please call Customer Service.
We are available 24 hours a day, 7 days a week.
Sincerely,
PayPal Department.
Please do not reply to this e-mail as this is only a notification. Mail sent to this address cannot be answered.
No comment.
Subject: Notification of payment received
From: Trujillo08@fpt.vn
Received: 12 May 2014
Attachment: [none]
Contents:
You’ve Received New Funds!
Dear [email adress removed],
This email confirms that you have received a payment for 569.70 GBP from Trujillo08@fpt.vn
Receipt ID: 1403-7964-0672-4830
The number above is the buyer’s receipt ID for this transaction. Please retain it for your records so that you will be able to reference this transaction for customer service.
View the details of this transaction [link removed]
PayPal Shopping Cart Contents
Item Name: Post Man Pat, PC Selby Car & Figure
Item Number: 400301809020
Quantity: 1
Total: 569.70 GBP
Cart Subtotal: 569.70 GBP
Postage: 14.25 GBP
VAT:
Cart Total: 569.70 GBP
Payment details
Total amount: 569.70 GBP
Currency: British Pounds
Transaction ID: 7HD151924J961211N
Postage and packaging: 14.25 GBP
Postal insurance: 0.00 GBP
Buyer: Kathryn Watts
Buyer’s User ID: kate3282
Postage Information
Address
[name and address removed]
Address status Confirmed
Have you lifted your withdrawal and receiving limits? Just log in to your PayPal account and click View Limits on the Account Overview page.
Yours sincerely,
PayPal
Copyright S 1999-2012 PayPal. All rights reserved.
PayPal (Europe) S.a r.l. et Cie, S.C.A.
Societe en Commandite par Actions
Registered Office: 5th Floor 22-24 Boulevard Royal L-2449, Luxembourg
RCS Luxembourg B 118 349
PayPal Email ID PP345
Note: This one was formatted to make it look a bit more legitimate but I’ve removed the formatting here as well as my email address, the pretend buyer’s postal address and the dodgy website link that they want you to visit. Only visit your usual login page when visiting a website and never the one sent in an email. Also, I don’t think PayPal would send emails in 2014 with a 2012 copyright notice.
Subject: Resolution of case #PP-071-177-912-168
From: PayPal <barclaycard@securesuite.net>
Received: 9 May 2014
Attachment: “Case_0418915.zip”
Contents:
Transaction ID: 67016158LPNSJ63K0
Our records indicate that you never responded to requests for additional information about this claim. We hope you review the attached file and solve the situation amicably.
For more details please see the attached file (Case_0418915.zip).
Sincerely,
Protection Services Department
PayPal does not tolerate fraud or illegal activities. Your complaint has been noted in the record of the PayPal user you reported. If we find this user has violated our policies, we will investigate and take appropriate action. If this occurs, you may be contacted in the future about the status of this complaint.
To make sure future transactions proceed smoothly, we suggest you visit the PayPal site and click the Security Center link located at the top of any page. There you will find tips on how to avoid fraudulent sellers in the “Fraud Prevention Tips for Buyers” section.
Please do not reply to this email. This mailbox is not monitored and you will not receive a response. For assistance, log in to your PayPal account and click the Help link in the top right corner of any PayPal page.
Copyright © 1999-2014 PayPal. All rights reserved.
PPID PP865
Note: And a follow up to the previous scam pretending to be from PayPal, no doubt aimed at infecting my computer.
Subject: Attention: Your account has been limited until we hear from you ID: (Ref #PP-014-736-389-235)
From: PayPal <No+Replys@paypal.org.il>
Received: 30 April 2014
Attachment: “#PP-014-736-389-235.html”
Contents:
Your Account PayPal Has Been Limited !
Hello ,
You recently tried to pay with PayPal but the transaction was declined because !
You don’t make the new Account’s Update to your PayPal account.
PayPal is constantly working to ensure security by regularly screening the accounts is our system. We recently reviewed your account, and we need more information to help
How can I restore my account access ?
- Download the attachment form to verify your Profile information and restore your account.
- Make sure you enter the information accurately, and according to the formats required.
Fill in all the required fields.
We thank you for your prompt attention to this matter
Note: A variation of the bank scam emails pretending to be from PayPal.
Subject: Payment issue
From: PayPal <barclaycard@securesuite.net>
Received: 20 March 2014
Attachment: PayPal Department.zip
Contents:
Dear PayPal Customer,
You have an incoming payment from a member of Craiglist slated for your account regarding your item.
This transaction cannot be completed due to errors present in your account information.
You are required to download the form attached to this email to fix this problem immediately.
Please do not reply to this message. For questions, please call Customer Service.
We are available 24 hours a day, 7 days a week.
Sincerely,
PayPal Department.
Copyright © 1999-2014 PayPal Inc. All rights reserved.
Please do not reply to this e-mail as this is only a notification. Mail sent to this address cannot be answered.
Note: I know PayPal do not send out attachments or ask you to click on links asking you to login. Variations of this from my inbox have different attachments and come from different random email addresses (not @paypal.com).
Subject: Limitations have been placed on your account
From: PayPal <aaa@aaa.com>
Received: 15 March 2014
Attachment: Online form.html
Contents:
Dear PayPal Member,
As part of our efforts to provide a safe and secure environment for the online community, we regularly screen account activity. While reviewing your PayPal accounts, we observed activity that we would like to further verify. For this reason, limitations have been placed on your account until your will review your registered intormation.
In order to resolve the account limitations, complete our online form
After we have gathered the necessary information, your account will be reviewed for reinstatement and you will be notified by e-mail of our decision.
We thank you for your prompt attention to this matter and apologize for any inconvenience.
Account Review Department
Note: As if PayPal would send an email from that email address but even if it pretended to come from @paypal.com (which is easy to mask), I know it’s a scam. The easy way to check is to go to your PayPal account (not using any links in emails).
Quickbooks Email Scams
Subject: Payment Overdue
From: QuickBooks Invoice <auto-invoice@quickbooks.com>
Received: 13 May 2014
Attachment: “invoice_05122014.zip”
Contents:
Please find attached your invoices for the past months. Remit the payment by 5/12/2014 as outlines under our “Payment Terms” agreement.
Thank you for your business,
Sincerely,
Rolando Dean
This e-mail has been sent from an automated system. PLEASE DO NOT REPLY.
The information contained in this message may be privileged, confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify your representative immediately and delete this message from your computer. Thank you.
Note: More emails are appearing to come from software lately. Obviously another scam with a Trojan attached.
RBS Email Scams
Subject: Important Docs
From: August Cortes <August@rbs.com>
Received: 6 August 2014
Attachment: “AccountDocuments.zip”
Contents:
Please review attached documents regarding your account.
Tel: 01322 803678
Fax: 01322 942430
email: August@rbs.com
This information is classified as Confidential unless otherwise stated.
No comment.
Subject: RBS Morning Commentary
From: rbsgbm@rbs.com
Received: 30 July 2014
Attachment: “Unnamed attachment”
Contents:
Please refer to the details below if you are having problems reading the attached file.
Please do not contact your Treasury Centre for technical issues – these should be routed to RBS FM support.
The attached file is in zip format; first you have to unzip it (self-extracting archive, Adobe PDF) and then it can be viewed in Adobe Acrobat Reader 3.0 or above. If you do not have a copy of the software please contact your technical support department.
ALL SUMMARIES OF RESEARCH REPORTS INCLUDED IN THIS PAGE CONSTITUTE PART OF THE RELEVANT REPORT WHICH IS ATTACHED AND ARE THEREFORE COVERED BY THAT DOCUMENT’S DISCLAIMER AND DISTRIBUTION RESTRICTIONS.
My virus scanner removed the attachment.
Subject: RE: Incident IM01208648
From: Rachelle Simon <Rachelle.Simon@rbs.co.uk>
Received: 24 July 2014
Attachment: “IM01208648.zip”
Contents:
Good Afternoon ,
Attached are more details regarding your account incident.
Please extract the attached content and check the details.
Please be advised we have raised this as a high priority incident and will endeavour to resolve it as soon as possible. The incident reference for this is IM01208648.
We would let you know once this issue has been resolved, but with any further questions or issues, please let me know.
Kind Regards,
Rachelle Simon
Level 2 Adviser | Customer Experience Team, IB Service & Operations 7th Floor, 1 Hardman Boulevard | Manchester | M3 3AQ | Depot code: 049
Tel: 0845 300 4108 |Email: Rachelle.Simon@rbs.co.uk The content of this e-mail is CONFIDENTIAL unless stated otherwise
No comment.
Subject: Experience de credit./Credit experience.
From: Alexandre Desbiens <Alexandre.Desbiens@rbc.com>
Received: 18 July 2014
Attachment: “Unnamed attachment”
Contents:
Bonjour,
Tel que discute, vous trouverez ci-joint, le document nous autorisante demander des experiences de credit.
Une fois le document signe par, veuillez me retourner le document par courriel et l’original par courrier.
Merci!
Hello ,
As discussed, please find attached the document authorizing us to charge credit experiences.
Once the document is signed, please return the document to me via email and the original by mail.
Thank you!
I guess this one was aimed at Canadians as it was in French and English. My virus scanner removed the attachment.
Subject: Outstanding invoice
From: Bankline.Administrator@rbs.co.uk
Received: 29 May 2014
Attachment: [none]
Contents:
Dear contact,
Please download on the link below from dropbox copy invoice which is showing as unpaid on our ledger.
[hyperlink removed]
I would be grateful if you could look into this matter and advise on an expected payment date .
Many thanks
Samuel Owen
Credit Control
Tel: 0845 300 2952
No comment.
Subject: RE: Important Docs
From: Connie Baxter <Connie@rbs.co.uk>
Received: 8 May 2014
Attachment: “ImportantDocuments.zip”
Contents:
Please review attached documents regarding your account.
Tel: 01322 484771
Fax: 01322 368339
email: Connie@rbs.co.uk
This information is classified as Confidential unless otherwise stated.
CONFIDENTIAL NOTICE: The contents of this message, including any attachments, are confidential and are intended solely for the use of the person or entity to whom the message was addressed. If you are not the intended recipient of this message, please be advised that any dissemination, distribution, or use of the contents of this message is strictly prohibited. If you received this message in error, please notify the sender. Please also permanently delete all copies of the original message and any attached documentation. Thank you.
Note: Another pretending to be from RBS so I gave it a section. The only RBS I know is a bank but there is no mention of the bank in the confidential notice. Obviously a scam but I wish they would have put in a bit more information to make it easier for me to categorise it.
Subject: RE: Incident IM06590879
From: Curtis Anthony <Curtis.Anthony@rbs.co.uk>
Received: 24 April 2014
Attachment: “Incident_6590879.zip” & “Untitled attachment 00004.txt”
Contents:
Good Afternoon ,
Attached are more details regarding your account incident.
Please extract the attached content and check the details.
Please be advised we have raised this as a high priority incident and will endeavour to resolve it as soon as possible. The incident reference for this is IM06590879.
We would let you know once this issue has been resolved, but with any further questions or issues, please let me know.
Kind Regards,
Curtis Anthony
Level 2 Adviser | Customer Experience Team, IB Service & Operations 7th Floor, 1 Hardman Boulevard | Manchester | M3 3AQ | Depot code: 049
Tel: 0845 300 4108 |Email: Curtis.Anthony@rbs.co.uk The content of this e-mail is CONFIDENTIAL unless stated otherwise
Note: What incident? Anyway, no self-respecting company would send out an unsolicited attachment.
Sage Email Scams
Subject: Invoice #8110329
From: Sage.co.uk <no-reply@sage.co.uk>
Received: 11 June 2014
Attachment: [none]
Contents:
Please remit BACs before 12/06/2014.
Please view complete invoice please click here [LINK REMOVED]
No comment.
Subject: RE: Invoice #1894822
From: Sage Accounting <Clayton.Self@sage-mail.com>
Received: 11 March 2014
Attachment: “Invoice_1894822.zip” & “Untitled attachment 00058.txt”
Contents:
Please see attached copy of the original invoice (Invoice #1894822).
Note: No accounting firm would send an email with so little detail? Curiosity doesn’t get the better of me as it’s obviously a scam.
Santander Email Scams
Subject: Info from SantanderBillpayment.co.uk
From: Santanderbillpayment-noreply@SantanderBillPayment.co.uk
Received: 19 August 2014
Attachment: “IR4278442.zip”
Contents:
Thank you for using BillPay. Please keep this email for your records.
The following transaction was received on 19 Aug 2014 at 09:19:37.
Payment type: VAT
Customer reference no: 4278442
Card type: Visa Debit
Amount: GBP 4,163.00
For more details please check attached payment slip.
Your transaction reference number for this payment is IR4278442.
Please quote this reference number in any future communication regarding this payment.
