A cheery message contains a PDF scam

Hello, there! That's what the subject line says in this cheerful scam attempt. The message claims to be from a Gmail account, but actually originated from a Yahoo entry point. The reply-to is in South Africa.

From: "Dr. Stella Williams" drstellawilliams10@gmail.com

Subject: Hello there!

Date: September 15, 2011 6:57:34 AM PDT

Reply-To: dr.stellawilliams1@hotmail.co.za

There was no message body; the scam is in an attached PDF file. You should never open files like this (I have tools to do it safely) because there can be malware embedded in PDF files. Here's what the message says:

Hello, how are you? I am Dr. Stella Williams from Uruguay. I work here in Iraq, and due to the in-balance of the country, we the foreign doctors want to leave following the withdrawal of the US TROOPS for lack of security. But the Iraqi soldiers don't want us to and we are not allowed to make calls to our country, so the Finance company in South Africa advised us to transfer our money to another country apart from our home country because they will freeze our account if we try to make any contact to our own country and the money is our career money.

We just need a help and someone we can trust so the Finance company in South Africa can transfer our money to your account.

Please respond urgently at: dr.stellawilliams1@hotmail.co.za

Dr. Stella Williams .

The attachment contains the fake United Nations scam

The payload of this message is in a text-only attachment. The message itself claims to be from the cs.com domain, which is CompuServe, and it's possible that's where it entered the mail stream. The reply-to address for the message is the same as in the attachment, belonging to an Internet service provider in Mongolia. The country code for the phone number, 234, is Nigeria.

The accusation that U.S. Federal Reserve chairman Ben Bernanke wants to steal your money — and put it into his personal bank account — makes for an amusing touch.

Don't open attachments in emails like this or click any links. Instead, delete immediately.

From: "UNITED NATION" michelletra2354@cs.com

Subject: DEAR UNPAID BENEFICIARY (Read The Message Attached For Details )

Date: September 16, 2011 4:21:09 PM PDT

Reply-To: mscarlap10@skymail.mn

There was no message body. Here's the attachment:

UNITED NATIONS OFFICE OF INTERNATIONAL OVERSIGHT SERVICES

Internal Audit, Monitoring,Consulting and Investigations Division

From: Ms.Carman L.Lapointe

Dear Unpaid Beneficiary

This is to inform you that I came to Nigeria yesterday from London,after series of complains from the FBI and other Security agencies from Asia, Europe,Oceania, Antarctica,South America and the United States of America respectively,against the Federal Government of Nigeria and the British Government for the rate of scam activities going on in these two nations.I have met with President GoodLuck of Nigeria who claimed that he has been trying his best to make sure you receive your fund in your account.

Right now,as directed by our secretary general Mr. Ban Ki-Moon,We are working in collaborations with the Nigerian Economic and Financial Crime Commission (EFCC) and have decided to waive away all your clearance fees/Charges and authorize the Government of Nigeria to effect the payment of your compensation of an amount of $10.5M approved by both the British/United States government and the UN into your account without any delay.The only fee you will pay to confirm your fund in your account is your Court Notarization fee to the UN.

Sincerely,you are a lucky person because I have just discovered that some top Nigerian and British Government Officials are interested in your fund and they are working in collaboration with One Mr.Ben S.Bernanke and others from USA to frustrate you and thereafter divert your fund into their personal account.

I have a very limited time to stay in Nigeria here so I would like you to urgently respond to this message with your full name, full address,direct phone number so that I can advise you on how best to confirm your fund in your account within the next 72 hours.Contact me immediately on this Cell Phone:+234-708 5781753 or email me on this mscarlap1@skymail.mn

Sincerely yours,

Ms.Carman L.Lapointe

United Nations Under-Secretary-General for Internal Oversight.

Cell Phone:+234-708 5781753

Direct Email:mscarlap1@skymail.mn

You can't win a national lottery that you didn't enter

Doesn't it look funny that a U.K. lottery is sending email from a German account, has your name as a bcc, and asks you to write back to a BluWorld account, which is a free email provider? You're not a winner, but if you reply you'll be a loser.

From: "admin@national-lottery.co.uk" ajack28@wpip5b5sz.homepage.t-online.de

Subject: You Won

Date: September 14, 2011 2:32:25 PM PDT

To: admin@national-lottery.co.uk

Reply-To: songann@blumail.org

You have won the National Lottery, Please contact Ann Song via details below for further information

Claims Unit

Lottery Fiduciary

Contact Person: Miss Ann Song

Email: ( songann@blumail.org )

Jack Lee

National Lottery

It's never a good sign when you're a bcc on a bequest email

This fake email from CBN appears to come from a Gmail account, but actually oriented from a mail server calling itself rvhyd.net -- which is a non-legitimate domain. See that the from and reply-to addresses are different - and the address in the message body is different again.

