419 Scam Example: "UK NATIONAL LOTTERY (BRIAN HUNT)"
The "UK NATIONAL LOTTERY" are is a real lottery whose name is amongst the most frequently used for fake lottery scams, which are mostly run by gangs in Nigeria for an advance fee fraud or "419" scam. The real UK National Lottery
Two names of innocent real people are often abused for this scam, neither of whom works for the UK National Lottery:
Please send us replies by "claims agents", especially money demands and payment instructions, we will publish them here.
This scam is related to the "Express Dispatch Courier Ltd." scam which was sent from the same IP address. It is also related to the "Castle International Lottery (Brian Hunt)" scam which used the same fake postal address and agent name as "UK NATIONAL LOTTERY (BRIAN HUNT)" and which is linked to the following fake courier services by IP address:
UK-LOTTO Headquarters: The Marina Offices, St Peters Yacht Basin, Newcastle upon Tyne, NE6 1HX England Customer Service Ref: UK/9420X2/68 Batch: 074/05/ZY369 WINNING NOTIFICATION: We happily announce to you the draw of the UK NATIONAL LOTTERY, online Sweepstakes International program held on Saturday 5th of March, 2005 in LIVERPOOL UNITED-KINGDOM. Your e-mail address attached to ticket number: 56475600545 188 with Serial number 5368/02 drew the lucky numbers: 06 . 19 . 24 . 26 . 27 . 49 .  Bonus Ball which subsequently won you the lottery in the 2nd category. You have therefore been approved to claim a total sum of US$2,500,000.00 (Two million,Five Hundred Thousand United States Dollars) in cash credited to file ktu/9023118308/03.This is from a total cash prize of $USD 25 Million dollars, shared amongst the first Ten (10) lucky winners in this category. All participants for the online version were selected randomly from World Wide Web sites through computer draw system andextracted from over 100,000 unions, associations, and corporate bodies that are listed online. This promotion takes place annually. Please note that your lucky winning number falls within our European booklet representative office in Europe as indicated in your play coupon. In view of this, your $USD2,500,000 (two million five hundred thousand dollars) will be released to you by any of our payment offices in Europe. Our European agent will immediately commence the process to facilitate the release of your funds as soon as you contact him. For security reasons, you are advised to keep your winning information confidential till your claim is processed and your money has been remitted to you in whatever manner you deem fit to claim your prize. This is part of our precautionary measure to avoid double claiming andunwarranted abuse of this program. Please be warned. To file for your claim, please contact our fiduciary agent: Mr.BRIAN HUNT Email: email@example.com with your claims verification information: FULL NAMES OF BENEFICIARY:........................ CONTACT ADDRESS:.................................. CITY/STATE:....................................... COUNTRY:.......................................... NATIONALITY:...................................... SEX:.......................AGE:................... TEL NO:........................................... NEXT OF KIN:...................................... ANNUAL INCOME:.................................... AMOUNT WON:....................................... REFENCE NO:................BATCH NO:.............. LUCKY NO:..................TICKET NO.............. SERIAL NO:.................LOTTERY DATE:.......... feel free to visit the online result site to confirm your winnings numbers. <http://www.national-lottery.co.uk/player/p/results/results.do> For Further enquiries and confirmation, Contact: Mr Brian Hunt <http://www.uknationallottery.com/meettheteam.php> Congratulations once again from all members and staffs of this program. Thank you for being part of our promotional lottery programs. Sincerely, MR ANDREW T. HALL Online coordinator for UK NATIONAL LOTTERY Sweepstakes International Program _____________________________________________ Castiga peste 1000 de premii cu Wella Design! http://wella.boom.ro
Reponse from the claims agent:
UK NATIONAL LOTTERY FIDUCIARY DEPARTMENT, REF NO: UK/9420X2/68 BATCH NO: 074/05/ZY369 19TH MARCH, 2005. DEAR FIRSTNAME LASTNAME, CONGRATULATIONS! YOUR UK LOTTERY WINNING CERTIFICATE IS READY. I HAVE ATTACHED A COPY OF THE CERTIFICATE TO THIS EMAIL FOR YOUR REVIEW. THE AGENCY THEREFORE WISHES TO KNOW THE MODE BY WHICH YOU WISH TO RECEIVE YOUR PRIZEWINNINGS, THE TWO OPTIONS ARE AS FOLLOWS. THE FIRST, REQUIRES THE WINNER TO CLAIM AND RECEIVE HIS WINNINGS IN PERSON AT OUR PAYMENT OFFICE HERE IN THE UNITED KINGDOM AS WINNINGS MUST BE CLAIMED BY THE ACTUAL BONAFIDE WINNER . SECONDLY, THE WINNER HAS THE OPTION OF RECEIVING HIS WINNINGS VIA TELEGRAPHIC WIRE TRANSFER, FROM A CORRESPONDING BANK HERE IN THE UK TO ANY DESIGNATED BANK ACCOUNT OF YOUR CHOICE. YOU ARE TO NOTIFY ME OF THE PROCEDURE THAT WILL BE MOST CONVINIENT FOR YOU TO RECEIVE YOUR PRIZEWINNINGS TO ENABLE US SEND YOU THE CONTACT DETAILS OF THE DEPARTMENT INCHARGE OF YOUR PREFERED MODE OF RECEIPT. WE DO UNDERSTAND THE FACT THAT THIS PROCESS IS TAKING A LITTLE LONGER THAN USUAL, WHICH IS AS A RESULT OF THE CAUTIOUS STEPS TAKEN IN THE PROCESSING OF YOUR DOCUMENTS, BUT I WISH TO ASSURE YOU CATHEGORICALLY THAT THIS PROCEDURE WILL SOON COME TO A LOGICAL CONCLUSION. I ANTICIPATE YOUR PROMPT RESPONSE INORDER TO ENSURE THE TIMELY COMPLETION OF THIS REMMITTANCE PROCESS. REGARDS, BRIAN HUNT. FIDUCIARY FOR UK NATIONAL LOTTERY.
