Stop Art Scams

Scam Email: Karen James

2012-01-30T09:29:00.000-08:00

Scammers will post their scam "pitch" anywhere. Here is one forwarded from an artist where the scammer put their pitch in the comments area of the artist's blog.

Hi Kathleen,
I ran across your blog site about art scams & wanted to post an additional name to your list. This appeared in my comment section on my blog. When I checked the IP sent to my email, it connected to an African server. Rather fishy...

*Karen James*
karen.shop@live.com
41.155.14.88
Submitted on 2012/01/28 at 1:53pm

Good Day,

I’m Karen James From Finland.I want to place an order and i know the difficulties encountered when shipping internationally,But that will not be a problem because i am registered with a shipping company which I’ve used severally times without any delay nor damage.Before i place the order,i want to inform you that i will be making the payment with my Mc/Visa cards because as for now i can only make payment with my US credit card account information,so if it’s okay by you kindly get back to me with the contact details and please reconfirm your website so as to know if I’m right with the site.I awaiting your swift response so as to list out the items needed.

Karen Shop
Address: Hitsaajankatu 9
00810 Helsinki, Finland
Phone: 0207 428 503
Warmest Regards,
Karen James

I appreciated running into your blog.

Sincerely,
Gale

Scam Email: Johnson Mark

2012-01-13T09:20:00.001-08:00

It's entertaining when the scammers don't even comprehend what order to put the first and last name for their fake email information.

FROM: Johnson Mark [markjohnson805@gmail.com]

Hi
My name is Johnson Mark, i will like to order for some piece of your work from your studio as gift for my parent are celebrating their wedding anniversary, so i will be glad to have your reply as soon as possible, i will be glad if you can send me your website address to choose or send me four of your artworks via email that is available for me to choose. Waiting to read from you today.so that we can make some progress.
Best Regards,
Johnson Mark.

Scam Email: Carmen Gonzalez

2012-01-12T07:11:00.000-08:00

This scammer has been reported under various names, using this email account but changing up the number (edwedg18@gmail.com, edwedg12@gmail.com, edwedg4@gmail.com, edwedg7@gmail.com, etc). Notice how they patiently try to walk the potential victim through the scam. The "story" comes out in the 3rd email. But why scammers try to rush victims through the steps of the scam is to avoid exactly what happened here - the artist got suspicious enough to search online and then found this blog. Scammers want to get their money from their victims before they get too suspicious.

Kathleen,

This just keeps getting a little uncomfortable. I actually sent my address and phone number. Yikes! Thank goodness I caught on. What happens next? Is there something I need to do to prevent this?

Sincerely,
Deborah

First Email:

On Jan 7, 2012, at 11:14 AM, Carmen Gonzalez [edwedg18@gmail.com]
wrote:

Hi,

Hope this message finds you well. I saw these creatives works on your web site and i will like you to get back with more details if they are still available for purchase.

"Ambsace" and "Six of Them

I will appreciate an urgent reply.

Best Regards,
Carmen Gonzalez.

Second Email:

On Jan 9, 2012, at 7:12 PM, Carmen Gonzalez [edwedg18@gmail.com] wrote:

Hi Deborah ,

Thanks so much for your response to my query about those creative works. I will like to proceed with the purchase of both pieces . Can you pls confirm the actual size and price of the two pieces so i can know how best to proceed. I will also like to know what inspire you to make the pieces.

I will look forward to hearing from you soon.

Best Regards,
Carmen.

Third Email:

On Jan 10, 2012, at 7:57 PM, Carmen Gonzalez [edwedg18@gmail.com] wrote:

Hi Deborah ,

Good to hear back from you. Yes,i will like to proceed with the purchase of both works ( framed and ready to hang ). I think they are lovely works and i hope to give them good home.

I am presently away in Cancun for my twin sister's wedding even though it comes at a time when i was preparing for a big move and also expecting a baby but it means so much to her. I should be back in few days.

Meanwhile,i will like you to forward your mailing address and phone number so i can inform my husband still shutling between our home in New Jersey and London on where to forward the payment . He has just been transfer to head the IT section of their head Office in London.

I can also forward your contact info to the local cartage company that will be moving all our house decors so they can get in touch with you to arrange shipping details. They can arrange FedEx pick up of the artworks from your studio.

I will look forward to hearing from you so i can know how best to proceed. Cheers.