Don't be fooled by scam messages like this, but simply delete them immediately.

From: "CBN" paulhow14@gmail.com

Subject: RE: CONSOLIDATED PAYMENT NOTIFICATION

Date: September 16, 2011 1:20:58 PM PDT

Reply-To: paulhoward19@gmail.com

Dear Beneficiary,

I hope that this correspondence is received with the urgency and the expediency required.

It has come to the notice of the Board of Trustees at the CBN that your present inheritance claims application being handled by the Remitting Bank in Nigeria is experiencing some man made irregularities.To this effect,it has become necessary for the Board of Trustees to invite trained Fund Transfer / Assets transfer Specialists from the United States to resolve and regularize your fund release with immediate effect and stop all further fund discrepancies.

We at Howard & Associates have been duly consulted by the CBN Board of Trustees and have been fully informed about how the staff of the remitting bank have been taking advantage of you by telling you to pay unnecessary exorbitant charges which will only make your fund payment a long drawn out process.

Due to this we have decided to step into the process of your fund transfer to enable your funds to be transferred within the soonest possible time without needing to pay all the huge sums of monies that are being demanded from you by the remitting bank, you are to get back to us immediately .All processes to have your funds paid to you immediately through the Federal Reserve Bank in New York have been initiated to cut out unnecessary costs.You are advised to keep this communication highly confidential as the CBN Board of Trustees have asked us to resolve this fund payment independent of the office of the CBN Governor to identify the the principal participants in this unethical payment procedure.Furthermore,you are hereby advised to pay no further fees or charges to the Remitting Bank in Nigeria as well as any person or persons, Real or Fictitious, prostates and institutions as they shall no longer be handling your payment process.

We shall await your immediate correspondence with your direct telephone numbers so that we may conclude your payment immediately contact the claim officier through this email address: paulhow100@zmail.com

Yours Faithfully,

Dr.Paul Howard.

Howard & Associates c/o CBN.

Statement of confidentiality: "the information in this email and in any attachments contains confidential information and is intended solely for the attention and use of the named addressee(s). It may not be disclosed to any person without authorization. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient you are not authorized to and must not disclose, copy, distribute or retain this message or any part of it."

With this fake failure note, the scammers weren't trying very hard

This message below didn't come from American Express. Rather, it originated at an IP address that's located near Fort Worth, Texas. The mail server gave its domain names as mbicdoftbobvezp.biz, which is fraudulent.

The PDF file that the site is trying to get you to download is actually a redirect link to http://nacha-ach.org/, which is a malware/phishing website. (The real NACHA website is nacha.org.) You can read more about this at http://www.nacha.org/news/newsDetail.cfm/RecentBusinessNewsID/236

Don't click on links in strange messages; instead, delete them immediately.

From: "The Electronic Payments Association" transfer@amex.com

Subject: NACHA canceled transaction

Date: September 16, 2011 8:10:11 AM PDT

Canceled Transfer

Transfer ID: 48596733

Reason for rejection: See details in the report below

Transfer report: report_48596733.pdf.exe (self-extracting archive, Adobe PDF)

13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100

2011 NACHA - The Electronic Payments Association

The U.S. government is not trying to help you here

Wow, it looks like an official U.S. government email address, complete with a convincing-looking "antifraud.ir.gov" domain. Well, no. This email actually entered the mailstream from a mail server in Toronto. The mail server gave off its address as nkajdionhecdv.com, but there is no domain registered with that address.

What about the message itself? Both links actually open sessions at http://new-irs-reports.com/, a known phasing domain which looks like the real IRS website. Do not click links in emails like this; instead, delete them immediately.

From: "United States Department of the Treasury"adminnistration@antifraud.irs.gov

Subject: Fraud tax income IRS.gov

Date: September 16, 2011 12:08:56 AM PDT

Taxpayer ID: commensurate-00000700955060US

Tax Type: INCOME TAX

Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax statement on Internal Revenue Service (IRS) website (click on the link below):

download tax statement: report-00000700952160US.DOC

http://www.irs.gov.

Western Union doesn't have money for your 'withdrawl'

This email looks like it was sent by Western Union, but it was actually sent via an open relay at qdomzedu.ua, which is in the Ukraine. The from address was forged. The link in the email, which I've deleted, goes actually to an executable file which contains malware that would infect an unprotected Windows PC. Don't click on links in messages like this - just delete them.

From: "Western Union transfer is available for withdrawl" mtcn@westernunion.com

Subject: Western Union transfer is available for withdrawl

Date: September 14, 2011 9:15:37 PM PDT

Dear customer.

