|
Violin teacher scam
This check scam targets violin teachers and other music teachers, costing them thousands of dollars. The criminals (most of them from West Africa) try to trick them into cashing a fake chashier's check for them and wiring them a large portion of the cash. This is a variation on a scam targeting professional photographers as well as classified ad sites for cars, motorbikes, horses, etc. This scam relies on the fact that a check can bounce weeks and months after funds have already been made available for it by the bank. When you deposit a check, it always remains your responsibility, not the bank's. If you have already withdrawn and wired out cash against the check you will have in effect borrowed money off the bank against the promise that the check is valid, which it wasn't, and given that money to criminals. In the "violin teacher scam" the criminal poses as someone who is looking for a teacher to provide several months of intensive violin tuition for a family member. He will send you a large cashier's check. If you receive such checks, do not try to cash them. Take them to the local police. Any money your account may be initially credited with when you deposit them will be debited again when the check bounces. For example, the "customer" may arrange for tuition costing $2000 but mail you a check for $5000. Once the bank credits your account with $5000 you will be asked to wire $3000 back to the sender which supposedly was earmarked for the son's airline ticket or some other purpose. Once the check bounces you will be owing $3000 plus a bounced check fee to your bank. It can hurt your credit rating, not to mention the possibility of a criminal investigation for passing a bad check. Here are some red flags to watch out for:
Please send us any such emails you may have received and we will publish them (withholding your name and email address, of course) to warn other music teachers and to assist law enforcement investigating such cases.
How to display message headers in Apple Mail (OS X)
Example email:
From: "Mr. Robert Barris" <robertbarris@msn.com> The teacher responded with the required information. Here's the next email from the scammer:
From: "Mr. Robert Barris" <robertbarris@msn.com> The teacher provided the postal address.
From: "Mr. Robert Barris" <robertbarris@msn.com> The teacher provided the postal address and talked about the schedule for lessons.
From: Mr. Robert Barris <robertbarris@msn.com> In all the communications the customer is only interested in the check:
From: Mr. Robert Barris <robertbarris@msn.com> Next email:
From: Mr. Robert Barris <robertbarris@msn.com> Here's the email from the fake WHO lawyer:
From: BARRISTER PRESTO DADA <legallawofficefirm@yahoo.com> Signed-By: yahoo.com | Mailed-By: yahoo.com Message headers: Received: from [195.166.234.34] by web51605.mail.yahoo.com via HTTP; Tue, 06 Dec 2005 10:24:07 PST Date: Tue, 6 Dec 2005 10:24:07 -0800 (PST) From: BARRISTER PRESTO DADA <legallawofficefirm@yahoo.com> Subject: Western Union Office Location for you.
Message headers: Received: from [80.179.102.100] by ws1-1.us4.outblaze.com with http for serahdam@consultant.com; Sun, 09 Jan 2005 12:45:29 -0500 From: "SERAH DAMON" >serahdam@consultant.com> To: emailaddress Date: Sun, 09 Jan 2005 12:45:29 -0500 Subject: VIOLIN TEACHER X-Originating-Ip: 80.179.102.100
Message headers: Received: from [212.247.93.242] by web32509.mail.mud.yahoo.com via HTTP; Wed, 25 May 2005 02:30:22 PDT Date: Wed, 25 May 2005 02:30:22 -0700 (PDT) From: Dr Alex Raymond <dralexray@yahoo.com> Subject: a violin teacher
"Mrs. Richard" (richardhilman@outgun.com, IP 80.179.249.178) From: "richard hilman" <richardhilman@outgun.com> To: <emailaddress> Sent: Thursday, 06 May, 2004 11:29 Subject: interested!!!!!!!!!!!!!!!!!! Hello title name, I am interested in your teaching for the academic pursuit of my children,they are two boys,8 and 11year of age.Let me know if you can handle it and your best offer for it and how you want the payment to be made.Please, get back on time,hope to hear from you soon. Thanks you. Mrs Richard. Message headers: Received: from [80.179.249.178] by ws5-4.us4.outblaze.com with http for richardhilman@outgun.com; Thu, 06 May 2004 10:29:38 +0800 From: "richard hilman" <richardhilman@outgun.com>
Hi title name, Sorry for delay and thanks for your prompt response,though I left for a project with Liusberg constructions in Libya.Give your final asking price for period of three months for the two kids then if it is okay by me.I will instruct my associate in omeara houston where am located to issue you a certified cashier's check while you send the detail information on how the payment gets to you,and when my associate will bring the kids to your place i.e name,address & phone#.my shipper Mr Williams Ladi,.email A.S.A.P with details soon. Thanks. Mrs Richard. Message headers: Received: from [80.179.249.178] by ws5-6.us4.outblaze.com with http for richardhilman@outgun.com; Fri, 14 May 2004 06:04:06 +0800 From: "richard hilman" <richardhilman@outgun.com>
Where do these fraud emails come from? The above emails are sent through Gilat and Quark Telecom, which are satellite broadband providers in Israel and Sweden, respectively. Typically, when these providers are used for fraud the customers involved are Internet cafes in Nigeria.