Best Regards,
Carmen.

Fourth Email:

From: Carmen Gonzalez [edwedg18@gmail.com]
Date: January 11, 2012 5:43:23 AM CST
Subject: Re: Artworks Inquiry...

Hi Deborah ,

Hope this message finds you well. I spoke with my husband late yesterday and he promise to send the payment as soon as you get back with your mailing address and phone number. I will look forward to hearing from you soon.

Carmen.

Scam Email: Emma David

2012-01-11T09:56:00.000-08:00

Here is an email I received this morning from another artist. Notice how the scammer sent another fake email from a fake shipper to make it look more legitimate and to try and move the scam along more quickly, before their potential victim figures out it's a scam.

Hello Kathleen,

I googled the first line of the last email I had received from "Emma David" emmasupperstore@gmail.com As you had mentioned the disjointed English and odd quantities of work sent off alarm bells. A total waist of my time but at least time is all I lost.

If you could add "her" name to the list I would much appreciate it.

Many Thanks
Tiffany

Dear Vicky & Tiffany,
This is an automated response from your webserver. We are delivering you an email from someone that was on your website. We'll give you the users details first that they submitted, then close the email with their comments (if they submitted any).

Name: Emma David
Address: Michelets vei 163,N-1368
STABEKK,Norway
Email Address: emmasupperstore@gmail.com (you can click reply and your email client will use this address)
Telephone Number: + 476713102630
Comments:Good Day, I'm Emma David From Norway.I want to place an order and i know the difficulties encountered when shipping internationally,But that will not be a problem because i am registered with a shipping company which I've used severally times without any delay nor damage. Before i place the order,i want to inform you that i will be making the payment with my Mc/Visa cards because as for now i can only make payment with my US credit card account information,so if it's okay by you kindly get back to me with the contact details and please reconfirm your website so as to know if I'm right with the site.I awaiting your swift response so as to list out the items needed. Emma-D-Supperstore Michelets vei 163, N-1368 STABEKK, Norway Telephone: + 476713102630 Telefax : + 476713 4527

Warmest Regards,
Emma David.

Second email from scammer:

Hello Victoria,

I got you response,So below here is what i need.

Blossom TreeOriginal Acrylic on CanvasQty...1
DunoonOil and pastel, incorporating lino printing30cmx40cmQty...2
View from Kirn of Western FerriesAcrylic Painting on Canvas60cmx66cmQty...3
Western Ferries in StormAcrylic PaintingOriginaQty...2
Waverley on ClydeWater Colour30cmx40cmQty...3

Please kindly calculate the total cost of the items,so that you can get the order processed for me.i will email you my credit card account information for the payment of the order.

Concerning the shipment, i will be having my shipping agent coming to pickup the order directly from you because i already have some large merchandise with them in which after picking up the items,they will then deliver it to me here in Norway.

Regards,
Emma.

Email from fake shipping company:

----- Forwarded Message -----
From: Highway Express [highwayexpress@ymail.com]
Sent: Wednesday, 11 January 2012, 15:07
Subject: Norway Shipment...

Dear Customer,

Highway Express Delivery have been informed by Mrs David from Emma-D-Supperstore (Norway) to picking up her order at your location and then send them over to Norway.I hope you are aware that she already have some merchandise at our warehouse which needs to be sent together over to her in Norway.and you have been informed that you will be transferring payment to us via western union in other for us to pick up her additional merchandise she have order in some location,and schedule our pick up arrangement with you.So we need to confirm the payment of (£2,350) fist so as to start up with the shipping document.and NOT,Payment needs to be received first before preparing any of the paper works as per custom regulations in meantime that the order would be pick up.

So kindly get back to us with the location where the goods will be pick up from and also we need to know the contact person that we will be pick up the goods from,also below here is our head office details where all European payment is been made to:

Receivers name: Kuma John
10 Jalan Juruanalisis SatuHicom-Glenmarie Industrial Park,
41050 Shah Alam, Selangor
MALAYSIA

Good Health,
Shipping Dept.
Highway Express Delivery.

Scam Email: Richard Aaron Graham

2012-01-10T10:05:00.000-08:00

Here is a great example to show that scammers almost could care less who they are sending their massive amount of emails to. Okay, some try to personalize their scam more than others. Below is an example of a scammer who doesn't try at all.

