View Single Post
  #1   (View Single Post)  
Old 9th February 2011
Carpetsmoker's Avatar
Carpetsmoker Carpetsmoker is offline
Real Name: Martin
Tcpdump Spy
Join Date: Apr 2008
Location: New Zealand
Posts: 2,203
Default Internet scam: A live example

Today I placed one laptop we've been having on stock for quite some time on ebay.

In 30 minutes I received a response from a guy named "van.royal12".

Hello Seller,Good Morning..I just wanna know if your item is still available for sale please get back to me with your last price and condition so i wait to hear from you asap.
I immediately smelled a rat: I placed the ad on the Dutch ebay (called, and the listing included the requested information so the question didn't make a lot of sense.

However, just in small chance it is a genuine message I replied. In case it was some form of scam at least I would entertain myself.

Dear van.royal12,

Yes, this item is still for sale.

Which prompted a quick reply:
Thanks for your fast response, i want to know that i am a Marine Engineer and am purchasing this item for my Associate, I have been buying things here and i always buy good item so i will be paying you 1200Euro for this item and also will be paying 50Euro for the shipping fee via TNT POST so i want you to get back to me with your payment details either your Pay Pal Email Address or Bank Transfer Details so i can proceed with the payment now so wait to receive your payment details asap.So here are the details needed from you below:

Bank Name Full Name Account Number Total Cost
OR PayPal Email Address.
This was even more suspicious, the item was listed at 1149 euro. Someone offering to pay more than the listing price? Right...

Regardless, lets reply and see what happens:

We do not have paypal. You can make a bank transfer to:

Aragorn B.V.
Account# [strip]
IBAN: [strip]
BIC/SWIFT: [strip]

The total amount is €1149 + Shipping.
Shipping is €10 for european (E.U.) shipments, and €25 for international shipments.

Please make sure you provide "Thinkpad T400" as a reference so we can trace the transfer.

Now things get more interesting, I promptly received another email.

Okay i am on my way to make the transfer now so i want you to packed the item and get it ready for shipping so as soon as the payment is done now i will get back to you cos the bank is near to me here so try and wait for online for some minutes.

Pleasure doing business with you.
Quickly followed by a "transfer confirmation":

This is to inform you that we have received your payment of €1250.00 EUR from Van Royal for an items(Thinkpad T400) Purchased from via ( advert .The money has now been deducted from the buyer's bank account and ready to be transfer into your bank account. It will be deposited into your Bank account :
***Sellers Bank Account Details***As provided by the Buyers (Van Royal)***

Account Nam:Aragorn B.V
Account number:[strip]
BIC Nummer:[strip]
Email Address:[strip]
This goes on for a bit more and includes images and fancy HTML markup.

This is quite obviously fake, not just from the spelling and punctuation errors, but a quick look at the email headers removed any possible doubt.

The bottom (that is first) Recieved: header
Received: from (
[]) by (Postfix) with ESMTP id CC0EE800BE
for <[snip]@[snip].nl>; Wed, 9 Feb 2011 13:18:49 +0100 (CET)
Received: by qyk8 with SMTP id 8so1253451qyk.20 for
<[snip]@[snip].nl>; Wed, 09 Feb 2011 04:21:01 -0800 (PST)
And the transfer was quickly "confirmed" by another email from my "buyer"

I would want to inform you that i just make the transfer into your Bank Account, and you should have gotten the payments notification from my Bank by now, you can check in your email inbox and bulk folders cause it goes in there sometimes, So i will love you to go ahead with the shipping this morning via TNT POST OFFICE....... and get back to me with the shipment details, and you are also to get back to my Bank customer email with the shipment details also, so they can deposit your funds into your account immediately, make sure you ship it to my Bank verified address on the payments notification.

Name: [strip]
Address: No 37 Lalubu Avenue
State: Ogun
City : Abeokuta
Country: Nigeria
Zip Code: 23403

Pleasure doing Business with you

I am still thinking of a way to reply to that ... Just for fun
UNIX was not designed to stop you from doing stupid things, because that would also stop you from doing clever things.

Last edited by Carpetsmoker; 10th February 2011 at 10:04 AM.
Reply With Quote