WHOIS details for sending network (IP 80.179.102.100):
inetnum: 80.179.102.96 - 80.179.102.127
netname: Gilat-ART1707
descr: Please Send Abuse/SPAM complaints To Abuse-gilat@012.net.il
country: GB
admin-c: DR5299-RIPE
tech-c: DR5299-RIPE
status: ASSIGNED PA
mnt-by: AS9116-MNT
mnt-lower: AS9116-MNT
source: RIPE # Filtered
role: DNS REG
address: 25 Hsivim st. Petach-Tiikva, Israel
remarks: trouble: abuse@012.net.il
admin-c: GE2074-RIPE
tech-c: IB737-RIPE
tech-c: AG914-RIPE
nic-hdl: DR5299-RIPE
mnt-by: AS9116-MNT
source: RIPE # Filtered
abuse-mailbox: abuse@012.net.il
% Information related to '80.179.0.0/17AS9116'
route: 80.179.0.0/17
descr: Golden Lines
origin: AS9116
mnt-by: AS9116-MNT
source: RIPE # Filtered
WHOIS details for sending network (IP 212.247.93.242):
inetnum: 212.247.93.0 - 212.247.93.255
netname: SE-QUARK-NET2
descr: Quark Telecom Consulting Constellation Networks
####################################
In case of improper use, please mail
or
####################################
country: SE
admin-c: TM1360-RIPE
tech-c: TM1360-RIPE
status: ASSIGNED PA
mnt-by: SWIPNET-LIR-MNT
mnt-lower: SWIPNET-LIR-MNT
source: RIPE # Filtered
person: Timothy Mahoney
address: Quark Telecom Consulting Constellation Networks
address: Virkesvagen 13
address: 238 37 Oxie
address: Sweden
e-mail: tmahoney@constellationnetcorp.com
phone: +46 40 529441
nic-hdl: TM1360-RIPE
source: RIPE # Filtered
% Information related to '212.247.0.0/16AS1257'
route: 212.247.0.0/16
descr: SWIPNET
#####################################################
In case of improper use originating from our network,
please mail or
####################################################
origin: AS1257
mnt-by: AS1257-MNT
source: RIPE # Filtered
WHOIS details for sending network (IP 80.179.249.178):
inetnum: 80.179.249.176 - 80.179.249.183
netname: Gilat-ART1899
descr: Please Send Abuse/SPAM complaints To Abuse-gilat@012.net.il
country: GB
admin-c: DR5299-RIPE
tech-c: DR5299-RIPE
status: ASSIGNED PA
mnt-by: AS9116-MNT
mnt-lower: AS9116-MNT
source: RIPE # Filtered
role: DNS REG
address: 25 Hsivim st. Petach-Tiikva, Israel
remarks: trouble: abuse@012.net.il
admin-c: GE2074-RIPE
tech-c: IB737-RIPE
tech-c: AG914-RIPE
nic-hdl: DR5299-RIPE
mnt-by: AS9116-MNT
source: RIPE # Filtered
abuse-mailbox: abuse@012.net.il
% Information related to '80.179.128.0/17AS9116'
route: 80.179.128.0/17
descr: Golden Lines
origin: AS9116
mnt-by: AS9116-MNT
source: RIPE # Filtered
"Larry Bank": London or Lagos?