Yours sincerely,
Banking Operations
This message is intended for the named person above and may be confidential, privileged or otherwise protected from disclosure. If it has reached you by mistake please contact the sender on 0300 200 3601 and delete the message immediately.
**PLEASE DO NOT REPLY TO THIS E-MAIL, AS WE WILL NOT BE ABLE TO RESPOND** Emails aren’t always secure, and they may be intercepted or changed after they’ve been sent. Santander doesn’t accept liability if this happens. If you think someone may have interfered with this email, please get in touch with the sender another way.
This message doesn’t create or change any contract. Santander doesn’t accept responsibility for damage caused by any viruses contained in this email or its attachments. Emails may be monitored. If you’ve received this email by mistake, please let the sender know at once that it’s gone to the wrong person and then destroy it without copying, using, or telling anyone about its contents.
Santander Corporate Banking is the brand name of Santander UK plc, Abbey National Treasury Services plc (which also uses the brand name of Santander Global Banking and Markets) and Santander Asset Finance plc, all (with the exception of Santander Asset Finance plc) authorised and regulated by the Financial Services Authority, except in respect of consumer credit products which are regulated by the Office of Fair Trading. FSA registration numbers: 106054, 146003 and 423530 respectively.
Registered offices: 2 Triton Square, Regent’s Place, London NW1 3AN and Carlton Park, Narborough LE19 0AL. Company numbers: 2294747, 2338548 and 1533123 respectively.
Registered in England. Santander and the flame logo are registered trademarks.
No comment.
Subject: Info from SantanderBillpayment.co.uk
From: Santanderbillpayment-noreply@SantanderBillPayment.co.uk
Received: 26 March 2014
Attachment: “VAT_241CDCF992.zip”
Contents:
Thank you for using BillPay. Please keep this email for your records.
The following transaction was received on 18 March 2014 at 20:03:41.
Payment type: VAT
Customer reference no: 9789049470611
Card type: Visa Debit
Amount: 483.93 GBP
Your transaction reference number for this payment is IR19758383.
Please quote this reference number in any future communication regarding this payment.
Full information in attachment.
Yours sincerely,
Banking Operations
This message is intended for the named person above and may be confidential, privileged or otherwise protected from disclosure. If it has reached you by mistake please contact the sender on 0845 302 1423 and delete the message immediately.
**PLEASE DO NOT REPLY TO THIS E-MAIL, AS WE WILL NOT BE ABLE TO RESPOND**
Note: I received 3 of these, all exactly the same but with different attachments, within a few hours. It’s also listed as the first one to pretend to come from Santander and mentioning VAT.
SITA Email Scams
Subject: Remittance Advice.
From: Accounts Payable <remittance.advices@sita.co.uk>
Received: 23 May 2014
Attachment: “all_payment_copies.zip”
Contents:
Please find attached folder for remittance advice and your outstanding statement from SITA UK.
Please arrange to send over a credit note as indicated in statement.
Any queries please contact us on 01934-524004.
Best Regards,
Luis Shivani,
Financial Controller
SITA UK
This email has been scanned by the Symantec Email Security.cloud service.
For more information please visit http://www.symanteccloud.com
No comment.
Sky Email Scams
Subject: Statement of account
From: Sky.com <statement@sky.com>
Received: 30 May 2014
Attachment: “Statement.zip”
Contents:
Afternoon,
Please find attached the statement of account.
We look forward to receiving payment for the April invoice as this is now due for payment.
Regards,
Katie
This email, including attachments, is private and confidential. If you have received this email in error please notify the sender and delete it from your system. Emails are not secure and may contain viruses. No liability can be accepted for viruses that might be transferred by this email or any attachment.
Wilson McKendrick LLP Solicitors, Queens House, 29 St. Vincent Place, Glasgow G1 2DT Registered in Scotland No. SO303162. Members: Mark Wilson LLB Dip. NP LP Allan T. McKendrick LLB Dip. LP NP.
No comment.
Subject: Statement of account
From: Sky.com <statement@sky.com>
Received: 3 April 2014
Attachment: “MarchStatement.zip”
Contents:
Good morning,
Please find attached the statement of account.
We look forward to receiving payment for the March invoice as this is now due for payment.
Regards
Lynn
This email, including attachments, is private and confidential. If you have received this email in error please notify the sender and delete it from your system. Emails are not secure and may contain viruses. No liability can be accepted for viruses that might be transferred by this email or any attachment.
Wilson McKendrick LLP Solicitors, Queens House, 29 St. Vincent Place, Glasgow G1 2DT Registered in Scotland No. SO303162. Members: Mark Wilson LLB Dip. NP LP Allan T. McKendrick LLB Dip. LP NP.
Note: This scam is pretending to come from Sky but like every other firm you have an online account with, they don’t send statements by email. You login using the original link you were given rather than any in an email to see your account details.
US Department of Justice Email Scams
Subject: UNITED STATES DEPARTMENT OF JUSTICE
From: Mr. James B. Comey <test1@kfu.edu.cn>
Received: 1 August 2014
Attachment: [none]
Contents:
If this email is not spam, click here to submit the signatures to FortiGuard – AntiSpam Service. [LINK REMOVED]
Federal Bureau of Investigation
Counter-terrorism Division and Cyber Crime Division J. Edgar. Hoover Building Washington DC Chris Swecker,
Attention Beneficiary ,
Records show that you are among one of the individuals and organizations who are yet to receive their overdue payment from overseas which includes those of Lottery/Gambling, Contract and Inheritance. Through our Fraud Monitory Unit we have noticed that you have been transacting with some impostors and fraudsters who have been impersonating the likes of Prof. Soludo /Mr. Lamido Sanusi of the Central Bank Of Nigeria, Mr. Patrick Aziza, Bode Williams, Frank, Anderson, none officials of Oceanic Bank, Zenith Banks, Kelvin Young of HSBC, Ben of FedEx, Ibrahim Sule, Dr. Usman Shamsuddeen and some impostors claiming to be The Federal Bureau of Investigation.
The Cyber Crime Division of the FBI gathered information from the Internet Fraud Complaint Center (IFCC) on how some people have lost outrageous sums of money to these impostors. As a result of this, we hereby advise you to stop communication with any one not referred to you by us. We have negotiated with the Federal Ministry of Finance that your payment totaling $5,900,000.00(Five Million Nine Hundred Thousand Dollars). will be released to you via a custom pin based ATM card with a maximum withdrawal limit of $15,000 a day which is powered by Visa Card and can be used anywhere in the world where you see a Visa Card Logo on the Automatic Teller Machine (ATM).
We guarantee receipt of your payment. This is as a result of the mandate from US Government to make sure all debts owned to citizens of American and also Asia and Europe which includes Inheritance, Contract, Gambling/Lottery etc are been cleared. Below are few list of tracking numbers you can track from Delivery Company website to confirm people like you who have received their payment successfully.
1)Name Howard Keighler
Tracking Number899328773367
Website FeDex.com
(2) Name: Jody Miller
Tracking Number: 899571438936
Website: FedEx.com
To redeem your funds, you are hereby advised to contact the ATM Card Center via email for their requirement to proceed and procure your Approval of Payment Warrant and Endorsement of your ATM Release Order on your behalf which will cost you $95 Usd only and nothing more as everything else has been taken care of by the Federal Government including taxes, custom paper and clearance duty so all you will ever need to pay is $95.00 only.
Mrs.Lisa Smith (ATM Card Center Director)
WASHINGTON, D.C. 20535
ATM Card Center Director
Email: lisasmith01lisa@aol.com
Phone:+1-786-558-3653
Do contact of the ATM Card Center via his contact details above and furnish him with your details as listed below:
FULL NAMES: __________________________________
DELIVERY ADDRESS FOR ATM CARD: __________________
DATE OF BIRTH: __________________
OCCUPATION: __________________
TELEPHONE NUMBER: _____________________
EMAIL ADDRESS: _____________________
On contacting him with your details your file would be updated and he will be sending you the payment information in which you will use in making payment of $95.00 via Money Gram or Western Union Money Transfer for the procurement of your Approval of Payment Warrant and Endorsement of your ATM Release Order, after which the delivery of your ATM card will be effected to your designated home address without any further delay, extra fee.
Here is the payment information
Recivers Name; orji Abuchi
Country:Nigeria
City:Lagos
Amount:$95
After making payment, do provide us with the following information as evidence of payment as written on the western union or money gram payment receipt.
You have to fill everything below as soon as you make the payment and a scan copy of the payment slip.
Senders Name:?
Senders Address:?
MTCN# (10 digit Western Union )
Amount Sent:
You are advised to make it known to us when we shall be receiving the confirmation of your payment receipt so that we will arrange for the shipping of your Parcel immediately.
James B. Comey, DIRECTOR
FEDERAL BUREAU OF INVESTIGATION
UNITED STATES DEPARTMENT OF JUSTICE
WASHINGTON, D.C. 20535
Note: Disregard any email you get from any impostors or offices claiming to be in posses  of the ATM card center who is the rightful person to deal with in regards to your payment and forward any emails you get from impostors to this office so we could act upon it immediately.Help stop cyber crime.
No comment.
Subject: UNITED STATES DEPARTMENT OF JUSTICE
From: Nicholas Story <info@fbi.gov>
Received: 7 April 2014
Attachment: [None]
Contents:
Federal Bureau of Investigation (FBI)
Counter-terrorism Division and Cyber Crime Division
J. Edgar. Hoover Building Washington DC
Dear Beneficiary,
Series of meetings have been held over the past 7 months with the secretary general of the United Nations Organization. This ended 3 days ago. It is obvious that you have not received your fund which is to the tune of Eight Million and Five Hundred Thousand United State Dollars ($8,500,000.00) due to past corrupt Governmental Officials who almost held the fund to themselves for their selfish reason and some individuals who have taken advantage of your fund all in an attempt to swindle your fund which has led to so many losses from your end and unnecessary delay in the receipt of your fund.
The National Central Bureau of Interpol enhanced by the United Nations and Federal Bureau of Investigation have successfully passed a mandate to the current president of Nigeria his Excellency President Good luck Jonathan to boost the exercise of clearing all foreign debts owed to you and other individuals and organizations who have been found not to have receive their Contract Sum, Lottery/Gambling, Inheritance and the likes. Now how would you like to receive your payment? Because we have two method of payment which is by Check or by ATM card?
ATM Card: We will be issuing you a custom pin based ATM card which you will use to withdraw up to $3,000 per day from any ATM machine that has the Master Card Logo on it and the card have to be renewed in 4 years time which is 2018. Also with the ATM card you will be able to transfer your funds to your local bank account. The ATM card comes with a handbook or manual to enlighten you about how to use it. Even if you do not have a bank account.
Check: To be deposited in your bank for it to be cleared within three working days. Your payment would be sent to you via any of your preferred option and would be mailed to you via DHL. Because we have signed a contract with DHL which should expire in next three weeks you will only need to pay $135 instead of $450 saving you $315 So if you pay before the three weeks you save $315 Take note that anyone asking you for some kind of money above the usual fee is definitely a fraudsters and you will have to stop communication with every other person if you have been in contact with any. Also remember that all you will ever have to spend is $135.00 nothing more! Nothing less! And we guarantee the receipt of your fund to be successfully delivered to you within the next 48hrs after the receipt of payment has been confirmed.
Note: Everything has been taken care of by the Federal Government of Nigeria, The United Nation and also the FBI and including taxes, custom paper and clearance duty so all you will ever need to pay is $135.
DO NOT SEND MONEY TO ANYONE UNTIL YOU READ THIS: The actual fees for shipping your ATM card is $420 but because DHL have temporarily discontinued the C.O.D which gives you the chance to pay when package is delivered for international shipping We had to sign contract with them for bulk shipping which makes the fees reduce from the actual fee of $420 to $135 nothing more and no hidden fees of any sort!
To effect the release of your fund valued at $8,500,000.00 you are advised to contact our correspondent in Africa the delivery officer Kelvin Lamar with the information below,
Name: Kelvin Lamar
Email: kelvin.lamar@secretarias.com
You are advised to contact him with the information’s as stated below:
Your full Name..
Your Address:…………..
Home/Cell Phone:…………..
Preferred Payment Method (ATM / Cashier Check)
Upon receipt of payment the delivery officer will ensure that your package is sent within 48 working hours. Because we are so sure of everything we are giving you a 100% money back guarantee if you do not receive payment/package within the next 48hours after you have made the payment for shipping.
Yours sincerely,
NICHOLAS STORY
FEDERAL BUREAU OF INVESTIGATION
UNITED STATES DEPARTMENT OF JUSTICE
WASHINGTON, D.C. 20535
TELEPHONE: (218) 646-2533
FAX: (202) 666-5283
Note: Do disregard any email you get from any impostors or offices claiming to be in possession of your ATM CARD, you are hereby advice only to be in contact with Kelvin Lamar of the ATM CARD CENTRE who is the rightful person to deal with in regards to your ATM CARD PAYMENT and forward any emails you get from impostors to this office so we could act upon and commence investigation.