Email sent to me:

Dear Kathleen:

Thanks for the blog on art scams. Stealing from self-employed artists is about as low as you can sink.

Here is a follow up story, which might amuse you, a letter to me from someone on your list of scammers.

First, some context: I am a biologist, not an artist. But my web site mentions I had an endowed professorship (*Chair* of environmental studies) and that I published a book chapter on *alligators* in wetlands.

A message arrived from Richard Aaron Graham, asking about unit price and lead time to purchase an "alligato chair".

Regards, Paul

FROM: Richard Aaron Graham richigraham@gmail.com
DATE: Jan 5 (4 days ago)
TO bcc: me

Hello,

My name is Richard and wants alligato chair .Please let me know unit price and the lead time to get them ready for pick-up

with kind regards here,
Richard.

Scam Email: Curtis Thompson

2012-01-09T20:19:00.000-08:00

Here is an email I received from an artist:

Hi, Kathleen - I have recently received a few emails that seem suspicious. Thanks for your very informative web site! At this point, the character has my address to send the payment, but that's as far as it's gotten. I told him that I wouldn't release the artwork until his payment cleared. If he sends more than the exact amount, I'll refuse or return it - and if he sends the exact amount, I'll see if my bank can verify it.

The name is Curtis Thompson and I'll forward the first email to you. If you want the rest, let me know.

Janice

First Email:

From: Curtis Thompson [sunoco010@gmail.com]
Date: Thu, 5 Jan 2012 22:30:42 +0100
Subject: Father's Day
--
Hello,
Good day to you over there, My name is Curtis Thompson I'm from New York and i hope this message finds you well.I was going through your works and my eyes caught Father's Day, I am moving soon and i will like to have it for my new apartment.

please let me know if the piece is available, if yes let me have the detailed price and more information about it. i will be waiting to read from you asap.
Curtis.

Second Email:

From: Curtis Thompson [sunoco010@gmail.com]
Date: Fri, 6 Jan 2012 06:49:10 +0100
Subject: Thanks

Hi,

Good to hear back from you. Yes,i will like to proceed with the purchase of the paintings. I think its a lovely work and i hope to give it a good home.

I am presently away in UK representing my company for an EU economic summit and i should be back in few days.

Meanwhile,i will like you to forward your mailing address and phone number so i can inform my personal assistant on where to forward the payment . I can also forward your contact info to the local cartage company that is handling my move so they can get in touch with you to arrange shipping details. They can arrange FedEx pick up of the artworks from your studio.

I will look forward to hearing from you so i can know how best to proceed. Cheers.

Best Regards,
Curtis.

Scam Email: Tanja Kailis

2012-01-04T15:25:00.000-08:00

This one just received is pretty classic. They are hiding the ball on the details of their scam until a person replies, then they will go more into detail about their shipper (who is really non-existent) and paying with a credit card (which will turn out to be stolen), and often they do not mention overpaying - which they will by a couple thousand dollars, explaining they need you to forward the difference to the shipper via Western Union. All their money is fake, you forwarding your money is real and they pick it up from Western Union and then can not be traced. It's why this particular format of the scam is so popular.

Hello , I will like to place a quick order with you to my location here in Beirut,Lebanon.Please advice if you can have it shipped to me .In regards to shipping my order,i will advice the best and easy way to have my order shipped to me in-case you might want to have difficulties sending orders to my location.Please also advice if you accept visa or master credit card cause i will be paying with my credit card.Let me know soon so i can place my order right away. Sincerely Tanja tanjakailis@rediffmail.com

Scam Email: John Henry or John Smith

2011-12-29T22:35:00.000-08:00

So many things about this scam is wrong. Makes it easy to know it is not for real. Lazy on the scammer's part. But good for us.

Return-path: [john_henry155@rediffmail.com]
Delivery-date: Thu, 29 Dec 2011 23:17:00 -0600
Received: from f4mail-235-239.rediffmail.com ([202.137.235.239]:52780 helo=rediffmail.com)
From: "Simth John" [john_henry155@rediffmail.com]
Subject: PLEASE QUOTE

Having gone through your listed products, we offer

great interest to do a purchase agreement with your

company. Please get back to us with the following

information

PLEASE QUATE

1. Prices FOB

2. Payment terms

3. Delivery Period

4. MOQ

5. Specified delivery date assuming from the Date of Order.

you can also get back to us through our private email:pretexglobal@yahoo.com

Please your quick reply will be highly appreciated.

