The scam group behind these emails are a little more creative than most email scammers looking to steal your banking details as they put some effort into copying the layouts and look of the email to closely match that of the financial institution they are claiming to be. They also write in better English than most scammers and they attempt to cover their tracks by using multiple hacked websites for the form which is used to steal your banking details. By using multiple hacked websites to send their scam emails and to conduct their fraud they hope to stay one step ahead of the authorities.

The Citi Credit Card Statement scam email is noted below. Do not click any links in this email and if you have already filled out the form you need to contact your bank and local police department immediately.

Dear Cardholder,

Your Citi Credit Card statement is now available for you to view online. Here are some key pieces of information from your statement:

Statement Date: May 10, 2012
Statement Balance: $4367.60
Minimum Payment Due: $2911.36
Payment Due Date: June 7, 2012

Want help remembering your payment due date? Sign up for automated alerts such as Payment Due reminders with Alerting Service.

To set up alerts sign on to www.citicards.com and go to Account Profile.

I prefer not to have this email contain specific information from my statement. Please send me just the announcement that my statement is ready to view online.

Your Citi Credit Card Statement Email Scam is a post from: Get Rich Fast

This scam is like most email draw scams in that they claim you won a prize for a contest you never entered and that you need to fill in a form and send it off for your prize – that’s when you will be contacted and asked to send money to release your winnings. No real lottery picks people at random and none ask for money to release funds that you legitimately won.

The scam email as sent to us is noted below. The email was sent from 175.142.194.228 belonging to tm.net.my

UK STOCK EXCHANGE DRAW
10 Paternoster Square, London,

EC4M 7LS United Kingdom

Draw No: 01/03/2012/SED/INTL

Dear Winner,

We congratulate you this day as you have emerged a winner in the UK Stock Exchange Draw. See attachment for claims procedure. Thank you.

Mrs. Susan Maule
Announcer
UK Stock Exchange Draw

NOTE: Please print this email only if you have to, let’s protect our environment.

The email contains a .pdf file called – CLAIMS_PROCESS_UK STOCK_EXCHANGE_DRAW.pdf. Don’t open attachments from any email of this type – they may contain malware or viruses.

Winner Notice – UK Stock Exchange Draw is a post from: Get Rich Fast

As with the vast majority of these email scams there are numerous dead giveaways that the email is not real. First with this one is the lousy use of the English language – your first hint that something is not right. That mistake in the title of the email should start your juices flowing – McDonalds can afford to pay people who know English.

Second clue – why is McDonalds contacting you and giving you money when you haven’t entered anything? They also don’t address you by any name – yet they know you won something? It’s these types of holes that you should see and pick apart to let you know that something is wrong. And for us – we haven’t eaten at a McDonalds in nearly two years!

The email as sent to us is below. It is very short and contains a form for you to fill out called winner.html. In it they ask for your credit card details and personal information – with this they will attempt to steal money from your credit card. Do not respond to this email and don’t open any email attachments from any email unless you know the sender and are expecting that particular email! This is one way they not only steal your information, they can also use such attachments to load malware and viruses onto your computer to steal even more information from you, or to use your computer to send out further spam emails targeting other people.

The form contained within winner.html will send your information to – 85.125.116.26.

Hello.
McDonald’s is contacting you to announce that you are the winner of a prize on $100.
You have been selected from our customers all across the country.

To enter in posession of the prize you have to download the attachment and complete it!
Your account will be charged within 3 days from sending the e-mail.

If you responded to this email already you will need to contact your credit card company and local police department – tell them what you have done and try to recover before the damage gets too great.

McDonald’s is contacting you to announce that you are the winner of a prize on $100 is a post from: Get Rich Fast

What gives this fake Apple store scam email away is the outbound links. In your email client or web browser when you place your mouse over the link you will see that outbound link is not to where it should be. In this case the outbound links lead to a hacked website – bound4life.dk/Yt2GMopT/index.html. This is not always a foolproof way of identifying a scam as the smarter scammers will use javascript to further hide the outbound link. This is why you should consider disabling both javascript and html in your email client – it will also add an extra layer of protection against certain email-borne viruses, worms and trojans.

The email was actually sent from 201.35.2.52 – yet another Brazilian blackhole on the Internet. Brazil is fast becoming a haven for Internet scams. The scammer also uses images directly from Apple.com – and yet again we wonder why these companies are allowing hot-linking of images directly from their servers? Unless they are doing it to help catch the low-lying idiot scammers and spammers, they are just helping the fraud take place.

