The Internet Fraud Advisory. 
A not for profit group based in Britain. 

Internet fraud. 

The lottery fraudThe money laundering fraud, Fraudsters haunting dating/matchmaking websites, The fake job offer fraud.  The bank accounts they use. A report on the mail service providers.  The fake loan offer fraudThe Nigerian service providers.

How Yahoo*, Western Union and others allow the criminals to flourish! Read it and weep...
*In Nigeria the fraud criminals are called "The Yahoo Boys".

An attempt to answer a common question:  "Why am I getting so much fraud mail, can't it be stopped!"
(This page will be augmented with more examples of the scandalous way in which several industries betray the confidence of Internet users around the world.)

uknationallotto.net "This domain was registered through AOL's public registrar as part of the AOL My eAddress product offering". Is that supposed to be some sort of excuse? (May 2008)

Yahoo Lottery? A report fraud mail of March '08 contained a reference to yahoolottery.com. yahoolottery.com is / was hosted by ... Yahoo.com!

THE AMERICAN CONNECTION: Nigeria seems to have an insatiable desire for Internet and telephony services. This is rather strange, when only about one in a hundred thousand people in Africa have access to a personal computer. No, they are not mailing relatives in Africa, they are mailing YOU, and an American politician accused of corruption seems happy to help. See the Washington Post article on Rep. William J. Jefferson and Atiku Abubakar, the vice president of Nigeria.   

An Australian 60 Minutes documentary "The Big Sting II" is the best piece of TV journalism I have seen on the subject of the Nigerian 419 scams. Watch what is presumably a summary of around 10 minutes and you will begin to understand why governments, police forces, Internet service providers, Western Union and the banks must confront the fraud menace.  N.B. I found I had to use Microsoft Internet Explorer to watch the film. The resource is "ninemsn".

THE MONEY TRANSFER AGENCIES. Western Union and MoneyGram are heavily used by the fraud criminals. Most fraud victims are asked to make payment in this way. If a victim contacts the money transfer agencies to ask about the money collection details, they will both refuse to divulge the information. I have even heard of cases where they do not seem able to cooperate with police agencies. This must change. Why should the money transfer agencies protect the fraud criminals and deny victims information? 

Late '07/early '08 - How could they!! Microsoft hosted these domains: FirstInlandBank.org, postonlinebank.com, unitednation-org.net ,  inchapefinancelimited-uk.com, federalbureau-investigation.org. accountnatwestbankplc.com, mastercardmegajackpot.com. fdbureauinvest.org. bmwclaimspromo.com. postbanktransfers.org, worlhealthorg.com, unitednationshq.org, euromillionsboard.com, EnglishAwards.co.uk, scarletsecurityagency.net,  fedbureauinvestigation.org, britishtobbacco.com,  standardcharteredsbank.com,  bnlverificationdept.com (they do not seem to want to close that one),  greyhoundxpresscours.com, bmwgroups.org ***,  centralbanknig-gov.org,  postbanktransfers.org, tntuklogistics.com,  britishonline-claimsdept.org,  atmcardsection.org, scarletsecurityagency.org, citizens-bnk.com,  centbanknig-online.org.

 Yahoo allowed these accounts:  fedex_companybenin1@yahoo.fr. claimsofficeonlineuklottery03@yahoo.co.uk, <barclays_bank_onlineuk@yahoo.com>,  <barclaysbank10000@yahoo.fr>, <uknationallotteryfundreleasedept@yahoo.co.uk>, <barclaybankacountdept@yahoo.co.uk> ,   bmwlotteryclaimsdeptuk@yahoo.co.uk barclaysbankof_londonengland@yahoo.co.uk co.operativebankplc001@yahoo.co.uk, info_uknationallottoeuromillions@yahoo.co.uk , Microsoft.claimsagent1@yahoo.co.uk , uklotteryfiduciary002@yahoo.co.uk , uk2007nationallottery_claimagent@yahoo.co.uk , foreignpaymentcommittee-nigeria.org, citibank_onlinetransfer_dept@yahoo.co.uk , britishlotto_claimsagent11@yahoo.com.hkbarclays_bankplc2@yahoo.co.uk, fedexcourier_servicesconpanyltd4@yahoo.fr walmartstoresinc_ukoffice@yahoo.co.uk , citytrustsecuritycompany.org !
 