Scam Email: Nadia Coker

2011-12-28T12:53:00.000-08:00

This scammer went as far as calling the potential victim to followup on receiving the payment (which is fraudulent). They want to rush a victim through the steps of the scam, before the potential victim is likely to actually search their name or email address online or ask their bank. Fortunately, the artist who forwarded this to me did not lose any money or items before she *did* search online.

If a scammer ends up bothering you via the phone, on the second call be all excited and say, 'the authorities have asked me to record this phone call - okay, what do we need to do next?" And I'm guessing they will hang up darn fast and not call back again.

Here is the last email sent by this scammer, with all the usual blah blah blah about their fake story to try and rationalize why they would be overpaying by so much (and of course leaving out the crucial details of ALL of their money is fake, the shipper is fake - there is no shipper, there is no husband, and the only one who gains from this is them, when they receive the victim's good money via Western Union so that once picked up it is untraceable).

From: Nadia Coker [bestnadiacoker@yahoo.com]
Date: Fri, 23 Dec 2011 23:28:54 -0800 (PST)
ReplyTo: Nadia Coker [bestnadiacoker@yahoo.com]
Subject: Re: Overpayment..

Hello Judith,
Good to hear you have received payment for "Curious". Thanks for your update, I am very excited and can't wait to have your work in our home. I hope to give it a very good home and enjoy the piece for years.
Regarding the payment, my husband overpays you because he didn't have full details of the transaction since I was sick when he sent it. He mistakenly added mover’s payment with yours. He sent you a check of ($6,200 instead of $4,500). Anyway that should not be a problem, kindly deposit the check with your bank and as soon as you are credited with the funds, you can go ahead and remove the asking price for ("Curious") and forward the difference back to my husband. I will talk to him and get back to you with the information require sending the refund back to him.
Meanwhile, the shipper is currently on Christmas holiday. I was able to get in touch with him shortly before sending you this message. He said he can not come for the pickup now until after Christmas or first week in January 2012 which I think is still very ok by me. He has promised to get in touch with you to arrange for the suitable date and time with you. Try and make shipping arrangement with them and keep me posted with updates.
Finally, I would like to thank you for your patient and sincerity. I hope to purchase more of your works in the nearest future and meet you

Scam Email: Anderson Harry

2011-12-24T10:29:00.000-08:00

Yet another scammer who can't recognize typical first names from last names when creating a fake scammer name.

From: Mr Anderson Harry [mr.andersonh@yahoo.com]
Sent: Friday, December 23, 2011 1:22 PM
Subject: inquiry

Hello,

   I am Mr.Anderson Harry, i want to buy painting works suitable for hotel installation/decoration mostly for these places; guest rooms, hallways, and the reception.currently its on renovation. I would prefer contemporary abstracts and figurative styles. oil on canvas and water color.
    Could you please let me know if you have some works available for sale,also get me the price details for the works. i am going to pay you with credit card.
     Kindly get back to me for more details.
Thanks.

BEST REGARDS,
Mr.Anderson Harry
+447011130170

Scam Email: Christine Cannon

2011-12-23T08:24:00.000-08:00

Very odd that this scammer felt the need to make their fake last name all capital letters. Also, their fake email address is pretty poorly constructed from their fake name. The rest of it is all classic to what we typically see.

Values submitted from web site form:

Name : Christine CANNON
Email : cannstine@gmail.com
Country : United States
City : seattle
Enquiry : Good day to you.

I am so excited that I came across of your work on internet search,I am interested in purchasing these creative artworks from you.....................

Embracing the future,Sharing the journey and Celebration of life

Let me know their various prices.and how much discounts are you going to give?I will be happy to have these selected artworks hung in our new home in South Africa.As well,I want you to take out the shipping cost.I have been in touch with a shipping firm that will be shipping other house decoratives.

We are traveling from our Seattle home to our new apartment as soon as possible.On Paying for the artworks,I will be glad to pay you with a Money Order or Cashier`s check in US funds that can be easily cashed at your local bank,please let me know on how to proceed for the payment of the creative artworks.

I will await your advise on how to proceed.Have a wonderful day.