Note: Another reasonably lengthy email but I thought I’d show all of it. This one relies on human greed but if you follow the old saying if it looks too good to be true it usually is then you can’t go wrong. On the surface it looks like this scam will only cost you $135 (after the fake discount) but who really knows what it will cost you once you give these criminals your details.
Virgin Media Email Scams
Subject: Virgin Media Automated Billing Reminder
From: Virgin Media <billing@virginmedia.com>
Received: 17 June 2014
Attachment: [none]
Contents:
Virgin Media Automated Billing Reminder
Date 17th June 2014
This e-mail has been sent you by Virgin Media to inform you that we were
unable to process your most recent payment of bill. This might be due to
one of the following reasons:
A recent change in your personal information such as Name or address.
Your Credit or Debit card has expired.
Insufficient funds in your account.
Cancellation of Direct Debit agreement.
Your Card issuer did not authorize this transaction.
To avoid Service interruption you will need to update your billing profile, failure to update your profile may lead in service cancellation and termination.
Please click on the link below to login to e-Billing. You will need to login using your primary E-mail address.
Login to e-Billing [LINK REMOVED]
Once logged in you will need to fill in the required fields, please ensure all address and contact details are up to date, once submitted your account details will automatically be updated within 24 Hours.
Kind Regards,
Virgin Media
Customer Services Team
Ellis Willis
No comment.
Wells Fargo Email Scams
Subject: Documents – WellsFargo
From: Wells Fargo Advisors <alerts@c-68-35-149-135.hsd1.nm.comcast.net>
Received: 30 April 2014
Attachment: “Message.zip”
Contents:
Secure Email from Wells Fargo Advisors
To Read This Message:
Look for and open Message.zip (typically at the top or bottom; location varies by email service).
Need help?
Support information , Video tutorial or
call the support line at 1.877.879.2495, option 3.
Your email: [email address removed]
ATTENTION: THIS E-MAIL MAY BE AN ADVERTISEMENT OR SOLICITATION FOR
PRODUCTS AND SERVICES.
To unsubscribe from marketing e-mails from an individual Wells Fargo
Advisors financial advisor, reply to one of his/her e-mails and type ‘Unsubscribe’ in the
subject line.
To unsubscribe from marketing emails from Wells Fargo and its affiliates, unsubscribe at
www.wellsfargoadvisors.com/unsubscribe.
Neither of these actions will affect delivery of important service messages regarding your
accounts that we may need to send you or preferences you may have previously
set for other e-mail services. For additional information regarding our electronic
communication policies, visit:
http://wellsfargoadvisors.com/disclosures/email-disclosure.html
Investments in securities and insurance products are:
NOT FDIC-INSURED/NO BANK-GUARANTEES/MAY LOSE VALUE
Investment professionals are registered representatives of Wells Fargo Advisors, LLC,
a registered broker dealer and a separate non-bank affiliate of Wells Fargo &
Company. Member FINRA/SIPC. 1 North Jefferson, St. Louis, MO 63103.
Email Security Powered by Voltage IBE
Copyright 2013 Wells Fargo. All rights reserved
Note: A quality improvement on the last email scam pretending to be from Wells Fargo.
Subject: Documents – WellsFargo
From: Lynda_Barrett@wellsfargo.com
Received: 1 April 2014
Attachment: “WellsFargo_Docs_042014.zip”
Contents:
Please review attached files.
Lynda_Barrett
Wells Fargo Advisors
817-373-0388 office
817-651-9897 cell
Lynda_Barrett@wellsfargo.com
Investments in securities and insurance products are:
NOT FDIC-INSURED/NO BANK-GUARANTEES/MAY LOSE VALUE
Wells Fargo Advisors, LLC is a nonbank affiliate of Wells Fargo & Company, Member FINRA/SIPC. 1 North Jefferson, St. Louis, MO 63103
CONFIDENTIAL NOTICE: The contents of this message, including any attachments, are confidential and are intended solely for the use of the person or entity to whom the message was addressed. If you are not the intended recipient of this message, please be advised that any dissemination, distribution, or use of the contents of this message is strictly prohibited. If you received this message in error, please notify the sender. Please also permanently delete all copies of the original message and any attached documentation. Thank you.
Note: Another scammer that can’t be bothered to make the file more attractive to me “please review attached files” doesn’t tell me why I should. Still slightly more creative than the scam email below.
General Scan/Copy Device Email Scams
Subject: Scanned Image
From: HP Digital Device <HP_Printer@pathowe.co.uk>
Received: 8 August 2014
Attachment: “Scanned Image.zip”
Contents:
Please open the attached document.
This document was digitally sent to you using an HP Digital Sending device.
This email has been scanned for viruses and spam.
No comment.
Subject: Scanned Image from a Xerox WorkCentre
From: Local Scan <scan.715@pathowe.co.uk>
Received: 30 July 2014
Attachment: “Xerox_Image.zip”
Contents:
You have a received a new image from Xerox WorkCentre.
Sent by: pathowe.co.uk
Number of Images: 4
Attachment File Type: ZIP [PDF]
WorkCentre Pro Location: Machine location not set Device Name: pathowe.co.uk
Attached file is scanned image in PDF format.
Adobe(R)Reader(R) can be downloaded from the following URL: http://www.adobe.com/
No comment.
Subject: Scanned Image from a HP Digital Device
From: HP Digital Device <HP_Printer@pathowe.co.uk>
Received: 27 May 2014
Attachment: “Image [_var=partorderb].zip”, “Untitled attachment 00004.txt”
Contents:
Please open the attached document. This document was digitally sent to you using an HP Digital Sending device.
This email has been scanned for viruses and spam.
Note: As per the Xerox WorkCentre email received a week ago today, this one pretends to come from a similar HP system at my company. Looks like they left some scripting in the image file name.
Subject: Scanned Image from a Xerox WorkCentre
From: Xerox WorkCentre <Xerox.Device1@pathowe.co.uk>
Received: 20 May 2014
Attachment: “Scan-001_200522014_092.zip”, “Untitled attachment 00015.txt”
Contents:
Please open the attached document. It was scanned and sent to you using a Xerox WorkCentre Pro.
Sent by: pathowe.co.uk
Number of Images: 8
Attachment File Type: ZIP [PDF]
WorkCentre Pro Location: Machine location not set Device Name: 85N09W2VB3
Attached file is scanned image in PDF format.
Adobe(R)Reader(R) can be downloaded from the following URL: http://www.adobe.com/
Note: This one is pretending to be from my company copying machine but I know how easy it is to fake the “from” email address. Still goes to show how they are trying to fool me into thinking it comes from my systems and for those not security aware it could prove costly.
General Voice, MMS & Fax Email Scams
Subject: AT&T – You Have a new Voice Mail
From: AT&T Voice Mail <voice-alert@att.net>
Received: 9 May 2014
Attachment: “Unnamed attachment”
Contents:
Voicemail Message
You have received a voicemail at 2014-09-05 10:12:34 CST.
You are receiving this message because we were unable to deliver it, voice message did not go through because the voicemail was unavailable at that moment.
* The reference number for this message is qjng_pxr65-1624895082-0214250496-68.
The length of transmission was 14 seconds.
The receiving machine’s ID: HGV72-VF522-Y29EQH.
Thank you,
AT&T Online Services
Contact Us
AT&T Support – quick & easy support is available 24/7.
…
Note: Like the one below pretending to be from Outlook my Internet Security software nabbed the Trojan attached to this email. This one was formatted to make it look more official with contact information, copyright and website links that I’ve removed from the above.
Subject: New Fax – 0800 200 400
From: UK2Fax <fax2@fax1.uk2fax.co.uk>
Received: 8 May 2014
Attachment: “FAX038979.zip”
Contents:
UK2Fax Fax2Email : New fax attached, received at 08/05/2014 08:23:29 GMT
Note: Another minimal attempt to get me to open a malware attachment. Who used a fax now-a-days anyway?
Subject: You have received a new fax message
From: FAX MESSAGE <faxmessage@bzq-79-177-4-158.red.bezeqint.net>
Received: 30 April 2014
Attachment: “FAX650923.zip”
Contents:
New fax at KOI28033624 from pathowe.co.uk Scan date: Wed, 30 Apr 2014 18:17:16 +0200
Number of page(s): 4
Resolution: 400×400 DPI
Attached file is scanned image in PDF format.
Adobe(R)Reader(R) can be downloaded from the following URL: http://www.adobe.com/
Note: A fax email pretending to come from my domain, with a bit more detail than the usual fax message scams with the link to Adobe.
Subject: New Fax: 3 pages
From: FAX [email address removed]
Received: 27 March 2014
Attachment: “fax-message847440.zip”
Contents:
You have received a new fax (fax-847440.zip).
Date/Time: Thu, 27 Mar 2014 19:45:14 +0100.
Number of pages:3
Note: Another fax message attachment. This one is pretending to come from my email address (i.e. both to and from are the same) but scammers can put anything in the “from” section of the message. At least this time they got a better date but the text of the attachment does not match the attachment itself.
Subject: New Fax Message on 03/19/2013
From: Hank Walden <o.makarenkov@ast-consulting.ru>
Received: 21 March 2014
Attachment: “fax.zip”
Contents:
You Have a New Fax Message
From: (696) 942-9872
Received: Wednesday, March 19, 2014 at 11:38 AM
Pages: 6
To view this message, please open the attachment
Thank you for using RingCentral.
Note: I’m guessing this scammer ran the same thing this time last year with an older subject date. I didn’t believe it then and I won’t believe it now.
Subject: New Voicemail Message
From: Voice Mail <noreply @pathowe.co.uk>
Received: 21 March 2014
Attachment: “VoiceMail.zip”
Contents:
New Voicemail Message
You have been left a 1:00 long message (number 1) in mailbox from “Eraring Energy” 07544473782, on Friday, 21 March, 2014 at 07:29:02 AM
The voicemail message has been attached to this email – which you can play on most computers.
Please do not reply to this message. This is an automated message which comes from an unattended mailbox.
This information contained within this e-mail is confidential to, and is for the exclusive use of the addressee(s). If you are not the addressee, then any distribution, copying or use of this e-mail is prohibited. If received in error, please advise the sender and delete/destroy it immediately. We accept no liability for any loss or damage suffered by any person arising from use of this e-mail.
Note: See how easy it is to spoof the sender email address. This scam email looks as if it comes from my domain but it doesn’t.
Subject: Orange MMS Service
From: Juliet <Juliet5f820a@bodygroup.ie>
Received: 18 March 2014
Attachment: Juliet-photo.jpg & Juliet_album_e65.zip
Contents:
How is it going? I am Juliet! i look for a second half.
I enjoy travelling and drawing! Look at my photos in attached file.
Answer me! Bye!
Mobile: +447*********
Passcode: 29F00250C81
Note: I don’t know who Juliet is and even if I did I wouldn’t open it unless I was expecting to receive an attachment. The .jpg file is a photo of a young lady but the zip has the virus. The hope of the scammer here is that you’ll trust the album because of the single photo.
Other Miscellaneous Email Scams
Subject: Bror Muskovac No. And while youre at it, ask him to trim h….
From: Brooklyns Kolkenbrock <Brooklyns@ci.selma.tx.us>
Received: 20 August 2014
Attachment: [none]
Contents:
Bror Muskovac!
Bror Muskovac No. And while youre at it, ask him to trim his fingernails, just to be safe.
rumor misstatement epsilon untie
wearer= skiing critique perambulator
redcurrants collectivises myrrh footstool trebled arriving passion masqueraded
[LINK REMOVED]
Regards
Brooklyns Kolkenbrock
I’ve no idea what this is about but I won’t be clicking that link.
Subject: Attention: Beneficiary
From: SKYE BANK PLC <customercenter70@rocketmail.com>
Received: 15 August 2014
Attachment: [none]
Contents:
Head Office:
Skye Bank Plc.
Akin Adesola Street, Victoria Island, Lagos.
Direct Line: +2349030558319
Fax: 234 111 6998
Date; 15/ 08/ 2014
Attention: Beneficiary
I am Timothy Oguntayo, the new Head authorized Fund Crediting Manager handling all foreign unpaid inheritance and contract fund. Your name is among the listed beneficiary who have not receive their inheritance payment and also among the once who have lost a lot of money while trying to claim their inheritance. Your payment file have been open today after the World Bank Executive board meeting concerning all Unpaid inheritance and we notice that your payment have been kept pending for a very long time due to the wrong information given previously by the payment Administrative officer.
