|
419 Scam Example: "UK NATIONAL LOTTERY / LLOYDS BANK PLC"
"UK NATIONAL LOTTERY / LLOYDS BANK PLC" are abused as fake labels used by a gang in Nigeria for a fake lottery fraud (advance fee fraud, "419"). The UK National Lottery does not award prizes by email address to people who never bought a ticket. Lloyds Bank Plc does not act as a "claims agent" for the real UK National Lottery. The objective of the scam is to get victims to wire money to the criminalsm, hoping to receive the promised but non-existent lottery prize at the end. Please send us replies by "claims agents", especially money demands and payment instructions, we will publish them here. Please report email addresses of "claims agents" and any other email addresses used in this scam to the free webmail providers (see abuse contact list).
Example of "UK NATIONAL LOTTERY" scam email: UK NATIONAL LOTTERY Support Center Bevan House 51 Bevan Avenue Conwy LL28 5AF United Kingdom FROM: THE DESK OF THE PROMOTIONS MANAGER, INTERNATIONAL PROMOTION/PRIZE AWARD DEPARTMENT, REF: UKNL/26510460037/05 BATCH: 24/00319/IPD ATTENTION: Sir/Madam RE/AWARD NOTIFICATION: FINAL NOTICE We are pleased to inform you of the announcement Today, 2nd May 2005, of winners of the UK NATIONAL LOTTERY, THE UNITED KINGDOM INTERNATIONAL PROGRAMS held on 25th April 2005 in Croydon,London. You email address was attached to ticket number 023-0148-790-459, with serial number 5063-11 drew The lucky numbers 43-11-44-37-10-43, and consequently Won you the lottery in the 2nd category. You have therefore been approved for a lump sum pay Of 500,000.00 British Pounds(GBP) in cash credited to file REF NO. UKNL/26510460037/05. This is from total prize money Of 2,000,000.00 British Pounds(GBP) shared among the four International winners in this category. All participants were selected randomly from World Wide Website through computer draw system and extracted from over 100,000 companies as part of International Promotions Program, which is conducted annually. Please note that your lucky winning number falls within our European booklet representative office in Europe as indicated in your play coupon. In view of this, your 500,000.00 British Pounds(GBP) dollars would be released to you by our preferred payment center in London. Our agent will immediately commence the process to facilitate the Release of your funds as soon as you contact him. For security reasons, you are advised to keep your winning information confidential till your claims is processed and your money remitted to you in whatever manner you deem fit to claim your prize. This is part of our precautionary measure to avoid double claiming and unwarranted abuse of this program by some unscrupulous elements. Please be warned. This is part of our security protocol to avoid Double claiming or unscrupulous acts by participants Of this program. To file for your claim, please contact our fiduciary Agent; Lloyds TSB Bank PLC #195 Edgware Road, London W2 1EY United Kingdom. Te: +447031948162 Fax: 443089876192 www.lloydstsb.com email: paulsmith1@financesource.com Agent officier in charge...Mr.Paul Smith. UK NATIONAL LOTTERY For due processing and remittance of your prize Money, please remember to quote your Reference and batch numbers in every one of your Correspondences with your agent. Remember, all prize money must be claimed not later Than 25th June 2005. After this date, all funds will Be returned as unclaimed. Furthermore, should there be any Change of your address; do inform your claims agent As soon as possible. Congratulations again from all our staff and thank You for being part of our promotional lottery program. Sincerely, Dr Paul White Zonal Co-ordinator www.national-lottery.com Here are mail headers: Received: from 81.199.108.18 by by17fd.bay17.hotmail.msn.com with HTTP; Mon, 02 May 2005 21:13:15 GMT X-Originating-IP: [81.199.108.18] X-Originating-Email: [uklotto212009@hotmail.com] X-Sender: uklotto212009@hotmail.com From: "promotions manager" <uklotto212009@hotmail.com> Subject: WINNING NOTICE! Date: Mon, 02 May 2005 13:13:15 -0800
WHOIS details for sending network (IP 81.199.108.18):