Some Microsoft hosted fraud domains (hopefully all closed by now) : internalrevenuedpt.com, 
 fbi-investigationoffice.org, bondsecurities.org ,
whitehartlanebankplc.com, apexfinanceltd-uk.com, nationallott-onlineuk.com, uk-lawfirm.com, onlinepostbank-england.com, claimsagentdept.com, guinness-gamespot.com, probateoffice-uk.org (MS refused to close this after a report of 24th April '07),  servicefinanceonline.com, claimsdept-officer.com, uk-lawfirm.org, emlverificationcenter.com, rabobankonline-plc.com, claimsprocessingunit.com,  bib-onlinemail.com, capitalmanagementltd.com, britishlot-online.org, claimsdept.net. stallionbankplc-uk.com , travelextransfer.com,  tntexpresscourier.com, contactclaimsagent-onlineresults.com, fiinconsultuk.com, scarletcourieronline.org,  hillsgordon-immigration-chambers.com,  netdrawsboard.org,  rocketxpressdelivery.com, yorkshirefinancesec.net,  contactclaimsagent-onlineresults.com,   irishinternational-onlinegames.net, swiftlinkcourierservices.net, sbnplc.com, europeanonlinegame.com, scarlet-delivery.net, volkswagenpromo.com, swiftlinkcourier.org, britishinterntional-onlinegames.org, greyhoundexpresscours.com, sterlmerchbankltd-uk.net, theroyalpeakraffle-draw.net, financeconsultuk.com, frontierforwardings.net, globalfrontline.com, globexcourieronline.net, claimsprocessingunit.com, parcelflightcouriers.com, acefinancelimited-uk.com, nig-immigration-services.net, sterlmerchbankltd-uk.net, royalpeakraffleuk.com .                    

 Yahoo - surely you can stop examples like (these are old ones but there are plenty of recent examples): lotteryclaimsagent4@yahoo.co.uk , ukclaimsverification@yahoo.co.uk , lottery005_services@yahoo.com , <ecobankofghana99@yahoo.com> and a classic from August '05 interconbanknigplc_financier@yahoo.co.uk . May '06: englandlotterywinning_notice@yahoo.co.uk, englandlotteryagent_claimofficer@yahoo.co.uk . Hint: this could help the Yahoo name becoming devalued to such an extent that we no longer trust it.

LYCOS:  ----- The following addresses had permanent fatal errors ----- <abuse@support.lycos.com> (reason: 452 4.4.5 Insufficient disk space; try again later) !

An abuse report to Comcast produced the following:
A message (from <john@data-wales.co.uk>) was received at 7 Mar 2008 3:04:07 +0000. The following addresses had delivery problems: <abuse@comcast.net> Permanent Failure: 522_
mailbox_full;_sz=1023999388/1024000000_ct=8408/100000 Delivery last attempted at Fri, 7 Mar 2008 03:04:07 -0000 .

 

August '07 - Who hosts the domain microsoftsweepstake.com? Amazingly it turns out to be Yahoo!! Is it any wonder that the UK House of Lords says that fraud victims should be able to sue Internet service providers. (I asked Yahoo to close microsoftsweepstake.com on 12 August 2007.) What about lottery-nl.com? That is a customer of AOL!

This is how Yahoo responded to a recent request to close down a criminal's mail account. Their strange observation highlighted thus :

"Thanks for writing to Yahoo! UKIE Customer Care. Thank you for sending this information to Yahoo! Please be assured that in Yahoo! we investigate all the reports our users make. After careful evaluation we have determined that the message you have sent us doesn't contain enough information to determine if the Yahoo! account you are reporting has broken our Terms of Services. (TOS)

In order to investigate this issue further, we ask you to provide us with a copy of other relevant e-mails you have received during your correspondence with this Yahoo! account, in particular the first message
that was sent to you.

Once we received this information, we will be able to investigate this matter further and take the appropriate action according to our TOS. I look forward to your response so that I may help you with your issue further.