Take care,
Christine CANNON

Scam Email: James Harry

2011-12-17T10:23:00.000-08:00

Here is a classic series of emails that went to an artist who forwarded it to me. Notice how he carefully presents each part of the scam in subsequent emails until he finally reveals the core of the scam: overpaying (with what will turn out to be a stolen credit card number) and asking that the overage be forwarded to his shipping company (who does not exist). He had not yet mentioned the "shipper" would then require payment via Western Union but that would most certainly come in the next email - had the artist not gotten suspicious and began searching online and confirmed it was a scam.

"Kathleen thanks for your info on the Internet. I came so close to getting ripped off. Here is the conversation from a so called " hotel owner" in London. did a search on his address and it is a car dealership. Plus could not find the hotel on the Internet.

Then I came across your blog.

Thank you,

Diane"

First Email:

From: "Mr.james Harry" [mr.jamesh@yahoo.com]
Date Sent: Dec 15, 2011, at 4:35 AM

Hello,

I am Mr.James Harry, i want to buy painting works for hotel installation/decoration mostly for these places; guest rooms, hallways, and the reception. I would prefer contemporary abstracts and figurative styles. oil on canvas and water color.
Could you please let me know if you have some works available for sale,also get me the price details for the works. i am going to pay you with credit card.
Kindly get back to me for more details.
Thanks.

BEST REGARDS,
MR. JAMES HARRY.
Owner lewis Hotel & spa
20 Radley Mews
Kensington
London
W8 6JP
+447011130170

Second email:

From: "Mr.james Harry" [mr.jamesh@yahoo.com]
Date Sent: Dec 16, 2011, at 11:44 AM

Hello Diane,
Thanks for your reply. I like some of the works here, they will make a nice fit for the decorations. I will take 3 works . Please do know that i made arrangement with a shipping agent that will come for the pick up. he is going to do the shipping with other items too. he will contact you immediately we are through with the payment.
I will like to see these works hanged in my hotel As soon as possible.

Please confirm the grand cost of the following Works for payment.

pink ladies $475.00
spring tulips &1,200 and hamony $1,500 Total = $3,175

Looking forward to your urgent reply.
BEST REGARDS,
MR. JAMES HARRY.
Owner lewis Hotel & spa
20 Radley Mews
Kensington
London
W8 6JP
+447011130170

Third Email:

From: "Mr.james Harry" [mr.jamesh@yahoo.com]
Date: December 17, 2011 12:30:17 AM CST
Subject: Payment Arrangement
Hello Diane,
Sorry i did not tell you how I got your contact, it was through the net. I was looking up for an Art gallery to request for artworks for my hotel renovation and i came across your contact.
YES I love the works. I am going to send you my credit card details for the payment proper.
once you are in receipt of it, you are authorize to charge my credit card,i will send it together with the three digit number and expiration date , or even the scan copy ,then you charge the card, it will reflect and confirm the total amount of $8,500.00USD in your account, then deduct $3,175 as full cost of the works, and transfer the balance of $5,325 to my shipping agent for the pick up and shipping of the works and other materials. I will forward to you his Information details immediately i receive your confirmation with this.
Confirm and get me these details for the payment

NAME, PHONE NUMBERS FOR SECURITY REASONS AND YOUR GALLERY ADDRESS.

NOTE ,i will pay,any expenses or fees incurred for the charges.
I am looking forward to your urgent confirmation ,

BEST REGARDS,
MR. JAMES HARRY.
Owner lewis Hotel & spa
20 Radley Mews
Kensington
London
W8 6JP
+447011130170

Scam Email: Mike Walter

2011-12-04T08:41:00.000-08:00

Here's an email I received from an artist:

Hello Kathleen,
I found your blog and thought I'd forward this to you. I was recently contacted by a Sgt. Mike Walter with the following emails. I did have the painting framed but that's OK, I'm just out $300 for that and it's not a big deal. But I started getting suspicious about this transaction and at this point I really think its a total scam. Yes, the kicker $2900 more than the asking price. I'm not going any further with this thing. I have the check which came from a bank in Utah and yet was posted from the UK. That makes no sense to me. In your blog you recommend just stop replying to the emails. Do the police or anyone else actually investigate this stuff. What do you recommend doing, besides stop replying to the emails? Thanks,
Denise

And here is the string of emails from the scammer (I've put my reply in the comments below):

From: Mike Walter [sgtmikewalter@gmail.com]
Date: November 21, 2011 11:35:48 PM PST
Subject: Payment Information

Hi,

Thanks for the message,I am very happy to know that the Artwork is still available for sale. i must tell you i am very much interested in the immediate purchase and i am willing to pay the asking price ($1000) for it framed .