The Federal Republic of Nigeria under the instruction of His Excellency President Goodluck Ebele A. Jonathan, GCFR have given ORDER in the First Quarter Payment Approval yesterday to release ALL outstanding payment through our Bank and your name is among the listed approved beneficiary to receive their PART PAYMENT of US$2.5M.
Furthermore, to be sure of whom we have contacted, The Skye Bank Management hereby advice that you fill and return the below listed personal details so as to enable us cross check with the one in your payment file before we commence with the release of your approval part payment.
First Name:
Last Name:
Middle Name:
Address:
DOB: (Date of Birth):
Telephone:
Mobile Phone:
Copy of your Identification: Drivers License OR International Passport:
Next of Kin Name:
As soon as the above information is receive and confirm correctly, the bank management will not hesitate to furnish you with your online account details and transfer instructions.
We Sincerely Apologize for the delay you have encountered in trying to receive your fund, but we assure you that those delays will never be encountered again.
Best Regards
MR. TIMOTHY OGUNTAYO
DIRECTOR,
HEAD FUND CREDITING MANAGER
SKYE BANK PLC
No comment.
Subject: BREAKING: Real hope for extremely overweight patients!
From: USATODAY.com <pat6805@tmsbeverlyhills.com>
Received: 15 August 2014
Attachment: [none]
Contents:
Having trouble viewing this email? | View it in your browser [LINK REMOVED]
USA TODAY: BREAKING NEWS
What is the best solution for overwieght patients? Fresh air and sports? Active outdoor hobbies? Living on vegetables and fruit? You are absolutely right, but a chubby guy will become sle.nder on condition that a) his/her will is a strong as steel;
b) he/she is as healthy as a horse!
Otherwise you cannot succeed without our new product that helps you lose_up to 25pounds monthly!
FOR MORE ON THIS STORY, GO TO:
USATODAY.COM [LINK REMOVED]
You are currently subscribed to this newsletter with the address:
[EMAIL REMOVED]
To UNSUBSCRIBE please click here. [LINK REMOVED]
Manage Subscriptions | Help | Advertise | Home Delivery | Privacy Policy – Your California Privacy Rights [ALL LINKS REMOVED]
© 2014 USA TODAY, a division of Gannett Satellite Information Network, Inc.
7950 Jones Branch Drive, McLean, VA 22108
This one looked like an official newsletter.
Subject: Invoice 5101945 August
From: Catalina David <kdsurwfd@parsonline.net>
Received: 13 August 2014
Attachment: “Invoice 5101945.zip”
Contents:
Hello,
Please can you let me have a payment date for the attached August Invoice?
Kind Regards
Catalina David
Accounts Administrator
‘(Main) 01884242626 ‘(Direct Dial) 01884 250764
Please consider the environment before printing
Broad Oak Toiletries Ltd, Tiverton, Tiverton Way, Tiverton Business Park, Tiverton, Devon, EX16 6TG
Registered No. 1971053 England & Wales
Telephone: +44 (0) 1884 242626
Facsimile: +44 (0) 1884 242602
No comment.
Subject: Your Prestigious Award.
From: BMW AUTOMOBILE <postmaster@w2012p-01.wavenet.com>
Received: 12 August 2014
Attachment: [none]
Contents:
Dear Winner,
This is to inform you that you have been selected for a prize of a brand new 2014 Model BMW 7 Series Car and a Check of $500,000.00 United States Dollars from international programs held on the 1st section 2014 in the UNITED STATES OF AMERICA.
The selection process was carried out through random selection in our computerized email selection system (ESS) from a database of over 250,000 email addresses drawn from all the continents of the world which you were selected.
The BMW Lottery is approved by the British Gaming Board and also Licensed by the International Association of Gaming Regulators (IAGR). To begin the processing of your prize you are to contact our fiduciary claims department for more information as regards procedures to claim your prize.
Name: Mr.Anthony Smith
Email:bmwautomobile_84@secretarias.com
Contact him by providing him with your secret pin code Number BMW:2551256003/23. You are also advised to provide him with the under listed information as soon as possible:
1.Name in full.
2. Address.
3. Nationality.
4. Age.
5. Occupation.
6. Phone/Fax.
7. Present Country.
8. Email address.
9. pin code Number BMW:2551256003/23
Dr. Norbert Reithofers.
THE DIRECTOR PROMOTIONS
BMW LOTTERY DEPARTMENT
UNITED STATES OF AMERICA
No comment.
Subject: Delivery failure: PKG-5618495
From: UKMail Group <reports@ukmail.com>
Received: 7 August 2014
Attachment: “PKG-561895.zip”
Contents:
An urgent service package has come to the local post office. Delivery was rescheduled because our courier was not able to deliver the package [RECEIVER NOT PRESENT].
You can find more information including contact details regarding your package in the attached file.
No comment.
Subject: CDS Invoice: 2932603
From: accounts@cdsgroup.co.uk
Received: 6 August 2014
Attachment: “Order 2932603.zip”
Contents:
Dear client
Please find attached your invoice number 2932603
If you have any queries with this invoice, please email us at accounts@cdsgroup.co.uk or call us on 020 8752 8040
For and on behalf of
The CDS Group of Companies
Crawfords of London | CrawfordsDelivery Services | Media Express | CDS International
Passenger Car Services Same Day UK Couriers TV Support Units Overnight & International
Tel: 020 8752 8040
Email: accounts@cdsgroup.co.uk
Please consider the environment before printing this email.
This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, please telephone or email the sender and delete this message and any attachment from your system.
If you are not the intended recipient you must not copy this message or attachment or disclose the contents to any other person. This e-mail or any attachments are for information purpose only and does not form any part of an agreement, contract or fact.
The contents of an attachment to this e-mail may contain software viruses, which could damage your own computer system. WhilstThe CDS Grouphas taken every reasonable precaution to minimise the risk, we do not accept liability for any damage, which you sustain as a result of software viruses. You should carry out your own virus checks before opening any attachment to this e-mail.
No comment.
Subject: Losing a size within a fortnight? It’s easy
From: pat26@auroraphotosmith.com
Received: 1 August 2014
Attachment: [none]
Contents:
Imagine enjoying your usual life (including your favorite coke and cupcakes in front of TV) and becoming almost a pound lighter every day! Would you call it a miracle? No! It is a result of a decade of hard work, thorough research and careful clinical testing. The formula boosts your energy, burns fat in your body and suppresses your appetite. Do not forget to use it regularly
More on this story: http://www.foxnews.com/health/2014/08/1/magicpill/ [LINK REMOVED]
For more news, please go to FoxNews.com [LINK REMOVED] and watch Fox News Channel.
More Newsletters | Unsubscribe | Privacy Policy [ALL LINKS REMOVED]
©2014 Fox News Network, LLC. All Rights Reserved.
Fox News never sends unsolicited email. You received this email because you requested a subscription to Breaking Alerts from FoxNews.com.
No comment.
Subject: Homicide Suspect
From: ALERT@nyc.gov <ALERT@host100-97-static.207-37-b.business.telecomitalia.it>
Received: 1 August 2014
Attachment: [none]
Contents:
Bulletin Headline: HOMICIDE SUSPECT
Sending Agency: New York City Police
Sending Location: NY – New York – New York City Police Bulletin Case#: 14-93287 Bulletin Author: BARILLAS #6284 Sending User #: 38448 APBnet Version: 372603
The bulletin is a pdf file. To download please follow the link below (Google Disk Drive service):
[LINK REMOVED]
The Adobe Reader (from Adobe.com) will display and print the bulletin best.
You can Not reply to the bulletin by clicking on the Reply button in your email software.
This one used Google short URLs to mask the dodgy destination.
Subject: No empty promises – At least 15 lbs off!
From: pated8@ccchorale.net
Received: 31 July 2014
Attachment: [none]
Contents:
To view this email as a web page, click here [LINK REMOVED]
Dear pat,
Too fat to endure? Easy and efficient way out!
You want to be fit, healthy and attractive but cannot live without all those delicious things. Does it mean you are doomed to be fat and ugly for the rest of your life? Fortunately, not now! We offer to all patients a perfect obesity-solution. Try and take the formula regularly and the med will do the rest of hard work for you! You will lose almost a pound a day without tiring gyms and diets!
Try it here, for FREE [LINK REMOVED]
(c)SlimMe 475 14th St., Suite 550, Oakland, CA 94612.
If you no longer wish to receive these emails, click on the following link: Unsubscribe [LINK REMOVED]
Does being fat make you ugly? I don’t think so but the author of this scam email certainly associates the two. The unsubscribe link points to the same dodgy website as the Try it link.
Subject: Attention:Beneficiary
From: Kathy James <annmariee@1199.org>
Received: 29 July 2014
Attachment: [none]
Contents:
Attention:Beneficiary I have to start by introducing myself as Mrs Kathy James, senior investigator working with the united Nations. From and ac-cured data base through the International Monetary Funds (IMF) we observed that you were supposed to receive your wire transfer of your funds on the 28-06-2014. This E-mail requires you to quickly confirm to this humble office if you have received your funds transfer. If No, complete the requested information Below: Full Name Age, Sex , Occupation Direct Mobile Number Nationality A valid passport I will be waiting for your swift response to this urgent matter Thanks! Mrs Kathy James UN INVESTIGATOR
No comment.
Subject: ADP Report
From: ADP_FSA_Services@ADP.com <AmericanExpress@welcome.aexp.com>
Received: 28 July 2014
Attachment: [none]
Contents:
Your Transaction Report(s) have been uploaded to the web site:
[LINK REMOVED]
Please note that your bank account will be debited within one banking
business day for the amount(s) shown on the report(s).
Please do not respond or reply to this automated e-mail. If you have any
questions or comments, please Contact [LINK REMOVED] your ADP Benefits Specialist.
Thank You,
ADP Benefit Services
This one used Google short URLs to mask the dodgy destination.
Subject: The Truth About your Fund.
From: Ban Ki Moon <annmariee@1199.org>
Received: 27 July 2014
Attachment: [none]
Contents:
Dear Victim,
This is to intimate you of a very important information which will be of a great help to redeem you from all the difficulties you have been experiencing in getting your long over due payment due to excessive demand for money from you by both corrupt Bank officials,Online Lovers and Courier Companies after which your fund remain unpaid to you.
Due to over rampant internet Banking corrupt activities, and also the High rate of scam on internet, compensation payment was stop. On our information we got about you, we found out that you are among those that have lost money to those internet scammers that claim to pay you back. The Board of Trustees decided to cancel the award payment with the bank, This meeting was held in London on 3rd of June, 2014.
I am Ban Ki Moon Director of international affairs in the United Nation (UN). It may interest you to know that reports have reached our office by so many correspondences on the uneasy way which people like you are treated by Various Banks, Online Lovers and Courier Companies Diplomat(s) across Europe to Africa and Asia London UK, and we have decided to put a STOP to that and that is why I was appointed to handle your transaction here in Malaysia.
After the meeting on 31st of June, 2014. an official agreement was reached on Tuesday 1st of July 2014, between the Board of Trustees and Security Company which took an immediate effects for the Security Company to issue all the victims a Certified International Master Card worth Ten Million Five Thousands United States Dollars (USD 10,500,000.00).
All Governmental and Non-Governmental prostates, NGO’s, Finance Companies, Banks, Online Lovers, Security Companies and Diplomat(s) which have been in contact with you of late have been instructed to back off and you have been advised NOT to respond to them anymore since the United Nation is now directly in charge of your payment. Your fund will be release to you directly from our source with immediate effect and we shall give you further details on how your fund will be released.
You are hereby advice to provide your information as stated below:
Full Name: …Address:. …Telephone:….Occupation:…….Age :……….
Name: Ban Ki Moon
Email:Â bankimoon1313@gmail.com
Note: You can also receive your Funds via Bank Draft Check or Bank Wire Transfer depends on your choice.I hope this is clear. STOP any further communication with ANYONE, any action contrary to this instruction is at your own risk.
No comment.
Subject: I changed photos at profile, please check
From: Julia <no-reply@saintcaprais.com>
Received: 25 July 2014
Attachment: [none]
Contents:
Hello!
I am Julia, 26 yo.
Are you ready to be my boyfriend and to start big friendship?
August is the best time for this 🙂
wish you good sunner time!
please check my new photos and message for you here:
[LINK REMOVED]
{%END_QUOTEDPRINTABLE%}
No comment.
Subject: New messages from ladie for you
From: Elina <no-reply@starnet.md>
Received: 25 July 2014
Attachment: [none]
Contents:
Hello, I am Elina
My age is 26.
My search are for man to start a big friendship and may be more.
And you?
I am on-line now, let`s chat?
my profile, message for you and new photos are here:
Visit our website here. [LINK REMOVED]
sweet kiss,
Elina
No comment.