The amount of money transfer: 2400 USD.

Money is available to withdrawl.

You may find the Money Transfer Control Number (MTCN) and receiver's details on Western Union website (click on the link below to download MTCN number and transfer details):

-- malware link removed --

http://www.westernunion.com.

Western Union.

Customer Service.

The U.N. uses funny domains, but that's because it's a scam

Isn't it odd that UNECA, a "United National Economic Commission for Africa," is sending email from armlocksmiths.com, a locksmith in East Sussex, England? And would use a reply-to address that's a Chinese Yahoo account?

This is a scam, pure and simple. At some point, after you replied, you would be asked to provide some personal information that could be used for identity theft, bank account information that could be used to pull money out of your accounts, and/or "fees" to expedite the process. Don't reply to messages like this.

From: "UNECA" enquiries@armlocksmiths.com

Subject: PAYMENT TRANSFER NOTIFICATION (UN ECONOMIC COMMISSION FOR AFRICA)?

Date: September 13, 2011 4:58:36 PM PDT

Reply-To: migiro_asha@yahoo.cn

UN ECONOMIC COMMISSION FOR AFRICA(UNECA)

P.O. Box 3001, ADDIS ABABA, ETHIOPIA

TEL: +251 11 551 0365 (direct)

FAX: +251 11 551 7200

Email: migiro_asha@yahoo.cn

Our Ref: AFUA /SNT/STB

ATTN: BENEFICIARY,

RE: INHERITANCE FUND TRANSFER NOTIFICATION

WE HAVE RECEIVED AN INSTRUCTION FROM THE MINISTRY OF FINANCE OF THE FIFTY FOUR(54) COUNTRIES IN AFRICA AND THEIR VARIOUS SENATE COMMITTEE ON FOREIGN PAYMENT(SCFP), TO PAY YOU YOUR CONTRACT/INHERITANCE FUND.

YOUR CONTRACT/INHERITANCE TOTALLING TEN MILLION FIVE HUNDRED THOUSAND DOLLARS (US$10,500,000.00), INCLUDING THE INTEREST RATE UPTILL DATE HAVE BEEN PROGRAMMED FOR IMMEDIATE TRANSFER THROUGH A CREDIBLE BANK OVERSEAS AND ALL MODALITIES FOR THE TRANSFER TO YOU BEING THE LEGITIMATE BENEFICIARY OF THE FUND HAVE BEEN FINALIZED.

MEANWHILE, WE WANT YOU TO CLARIFY US IF YOU INDEED APPROVE A WOMAN BY THE NAME KAY HANN TO CLAIM THE FUND ON YOUR BEHALF. THE SAID MRS. KAY HANN IS CLAIMING TO

THIS OFFICE THAT SHE IS YOUR REPRESENTATIVE INSTRUCTED BY YOU TO RECEIVE THE FUND ON YOUR BEHALF. NOTE THAT SHE ACTUALLY TENDERED SOME VITAL DOCUMENT, WHICH SERVES AS PROVE FOR THE COLLECTION OF THESE FUNDS.

BELOW IS THE LIST OF THE DOCUMENTS WHICH SHE TENDERED:

1. LETTER OF ADMINISTRATION.

2. HIGH COURT INJUNCTION.

3. ORDER TO RELEASE.

DUE TO THE NATURE OF MY JOB, I CANNOT AFFORD TO MAKE MISTAKES IN RELEASING THESE FUNDS TO ANYONE WHO CAN NOT TENDER A SIGNED NOTE OF AUTHORIZATION FROM YOU THE RECOGNIZED TRUE BENEFICIARY TO THESE FUNDS.

NOTE THAT I ASKED HER TO COME BACK NEXT WEEK SO I CAN VERIFY THIS FACT FROM YOU FIRST BEFORE I PROCEED WITH THIS GUESTURE.

KINDLY CLARIFY US ON THIS ISSUE BEFORE WE MAKE THE PAYMENT TO MRS. KAY HANN. HOWEVER, NOTE THAT WE AWAIT YOUR EMAIL SHORTLY WHICH WILL INCLUDE ALL THE INFORMATIONS INDICATED BELOW TO ENABLE THE CREDITING BANK EFFECT YOUR TRANSFER.

WE HAVE MADE CONCRETE ARRANGEMENT JUST TO MAKE SURE THAT YOUR VALUABLE (US$10,500,000.00) TEN MILLION FIVE HUNDRED THOUSAND UNITED STATES DOLLARS IS SUCCESSFULLY RELEASED TO YOU.