Hi, Message headers: Received: from [80.231.5.246] by web34011.mail.mud.yahoo.com via HTTP; Tue, 16 Aug 2005 05:00:56 PDT Date: Tue, 16 Aug 2005 05:00:56 -0700 (PDT) From: Larry Bank <goingon_4life@yahoo.com> Subject: YOUR SERVICES IS NEEDED CELLO LESSON FOR MY KIDS
WHOIS details for sending network (IP 80.231.5.246):
inetnum: 80.231.5.0 - 80.231.5.255
netname: COBRANET-ISP-TGB2
descr: Cobranet
country: NG
admin-c: HM1517-RIPE
tech-c: ED740-RIPE
status: ASSIGNED PA
mnt-by: AS8297-MNT
source: RIPE # Filtered
person: Hikmat Mardo
address: Lagos-Nigeria
address: Lekki Phase 1
address: rafiu babatunde street plot 8
phone: +23417767720
phone: +234802 832 2133
phone: +23415555656
phone: +9613666325
e-mail: hjm@cobranet.org
nic-hdl: HM1517-RIPE
mnt-by: IABG-MNT
source: RIPE # Filtered
person: Elie Dib
address: Lagos-Nigeria
address: Lekki Phase 1
address: rafiu babatunde street plot 8
phone: +9613235266
e-mail: elie@cobranet.org
nic-hdl: ED740-RIPE
mnt-by: IABG-MNT
source: RIPE # Filtered
"TOM JOHNSON" (tomjohnson143@hotmail.com) From: "TOM JOHNSON" <tomjohnson143@hotmail.com>
"April Kauffman" (april_kauffman@hotmail.com)
From: "April Kauffman" <april_kauffman@hotmail.com> Message headers: Received: from [65.54.187.60] (HELO hotmail.com) by mailhost (CommuniGate Pro SMTP 4.2.4) with ESMTP id 99183503 for mailaddress; Mon, 31 Oct 2005 19:25:46 -0500 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Mon, 31 Oct 2005 16:25:43 -0800 Message-ID: <BAY18-F107F948960F4435D478152EB6F0@phx.gbl> Received: from 192.116.135.74 by by18fd.bay18.hotmail.msn.com with HTTP; Tue, 01 Nov 2005 00:25:43 GMT X-Originating-IP: [192.116.135.74] X-Originating-Email: [april_kauffman@hotmail.com] X-Sender: april_kauffman@hotmail.com From: "April Kauffman" <april_kauffman@hotmail.com> To: mailaddress Bcc: Subject: TEACHER NEEDED Date: Mon, 31 Oct 2005 17:25:43 -0700
WHOIS details for sending network (IP 192.116.135.74): inetnum: 192.116.133.0 - 192.116.137.255 netname: GILAT-SATCOM-BLOCK-38-39-41-42-43 descr: Gilat-Satcom remarks: For abuse issues related to Gilat, email abuse-gilat@012.net.il country: GB admin-c: GS3350-RIPE tech-c: GS3350-RIPE status: ASSIGNED PA mnt-by: AS9116-MNT mnt-lower: AS9116-MNT source: RIPE # Filtered role: Gilat Support address: Gilat Satcom address: 21D Yagia Kapaim st. Petach-Tikva, Israel phone: +972 3 9255000 fax-no: +972 3 9217938 admin-c: DR5299-RIPE admin-c: GE2074-RIPE tech-c: DR5299-RIPE tech-c: GE2074-RIPE remarks: trouble: abuse-gilat@012.net.il nic-hdl: GS3350-RIPE mnt-by: AS9116-MNT source: RIPE # Filtered abuse-mailbox: abuse-gilat@012.net.il % Information related to '192.116.128.0/18AS9116' route: 192.116.128.0/18 descr: Goldenlines remarks: For addressing issues, email lir@linux.goldenlines.net.il remarks: For abuse issues, email abuse@012.net.il origin: AS9116 mnt-by: AS9116-MNT source: RIPE # Filtered
Also see the banjo version of this scam. From: "Mrs Tamia woods" <tammmywoods4luv@yahoo.com> Message headers: Received: from [192.116.135.74] by web35512.mail.mud.yahoo.com via HTTP; Mon, 14 Nov 2005 10:24:19 PST Date: Mon, 14 Nov 2005 10:24:19 -0800 (PST) From: Mrs Tamia woods <tammmywoods4luv@yahoo.com>
|