The scam email is noted below. If you responded to this email already and filled in the form you need to contact your credit card company and review this from Apple – http://support.apple.com/kb/HT4933?viewlocale=en_US

Order Acknowledgment

Order Number: W239675373

Ordered on Apr 09, 2012

Bill to

Jerri Christian
989 E Airport Rd
Urbana IL 61802-7407
(815)975-6174

Ship to

Jerri Christian
989 E Airport Rd
Urbana IL 61802-7407
(815)975-6174
Items in Your Order

MBP 17/2.4/2X2GB/750/SD/HR-GLSY-USA

$2,499.00

1

$2,499.00

Ships within 24 hours
Delivers Apr 11 – Apr 12 by Next Day Shipping
Part Number: MD311LL/A

OVERNIGHT SHIPPING CHARGE

$27.00

1

$27.00

Part Number: SHIPPINGG

Subtotal

$2,526.00
Estimated Tax

$157.88

Order Total

$2,683.88

Frequently Asked Questions
When will I get my items?
You will see a ‘Delivers’ estimate below each item, which reflects when your items are expected to arrive at your shipping address. Once your item ships from our warehouse, you will receive a Shipment Notification email with carrier and tracking information.

If you ordered multiple items, you may receive separate shipments with no additional shipping charges.

How do I view or change my order?
Visit online Order Status to view the most up-to-date status and make changes to your order. For more information about shipping, changing your order, or returns, please visit online Help.

You can also call Apple Store Customer Service at 1-800-676-2775, Mon-Fri 5 a.m. – 8 p.m., Sat-Sun 7 a.m. – 4 p.m PT. Please have your Order Number available.

Fake Apple Store Order Acknowledgment Scam Email is a post from: Get Rich Fast

This scam job offer email is like most of the others – short on details but long on promises. They all pretty much work the same where you are offered a job you didn’t apply for with the promise of working from home for really good money. The scam comes in how it is done. You will be sent payments and asked to deposit them into your bank account and send a portion of the money back to the scammer. After some time the bank will find that the deposited checks are fraudulent and deduct the amount from account – leaving you on the hook for the money.

No serious company will ever ask you function like this. You are not a banker and every business does its own payment processing. Never deposit money sent from offers like this like and withdraw upon it.

The job scam email as sent to us is noted below:

Good Day,

My Name is Mr. Paul Harris, Recruitment Manager Action Aid International. I am pleased in offering you a part time job where you work from home without interfering with your present job. Should you be interested please contact me for more details,

Best Regard

Paul Harris

It should be noted that ActionAid International is a real organization – ‘Action Aid International’ is a pathetic attempt at associating themselves with a real entity. Don’t be fooled.

RE: JOB OFFER Recruitment Manager Action Aid International is a post from: Get Rich Fast

This scam email attempts to scare you into filling out the form with your personal information by saying your account has been frozen because too many connections were made to your account. So to get your account working again you are requested to fill out a form and submit it to the scammers.

The ‘from’ email is forged to appear to come from Scotia@scotiaonline.com when in fact the email was sent from 90.83.107.141 which belongs to France Telecom – probably a hacked home computer working away as a sender of spam.

The moron scammers also used images directly from the Scotiabank servers – hotlinked – so it will not be long before the Scotiabank is on to the ruse. Or so we can hope anyways – so always slow down and practice safe surfing!

The scam email as sent to us is noted in full below. If you already filled out the form and sent it in – you need to contact both your local police department and bank immediately.

DESACTIVATION OF YOUR ON-LINE ACCESS ACOUNT

Dear Customer,

WATCH OUT !

We had recently noticed that many IP addresses were connected to your ScotiaBank account, moreover the password errors before getting access to your internet portal. Now, we need to reconfirm, for your security, some of your ScotiaBank’s account informations. In case of no confirmation from you, we will be obliged to desactivate your on-line account for indefinite time.

The procedure is easy :

1. Download the attached form and open it in a secure internet navigator.

2. After that, you will be asked to follow some instructions to restore your account.

We apologize for the inconvenience and look forward to hearing from you.
THIS IS AN AUTOMATIC MESSAGE. PLEADE DO NOT REPLY.

IMPORTANT DESACTIVATION OF YOUR ON-LINE ACCESS is a post from: Get Rich Fast

The ‘from’ email address has been forged to appear to be from easyweb@tdcanadatrust.com when in fact it has been sent from an email server in Brazil – yet another country becoming known as a blackhole on the Internet when it comes to spam and scams.

The scammers also stupidly linked directly to images on the TD Canada Trust servers which will quickly notify them of the ongoing scam attempt. Well, one can hope anyways, and why are these banks not blocking hotlinking of their images and logos? Is it to help track and catch these scammer morons – we’ve asked two banks and didn’t receive any answer to that question.

The scam email has two real outgoing links to TD Canada Trust but the one purporting to lead you to your account and a fix to your ‘problem’ leads to a hacked website – eyeware4you.zzz/images/infobox/schemes/index.html on IP 61.47.47.35.

The scam email is noted below in full. If you receive these types of email alerts they are all scams so they can just be deleted or if you wish you can forward them to your bank so they can get the authorities involved in tracking down the scammers.