inetnum: 81.199.108.0 - 81.199.111.255
netname: CIDR-INTERCELLULAR-1
descr: Intercellular Nigeria Ltd
country: NG
admin-c: YA95-RIPE
tech-c: YA95-RIPE
status: ASSIGNED PA
mnt-by: AS12491-MNT
source: RIPE # Filtered
person: Yakubu Adamu
address: 5th Floor, UBA House 57
address: Marina, Lagos
address: Nigeria
phone: +234 14704387
fax-no: +234 12643014
e-mail: akintolad@intercellular-ng.com
e-mail: adamuy@intercellular-ng.com
nic-hdl: YA95-RIPE
source: RIPE # Filtered
British Lottery International (Rex Mcarthy) In this lottery scam victims are told they won a lottery prize, then they need to pay money before the prize can be paid and finally they receive an offer of a loan to cover the payment. This loan is extended in the form(fake) checks. The check bounce after it has been deposited and funds withdrawn against it. The victim will end up owing the bank $20,000 which by that time are already in the hands of the criminals. The check fraud ring appears to operate from Canada. Ref. Number: BTL/491OXI/04 Message headers: Received: from [192.168.70.228] by ims1d.cp.tin.it with HTTP; Sat, 9 Jul 2005 13:54:42 +0200 Date: Sat, 9 Jul 2005 13:54:42 +0200 Message-ID: <4293E4EB0016D7CD@ims1d.cp.tin.it> From: "BRITISH INTERNATIONAL LOTTERY ( CO-COORDINATOR)" <lothrey4winners@virgilio.it> Subject: CONGRATULATION YOU WON MIME-Version: 1.0 Content-Type: text/plain; charset="ISO-8859-15" Content-Transfer-Encoding: quoted-printable X-Originating-IP: 213.185.125.98 Loan offer: BRITISH LOTTERY INTERNATIONAL Message headers: Received: from [213.185.125.98] by web42102.mail.yahoo.com via HTTP; Thu, 07 Jul 2005 02:37:29 PDT Date: Thu, 7 Jul 2005 02:37:29 -0700 (PDT) From: British International Lottery <rex2mcarthy@yahoo.com> Subject: Contact financier.
WHOIS details for sending network (IP 213.185.125.98):
inetnum: 213.185.96.0 - 213.185.127.255
org: ORG-IA67-RIPE
netname: UK-INTELSAT-20021129
descr: PROVIDER
descr: Intelsat
country: GB
admin-c: IRA4-RIPE
tech-c: IRTC1-RIPE
tech-c: CQ37-RIPE
tech-c: AT1875-RIPE
status: ALLOCATED PA
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: AS22351-MNT
mnt-routes: AS22351-MNT
source: RIPE # Filtered
organisation: ORG-IA67-RIPE
org-name: Intelsat
org-type: LIR
address: Intelsat
address: Chiswick Park, Building 3
address: 566 Chiswick High Road
address: London
address: W45YA
address: United Kingdom
phone: +44 208 899 6035
phone: +1 202 944 6792
phone: +1 202 944 6958
fax-no: +1 202 944 6955
e-mail: augustin.traore@intelsat.com
e-mail: chuan.qin@intelsat.com
admin-c: AT1875-RIPE
admin-c: IRA4-RIPE
admin-c: IRTC1-RIPE
admin-c: CQ37-RIPE
mnt-ref: AS22351-MNT
mnt-ref: RIPE-NCC-HM-MNT
mnt-by: RIPE-NCC-HM-MNT
source: RIPE # Filtered
role: Intelsat Ripe Admin
address: Intelsat Global Service Corporation
address: 3400 International Drive, NW
address: Washington, DC
address: 20008
address: USA
e-mail: noc@intelsat.com
e-mail: bgp@Intelsat.com
admin-c: AT1875-RIPE
tech-c: CQ37-RIPE
nic-hdl: IRA4-RIPE
remarks:
remarks: *************************************************************
remarks: * *
remarks: * This is a generic ROLE object for an Intelsat Admin *
remarks: * Contact person for RIPE matters. Inquiries about RIPE *
remarks: * issues should be directed to the NOC or BGP email-boxes, *
remarks: * which will forward them appropriately. For operational *
remarks: * issues, send an Email or call the Intelsat NOC at: *
remarks: * *
remarks: * noc@intelsat.com *
remarks: * +1 202 944 6792 *
remarks: * *
remarks: * For BGP related issues, send an email to: *
remarks: * *
remarks: * bgp@intelsat.com *
remarks: * *
remarks: * For issues of network abuse, including spam, please send *
remarks: * email to Intelsat at: *
remarks: * *
remarks: * abuse@intelsat.com *
remarks: * *
remarks: *************************************************************
remarks:
source: RIPE # Filtered
role: Intelsat RIPE Technical Contact
address: Intelsat Global Service Corporation
address: 3400 International Drive, NW
address: Washington, DC
address: 20008
address: USA
e-mail: abuse@intelsat.com
e-mail: noc@intelsat.com
e-mail: bgp@Intelsat.com
