Jan 21 2008
Let’s Play “Count the Red Flags”!
(In which we count the number of things that are wrong or suspicious within a scam e-mail message, just for sport.)
This showed up in my mailbox this morning, and I think it’s better than most:
To: lscfhafes@4d2.org
Date: Mon, 21 Jan 2008 08:05:13 -0500 (EST)
Subject: Congratulations!!! You Have Won One Million Euro...Contact Your Claims Agent.
From: "Westdeutsche Lotterie GmbH & Co. OHG."
Reply-To: westdeutsche_draw@yahoo.de
Received: from spain.micfo.com ([64.15.152.75])
by 4d2.org with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.68)
(envelope-from
id 1JGwjl-0006eu-1z
for lscfhafes@4d2.org; Mon, 21 Jan 2008 08:31:04 -0500
Received: from localhost ([127.0.0.1]:49090 helo=64.15.152.75)
by spain.micfo.com with esmtpa (Exim 4.68)
(envelope-from
id 1JGwKv-0005e7-VT; Mon, 21 Jan 2008 08:05:14 -0500
Received: from 213.185.118.195 ([213.185.118.195])
(SquirrelMail authenticated user henry@ogiomemm.net)
by 64.15.152.75 with HTTP;
Mon, 21 Jan 2008 08:05:13 -0500 (EST)
1. “Westdeutsche Lotterie GmbH & Co. OHG”, which should be a public corporation of some size, appears to use yahoo.de for email.
2. The message was sent through SquirrelMail, a webmail program that yahoo.de wouldn’t use.
3. The sender authenticated himself to SquirrelMail as henry@ogiomemm.net, which is different from the purported “From” address @yahoo.de.
4. The user sending the message has the IP address 213.185.118.195. And here’s who owns that IP address (drumroll please):
person: Victor Asiboja
address: VIENNA TECHNOLOGIES LTD.
address: NIGERIA
phone: +234-52-250676
e-mail: oriagome@yahoo.com
e-mail: borngirl@yahoo.com
nic-hdl: VA792-RIPE
mnt-by: AS22351-MNT
(Yes folks, we have already traced this back to Nigeria.)
5. The sender’s webmail server [ogiomemm.net/spain.micfo.com] appears to be located somewhere in Quebec. This is a very multinational organization indeed.
Westdeutsche Lotterie GmbH & Co. OHG
Central Office
Management and Central Services:
Rosenstrasse 12-16
DE - 70156 Stuttgart
Germany
Reference Number: WL/GmbH-23/07-OHG
Batch: WL/07- GmbH/9907
6. “Westdeutsche Lotterie GmbH & Co. OHG” looks like a real company — they run the lottery in the German state of North Rhine-Westphalia. But why would they have offices in Stuttgart, which is in a different state?
7. The addresses on Rosenstraße in Stuttgart go from 24 to 46, so 12-16 is an impossibility. In this day of online mapping tools, this is dead easy to find out.
8. The postal code for addresses on Rosenstraße is 70182, not 70156.
9. Plastering “GmbH” all over official-looking numbers makes no sense.
Congratulations!!!
We are pleased to inform you of the result of the just concluded annual final draws of the Westdeutsche Lotterie GmbH & Co. OHG Program.
Westdeutsche Lotterie GmbH & Co. OHG draws was conducted from an exclusive list of 25,000,000 e-mail addresses of individual and corporate bodies picked by an advanced automated random computer ballot search from the internet as part of our international promotions program which we conduct every year. No tickets were sold.
10. I know this is kind of subjective, but the English here is not broken in a way consistent with a bad translation from German.
11. The recipient address (lscfhafes@4d2.org) is random garbage that I have never posted anywhere — so where did they find it?
12. No tickets were sold? Who funds this lottery?
After this automated computer ballot, your e-mail address attached to serial number 07-9907 drew the lucky numbers 9-11-25-30-38-46 which consequently emerged you as one of first fifty (50) lucky winners in this category.
13. If you had a list of 25 million email addresses and wanted to pick 50 of them as winners, why would you assign them serial numbers and random lotto picks instead of just selecting 50 addresses at random? For that matter, how could you guarantee that 50 winning combinations would even be generated?
14. The odds of winning 1 million euros in this lottery are 1:500,000. The odds of winning the much lesser sum of $200,000 in the very popular Powerball lottery in the US are 1:3,563,609. This is quite a lucrative lottery.
You have therefore been approved for a lump sum payout of €1,000,000.00 (One Million EURO) in cash credited to file WL/GmbH-23/07-OHG. This is from a total cash prize of €50 Million Euro shared amongst the first fifty (50) lucky winners in this category.