I will like to let you know that your payment will be in a Certified Check and i will wait till it clears your bank before telling my shipper to come for the pick up, this will not take time at all because the payment will be sent out immediately i read back from you.You don't have to worry about shipment, my shipper will handle it. So get back to me with the information needed to send you the payment
I:E :

Full Name
Standard Mailing Address
Phone numbers

so that i can proceed in the payment arrangement. I will like you to consider it sold and get back to me asap with needed information to mail the payment.

Kind Regards and God bless you.

Mike.

Begin forwarded message:

From: Brad Bucknor [movingalltheway@yahoo.com]
Date: December 1, 2011 6:37:34 AM PST
Subject: Packing and Shipment arrangements for Sgt Mike Walter
Reply-To: Brad Bucknor [movingalltheway@yahoo.com]

Hi,

I have received communication from Sgt Mike Walter that we should work with you to pack and ship some artwork of his together with his other house decors to his new house in Indianapolis, IN when you two are through with the transaction,as he advise.

I will like you to get back with the kind and nature of the things he want to ship.I will like to have your studio/home address ,so i can make arrangement with any nearby Agent that will be coming for the pick up once you and Sgt Walter are through with the transactions. Thanks.

I will be happy to get an early reply from you so that i can begin arrangements on my end. Thanks.

Brad.

Pack N Box Movers and Logistics LTD
"Movers you can trust"
Email: movingalltheway@yahoo.com

Begin forwarded message:

From: Mike Walter [sgtmikewalter@gmail.com]
Date: December 3, 2011 10:24:14 AM PST
Subject: Payment Delivery

I have been expecting your email message because the courier service that will deliver the check has told me that it will be delivered today, get back to me as soon as possible so that i can know the delivery status of the check and get back to them if it is not yet delivered.
Regards.
Mike.

Begin forwarded message:

From: Mike Walter [sgtmikewalter@gmail.com]
Date: December 4, 2011 2:01:46 AM PST
Subject: Payment

Hi Denise,

Thanks for the message, i am very happy that the check has been finally delivered to you despite all the delay, I told you in my previous email that the remaining fund will be for the movers that will be moving all my decors to my new home and your Painting is included.I would have handled this in a more different way if not for my present deployment and now i am in Yemen, Deduct $1300 for the painting, Western Union Charges and your running around expenses.the remaining $2600 is to be sent to the movers to schedule pick-up asap, Please contact the movers for the information that will be required to send them the funds via western union money transfer and i am sure they will work with you and make sure the pick-up arrangement will be as easy as possible...Thanks for your patience and honesty in this transaction so far, please feel free to advice.... Thanks again and God bless you.

Kind Regards..

Mike.

Scam Email: Alice Mogan

2011-12-02T15:50:00.000-08:00

The contents of this scam email was a little different than the usual I see but there were still the enough of the usual signs to tell me this was a scam. One sign was the word enquiry. The generic nature of the email not even referencing what I supposedly do. The weird company name. Signing the email not by the person's name that has been stating at the beginning. And finally that weird period I *always* seem to see at the end of a signature of a scam email. Their templated software must produce this because no real person puts a period there.

NOTE!!!! DO NOT ACTUALLY CLICK ON THE LINK IN THEIR SCAM EMAIL!!! It's there to just show what was in their email in case others search on that to see if they have also received a scam.

Return-path: [info@aalconltd.com]
Delivery-date: Fri, 02 Dec 2011 17:38:41 -0600
Received: from [189.10.142.230] (port=39570 helo=pirahy.ind)
            by gator1036.hostgator.com with esmtps (TLSv1:AES256-SHA:256)
            (Exim 4.69)
            (envelope-from [info@aalconltd.com])
Message-Id: <201112022036.pB2Ka03n008759@pirahy.ind>
Reply-To: [aalconltd@yahoo.com.ph]
From: "Anglo group"[info@aalconltd.com]
Subject: Enquiry
Date: Fri, 2 Dec 2011 15:41:15 -0500

Dear Sir/Mdm

My name is Alice Mogan we got a recommendation of you from one of your customers about your products you deal on. Here is the exact sample of the product we wish to deal with your company, so please confirm to us if You/your Company can make provision of the exact. Please kindly view our website for the design sample of our desired products if your company can partner with us with similar products in the in-page of our company website below.