e-mail: Chuan.Qin@Intelsat.com
e-mail: Augustin.Traore@Intelsat.com
admin-c: IRA4-RIPE
tech-c: CQ37-RIPE
nic-hdl: IRTC1-RIPE
remarks:
remarks: *************************************************************
remarks: * *
remarks: * This is a generic ROLE object for an Intelsat Technical *
remarks: * Contact person for RIPE matters. Inquiries about RIPE *
remarks: * issues should be directed to the NOC or BGP email-boxes, *
remarks: * which will forward them appropriately. For operational *
remarks: * issues, send an Email or call the Intelsat NOC at: *
remarks: * *
remarks: * noc@intelsat.com *
remarks: * +1 202 944 6792 *
remarks: * *
remarks: * For BGP related issues, send an email to: *
remarks: * *
remarks: * bgp@intelsat.com *
remarks: * *
remarks: * For issues of network abuse, including spam, please send *
remarks: * email to Intelsat at: *
remarks: * *
remarks: * abuse@intelsat.com *
remarks: * *
remarks: *************************************************************
remarks:
source: RIPE # Filtered
person: Chuan Qin
address: Intelsat
address: 3400 International Drive, NW
address: Washington, DC
address: 20008
address: USA
phone: +1 202 944 8530
nic-hdl: CQ37-RIPE
e-mail: Chuan.Qin@Intelsat.com
source: RIPE # Filtered
person: Augustin Traore
address: 3400 International Drive NW,
Washington DC 20008-3006
phone: +703-944-7033
e-mail: augustin.traore@intelsat.com
nic-hdl: AT1875-RIPE
mnt-by: AS22351-MNT
source: RIPE # Filtered
"British International Lottery" (Mr. Todd Aaron) From: "uk world" <uk_word@yahoo.co.uk> To: <uk_word@yahoo.co.uk> Sent: Thursday, 12 May, 2005 12:29 Subject: WINNING NOTIFICATION!! British International Lottery Support Center Bevan House 51 Bevan Avenue Conwy LL28 5AF United Kingdom FROM: THE DESK OF THE PROMOTION MANAGER INTERNATIONAL PROMOTIONS/PRICE AWARD DEPARTMENT. REF NO: BTL/4910X1/04 BATCH NO: 12/25/0304 RE: AWARD WINNING NOTIFICATION/ FINAL NOTICE National U.K Lottorey wishes to inform you the results of the E-mail address ballot lottery international program by Great Britain held on 3rd March, 2004. Your email address was attached to ticket number 564 75600545-188, with serial number 5388/02 drew with lucky numbers 43-11-44-37-10-43, and consequently you Won the lottery in the (A) category.All participants were selected through a computer ballot system drawn from Microsoft users from company and individual email addresses. You have therefore been approved a lump sum of SIX HUNDRED THOUSAND GREAT BRITAIN POUNDS. Be advice to keep your winning information confidential until your claims has been processed and your money remitted to you. This is part of our security protocol to avoid double claiming and unwarranted abuse of this program,For the release of your winning,kindly contact your claims agent: Mr. Todd Aaron Tel: +44 703 184 8857 Fax: +44 870-135-6643 Email: todd_aronn4@yahoo.co.uk Our agent will immediately commence the process to facilitate the Release of your funds as soon as you contact him and you are to quote your lucky number for confirmation on your winning in every correspondences with claims agent. All winning must be claimed not later than 10th June, 2005. After this date all unclaimed funds will be retured to European Union Treasury as unclaimed. Furthermore, should there be any Change of your address; do inform your claims agent as soon as possible. Congratulations!! again from all our staffs and thank you for being part of our promotional lottery program. Yours faithfully, Dr Paul White Zonal Co-ordinator (Promotions Manager) -------------------------------------------------------------------------------- How much free photo storage do you get? Store your holiday snaps for FREE with Yahoo! Photos. Get Yahoo! Photos Message headers: Received: from [80.179.191.232] by web26307.mail.ukl.yahoo.com via HTTP; Thu, 12 May 2005 04:29:32 BST Date: Thu, 12 May 2005 04:29:32 +0100 (BST) From: uk world <uk_word@yahoo.co.uk> Subject: WINNING NOTIFICATION!! To: uk_word@yahoo.co.uk IP address 80.179.191.232 is in the same neighbourhood as IP 80.179.191.228 used in the "SUDDEUTSCHE KLASSENLOTTERIE" fake lottery scam.
