Thursday, March 11, 2004

Bequest Scam E-mail

Now here's a really new one... a message that Mozilla Thunderbird 0.4 thinks is spam, where the sender claims that I'm eligible for a 2.5 million bequest by some bloke who passed away last year. I've been digging through the message text a few times trying to find the "gotcha" and it doesn't seem to be real obvious as to what the intent is other then them trying to find easy marks for further attempts.

The message is in HTML format, but I'm going to strip the codes and merely post the text version.

===========================================
From - Wed Mar 10 19:54:20 2004
X-UIDL: 404fb89100000033
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path:
Received: from precept.geekmail.cc (precept.geekmail.cc [10.0.1.11])
by proverb.geekmail.cc (8.12.10/8.12.9) with ESMTP id i2A5uWvp000871
for ; Tue, 9 Mar 2004 21:56:32 -0800
X-Envelope-To:
Received: from gawab.com (www.gawab.com [204.97.230.36])
by precept.geekmail.cc (8.12.10/8.12.9) with SMTP id i2A5uUHS022829
for ; Tue, 9 Mar 2004 21:56:31 -0800
Received: (qmail 96472 invoked by uid 1004); 10 Mar 2004 05:59:54 -0000
Message-ID: <20040310055954.96471.qmail@gawab.com>
Received: from 82.128.1.170 by gawab.com with HTTP;
Wed, 10 Mar 2004 05:59:54 GMT
From: "DAVID WINK"
To: rev_davidwink8@gawab.com
Reply-To: re_davidwink@rediff.com
Subject: NOTICE OF BEQUEST (JOHN RYERSON IS DEAD)
Date: Wed, 10 Mar 2004 05:59:54 GMT
Mime-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Originating-IP: [82.128.1.170]
X-Milter: Spamilter
Status:

St. Jude's Presbyterian Church
72 Belgravia Crescent, Southernwood
London.
Email: rev_fathergeorge@alexandria.cc


Notification of Bequest

My name is Rev David Wink, a Parish Priest of the Presbyterian Church in East London where the late Engr. John Ryerson woship before his death on the 9th of february 2002

On behalf of the Trustees and Executors of the estate of Late Engr. John Ryerson, I once again try to notify you as my earlier letter to you through the Post Office was returned undelivered. I hereby attempt to reach you via your email. I wish to notify you that late Engr. John Ryerson made you a beneficiary to his will.

He left the sum of two Million five Hundred Thousand Dollars (US$2,500,000.00 ) to you in the codicil and last testament to his will. This may sound strange and unbelievable to you, but it is real and true. Being a widely traveled man, he must have been in contact with you in the past or simply you were nominated to him by one of his numerous friends abroad who wished you good and believed you will use the bequested sum in pursuance and furtherance of his long time dreams and efforts to the work of humanity. He instructed in his will that the beneficiaries of his will should use the money to assist the poor and less-privileged in Asia, Africa and the caribbeans.

Engr, JOHN RYERSON until his death was a former managing director and pioneer staff of a giant construction company. He was a very dedicated religiuos man who loved to give out. His great philanthropy earned him numerous awards during his life time. Late Engr. John Ryerson died on the 9th day of February 2002 at the age of 82 years, and his Will is now ready for execution.

Please If I reach you as I am hopeful, endeavor to get back to the attorney , who is in charge of te estate of the late Ryerson , as soon as possible to enable him execute the Will to conclude his job. If you find any need to get back to me, please do not hesitate to do so. Below is the detailed contact of the attorney of the late late Engr. John Ryerson.

CONTACT:
GOLDEN SOURCE CHAMBERS
SKY HOUSE,
200, UNION STREET
LONDON, SE1 0LY

ENGLAND
TEL/FAX: + 44 870 134 6275
+ 44 774 339 7507
EMAIL: okpubic@yahoo.ca


Rev. Father David Wink
(Parish Priest)
________________________________
15 Mbytes Free Web-based and POP3
Sign up now: http://www.gawab.com
===========================================

Okay, now for the analysis...

1) Is there a "St Jude's Presbyterian Church" in East London?

Not according to the "Churches in East London" web page. The street address given, "72 Belgravia Crescent" matches the Assembly of God church which is not a Presbyterian church. Google turns up a bunch of results for "St. Jude's Presbyterian Church London" none of which are matches. Especially not with the address given. Searching on "Presbyterian Church Southernwood London" turns up only 29 hits, again with no matches to a real church.

2) What about the supposed death of John Ryerson on Feb 9 2002?

Googling on "+"john ryerson" +february" turns up some very interesting results, and a few verbatim copies of the e-mail that I just received. These all pretty much score it up as a scam.

NOTIFICATION OF BEQUEST
- Identical contact information for Golden Source Chambers, except this letter purports to be from the solicitor. Asks you to fax current telephone number and address to the solicitor.

NOTIFICATION OF BEQUEST
- different solicitor (Ezekwed Chambers), different address, and only $250,000 instead of $2,500,000. Age 68 instead of 82. Gotcha is when they ask you to "forward any proof of identities of yours, your current telephone and fax numbers and your forwarding address".

[FLASH-BUGS] Urgent Response
- West African address instead of England, with $25,000,000 instead of $2,500,000. This one lists the age at death as only 68 instead of 82. Gotcha again is to "forward any proof of identities of yours,
your current telephone and fax numbers and your forwarding address".

In High Cotton: My new found fortune
- Jan 2004 copy, West African version, $25,000,000, age 68, same gotcha as the previous one (word for word identical for the most part).

RE: NOTIFICATION OF BEQUEST
- Ezekwed Chambers again, Age 68 as the age at death, $1,500,000 sum, reportedly an European working in Nigeria. This one asks for "forward any proof of identities of yours, your current telephone and fax numbers and your forwarding address to enable us file necessary documents", which is the "gotcha".

The Register: Ghostly 419: The scam from beyond the grave
- Article in The Register about this 419 scam. Guess this one's been around the block almost 2 years now.

What it looks like is either an attempt at identity theft, or a soft-sell in order to hook you into participating in a 419-style scam where you have to front monies in order to receive the payout. The crooks, of course, will keep stringing you along, coming up with additional fees / bribes / other expenses that suddenly need to be taken care of in order for you to receive the monies.

Other useful searches which turn up additional versions of the scam spam:

"Notification of Bequest"
"Golden Source Chambers"
"John Ryerson made you a beneficiary to his will"
"Being a widely traveled man"
"former managing director and pioneer staff of a giant construction company"
"died on the 9th day of February 2002"