Subject: CNN Breaking News – Malaysian Boing 777
From: CNN Breaking News <BreakingNews@mail.cnn.com>
Received: 24 July 2014
Attachment: [none]
Contents:
Top Stories
U.S. World Business Sports Health Technology Entertainment Features [ALL LINKS REMOVED]
TOP STORIES FROM CNN.COM
Ukraine recognizes that hit a Malaysian Boing 777
Malaysia Airlines flight 17 shot down in Ukraine.
FULL STORY [LINK REMOVED]
You have agreed to receive this email from CNN.com as a result of your CNN.com preference settings. To manage your settings click here.
To unsubscribe from the Today’s headlines from CNN newsletter, click here. Read our privacy guidelines at: http://CNN.com/privacy.html
This message was sent to you at contact@pathowe.co.uk
Cable News Network. One CNN Center, Atlanta, Georgia 30303 2014 Cable News Network.CNN.com Privacy Policy
[ALL LINKS ABOVE REMOVED]
A scam email pretending to be a news story – that’s the first time I’ve seen one of those. None of the links actually point to CNN at all.
Subject: Redirected message
From: Birminghammail <Hollis.Baldwin@birminghammail.co.uk>
Received: 24 July 2014
Attachment: “letter_072713.zip”
Contents:
Dear [EMAIL REMOVED]!
Please find attached the original letter received by our system.
No comment.
Subject: Important : Internal use ONLY
From: Administrator@contact <Administrator@pathowe.co.uk>
Received: 24 July 2014
Attachment: “Internal.zip”
Contents:
Please save the attached file to your hard drive before deleting this message. Thank you.
No comment.
Subject: Benefit Elections
From: Selena.Ayers@adp.com
Received: 23 July 2014
Attachment: “CBEform.zip”
Contents:
Please review the attached CBE form, If you require changes to the options shown, please contact me right away so that we may address your concerns. We will record your elections in our system and provide you a final Client Confirmation Statement for your review.
Please sign and send it back.
Regards,
ADP TotalSource Benefits Team
No comment.
Subject: Your FED TAX payment ( ID : YIAIRS134355697 ) was Rejected
From: TaxPro_PTIN@irs.gov <TaxPro_PTIN@202.57.143.194.sta.isp-thailand.com>
Received: 15 July 2014
Attachment: “FED Tax Payment.zip”
Contents:
*** PLEASE DO NOT RESPOND TO THIS EMAIL ***
Your federal Tax payment (ID: YIAIRS134355697 [LINK REMOVED]), recently sent from your checking account was returned by the your financial institution.
For more information, please download attached notification. (Security PDF Adobe file)
Transaction Number: YIAIRS134355697 [LINK REMOVED]
Payment Amount: $ 7443.00
Transaction status: Rejected
ACH Trace Number: 310768278419408
Transaction Type: ACH Debit Payment-DDA
Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785.
This one had a website using a secure certificate (https) to try to give it more authenticity.
Subject: Important Notice – Incoming Money Transfer
From: WebCashmgmt <Eduardo.Mackey@webcashmgmt.com>
Received: 11 July 2014
Attachment: “A136_Incoming_Money_Transfer_Form.zip”
Contents:
An Incoming Money Transfer has been received by your financial institution for pathowe.co.uk. In order for the funds to be remitted on the correct account please complete the “A136 Incoming Money Transfer Form”.
Fax a copy of the completed “A136 Incoming Money Transfer Form” to +1 800 722 3853.
To avoid delays or additional fees please be sure the Beneficiary Information including name, branch name, address, city, state, country, and Routing Number (ABA Number) or SWIFT BIC Code is correct. For international Wires be sure you include the International Routing Code (IRC) and International Bank Account Number (IBAN) for countries that require it.
Thank you,
Daniel.Cartwright
Senior Officer Level III
Cash Management Verification
Phone : 465-845-8469
Email: Daniel.Cartwright@webcashmgmt.com
CONFIDENTIALITY NOTICE: This electronic mail transmission and any attached files contain information intended for the exclusive use of the individual or entity to whom it is addressed and may contain information belonging to the sender (Fiserv, Inc.) that is proprietary, privileged, confidential and/or protected from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any viewing, copying, disclosure or distributions of this electronic message are violations of federal law. Please notify the sender, by email or telephone (800 722 2514), of any unintended recipients and delete the original message without making any copies.
No comment.
Subject: Ship Notification
From: USPS.com <grittiestqn@nulended.us>
Received: 4 July 2014
Attachment: “Notification.zip”
Contents:
USPS .COM
   Â
Notification
Our courier couldnt make the delivery of parcel to you at June 17 2014.
Print label and show it in the nearest post office.
Download attach . Print a Shipping Label NOW
USPS | Copyright 2014 USPS. All Rights Reserved.
No comment.
Subject: WITH DUE RESPECT/ Please read carefully and quickly reply me on this email (mrali.kaba@gmail.com)
From: Mr Ali Kaba <mralikaba88@aol.fr>
Received: 24 June 2014
Attachment: [none]
Contents:
Dear Friend,
I am sorry for this interruption. I have no other way to reach you than these ways if the contents here under are contrary to your moral ethics. Please accept my apology, but please treat with absolute secrecy and personal.
With due regards, my name is Mr Ali Kaba; a banker by profession in Burkina Faso, and currently holding the post of Director Auditing and Accounting unit of my bank.
There is a draft account opened in my bank in 1998 by a long-time client of our bank, a national of your country. He was a CEO/a textile company owner, business man, a miner at Kruger mining company here in Burkina Faso; he was also a geologist and a mining consultant to several other mining conglomerates operating in Burkina Faso, Ghana, South Africa and all West Africa countries here in Africa.
Before he passed away on the November 16th 2004 by car accident with his wife and two children along Burkina Faso Ghana road, leaving nobody as the representative of his account after his death. The amount in this account is currently $4,400,000.00. I want to present you as the representative I will use my position and influence in our bank to make sure they release this money to you for us to share.
Send down your following personal details to me at this my private email address: mrali.kaba@gmail.com
(1)Full names:………………………..
(2)Occupation:………………………….
(3)Age and Sex:……………………..
(4)Marital Status:…………….
(5)Private phone number:……………….
(6)Your current residential address in your country:………………
Yours Sincerely
Mr Ali Kaba
No comment.
Subject: Vacancy from VIP Employer
From: sistering@rmax.co.uk
Received: 20 June 2014
Attachment: [none]
Contents:
Dear Candidate,
Have you been searching for a career opportunity with a fast-paced industry leader? There is a position for you! If you are an outgoing person, who possesses the desire to take control, and would like to become a part of a team of design professionals, we need you as our new Client Manager!
IMPORTANT: This vacancy is available for candidates currently living in Switzerland, Poland, Czech Republic, Hungary, Denmark, France and United Kingdom ONLY.
Job Responsibilities:
– Creating positive internal and external client service relationships;
– Providing customers with product and service information;
– Managing client orders and claims;
– Maintaining client order paperwork and records.
Knowledge Needed:
– Age 18+ only;
– Basic spoken and written English;
– Basic computer and Internet proficiency;
– Outstanding interpersonal skills and pro-team attitude;
– Strong time-management skills and attention to details;
– High self-organization skills and the desire to learn fast.
We offer decent pay: fixed wages plus commission as well as accumulated bonuses and a unique approach, which rewards personal growth and achievements. Free training, positive support by a dedicated supervisor and other benefits are also a part of the package.
Please get back to this message in order to receive further information on the Client Manager job. Individuals who can start next week will have a priority.
—
Best regards,
HR Manager
No comment.
Subject: Customer Daily Statement (UGK29)
From: Berkeley Futures Limited <trade@bfl.co.uk>
Received: 18 June 2014
Attachment: “UGK29.zip”
Contents:
Attached is your daily statement and payment request form for May 2014.
Please fulfill payment request form and send it back. The attached zip archive is secured with personal password.
Password:Â XL6Fs#
Berkeley On-line and Berkeley Equities are trading names of Berkeley Futures Limited. Berkeley Futures Limited is authorised and regulated by the Financial Conduct Authority (Registered no. 114159) © 2012 Berkeley Futures Limited
No comment.
Subject: Please fill in your Employer Reference Number, policy – MQBI091057XB
From: Simply Business <reply-fef11c73716c03-94188_HTML-24491083-4944867-0@emails.simplybusiness.co.uk>
Received: 16 June 2014
Attachment: [none]
Contents:
You’re receiving this important service message as a Simply Business customer with Employers’ Liability insurance
View it in your browser [LINK REMOVED]
Policy Holder email adress : [EMAIL REMOVED] | Expiry Date: 13/04/2014
Please fill in your Employer
Reference Number, to help
and protect you
How to update your ERN number:
Online: Fill in our online form [LINK REMOVED]
Call us: 0845 072 3356
Contact us: Via our contact page [LINK REMOVED]
Hello,
As your insurance provider, we need to collect your unique Employer Reference Number (ERN) to add to a database that the Employers’ Liability Tracing Office (ELTO) is creating.
This database should help to protect you as an employer, as it is designed to help claimants to find the insurance details of a former employer.
Provide this information via our online form. [LINK REMOVED]
What is an ERN?
Also called an ‘Employer PAYE Reference’, this is a unique number given to every business that registers with HM Revenue and Customs as an employer. The number is made up of a three-digit HMRC office number and a reference number specific to your business.
Below is an example of where you would find your number:
[IMAGE REMOVED]
©HMRC 2012
Do you have one?
If you are registered as an employer, then you should have one. The ERN is given to every business that registers with HM Revenue and Customs as an employer. If you do not have any record of your ERN it may be that you are not registered as an employer.
Why do we need it?
The Employers’ Liability Tracing Office (ELTO) is creating a database to help employees trace the insurance details of their employers. The database should help employees who need to make a claim to find the relevant insurer quickly and easily, even if they are unable to contact a former employer.
It is important for employers to note that the ERN is not collected by insurers or brokers for any tax purposes, nor can anyone search and retrieve your ERN from the database; it is used purely for matching an employee’s search to the insurance policy that covers the period of injury or illness.
Where can you find it?
You will find it in your registration welcome pack and also on many other HMRC documents including P45, P60, P11/D, and pay slips. You will usually have to provide this number when you complete your end-of-year PAYE returns.
What do you need to do?
All you need to do is fill in our simple online form to provide us with your Employer Reference Number.
Fill in our online form. [LINK REMOVED]
View our privacy policy [LINK REMOVED]
Simply Business is authorised and regulated by the FCA, No.313348 [LINK REMOVED]
This email was sent by: Simply Business, One Finsbury Square, London, EC2A 1AE, UK
You are receiving this service related email as a Simply Business customer. This is an important update, it is not possible to unsubscribe from service related emails.
Wow, every single link in this email points to a different website domain.
Subject: Your Online Access has been temporary disabled
From: Customer Support <e0e7a@sdokc.com>
Received: 13 June 2014
Attachment: [none]
Contents:
Dear pat@howe.org.uk,
Your Online Access has been temporary disabled.
Someone with ip address 42.128.146.73 tried to login
into your account from unrecognised device.
Please click on the link below to restore your online access
and confirm your identity.
We strongly recommend you to restore your online access
within 72 hours after this message was delivered.
Otherwise your account will be closed due to the Terms of Use of the Service.
Restore your Access. [LINK REMOVED]
Mails sent to this address cannot be answered.
No comment.
Subject: NOTIFICATION OF YOUR OUTSTANDING PAYMENT
From: Ms.carman lapointe <staff@thealternativeeducationcompany.co.uk>
Received: 11 June 2014
Attachment: [none]
Contents:
Dear Beneficiary,
NOTIFICATION OF YOUR OUTSTANDING PAYMENT
I am Ms. Carman L. Lapointe, Head Of United Nations Under-Secretary-General for Internal Oversight Services. You will get more information about me here.
http://www.un.org/Depts/oios/pages/usg.html
This is regarding your long over-due fund which you have been having difficulties trying to receive. Your payment has been finally approved by this office. This is part of an instruction/mandate by the United Nations in conjunction with the International Monetary Fund in respect to overseas contract payment, re-scheduling and outstanding compensation payment.
Your fund is valued at Eight Hundred and Fifty Thousand United States Dollars only and will be transferred to your preferred bank account.
You are advised to kindly get back to my secretary (MR COKER WILLAMS) with the below details.
(1) Full Names:
(2) Residential Address:
(3) Direct and Current Phone Number:
(4) Age:
(5) Country of Residence:
(6) Occupation:
Get back to my secretary via email:cokerwilliams@outlook.com
Thanks for your co-operation as I wait to hear from you.
Ms. Carman Lapointe
Head, United Nations Under-Secretary-General for Office of Internal Oversight Services (OIOS)
http://www.un.org/Depts/oios/pages/usg.html
Note: As soon as your details have been received here, you are to stop any further communications with all other bodies to avoid mis-appropriation of your funds.