Here are mail headers from this response:
Subject: YOUR WINNING CERTIFICATE IS READY. Received: from [184.108.40.206] by mprdmailfe3.nwk.myway.com via HTTP; Sat, 19 Mar 2005 12:45:40 EST X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: ID = 2d20e40ca25ef8da0567392cda3626fb Reply-To: firstname.lastname@example.org From: "BRIAN" <email@example.com>
OrgName: Global Communicaton Network NetExpress OrgID: GCNN Address: Plot 287 Ajose Adeogun Street City: Lagos StateProv: PostalCode: Country: NG NetRange: 220.127.116.11 - 18.104.22.168 CIDR: 22.214.171.124/25 NetName: NETEXPRESS1 NetHandle: NET-216-139-181-128-1 Parent: NET-216-139-160-0-1 NetType: Reassigned Comment: RegDate: 2002-10-04 Updated: 2002-10-04 TechHandle: TIK-ARIN TechName: Ikoko, Tekena TechPhone: 234-84-237-536 TechEmail: firstname.lastname@example.org OrgTechHandle: ETI2-ARIN OrgTechName: Timitimi, Ebibomo OrgTechPhone: 2341-262-0934 OrgTechEmail: email@example.com
The following message from a criminal posing as a bank came with a very real looking Adobe PDF form to open an account at supposedly the Royal Bank of Scotland, for the victim to reveal all his private data and a request for picture ID.
Royal Bank of Scotland Smith House Elmwood Avenue, Feltham Middlesex, TW 13 7QD U.K. 22ND MARCH, 2005. REFERENCE NUMBER: RBS/CS/2005/45876/77 Attn: Firstname Lastname, This is to inform you that your UK lottery winning funds of U$D 2.5 million has been deposited with the treasury and security department of this bank by the UK national lottery. The management of the UK lottery agency has instructed that we transfer the said monies to you at any designated bank account of your choice and the operations department of this bank is to handle the transfer. To commence this transfer transaction, a gold dollar cheque account will be activated for you in this bank, into which your funds will be deposited, and subsequently transfered from, to you at any bank account you wish. I have attached your account opening forms to this email, you are to complete the form with black ink, in capital letters as it duely concerns you, and send back to us at this department via fax or email attachment. fax no: +44 7075055626 We also require that you send a copy of any valid identification that bears your photograph and full names so we can prove that you are FIRSTNAME LASTNAME, the true beneficiary of the funds in our custody. The following information of the designated bank account you wish the funds to be transfered will also be required. Bank Name: Bank Address: Account holders name: Type of account: Bank aba/routing number: Your certificate of deposit will be issued for you as soon as we receive your account opening forms and identification and have proven that you are the actual bebeficiary of the funds. We also need you to send us your lottery winning documents for inspection inorder to ascertain that the said funds are not being transfered for illegal activities. I anticipate your propmt response. Yours in service, Neil Roden. Director of operations.
As you can see from the message headers, the "bank" uses the same IP address as the "lottery":
Received: from 126.96.36.199 by by21fd.bay21.hotmail.msn.com with HTTP; Tue, 22 Mar 2005 15:25:03 GMT X-Originating-IP: [188.8.131.52] X-Originating-Email: [firstname.lastname@example.org] X-Sender: email@example.com From: "Royal Bank Of Scotland" <firstname.lastname@example.org>
Request: rbs-online-uk.com from whois.crsnic.net:43 [cached Sat Mar 26 03:22:04 2005 UTC] from whois.enom.com:43 [cached Sat Mar 26 03:22:05 2005 UTC] Registration Service Provided By: Microsoft Contact: email@example.com Visit: http://support.msn.com/contactus.aspx?pk=PersonalAddress Domain name: rbs-online-uk.com Registrant Contact: Royal Bank Of Scotland Royal Bank Of Scotland (firstname.lastname@example.org) +1.5592917520 Fax: none 7031 West 750 North Winamac, IN 46996 US Administrative Contact: Royal Bank Of Scotland Royal Bank Of Scotland (email@example.com) +1.5592917520 Fax: none 7031 West 750 North Winamac, IN 46996 US Technical Contact: NOC MSN NOC MSN (MSN-PA-TECH@msn.com) +1.4258828080 Fax: none One Microsoft Way Redmond, WA 98052 US Billing Contact: NOC MSN NOC MSN (MSN-PA-BILL@MSN.COM) +1.4258828080 Fax: none One Microsoft Way Redmond, WA 98052 US Status: Locked Name Servers: pdomns1.msn.com pdomns2.msn.com Creation date: 08 Mar 2005 11:39:00 Expiration date: 08 Mar 2006 11:39:00
UK NATIONAL LOTTERY (Mark henry, Richard K. Lloyd)