15. What’s with the numbers in parentheses? This is just an e-mail, not some elaborate legal contract.
16. Stripping the non-unique gobbledygook out of “WL/GmbH-23/07-OHG” leaves only four meaningful digits. If this is supposed to be a unique file number for me, why doesn’t it provide enough number space for the 25 million supposed entrants (and why have other people online posted copies of this message with the exact same file number, but that’s a different issue)?
These funds is given to you for your business,educational and personal development, and at least 10% to be used by you to develop part of your enviroment, which is a measure of universal development strategy, and eradication of poverty.
17. This raises further questions of how this lottery is funded. If you were out to do some philanthropy, would you choose to fund a free online lottery on the condition that winners use 10% of their money for good works?
This year Lottery Program Jackpot is the largest ever for Westdeutsche Lotterie GmbH & Co. OHG. The estimated €50 million jackpot would be the sixth-biggest in Europe history. The biggest was the €363 million jackpot that went to two winners in a Febuary 2003 drawing of The Big Game Mega Millions' predecessor.
18. Many more than 5 lottery prizes in excess of 50 million euros have been awarded in the EuroMillions lottery alone, in the last few years. You would think that lottery organizers would know that.
19. It wasn’t 363 million euros, it was 363 million dollars, and it happened in the U.S. in 2000. So basically everything in the last sentence is wrong.
The idea of this lottery program is that within ten years from now, there will be notable richness among many unusual people around the world. This will give many people the opportunity to kick start their lives to a stage where they had always wanted.
20. This point may be a bit philosophical, but I feel that this just doesn’t wash. Many lottery winners who don’t tuck their winnings straight into savings end up bankrupt, addicted to drugs, or dead. There are sob stories all over the place. Again, this paragraph seems to imply some anonymous philanthropist lurking in the shadows. But isn’t giving away money randomly even more irresponsible than giving it to people who have bought a ticket? The only person I can imagine spending 50 million euros this way is Rich Texan.
Your fund is now deposited in an offshore bank with a hardcover insurance. Due to the mix up of some numbers,names and e-mail addresses, we advice that you keep this award from public notice until your claim has been processed and your money remitted to your nominated bank account as this is part of our security protocol to avoid double claiming or unwarranted taking advantage of this program by the general public.
21. “Mix-up”? “Keep this award from public notice”? Come on. And “general public”? It doesn’t get much more general than 25 million random e-mail addresses.
Please note that your lucky winning number falls within our booklet representative office in London. In view of this, your €1,000,000.00 (One Million Euro) would be released to you by our affiliate bank in London. Our agent will immediately commence the process to facilitate the release of your funds to you as soon as you make contact with him.
22. So they don’t sell tickets and they don’t process payouts. What exactly does this mysterious German lottery company do?
To begin your claim please contact our licensed and accredited agent assigned to you:
Mr.Jamie Ryan
Westdeutsche Lotterie GmbH & Co. OHG
Lotto Payment Release Order Dept:
London Representative Office.
Phone: +44-704-577-4570
Fax: +44-870-974-9667
E-mail: ryan_jamie19@yahoo.de
23. Licensed and accredited for what, and by whom? Why would they issue licenses for lottery agents?
24. Another Highly Important Lottery Representative with a Yahoo mail account, and using yahoo.de even though he’s got an English name and lives in London. I’ll bet that Mr. Jamie Ryan has a Nigerian IP address, too.
Your claims agent will assist you in the processing and remittance of your prize funds into your designated bank account.
Note that all prize funds must be claimed not later than 3 weeks. After this date all funds will be returned to the LOTTERY TREASURY as unclaimed. In order to avoid unnecessary delays and complications, please endeavor to quote your Reference Number:WL/GmbH-23/07-OHG and Batch numbers:WL/07-GmbH/9907 in every correspondence with your agent. Furthermore, should there be any change in your address, do inform your claims agent as soon as possible.
25. Blah blah blah, high pressure tactics. Real lotteries don’t work this way anywhere. Most lotteries give winners a year to claim their prizes. Also, here we have further confirmation that my reference number is supposed to be unique, in case there was any doubt.
Members of the affiliate agencies are automatically not allowed to participate in this program.
Congratulations once again from all members of our staff and thanks for being part of our promotions program.
Yours faithfully,
Mrs.Susi Cristoph
Promotions Manager.
Westdeutsche Lotterie GmbH & Co. OHG.
So that’s 25 alarm bells that went off in my head. Not that I would notice most of these without purposefully picking the letter apart, but one or two should be enough.
Before anybody accuses me of pointlessly deconstructing an obvious scam letter, Google “Westdeutsche Lotterie” and take a look at the people asking “is this real” in online forums. Those are the people smart enough (and uncertain enough) to ask — how many people have actually fallen for this crap?
Also, if anybody has more red flags to add, please feel free to do so.
Oh my God.
Thank you very much, they are asking me to deposit 1800gbp, in order to make the deposit in my bank account.