THE REQUIRED INFORMATION IS AS STATED BELOW:

1. YOUR NAME:

2. YOUR ADDRESS:

3. YOUR TELEPHONE:

4. FAX:

6. SEX:

7. YOUR OCCUPATION:

LASTLY, BE INFORMED THAT THIS REPUTABLE OFFICE IN CONJUCTION WITH THE WORLD BANK HAVE BEEN APPROVED AND EMPOWERED BY A MEMORANDUM SIGNED BY THE 54 PRESIDENT's IN AFRICA.

WE ARE SOLELY AUTHORIZED AND ACCREDITED TO HANDLE ALL DELAYED CONTRACTOR/INHERITANCE FUNDS AT THIS THIRD QUARTER OF THE YEAR 2011/2012 PAYMENT SCHEDULE.

WE ARE WAITNG TO HEAR FROM YOU AS SOON AS POSSIBLE.

BEST REGARDS,

MRS. ASHA ROSE MIGIRO.

EXECUTIVE SECRETARY

Not a dying widow but a healthy scammer

A link to a sad news story does not confer legitimacy on someone sending an email. Anyone can link to any news story. This is a scam. Do not reply to messages like this.

From: "Mrs. Rosemary Collins"mkinder@cinci.rr.com

Subject: Dear Beloved One

Date: September 17, 2011 9:05:43 AM PDT

Reply-To: rosemarty90@gmail.com

Beloved,

Compliments of the day to you! By this e-mail, I do sincerely apologize for my intrusion of your privacy. However, I have a serious concern with which I believe you might be of help and for this reason, I can not but reach out to someone . My name as given above is Mrs. Mary Collins a nationality of United Kingdom. I am married to Mr. Samuel Collins who worked with the British embassy in America for nine years before he died in the plane crash On 31st of July 2000 with other passengers aboard as you can confirm it yourself through this web site. (http://news.bbc.co.uk/1/hi/world/europe/859479.stm)

We were a dedicated Christians and decided to serve mankind to the best of our ability. Since his death, I have lived with the memories, fighting effortlessly to lead a normal life but all to no avail. I suffered mentally and psychologically and shortly was diagnosed of Cancer. I lived with the scourge praying earnestly for divine intervention. Just a month ago, the doctor informed me that I have just about three months more to live. I was not shocked. I accepted the news in good fate.

Brethren, it is in this regard that I write to you, having sourced your address from a database in my late husband's internet dossier after fervent prayers. Before my husband died, he deposited a sum of $5 Million (Five Million United States Dollars) with a bank in New York USA. I have wholeheartedly decided to donate the entirety of this fund to any devoted believer or organization and to achieve this, I need an individual that will utilize this funds adherently for these purposes:

1: For the sick, less-privileged and destitute

2: For the Widows and the motherless babies e.t.c.

3: orphanages, Research centers and widows propagating

These are the wishes of a dying woman. They are the desires of my heart, hence my decision as I do not have a child to take over my inheritance. Please, understand that I am not doing this because of fear of death as I am certain where my place already is. At this point, friends, well wishers, and my husbands relatives are all clampered around me as I sojourn in my hospital bed and are unaware of my plight, hence I will not be able to make an open conversation. When I receive your response, I will direct you at once to the bank. I will also empower you with a letter of authority as the new beneficiary to this fund with all necessary documentation.

All I need from you is Truthfulness, Honesty and Sincerity assuring me that you can in all honesty and obedience utilize the funds for the purpose with which it is meant. In any a case, a quick response from you will be highly appreciated as I am already on a count-down and may not have ample time to finalize the procedures. Any delay in response may compel me to source for other measures or perhaps choose the alternative which I will not be happy to. Please, do not see this as a strange possibility or an unbelievable opportunity to make wealth, rather see this as a rare chance to assist the less privileged in truth and in spirit with a substance. Please you can contact me privately on my email address (rosemarty90@gmail.com)

I await your immediate response.

Thank You and Bless You richly!

Yours Sincerely

Mrs. Mary Collins

No thanks, Mrs. Robins

This email appears to have been sent from a hacked mailbox at Kettering University in Michigan — at least, it was processed by their mail servers. However, it's fraudulent. Don't reply to messages like this, just delete them.

From: Barbara Robins brobins@kettering.edu

Subject: Dear Brethren

Date: September 15, 2011 9:39:39 PM PDT

Although I am not comfortable discussing the content of my mail on the internet owing to lots of unsolicited/Spam mails on the net these days.Anyway my message is that I have made up my mind to WILL my late Husband's funds to you so that you can use it for charity duties and good work to humanity in your country. The amount is 4million Dollars. Please get back to me on my personal and secured email address for further information.My secured email is: brobins2011@live.com

Mrs. Barbara Robins