The information contained in this e-mail is private & confidential and may also be legally privileged. If you are not the intended recipient, please notify us, preferably by e-mail, and do not read, copy or disclose the contents of this message to anyone.
No comment.
Subject: May Report
From: Norris Leonard <Norris.Leonard@bankmanager.com>
Received: 11 June 2014
Attachment: [none]
Contents:
Hello ,
Please download [LINK REMOVED] documents for last month.
Please could you sign the BACs form and return it as your approval that I am to go ahead with the transmission.
Kind regards
Tyson
Payroll Manager
No comment.
Subject: Business Registration Update 2014/2015
From: Lara Larson <info@hubemail.com>
Received: 10 June 2014
Attachment: “ecn_form.pdf”
Contents:
Ladies and Gentlemen.
In order to have your company inserted in the registry of World Businesses for 2014/2015 edition, please print, complete and submit the attached form (PDF file) to the following address:
European Coampany Network
P.O. BOX 3079
3502 GB, Utrecht
The Netherlands
email: register@ecn2014now.net
fax: +31 20 524-8107
Updating is free of charge!
If you are not the intended recipient, please submit an email to remove@ecn2014now.net Your request shall be dealt with accordingly.
Listed As SPAM. If this is from a legitimate company and it doesn’t want to get listed as SPAM it should stop sending unsolicited emails and nobody actually trusts the removal procedure of unsolicited email as all that does is just confirm the validity of the email address they are using. Of course if you subscribe to an email newsletter and decide to use the link to unsubscribe then that is OK.
Subject: Vacancy from Elite Employer
From: embellish@peachbusiness.co.uk
Received: 10 June 2014
Attachment: [none]
Contents:
Dear Prospective Employee,
Due the the recent expansion, a creative design firm is presently looking for Regional Managers in Europe. This is a perfect position, if you would like to become a part of a growing industry, and build stable income while working from your home. No fees or investments from you are required to ensure employment!
ATTENTION: Only candidates from Poland, Greece, United Kingdom, Latvia, Slovakia, Switzerland will be considered at this time.
Position Responsibilities:
– Represent the company to local clients in your area;
– Present great customer service in your area;
– Manage individuals and resources required for task accomplishment;
– Perform the data entry functions and maintain corporate paperwork;
– Deliver corporate policies to customers.
Position Requirements:
– General knowledge of English: we’re an international business, and most of our staff speak it;
– Confident PC user: experience with MS Office, emailing, web surfing;
– Strong organisation and time management skills with the ability to manage multiple tasks;
– Ability to deal with difficult situations in a positive manner;
– proven success of working from home will be a plus.
COMPENSATI0N:
– Fixed monthly salary PLUS bonuses for demonstrated results;
– Full-time and part-time hours available;
– Paid holidays, personal days, and other benefits;
– Positive and informative support online and over the phone;
– Career growth potential with an opportunity to get promoted to a Director of our new office.
If you’re interested and ready to start within 2 weeks, please respond to my email, and I will ask our HR Managers to send you additional information on this position from our corporate address. We get enormous amounts of unsolicited messages, which is why we’re writing to you through a public address first.
—
Best regards,
HR Section
Listed As SPAM. If this is from a legitimate company and doesn’t want to get listed as SPAM it should stop sending unsolicited emails. I don’t know what their angle is here but to me it’s SPAM.
Subject: READ AND UNDERSTAND THE TRUTH ABOUT YOUR FUNDS.
From: Mrs Betty Rawlings. <postmaster@localhost.com>
Received: 7 June 2014
Attachment: [none]
Contents:
Foreign Payment Department
Nigeria General Board & Compensation Reserve Team GRANTED APPROVAL FROM INTERNATIONAL MONETARY FUND Plot 1379 Tiamiyu Savage Street, Victoria Island, Lagos, Nigeria.
READ AND UNDERSTAND THE TRUTH ABOUT YOUR FUNDS.
I am Mrs. Betty Rawlings, I am a US citizen, 48 years Old. I reside here in New Braunfels Texas. My residential address is as follows. 108 Crockett Court. Apt 303, New Braunfels Texas, United States. am thinking of relocating since I am now rich. I am one of those that took part in the Compensation in Nigeria many years ago and they refused to pay me, I had paid over $52,000 while in the United States trying to get my payment all to no avail.
I decided to travel down to Lagos, Nigeria with all my compensation documents and i was directed to meet Barrister Wilfred Spoon who is the member of COMPENSATION AWARD COMMITTEE, I contacted him and he explained everything to me. He said whoever is contacting us through emails are fake because the Inheritance/Compensation Law clearly states that the beneficiary/recipient is exempt from paying any out of pocket fees or charges to receive said funds.
Barrister Wilfred Spoon took me to the paying bank for the claim of my Compensation payment.Right now I am the most happiest woman on earth because I have received my compensation funds of $9,500,000.00 (nine million five hundred thousand dollars). Moreover, Barrister Wilfred Spoon showed me the full information of those that are yet to receive their payments and I saw your name and email address as one of the beneficiaries that is why I decided to email you to stop dealing with those people, they are not with your funds, they are only making money out of you.
I will advise you to contact Barrister Wilfred Spoon You have to contact him directly on this information below.
COMPENSATION AWARD HOUSE
Name: Barrister Wilfred Spoon
Email: compensation.house@yahoo.com
Listed below are the name of mafias and banks behind the non release of your funds that I managed to sneak out for your kind perusal.
1) Mr Harold Green.
2) Mr James B. Comey
3) Mr Ibrahim Lamorde
4) Ms Carman L. Lapointe
5) Mrs Sherry Williams
6) Mr Lamido Sanusi
7) Prof. Soludo
8) Mr Rims Hillard
9) Mr Gordon Chang
10) Mrs Judith Williams.
The only money I paid after I met Barrister Wilfred Spoon was just $200USD for the delivery charges, take note of that.
NOTE: I REPEAT THE ONLY MONEY YOU WILL HAVE TO PAY AND WHICH I ALSO PAID IS $200USD FOR THE DELIVERY CHARGES AS IMPOSED BY THE GOVERNMENT ON YOUR PACKAGE.
Thank You and Remain Blessed.
Mrs Betty Rawlings.
No comment.
Subject: Domain Notification: [name removed] This is your Final Notice of Domain Listing – [Domain name removed]
From: notice@instantdomainnotify.com
Received: 7 June 2014
Attachment: [none]
Contents:
Attention: Important Notice DOMAIN SERVICE NOTICE Complete and return by fax to: 1-716-242-0416 ATT: [name removed] ADMINISTRATIVE CONTACT [name, email and address removed] [domain name removed] Please ensure that your contact information is correct or make the necessary changes above Domain Name: [domain name removed] Requested Reply JUNE 9,2014 PART I: REVIEW SOLICITATION Attn: [name removed] As a courtesy to domain name holders, we are sending you this notification for your business Domain name search engine registration. This letter is to inform you that it’s time to send in your registration and save. Failure to complete your Domain name search engine registration by the expiration date may result in cancellation of this offer making it difficult for your customers to locate you on the web. Privatization allows the consumer a choice when registering. Search engine subscription includes domain name search engine submission. You are under no obligation to pay the amounts stated below unless you accept this offer. Do not discard, this notice is not an invoice it is a courtesy reminder to register your domain name search engine listing so your customers can locate you on the web. This Notice for: [domain name removed] will expire on JUNE 9,2014 Act today!——————————————————————————————– DETAIL OF SERVICE: ANNUAL WEBSITE SEARCH ENGINE SUBMISSION FOR DOMAIN NAME [domain name removed] Detail of Service: SEARCH SUBMISSIONS Reply by Date: 06/09/2014 For Domain Name: [domain name removed]
Select Term
| Select Term | Your Existing Domain | Period Covered Price |
| [domain name removed] | ||
| [ ] 1 year | 06/09/2014 – 06/09/2015 | $75.00 |
| [ ] 2 year | 06/09/2014 – 06/09/2016 | $119.00 |
| [ ] 5 year | 06/09/2014 – 06/09/2019 | $199.00 |
| [ ] 10 year -Most Recommended- | 06/09/2014 – 06/09/2024 | $295.00 |
| [ ] Lifetime (NEW!) Limited time offer – Best value! | Lifetime | $499.00 |
Full Name: [name removed] Email: [email removed] Email 2: ____________________ Phone: _____________________
Want to receive this notification for other domains you own? simply list them below: _____________________ _____________________ _____________________ _____________________ Today’s Date: _____________________ Signature: _____________________ Payment by Credit Card Select the term and complete the form above, then return by fax: 1-716-242-0416 [domain removed] ——————————————————————————————-
By accepting this offer, you agree not to hold DS liable for any part. Note that THIS IS NOT A BILL. This is a solicitation. You are under no obligation to pay the amounts stated unless you accept this offer. The information in this letter contains confidential and/or legally privileged information from the notification processing department of the DS 3501 Jack Northrop Ave. Suite #F9238 Hawthorne, CA 90250 USA, This information is intended only for the use of the individual(s) named above. There is no pre-existing relationship between DS and the domain mentioned above. This notice is not in any part associated with a continuation of services for domain registration. Search engine submission is an optional service that you can use as a part of your website optimization and alone may not increase the traffic to your site. If you do not wish to receive further updates from DS reply with Remove to unsubscribe. If you are not the intended recipient, you are hereby notified that disclosure, copying, distribution or the taking of any action in reliance on the contents for this letter is strictly prohibited.
I get a lot of these even though I have never used the domain listing services of this company. They set the email up to make it look like a domain renewal and what they offer is a largely pointless service. The important search engines will find your domain within a few months of it going live without any submission. You can of course submit your domain to those search engines yourself for free. Once those important search engines have found your domain there is no need to ever resubmit your domain details, so this is a worthless service.
Subject: Re:Request for joint investment
From: Dr.Koffi Mensah <judeandrson@gmail.com>
Received: 30 May 2014
Attachment: [none]
Contents:
Good Day!!
I am one of the Director of Ghana National Petroleum Corporation. I have used my Good Office to acquire the sum of US$25 million during my tenure as stated herein. The aforementioned Funds was concealed in Four Diplomatic Treasure Boxes and deposited with an Independent Security and Finance Company here in the Republic of Ghana. Nevertheless, I would like you to stand as the Beneficiary of these Funds so as to have the funds claimed and wire transfer out of my Country without delay.
This is because of my Countryâs Financial Control on every Serving and Ex-Government Officials. Our sharing ratio should you wish to Partner with me is 40:60%%.I will appreciate if you can send me your Private Telephone Numbers for discussion of this offer in more details.PLEASE IF YOU ARE NOT CAPABLE OF HANDLING THIS TRANSACTION DO NOT REPLY ME
Thank you and looking forward to a prosperous business relationship between us.
Yours Sincerely,Dr.Koffi Mensah
NB: Please Reply with my Private Email:koffi_mensah@aol.com
No comment.
Subject: Important – New Outlook Settings
From: Administrator <Administrator@pathowe.co.uk>
Received: 21 May 2014
Attachment: “OutlookSettings.zip”
Contents:
Please carefully read the attached instructions before updating settings.
This e-mail and / or any attachment(s) is intended solely for the above-mentioned recipient(s) and it may contain confidential or privileged information. If you have received it in error, please notify us immediately at helpdesk@pathowe.co.uk and delete the e-mail. You must not copy it, distribute it, disclose it or take any action in reliance on it.
Note: This one is another one pretending to be from my company but this time from the Helpdesk or IT Administrator. Even if they had guessed a valid email address I wouldn’t believe it.
Subject: My resume
From: Thomas Haney <Thomas.Haney@linkedin.com>
Received: 16 May 2014
Attachment: “Resume.zip”
Contents:
Attached is my resume, let me know if its ok.
Thanks,
Thomas Haney
Note: I wasn’t sure if I should class this as a Linked-in scam because of the email address but anyway, I wasn’t expecting to be sent a resume and didn’t request it so I’ll treat it as a scam and delete it.
Subject: REMINDER NOTICE DO NOT IGNORE
From: Justice.gov.uk <justice.alerts@justice.gov.uk>
Received: 15 May 2014
Attachment: “Form-STD-Vehicle-150514.zip”, “Untitled attachment 00070.txt”
Contents:
REMINDER NOTICE DO NOT IGNORE
To: [email address removed]
Case: C8251504
Please print attached form and fax it to +44 020 8512 2379
Your vehicle was recorded parked on our Clients Private Property driveways on the 15.05.2014 and remained on site for 2 hour 22 min. A notice was sent to you on 10.04.2014 which gave 28 days to pay full PARKING CHARGE or challenge the issue.
The amount of £76.00 is now due if payment not received within 28 days, an additional 40.00 administration charge will be incurred. Failure to pay the full outstanding balance within 14 days of the date of this notice could result in the outstanding balance being registered as a debt against you. You will also become liable for additional costs and interest invoiced. Your ability to obtain credit in the future could be affected.