Click Here To View Our Sample. http://charleshhulseps.ocdsb.ca/Page/images/login.alibaba.com/login.alibaba.com/login.alibaba.htm

Upon the receipt of your confirmation, I shall forward to you the order quantity and delivery details, which will enable you to give us a proper quotation.

Looking forward to receiving your inquiry with price, invoice and shipment terms

Sincerely
Regards
Anglo group
Purchasing Manager.

Scam Email: Vivian Peston

2011-11-22T08:10:00.000-08:00

Sharon forwarded me a scam email she received. She seemed to have some lingering doubt as to whether it was a scam or not, but it definitely is.

Hi,

I have received an inquiry about my artwork and think this one is a spammer. Might not be, but as there were a few red flags, thought I'd pass this correspondence thread along as the name Vivian Peston did not appear on the list of names on your site.

Sharon

-----Original Message-----
From: Vivian Peston [vivianpeston@yahoo.com]
Sent: Mon, Nov 21, 2011 8:23 pm
Subject: Re: Mailing Info?

Hello Sharon,
Good to hear back from you. Yes, I will like to proceed with the purchase of both “Gramercy Park West Snow” ($900) and “Union Square Winter” ($1200). I really like them and I believe they will make a beautiful home. Kindly take them off your website and consider them sold to me.
Though, I am presently away in Geneva, Switzerland for my twin sister's wedding even though it comes at a time when I was preparing for a big move and also expecting a baby but it means so much to her. I should be back in few days.
Meanwhile, I will like you to forward your name, standard mailing address and phone number so I can inform my husband who is still shuttling between our home in New Jersey and London, United Kingdom on where to forward the payment by (Cashier’s Check). He has just been promoted and transfers to head the plant section of their head office in London.
I will also contact the shipping agent that will be shipping our entire house decorative so he can get in touch with you to arrange for the pickup at your address or studio as soon as you receive the payment and clear your bank.
I will look forward to hearing from you so i can know how best to proceed. Cheers.
Best Regards,
Vivian.

-----Original Message-----
From: Vivian Peston [vivianpeston@yahoo.com]
Sent: Mon, Nov 21, 2011 10:55 am
Subject: Re: Purchase Info..

Hello Sharon,
Thanks so much for your response to my query about those creative works. Yes I will like to proceed with the purchase of both “Gramercy Park West Snow” ($900) and “Union Square Winter” ($1200). They are really nice and I must commend you for the job well done.
Can you please get back with what inspire you to make this nice works as to know how best to proceed with the purchase?
I will look forward to hearing from you.
Best Regards,
Vivian

-----Original Message-----
From: Vivian Peston [vivianpeston@gmail.com]
Sent: Sun, Nov 20, 2011 9:44 am
Subject: Purchase Info..

Hello ,
Hope this message finds you well. I saw these realistic creative artworks on your website ([url as inserted here]). They are really nice and I am interested in them. Kindly get back to me as soon as you can if they are still available for purchase including their prices. They are titled as;
“Gramercy Park West Snow” and
“Union Square Winter”
I will appreciate your prompt reply.
Best Regards,
Vivian.

Scam Email: Brian Needs Help

2011-11-08T13:55:00.000-08:00

Here is a scam we see quite a bit that takes a different approach to getting money out of people. This was forwarded to me by another artist.

In this scam, it is typical that someone's web-based email or facebook account has been hacked (either by phishing and someone accidently giving up their password or just by software that goes through millions of combinations and once in awhile hits it lucky and guesses the correctly combo - particularly when people's passwords are easy to guess). So this scam email looks like it is coming from someone you know. I can relate to this. It happened to me on my hotmail account (and I wouldn't have considered my password easy to guess!)

Then they pretend they are in trouble and need money fast - via Western Union... sound familiar?? Really, scammers would really have to go back to the drawing board if Western Union was just willing to create a system where their transactions were verified and traceable. That they are not is why scammers have earned such a great living utilizing Western Union.

Okay, here's the email (and notice that classic weird period after the sign-off name... that is in almost every scam email and I don't know why - must be the software they use to generate these emails).