WHOIS details for sending network (IP 80.179.191.232):
inetnum: 80.179.191.226 - 80.179.191.255
netname: Gilat-ART4211
descr: Please Send Abuse/SPAM complaints To Abuse-gilat@012.net.il
country: GB
admin-c: DR5299-RIPE
tech-c: DR5299-RIPE
status: ASSIGNED PA
notify: lir@linux.goldenlines.net.il
changed: lir@linux.goldenlines.net.il 20050202
mnt-by: AS9116-MNT
mnt-lower: AS9116-MNT
source: RIPE
route: 80.179.128.0/17
descr: Golden Lines
origin: AS9116
mnt-by: AS9116-MNT
changed: lir@linux.goldenlines.net.il 20020711
source: RIPE
role: DNS REG
address: 25 Hsivim st. Petach-Tiikva, Israel
e-mail: dnsreg@012.net.il
trouble: abuse@012.net.il
admin-c: GE2074-RIPE
tech-c: IB737-RIPE
tech-c: AG914-RIPE
nic-hdl: DR5299-RIPE
notify: lir@linux.goldenlines.net.il
changed: lir@linux.goldenlines.net.il 20030715
mnt-by: AS9116-MNT
source: RIPE
Reply from the claims agent:
From: "Dr Todd Aaron" <todd_aronn11@yahoo.com> To: <todd_aronn11@yahoo.com> Sent: Friday, 13 May, 2005 21:08 Subject: Attn: Dear Winner Attn:Dear Winner I am Dr. Todd Aaron, the fiduciary agent assigned to your case to help you in the claims process of your funds. I wish to congratulate you and to say you are a lucky person to have won this lottery. All the winners in the Lottery were selected randomly through a computer ballot system from Email addresses and Names from the World Wide Web. You are required to fill the attached form to facilitate the processing of your claims and certificate which will lead to the payment of your prize to you as required. You are also to send a copy of your International Passport or Drivers License along with the filled form. If you do not have any of these, you can send your National Identity Card or any other form of Identification. You are to choose only One (1) from the Three (3) given options on how to claim your prize. For any option you choose, you are to fill in the necessary information for the option you choose. 1. You go to our paying agent to collect your prize of 600,000,00 (SIX HUNDRED THOUSAND GREAT BRITAIN POUNDS.) in cash. 2. Transfer of your funds to your local bank account by Telegraphic Bank transfer and your funds will be in your account within 48 hours. 3. You employ the services of our affiliate courier company to courier your Award Certificate and Certified Bank Cheque to you. (5 -14 Days) If you choose option 2 or 3, you will be totally responsible for the Telegraphic Bank Transfer Charges OR Courier Charges. When we receive your Filled Form, we will send you more information about any option you choose. Note that your funds have been insured and no deductions of any kind can be made on your funds. You are to send your Filled Form and Scanned Identification by Email Attachment or to our office fax:44 701356643 Once again I say congratulations and hope to hear from you soon. Yours faithfully, Mr. Todd Aaron Tel:+447031848857 Fax: 44 701356643 -------------------------------------------------------------------------------- Do you Yahoo!? Yahoo! Mail - Helps protect you from nasty viruses. Message headers: Received: from [80.88.128.12] by web32413.mail.mud.yahoo.com via HTTP; Fri, 13 May 2005 05:08:45 PDT Date: Fri, 13 May 2005 05:08:45 -0700 (PDT) From: Dr Todd Aaron <todd_aronn11@yahoo.com> Subject: Attn: Dear Winner To: todd_aronn11@yahoo.com
"claim process form.doc"
Title: UK INTERNATIONAL LOTTERY