I was very stupid, I did send my ID, and my bank account number, but when they ask for me to deposit that kind of money, that’s when I started wondering if it was real or not.
Oh my, what will it happend now.?
Can they use my information?
HELP!!!!
Hi Magda,
Since you haven’t sent them money, the only thing they could do would be to use your bank account number and ID information to make a fake wire transfer request to your bank.
It’s not a disaster for them to have your ID — the worst thing they will probably do is use your ID to trick other victims in the future. It’s unlikely that they’ll be able to use your ID to do things like open bank accounts, especially since they’re probably in a different country.
If you haven’t responded to these people yet, I recommend that you try not to sound like you are suspicious of them. For example, tell them you have to move to a different country for your job and won’t have access to e-mail for a long time. And then just don’t talk to them any more.
It’s probably also a good idea to talk to your bank. Explain what happened and ask if they can change your account number, in case the scammers do try to take money from your account.
I’m glad you thought twice before sending them the money. A lot of people fall for this sort of thing the first time they receive a message like this, and there are some people that are suckered into sending money like this repeatedly — you have no reason to feel stupid at all.
This is the second time this year that I have received something like this, once in the mail and now via e-mail. Thank goodness for suspicious people and the ability to track down scam artists. Both occasions I almost believed it, but listened to my gut and did a little research. Thank you to those that dug a little deeper.
Westdeutsche Lotterie GmbH & Co. OHG Program.
Wow,
I just received the exact letter with the exact winning numbers. Duplicate letter. Where can we report this?
I just received the same email. There has to be an appropriate law enforcement agency where we can report this. Please post one if you know.
Thanks
Westdeutsche Lotterie GmbH & Co. OHG
Central Office
Management and Central Services:
Rosenstrasse 12-16
DE – 70156 Stuttgart
Germany
Reference Number: WL/GmbH-23/07-OHG
Batch: WL/07- GmbH/9907
Sandy,
It’s certainly fraud, but the people perpetrating it are most likely somewhere in Nigeria, well out of the reach of decent law enforcement. In the U.S., you can report things like this to the FTC but it seldom, if ever, does any good — why would it?
Stuff like this happens all the time, and only very rarely is anyone punished. People just have to realize that by connecting themselves to the Internet, they’re participating in a grand experiment in anarchy, and it’s their own responsibility to keep themselves safe.
I just got this same exact email myself also, same numbers too lol, gotta love the scammers and how hard they try don’t ya? Anyways I will be reporting this via MailWasher Pro (email spam washing program that caught this email for me to start with) which will in turn report it to yahoo. We may not be able to legally do anything, but the headers do also give you the internet company that this email is attached to so it can be reported to them also.
Mailwasher will do this all for me so I won’t have to do it manually myself, but if you need to do this manually, go to yahoo and find the report abuse setup there, if there isn’t one directly find the help section and scan it till you find where to report it, it’s there. Same for the internet company this email listed “hebergement.com” I just typed that into my browser and it took me to an internet provider page. It needs translation so you’ll need to use an internet translator site if you don’t speak the language hehe.
Anyways, there may not be much we can do, but at least there are a couple things, and the more people that report this to yahoo, the more people will be blocked from using that service for this type of garbage. Just my opinion, hope it gets a few people to at least try
Jo Ann
Jo Ann,
The situation with e-mail headers isn’t always that simple. In your case, “hebergement.com” is an innocent victim of this scam — the sender of the email is either forging e-mail headers to make it appear that the message originated from that domain, or exploiting a vulnerability in a mail server. It’s can be trivial to do either one.
The only thing you can put any amount of trust in is the originating IP address, which in my example I traced to a small operation (could very well be nothing more than a small internet cafe) in Nigeria. There’s no way the person associated with that IP address is going to care about the scam — they could even be complicit in it.
The best you can hope for by reporting these messages is that Yahoo improves their bulk mail filters as a result of your report, but that won’t help anybody that isn’t using Yahoo mail. Sure, you may get the scammer’s Yahoo mail account revoked as well, but he can always open another one.
If you want to take the time to report these messages, you can, but I personally think that time would be better spent educating others about this type of scam.
Hi Mike,
I got a similar email with identical reference numbers! The thing is that I have a yahoo.co.uk address though I actually live in India. I guess the folks behind this scam thought I live in the UK and that I’d rush to my bank to send them the money!
I found that some of these scamsters are FORGING sender email addresses ( I received an email where the sender had used my own yahoo email id as the sender!) and then they try to sucker someone.
Yes, most of these Internet scams originate from Nigeria. Enterprising folks, aren’t they? If only they’d put this brainpower to honest use…..!
Hi Mike,
I got this same e-mail this morning. Most of the time I can distinguish between scams, but this one was a little better than the others. I usually reply something really foul back to them and they leave me alone. They should be ashamed of themselves.