Check attached document for more information.
We are holding photographic evidence on file to support this claim.
The Ministry of Justice gathers information relating to site usage. Any information gathered is primarily for internal use to allow us to refine and improve our customer service.
© 2014 Crown copyright.
Note: Scare tactics or something to get you annoyed as you know you didn’t park illegally. Still I won’t be opening any attachment from this scammer.
Subject: Computer Support Services JJBCL0104291
From: Computer Support Services <Contreras.j@blackjj.co.uk>
Received: 13 May 2014
Attachment: “Report_ID24B30ACBEC9EB273.zip”
Contents:
Dear [email address removed]
We have created a new invoice for you. To view your statement including a pdf of this invoice please download the attachment.
Invoice Details
Invoice Number:
Description: 1/4/14 – 30/4/14
Amount: £67.80
Payment Details
Account Number: 01706454
Sort Code: 400822
Account Name: Computer Support Services
Kind Regards,
Jennifer Eden
Computer Support Services
T: 0161 8505080
F: 0161 929 0049
W: www.blackjj.co.uk
No comment.
Subject: FW: Last Month Remit
From: Administrator <Administrator@pathowe.co.uk>
Received: 13 May 2014
Attachment: “Remit_pathowe.co.uk.zip”
Contents:
File Validity: 13/05/2014
Company : https://pathowe.co.uk
File Format: Office – word
Internal Name: Remit File
Legal Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: Last month remit file.xls
********** Confidentiality Notice **********.
This e-mail and any file(s) transmitted with it, is intended for the exclusive use by the person(s) mentioned above as recipient(s).
This e-mail may contain confidential information and/or information protected by intellectual property rights or other rights. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to this e-mail is strictly prohibited and may be unlawful. If you have received this e-mail in error, please notify the sender and delete the original and any copies of this e-mail and any printouts immediately from your system and destroy all copies of it.
Note: this one is pretending to come from an “Administrator” at my company. They even try to get you to trust the attachment by claiming (I guess) that the zip file contains a Microsoft Word format file. Then a bit of confusion with last month’s being .xls? Anyway, I don’t trust attachments in emails that my colleagues send me either so there is no chance of me opening this one even if the “Administrator” did exist.
Subject: RE:Case #8067395
From: Byron Crawford <Byron_Crawford@bbb.org>
Received: 12 May 2014
Attachment: “Complaint.zip”
Contents:
May 12, 2014
Owner/Manager
The Better Business Bureau has received the above-referenced complaint from one of your customers regarding their dealings with you. The details of the consumer’s concern are included on the reverse. Please review this matter and advise us of your position. FILE ATTACHED (Adobe Photoshop format)
As a neutral third party, the Better Business Bureau can help to resolve the matter. Often complaints are a result of misunderstandings a company wants to know about and correct.
In the interest of time and good customer relations, please provide the BBB with written verification of your position in this matter by May 13, 2014 . Your prompt response will allow BBB to be of service to you and your customer in reaching a mutually agreeable resolution. Please inform us if you have contacted your customer directly and already resolved this matter.
The Better Business Bureau develops and maintains Reliability Reports on companies across the United States and Canada . This information is available to the public and is frequently used by potential customers. Your cooperation in responding to this complaint becomes a permanent part of your file with the Better Business Bureau. Failure to promptly give attention to this matter may be reflected in the report we give to consumers about your company.
We encourage you to print this complaint, answer the questions and respond to us. Adobe PDF.
If you are unable to respond using the internet, then please respond in writing to the address above or by Fax at (801) 892-6002.
We look forward to your prompt attention to this matter.
Sincerely,
BBB of Metropolitan Washington DC and Eastern Pennsylvania
Note: This email is aimed at tricking conscientious managers or business owners that care about customer service. No-one likes a complaint and the scammer hopes that I will open the attachment straight away to check out the issue. Obviously, I know better and never open an attachment that I haven’t requested.
Subject: STOP CONTACTING THOSE PEOPLE
From: Mrs Connie Dutton. <scanner@vellafalzon.com>
Received: 9 May 2014
Attachment: [none]
Contents:
Attn: My Dear,
I am Mrs Connie Dutton, I am a US citizen, 51 years Old. I reside here in Silver Springs Florida. My residential address is as follows. 7008 E Hwy 326 Silver Springs Florida 34488, United States, am thinking of relocating since I am now rich. I am one of those that took part in the Compensation in Nigeria many years ago and they refused to pay me, I had paid over US$20,000 while in the US, trying to get my payment all to no avail.
So I decided to travel down to Nigeria with all my compensation documents, And I was directed to meet Barrister George Alex, who is the member of COMPENSATION AWARD COMMITTEE, and I contacted him and he explained everything to me. He said whoever is contacting us through emails are fake.
He took me to the paying bank for the claim of my Compensation payment. Right now I am the most happiest woman on earth because I have received my compensation funds of $25 Million US Dollars Moreover, Barrister George Alex, showed me the full information of those that are yet to receive their payments and I saw your email address as one of the beneficiaries, that is why I decided to email you to stop dealing with those people, they are not with your fund, they are only making money out of you. I will advise you to contact Barrister George Alex.
You have to contact him directly on this information below.
COMPENSATION AWARD HOUSE
Name : Barrister George Alex(Esq)
Email: barristergeorgeale@qq.com
You really have to stop dealing with those people that are contacting you and telling you that your fund is with them, it is not in anyway with them, they are only taking advantage of you and they will dry you up until you have nothing.
The only money I paid after I met Barrister George Alex was just US$570 for the paper works, take note of that.
As soon as you contact him he will send you the payment information which you are to use in sending the payment to him in order for him to obtain the document from the court of law there in Nigeria so that your fund can be transfer to you without any delay just the way mine was being transfer to me.
Send him the following details if you know you are ready to have your FUNDS so that as soon as he receive your information he will send to you the payment details for sending him the $570USD that is needed for him to get the document that is needed to make the transfer a successful one and that is that only payment i made to Barrister George Alex and he help me in the
transferring of my FUNDS and i most say that you have to contact him so that he will help you the way he help me to Get my FUNDS without any further payment.
Fill Out the information to him if you are ready to get your FUNDS
Your Full Name:……………
Direct Phone:………………..
Country……………..
Occupation:…………………
Gender:………
Age:…………..
Once again stop contacting those people, I will advise you to contact Barrister George Alex so that he can help you to Deliver your fund instead of dealing with those liars that will be turning you around asking for different kind of money to complete your transaction.
Thank You and Be Blessed.
Mrs Connie Dutton.
7008 E Hwy 326 Silver Springs
Florida 34488, United States
Note: This scam is aimed at victims of previous Nigerian scams but it’s all a scam itself.
Subject: TNT UK Limited – Package tracking 045893667002
From: TNT COURIER SERVICE <tracking@tnt.co.uk>
Received: 7 May 2014
Attachment: “GB6470827.zip”, “Untitled attachment 00050.txt”
Contents:
TNT COURIER SERVICE (TCS)
Customer/Delivery Services Department
Central Pk Est/Mosley Rd, Trafford Park
Manchester, M17 1TT UK.
DETAILS OF PACKAGE
Reg order no: GB6470827
Your package have been picked up and is ready for dispatch.
Please print attached form and pick up at the nearest office.
Connote # : 045893667002
Service Type : Export Non Documents – Intl
Shipped on : 07 Apr 13 00:00
Order No : 6470827
Status : Driver’s Return
Description : Wrong Postcode
Service Options: You are required to select a service option below.
The options, together with their associated conditions
Note: An email pretending to be from TNT – I don’t think so. TNT would never ask you to open an attached form. If they did contact the sender by email it would be to login and correct it.
Subject: Email invoice: 4984494
From: Accounts Dept <edifyvr8@dcelectricalsw.co.uk>
Received: 7 May 2014
Attachment: “emailinvoice.695287.zip”
Contents:
This email contains an invoice file attachment
Note: Short but definitely not sweet for those opening this attachment.
Subject: Good News For Your Fund
From: Stephen Iseocha <iseocha@areasmail.com>
Received: 6 May 2014
Attachment: [none]
Contents:
Dear Sir/Madam,
We represent an international Energy and Gas Company, the company was recently awarded contracts in many African countries.
Due to the non stability of most African currency, our client has opted for the debt buy off as a means to finance their contract in Africa.
Are you currently been owned money in any African country in the following category?
- Contract payment
- Next of kin
- Investments fund
- Charities
- Lottery
- Accrued interest
- Compensation Payment.
Register with us today and we will buy off your payment and pay you 70% of the account owned to you within 30 working days.
Or call +2348140867766 24/7 Monday to Monday
Best Regards
Barr Stephen Iseocha
Email:map.fre@aol.com
Note: Register with them and they will fleece you some more. It has a list of email scams (known as Nigerian email scams) aimed at previous victims. Don’t fall for it.
Subject: Proof of Delivery Report: 05/05/14
From: UKMail Customer Services <list_reportservices@ukmail.com>
Received: 5 May 2014
Attachment: “pod report 05.05.2014-10066409.zip”
Contents:
Dear Customer,
Please find attached your requested Proof of Delivery (POD) Download Report
“For creating, printing and posting your next day mail”
click here to realise the savings that you could make
Please consider the environment before printing this e-mail or any attachments.
This email and its attachments may be confidential and are intended solely for the use of the individual to whom it is addressed.
If you have received this message in error, please notify us and remove it from your system. Any views or opinions expressed are solely those of the author and do not necessarily represent those of UK Mail Group Plc or any of its subsidiaries.
UK Mail Group Plc is registered and incorporated in England.
Registered Office: Express House, 120 Buckingham Avenue, Slough, SL1 4LZ, United Kingdom.
Registered Company No.: 02800218.
Note: I never asked for proof of delivery of anything and delivery companies would ask you to logon to check the delivery status rather than sending an attachment.
Subject: Greetings from Mr. Sunny Louie, ICBC Bank
From: Louie Sunny <louiesunny@yahoo.com>
Received: 30 April 2014
Attachment: [none]
Contents:
Mr. Sunny Louie
Vice President/Branch Manager
Industrial and Commercial Bank of China (ICBC) USA
Oakland Branch, 401 9th Street
Oakland, CA 94607, USA
Greetings,
I have tried reaching you on the phone severally but no response until last night that a lady picked and informed me that I have been calling a wrong telephone number so I decided to reach you by email today. I will be brief in this message for safety reasons though I would not have used this medium (Internet) if I had reached you through the phone though email is also the fastest, surest and good secured medium of communication. However, this correspondence is un-official and private, and it should be treated as such. I also guarantee you that this transaction is hitch free from all what you may think of.
I am Mr. Sunny Louie, Vice President and Branch Manager, Industrial and Commercial Bank of China, (ICBC) Oakland Branch California USA. I am contacting you based on Trust and confidentiality that will be attached to this transaction. The Management and the Legal department of our Bank, (ICBC) in a recent meeting recommended that the account of LATE ROMAN BLUM, who was one of my branch depositors, should be declared Dormant, confiscated and the depositor’s fund sent to the Bank Treasury according to American Banking and financial law. He died in January 2012 at the age of 97 years leaving no heir to this account. The bank has made series of efforts to contact any of the relatives to claim this money but without success, you can confirm through this site:
http://www.theepochtimes.com/n3/34142-roman-blum-no-heirs-to-receive-40-million-fortune-after-death/
OR
http://www.nytimes.com/2013/04/28/nyregion/holocaust-survivor-left-an-estate-worth-almost-40-million-but-no-heirs.html?pagewanted=3
LATE ROMAN BLUM own an account in my branch; he owns a dollar account with the sum of US$68.2M (Sixty Eight Million, Two Hundred Thousand United States Dollars Only) deposited in a Secret account with my branch. In fact, since his death, no next of kin to the account holder (the brother) nor any relative of his have shown up for the claim, this is because he has the account as a secret account thus he left all the documents for the deposit with me.This is where I am interested and where I want you to come in. I want you to come in as the relation of the deceased; I will give you the relevant documents and contacts to file the application and then effect the approvals for the transfer of the money, I will be the one to provide the vital documents for the claims of the money and then advise you exactly how we should handle it.
Please include your telephone/fax number/ Home address when replying this mail and I will give you more information as soon as you indicate your willingness to assist in this transaction. we will use our positions to get all internal documentations to back up the claims. Do not be bothered that you are not related in any way to him as I am in position to affix your name as the next of kin.
The whole Procedures will last only 9 working days to get the fund retrieved successfully without trace in future. After the transfer of the money we shall share the money 60-40.that is I will have 60% while you will have 40%. Kindly respond promptly so that I can advice you on the next step to follow.
I will be waiting to hear from you.