From: "Dr Todd Aaron" <todd_aronn11@yahoo.com> To: "firstname lastname" <emailaddress> Sent: Wednesday, 18 May, 2005 16:22 Subject: Attn:title firstname lastname Attn:title firstname lastname Top of the day to you and this is my suggestion and advice to you that will be more better than openning a new account i the bank you listed, we have deplomatic courier company that will deliver your winning 600,000.00 pounds to your door step and you will have to pay for the air freet and the charges for them to do that, That is the best way and you only have to pay $9,000 and they will bring your winnings to you. I will like to know what you have to say about this because its better than bank transfer becasue you will have to pay much for bank transfer charges. I will send your winning certificat to you in my next mail. Regards Todd Aaron. Message headers: Received: from [80.88.128.12] by web32411.mail.mud.yahoo.com via HTTP; Wed, 18 May 2005 00:22:43 PDT Date: Wed, 18 May 2005 00:22:43 -0700 (PDT) From: Dr Todd Aaron <todd_aronn11@yahoo.com> Subject: Attn:title firstname lastname
Message headers: Received: from [80.88.128.12] by web32413.mail.mud.yahoo.com via HTTP; Thu, 19 May 2005 09:52:32 PDT Date: Thu, 19 May 2005 09:52:32 -0700 (PDT) From: Dr Todd Aaron <todd_aronn11@yahoo.com> Subject: Attn:title firstname lastname
An image of the followiing fake check was emailed to the victim after paying £650:
The street address is that of a Lloyds TSB bank branch. The fake image of check was edited from a scan of a Lloyds TSB check. That wasn't the end of it. The criminals thenm demanded £6000 to be paid by Western Union or into a bank account: From: "Todd Aaron" <todd_aronn@hotmail.com> To: <emailaddress> Sent: Friday, 03 June, 2005 2:49 Subject: Attn:title firstname lastname(ACCOUNT) British International Lottery Support Center Bevan House 51 Bevan Avenue Conwy LL28 5AF United Kingdom Attn:title firstname lastname Top of the day to you,This is the complet account details you requested and you can make the payment from your Bank and do not send any DRAFT because we don't accept it. As soon as you make the payment you are to send the payment slip. Am given you so many uption to make payment because i want you to get your check soonest. IBAN: GB21BARC20325360237140 SWIFTCODE: BARCGB22 BARCLAYS SORT CODE: 203253 ACCOUNT NUMBER: 60237140 FURTHER CREDIT TO, THE WOOLWICH BANK POWIS STREET WOOLWICH, LONDON A/C. NAME: MR.PHILLIP RADEBE A/C.NUMBER: 58471261 SORT CODE: 108002 Get back soon Regards Todd Aaron Message headers: Received: from 80.88.128.12 by by19fd.bay19.hotmail.msn.com with HTTP; Thu, 02 Jun 2005 17:49:47 GMT X-Originating-IP: [80.88.128.12] X-Originating-Email: [todd_aronn@hotmail.com] X-Sender: todd_aronn@hotmail.com
WHOIS details for sending network (IP 80.88.128.12):
inetnum: 80.88.128.0 - 80.88.128.127
netname: EMP-MFG-NOC
descr: Central infrastucture for Emperion at Middelfartgade.
descr: Supports various NMS systems, IP DVB Encoders as well as one
descr: router pr. customer link.
country: DK
admin-c: KW6968-RIPE
tech-c: EMP5-RIPE
status: ASSIGNED PA
notify: noc@emperion.net
mnt-by: EMP-NOC-MNT
changed: hostmaster@ripe.net 20010829
changed: kmw@Emperion.net 20010903
changed: kmw@Emperion.net 20010906
changed: gbl@emperion.net 20030210
source: RIPE
route: 80.88.128.0/20
descr: DK-EMPERION-20010828-ROUTE
origin: AS21125
mnt-by: EMP-NOC-MNT
changed: kmw@Emperion.net 20010906
source: RIPE
role: Emperion NOC Operator
address: Emperion A/S
address: Middelfartgade 7
address: 2100 Koebenhavn Oe
address: DK
phone: +45 3929 3530
e-mail: noc@emperion.net
trouble: kmw@emperion.net
admin-c: KW6968-RIPE
tech-c: KW6968-RIPE
tech-c: SRL7-RIPE
tech-c: AJ163-RIPE
tech-c: GB1283-RIPE
tech-c: FL497-RIPE
nic-hdl: EMP5-RIPE
notify: noc@emperion.net
mnt-by: EMP-NOC-MNT
changed: KMW@EMPERION.NET 20010906
changed: kmw@emperion.net 20020110
changed: kmw@emperion.net 20021107
source: RIPE
person: Kim Wohlert
address: Emperion A/S
address: Middelfartgade 7
address: 2100 Koebenhavn Oe
address: DK
phone: +45 3929 3530
e-mail: kmw@emperion.net
nic-hdl: KW6968-RIPE
mnt-by: EMP-NOC-MNT
changed: andreas@dk.uu.net 20010807
changed: hostmaster@dk.uu.net 20010903
changed: kmw@emperion.net 20020110
source: RIPE
See Email addresses associated with IP address 80.88.128.12
| |||||||||||||