Dear Customer,

We recently reviewed your account, and suspect that your TD Canada Trust Online Banking account might have been accessed by an unauthorized third party.

Protecting the security of your account is our primary concern, therefore as a preventive measure, we have temporarily limited access to sensitive account features.

To restore your account access, we need you to confirm your identity.

Please follow the link below to proceed to confirming your account information:

https://easywebsoc.td.com/waw/idp/login.htm?execution=e1s11sessargs8WiAT-tsM5PMX8vgoSt9YoyidHmkqZ.

If you are concerned about the authenticity of this message, please click here or call the phone number on the back of your credit card.
If you would like to learn more about e-mail security or want to report a suspicious e-mail, click here.

© 1999 – 2012 TD Canada Trust. All rights reserved. Equal Housing Lender

Important Notice – TD Canada Trust Scam Email is a post from: Get Rich Fast

This particular email lists a company name that doesn’t exist and uses your usual scam email tactics such as a fake ‘from’ email, fake names and having been sent from nefarious regions of the Internet.

The email was sent from mail.restoria.ru – IP – 46.0.207.185. That alone should raise some red flags. Ask yourself if you really feel comfortable sending your personal identification and banking details to company and individual that don’t exist, in a country known for email spamming and scamming? Of course you don’t and that’s why taking a few seconds to listen to your common sense just makes sense. Using google doesn’t hurt either!

The scam email as sent to us is noted in full below. There are hundreds of variations of the same thing all looking to prey on those in need of a loan or financial bridge. Simply put – reputable financial companies don’t spam!

Greetings,

We the project liberty finance loan company invite you to partner with us and benefit in our new Loan and Project funding program. We offer flexible loans and funding for various projects bypassing the usual rigorous procedures. This Funding program allows a client to enjoy low interest payback for as low as 3% per annum for a period of 5-20 years. We can approve a loan/funding for up to USD 500,000,000.00 or more depending on the nature of business. We are currently funding for:

* Starting up a Franchise
* Business Acquisition
* Business Expansion
* Commercial Real Estate purchase
* Contract Execution

We are open to having a good business relationship with you. If you think you have a solid background and idea of making good profit in any venture, please do not hesitate to contact us for possible business co-operation with the details below.

Your Name::
Loan Amount::
Contact Address::
Sex/Age::
Loan Duration::
Country::
Valid Cell Phone Number::

Mr Williams Harry.

If you have responded to this email you need to contact your bank immediately and tell them in full what you have done.

RE: GREETINGS FROM LIBERTY FINANCE LOAN COMPANY is a post from: Get Rich Fast

If you get the following email you can delete it as spam. If you deal with the Bank of America be sure to forward your copy to their crime division. If you have downloaded the fake .doc file you should do a virus scan immediately as the file is likely also a vector for a virus.

We have successfully sent the following transfer:

*********************************************
Item #: 381669643
Amount: $1992.00
To: Ciba Geigy
Fee: 45.00
Send on Date: 03/16/2012
Service: Domestic Wire Transfer
*********************************************

You can always check your transfer status on the Review Transfer screen at www.bankofamerica.com.

Wire Details Report: report_381669643.doc (Microsoft Word Document)

Sincerely,

Member Service

www.bankofamerica.com

(C) 2012 Bank of America Corporation. All rights reserved.

The ‘from’ email has been faked like most scam emails of this type. It’s actually been sent from 122.174.19.9 which belongs to a growing spam and scammer haven at airtelbroadband.in in India.

In the scam email we got one of the outbound links leads to 204.3.32.57 – a hacked server belonging to ntta.com in the United States. The other cloaked outbound link leads to 1stjokers.clanteam.zzz – this one is a free web host.

Your Same Day wire transfer was successfully sent is a post from: Get Rich Fast

The sender claims to be Libya yet the email was sent from 184.171.167.202 belonging to Secured Servers in the U.S. (this one comes up a lot) and routed through 68.230.241.215 – Cox Communications in Iowa. So unless a massive shift has happened in the world’s continents we can already see that this is a scam.

The scam email as sent to our email account is below. If you receive this email you can just delete it. If you have already responded contact your local police department.

Hello friend,

This is Sgt John Morgan Jr. of the Belgium NATO special force but redeployed to Libya, and presently stationed in Tripoli. I will like to share some very vital information that would bring some good financial returns to us in just a few weeks or days depending on how fast we handle the matter. I am seeking your assistance to evacuate the sum of $18M from this country to you, as far as I can be assured that it will be safe in your care until I complete my service here.

This may not be the best medium to make this kind of contact but it is the only access for me to reaches you.

I will continue with the details when you signify your intention to work with me.

johnmorgan@blumail.org

Respectfully,
Sgt John Morgan Jr.

I Am Seeking Your Assistance Scam Email is a post from: Get Rich Fast