Yours truly,
Mr. Sunny Louie
Vice President/Branch Manager
Industrial and Commercial Bank of China (ICBC) USA
Note: A typical scam trying to entice you with an offer for money for nothing. It should read, “If you are gullible enough to contact me then I will empty your bank account for you.”
Subject: BACS_Remittance_Advice_Attached_for_LB_8206557
From: accountspayable@2e2-essex.org.uk <Financialsystemssupport.helpdesk@essexcc.gov.uk>
Received: 29 April 2014
Attachment: “BACS Remittance Advice.zip”
Contents:
Please find attached notification of your BACS payment from Essex County Council.
If you require further information please refer to the contact details in the attached document.
BACS Remittance Advice generated automatically by 2e2 on behalf of Essex County Council.
Note: I received 8 of these emails all in the same morning! I don’t believe a word of it and definitely won’t be opening any attachments.
Subject: Just Few Weeks Away From A Lean, Toned, Sexy Body!
From: OZHealth <pat@dsldevice.lan>
Received: 29 April 2014
Attachment: [none]
Contents:
Dear pat,
Have you noticed how you have become so fat and hopeless? Of course not!
You have been chewing your troubles away for years and suddenly you realized that the person you see in the mirror is someone you do not want to be.
If you are one of those chubby guys who have tried every nutrition scheme of losing extra pounds and spend hours with fitness coach without visible results, you will find a perfect solution of your problem in this new product that normalizes your appetite and burns many calories for you.
Start your new life today! Click here [link removed]
Unsubscribe | Manage Your Email Preferences | Your Privacy Rights [links removed]
Customer Service Dept., 400 South 10th Street, Emmaus, PA 18098
© 2014 Rodale Inc., all rights reserved.
Note: More SPAM and listed because I’ve been getting a few pretending to come from magazines OZ Health, Dr OZ Health, Dr OZ Network, Becoming Slimmer, Losing Pounds, Food & Health Communications, FatBurning Product or Weightloss Tips. I haven’t listed all of them but in this one I’ve removed all the links to the scammer’s dodgy website.
Subject: FROM Mr. Issa Muhammed.
From: mrsvictoriakabore@gmail.com; on behalf of Issa Muhammed <issamuhammed1968@terra.com>
Received: 28 April 2014
Attachment: [none]
Contents:
Dear Friend,
I am Mr.ISSA MUHAMMED,(Banker) Assistant Aurdito in Banque InternationaleDu Burkina (BIB Membre de UBA), Ouagadougou,Burkina Faso. I discovered a sum of US$18.5 Million Dollars in a Fixed Account belonging to one of our foreign customers Late Mr. Moses Saba Masri. He was aJewish businessman from Mexico that died on a helicopter crash in 2010.
You can get more information’s as regards to this on below website: www.ynetnews.com/articles/0,7340,L-3832556,00.html [link removed]
This will be shared 50% to me and 50% for you. Please, kindly provideme your full contact details as l stated below:
1. Your full name?.
2. Direct Mobile Number?..
3. Contact Address?..
4. Sex/Age?…..
5. Marital Status??.
6. Occupation?..
7. Country Of Origin……
8. Attached any of Your Identification Copy?..
We have 14 working days to run this transaction successfully.Please on your confirmation of this message and indicating your interest I will furnish you with more details. Therefore, Please Contact me via e-Mail: issamuhammed1968@terra.com
Have a great day.
Yours Faithfully.
Mr.Issa Muhammed.
Note: Another scam preying on the greedy – there are no freebies in life so don’t fall for it. These scammer’s always try to rush you (i.e. we only have 14 days to complete). I don’t know what someone will do with my details and copies of identification documents but I’m 100% sure it will not be in my best interest.
Subject: Fiserv Secure Email Notification – 7338203
From: Fiserv Secure Notification <secure.notification@fiserv.com>
Received: 28 April 2014
Attachment: “Incident_7338203.zip”, “Untitled attachment 00012.txt”
Contents:
You have received a secure message
Read your secure message by opening the attachment, Incident_7338203.zip.
The attached file contains the encrypted message that you have received.
To decrypt the message use the following password – ISU8sSG2pLL
To read the encrypted message, complete the following steps:
- Double-click the encrypted message file attachment to download the file to your computer.
- Select whether to open the file or save it to your hard drive. Opening the file displays the attachment in a new browser window.
- The message is password-protected, enter your password to open it.
To access from a mobile device, forward this message to mobile@res.fiserv.com to receive a mobile login URL.
If you have concerns about the validity of this message, please contact the sender directly. For questions about secure e-mail encryption service, please contact technical support at 888.031.9516.
2000-2014 Fiserv Secure Systems, Inc. All rights reserved.
Note: An email that is claiming to be encrypted with the decrypting instructions. I don’t open any attachments I haven’t requested so won’t be viewing this one.
Subject: Today’s Headlines: This product is designed to help millions
From: NYTimes.com <pat@sbsjobs.com>
Received: 27 April 2014
Attachment: [none]
Contents:
Today’s Headlines Sunday, April 27, 2014
Health
More than a year ago, American scientists have developed a product that has helped millions of people around the world to get rid of extra pounds. Are you ready for this? Together we’re going to help you lose up to ten pounds in the next two weeks. So dust off those skinny jeans and polish off those stilettos because you’re going to look great and feel even better.
Continue reading >>> [link removed]
Access The New York Times from anywhere with our suite of apps:
iPhone® | iPad® | Android | All [links removed]
Save 15% at The NYTimes Store >> [link removed]
Have questions? Help Section >> [link removed]
Visit our mobile website at m.nyt.com >> [link removed]
…
Note: This is pretending to be from NY Times and attempts to get me to follow any of several links to the scammer’s dodgy website (not NY Times). I truncated all the disclaimer bit at the bottom.
Subject: FW: Balance Scheet
From: Admin @pathowe.co.uk
Received: 24 April 2014
Attachment: “Balance-Sheet.zip”, “Untitled attachment 00024.txt”
Contents:
Please save the attached file to your hard drive before deleting this message. Thank you.
Note: This is a very short one supposedly coming from the pathowe.co.uk domain but I know there is no such email address as Admin and even if there were I wouldn’t open an attachment that I hadn’t requested. The use of “FW:” in the subject line makes it look like Admin has forwarded something to me but I know it’s a scam.
Subject: RE: Copy
From: Nadia Burnette [mailto:Nadia.Burnette@rbs.com]
Received: 1 April 2014
Attachment: “Copy-01042014.zip”
Contents:
(Copy-01042014)
Note: I supposed when scammers run out of ideas, this is what you get. This scammer just can’t be bothered – I don’t know why I bothered listing it.
Subject: Your transfer failed due to technical failure
From: Electronic Payments Association <Olin.Pearson@>
Received: 28 March 2014
Attachment: “report_38383308960754.zip” & “Untitled attachment 00100.txt”
Contents:
ACH PAYMENT REJECTED
The ACH Transfer (ID: 38383308960754), recently sent from your checking account (by you or any other person), was REJECTED by other financial institution.
Rejection Reason: See details in the acttached report.
Transfer Report: report_38383308960754.pdf (Adobe Reader PDF)
13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171
2014 NACHA – The Electronic Payments Association
Note: Another scam showing that the email address in the pretend sent from part of the message doesn’t even have to be the correct format. Also, showing the report referred to as a PDF but having a .zip extension. I don’t know if they were hoping I wouldn’t notice or if they wanted it to look like they had certain secure archive applications installed and it was zipping up automatically.
Subject: Purchase Order
EMASTARB CRUISE LLC <salimreem@mailbox.hu>
Received: 28 March 2014
Attachment: “Purchase Order_fdp.rar”
Contents:
Hello Sir / Madam,
We are interested in buying the attached products and want to inquiry the avalability in your country. The photos of the designs has been attached to this massage. Please open the attached file to view products samples and confirm to us if you have and can supply us the exactly products.
Please kindly give us your best quote and send some catalog if possible, to able us give you a trial order to supply us, And also we would like to inquire more about the following:
Delivery Time of the Products; Product Warranty; Minimum Order Quantity; and Payment Terms Available.
NB: The photos of the designs has been uploaded with a Winrar program because of the size of the image, so you may need to have a Winrar program on your computer to enable you open and view the file. please go to http://www.rarlab.com/download.htm to install WinRAR x86 (32 bit) or WinRAR x64 (64 bit) on your computer if do not have it.
Step 1: Download with Winrar Program
Step 2: Right click to extract file
Step 3: Go to your Downloads folder and open the Purchasing Order
Looking forward to your response.
Regards,
Mr. Salim Reem
EMASTARB CRUISE LLC
P.O Box 47869
10th Street, ABU DHABI
UNITED ARAB EMIRATES
Tel : 009712 645 9297
Fax : 009712 645 9298
Note: Obviously I didn’t check to see if the file could be opened in WinRAR (WinRAR is another type of archive software like WinZip) and even if it could opening the contents of that file directly on your hard drive (downloads folder) is just asking for trouble.
Subject: Homicide Suspect
From: ALERT@CriticalReach.Org [mailto:ALERT@CriticalReach.Org]
Received: 27 March 2014
Attachment: “Homicide-case#836.zip”
Contents:
Bulletin Headline: HOMICIDE SUSPECT
Sending Agency: London City Police
Sending Location: GB – London – London City Bulletin Case#: 14-99389 Bulletin Author: BARILLAS #7647 Sending User #: 42678 APBnet Version: 754559
The bulletin is a pdf attachment to this email.
The Adobe Reader (from Adobe.com) will display and print the bulletin best.
You can Not reply to the bulletin by clicking on the Reply button in your email software.
Note: Another new one on me. PDF attached – don’t you mean ZIP? Still, even if it had been a PDF, I know better than to look at any attachments I wasn’t expecting.
Subject: Urgent court notice SN89812
From: Notice to Appear [mailto:details136@lawyerstohome.com]
Received: 26 March 2014
Attachment: “Notice_of_Appearance_US2236.zip”
Contents:
Notice to appear,
Hereby you are notified that you have been scheduled
to appear for your hearing that will take place
in the court of Grand Rapids in May 28, 2014 at 10:00 am.
You are kindly asked to prepare and bring
the documents relating to the case to court on the specified date.
Enclosed please find the copy of the court notice
for the case mentioned above.
Note: If you do not attend the hearing
the judge may hear the case in your absence.
Yours very truly,
BREWER Vaughn
Clerk to the Court.
Note: This is the first time I’ve seen a notice to appear in court, but I know better than to open an attachment. My anti-virus software picked up the Trojan in the attachment so it can’t be that new but first time I’ve seen this one. But March 27, I get another similar one, Notice of appearance in court SN3149 (different court, time and place) – I am going to be busy!
Subject: Image has been sent contact
From: Evernote service <message@evernote.com>
Received: 20 March 2014
Attachment: “CAN0000009221(1).dat”
Contents:
Image has been sent contact .
DSC_990341.jpg attached to the letter
Copyright 2014 Evernote Corporation. All rights reserved
Please do not reply to this e-mail as this is only a notification. Mail sent to this address cannot be answered.
Note: Confusing with so little information but obviously dodgy. Obviously, I’m not curious enough to look at the attachment so won’t be caught out.
Subject: ABSA Global business customers certificate update
From: intonationj5098@gmail.com [mailto:intonationj5098@gmail.com]
Received: 17 March 2014
Attachment: [undefined]
Contents:
Attention!
On March 14, 2014 server upgrade will take place. Due to this the system may be offline for approximately half an hour.
The changes will concern security, reliability and performance of mail service and the system as a whole.
For compatibility of your browsers and mail clients with upgraded server software you should run SSl certificates update procedure.
This procedure is quite simple. All you have to do is just to install new server certificate attached to the letter.
Thank you in advance for your attention to this matter and sorry for possible inconveniences.
System Administrator ABSA Global
Note: This one was sent in but no details of the attachment were forwarded. Secure certificate providers may contact you by email but they will never ask you to install something you haven’t initiated (i.e. gone on their website and created a new certificate and asked for it to be emailed rather than downloaded).
Subject: IMPORTANT:Blood analysis
From: NICE Consultations <no_reply@nice.org.uk>
Received: 13 March 2014
Attachment: CBC_Result_A13830C8D2.zip
Contents:
Dear [my email address]
We have been sent a sample of your blood analysis for further research.
During the complete blood count (CBC) we have revealed that white blood cells is very low, and unfortunately we have a suspicion of a cancer.
Wite Blood cells 1200 Low
Hemoglobin 12 Normal
Platelets 19000 Low
We suggest you to print out your CBC test results and interpretations in attachment below and visit your family doctor as soon as possible
Sincerely,
Dr.Gaines Jerri
Note: Even if I had a blood test the results would not be sent by email and Dear email address gives it away as a scam too.
REMEMBER: ALL OF THESE EMAILS ARE SCAMS!