Regards, .............  Customer Care - Yahoo! UK & Ireland

CONFIDENTIALITY NOTICE: This email and any attachment is confidential and
may be legally privileged. It is intended for the named recipient only."


This was the mail forwarded to Yahoo with the request to close the account. I have flagged in red just some of the content which points to this being criminal fraud mail (including the typical punctuation, spacing and spelling mistakes).


Return-Path: <eaglexpresscourierservices@yahoo.co.uk> (An address of the sort commonly used by the criminals).
Received: from web28003.mail.ukl.yahoo.com
([217.146.182.108] verified)
by .............co.za (CommuniGate Pro SMTP 5.0.9)
with SMTP id 180709228 for ........co.za; Sun, 14
Jan 2007 20:19:26 +0200
Received: (qmail 98682 invoked by uid 60001); 14 Jan 2007
18:19:08 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.co.uk;
Message-ID:
<20070114181908.98680.qmail@web28003.mail.ukl.yahoo.com>
X-YMail-OSG:
QnCShOAVM1ksvA9I1zzkIgru6UnYkkv2E2iGzInUzOfKTzhcsXqDXF.ekBP_
45bkWA--
Received: from [196.3.62.3] (Starcomms Nigeria, commonly used by the criminals. Just why would a person posing as a European try to hide the fact that he was mailing from a Nigerian Internet cafe by using a Yahoo.co.uk address?)
by web28003.mail.ukl.yahoo.com
via HTTP; Sun, 14 Jan 2007 18:19:08 GMT
Date: Sun, 14 Jan 2007 18:19:08 +0000 (GMT)
From: Eagle Xpress Courier Services
<eaglexpresscourierservices@yahoo.co.uk>
Subject: MAKE PAYMENT IMMEDIATELY (Typical fraud subject header)


Compliments of the day to you.
I received your mail and identification,you are now to make payment to our accounts officer. You are to make payment of the sum of 246.75 to our Account department.Make payment via Money gram which is one of the fastest means to transfer money, just go to any rennies bank outlet you will find the
services of money gram transfer..Make payments to our account officer. (A typical 419 fraud payment request)

Mrs Linda Williams
Cumberland House
80 Scrubs Lane
London
United Kingdom.

Ensure to mail us the scaned reciept of the payment as well as Refrence number, sender's first and last name. These informations should be mailed to the following email address
courier_exchange@deliveryman.com
infodesk_eaglexpressuk@yahoo.co.uk (Typical additional addresses)

As soon as your payment is Verified,your package will be dispatched to your address and should get to you within 48 hrs with respect to the option you chose. I hope to hear from you soon.Have a nice Day.

Mr Harrold Thurham.

   Additional information was sent to Yahoo and we hope that they have now acted, but why do they take any opportunity to disregard abuse reports and to delay taking action? We receive many reports from potential fraud victims who find it difficult to include full mail headers when they forward fraud mail to us. We have hundreds of examples of cases where Yahoo has declined to close obvious criminal accounts on the grounds that just some of the fraud mail headers were not included in a report. 

 

................................................

Microsoft.  How they responded (Jan '07) to a report that a site they host, netdrawsboard.org, appeared to have been registered for the purpose of Internet fraud:

<abuse@microsoft.com>:
Remote host said: .... <Your e-mail was rejected by an anti-spam content filter on gateway (........). Reasons for rejection may be: obscene language, graphics, or spam-like characteristics. Removing these
may let the e-mail through the filter.>
 

It would be interesting to know how one could forward the evidence of fraudulent spam mail , without the report containing some "spam like characteristics". 

A target of the scammers wrote for advice recently and added "I have contacted Microsoft four times on this matter, and they cannot be bothered to respond".
 

...........................................................

Not just Yahoo and Microsoft ....

Cox.net : on sending an abuse report to cox.net (January '07) we received the following response: "This Message was undeliverable due to the following reason: The user(s) account is temporarily over quota. <abuse@cox.net>  Please reply to <Postmaster@cox.net>  if you feel this message to be in error." We were complaining about the use of marcibell@cox.net in a fraud mail sent on the 8th January.
 


  John Weston / IFA Group (UK), 2002 ...