Subject: TRAGIC NEWS (they put the name of someone you know here) HELP NEEDED

I'm writing this with tears in my eyes my Family and I came down here to Madrid,Spain for a short vacation,unfortunately we were mugged at the park of the hotel where we stayed all cash,credit card and cell were stolen off us but luckily for us we still have our passports with us.

We've been to the embassy and the Police here but they're not helping issues at all and our flight leaves in less than 3hrs from now but we're having problems settling the hotel bills and the hotel manager won't let us leave until we settle the bills.

Am freaked out at the moment.

Brian.

Scam Email: James Karg

2011-11-02T19:58:00.000-07:00

Hi Kathleen - My name is beth and i received this strange e-mail today...a friend told me about recent "art scams" going around, and a quick google search lead me to your site. I was about to fall into the "too good to be true...but i still believe it" trap, but thought i might get your take on it. based on what i've read about these scams so far, it seems like this fella's just blowin' smoke. if you have a chance, i'd love to hear what you think.
Thanks!
Beth

---------- Forwarded message ----------
From: James Karg [jkarg001@gmail.com]
Date: Wed, Nov 2, 2011 at 5:57 AM
Subject: dream monster 3

Good day,

My name is James Karg, I'm from california and i hope this message finds you well.I was going through your works and my eyes caught this particular work, i will like to have it for my new apartment this month.please let me know if the piece is available, if yes let me have the detailed price and more information about it. i will be waiting to read from you.

Regards.

James.

Scam Email: Cynthia Hilson

2011-10-30T10:33:00.000-07:00

Here is an email I received this morning from an artist:

Good work Kathleen. Thanks for taking the time to compile the scam list. Just received my first scam this morning from:

Cynthia Hilson [cynthilson@gmail.com]

The original email is below.

Received: from unknown (HELO cloudmark1) (10.49.16.75)
From: "Cynthia Hilson" [cynthilson@gmail.com]
Subject: artworks purchase
Date sent: Sun, 30 Oct 2011 06:06:00 -0400

Good day to you.

I am so excited that I came across of your work on internet search,I am interested in purchasing these creative artworks from you.....................

The Valley,Logging Road,Green Apples,Creole Cabin and Portrait of a Jug

Let me know their various prices.and how much discounts are you going to give?I will be happy to have these selected artworks hung in our new home in South Africa.As well,I want you to take out the shipping cost.I have been in touch with a shipping firm that will be shipping other house decoratives.

We are traveling from our Seattle home to our new apartment as soon as possible.On Paying for the artworks,I will be glad to pay you with a Money Order or Cashier`s check in US funds that can be easily cashed at your local bank,please let me know on how to proceed for the payment of the creative artworks.

I will await your advise on how to proceed.Have a wonderful day.

Take care,
Cynthia Hilson

Scam Email: Lynda James

2011-10-24T10:23:00.000-07:00

Scammers choosing James as part of their fake name seems like a really common thing. Clearly they don't use a name randomizer. Ooops. Mustn't give them any additional ideas.

Here is one an artist forwarded to me this morning:

Time Submitted: Mon, 24 Oct 11 04:14:54 +0100
From IP: 41.205.173.195

NAME = Lynda
EMAIL = lynda.jameshop@gmail.com
EMAILCONFIRMATION = lynda.jameshop@gmail.com
TELEPHONE = 4755875436
COMMENT = Good Day,

I'm Lynda James from Norway.I want to place an order and i know the difficulties encountered when shipping internationally,But that will not be a problem because i am registered with a shipping company which i'v used severally times without any delay nor damage.
Before i place the order,i want to inform you that i will be making the payment with my Mc/Visa cards because as for now i can only make payment with my US credit card account information,so if it's okay by you kindly get back to me with the contact details and please reconfirm your website so as to know if i'm right with the site.I awaiting your swift response so as to list out the items needed.

Lynda-J-Supperstore
Strandgaten 34,
N-5817 BERGEN,
Norway.
Telephone: 4755875436
Telefax: 4755875427

Warmest Regards,
Lynda James.

Scam Email: Ricky Tetteh

2011-10-05T17:49:00.000-07:00

Ah yes, this is exactly the kind of language I use when I talk about my art with clients..... NOT!

And what is with the signature?? The fake name has the middle initial AFTER the last name? So lame.

Return-path: [oforidankwa05@gmail.com]
Delivery-date: Wed, 05 Oct 2011 19:07:22 -0500
Received: from mail-gx0-f171.google.com ([209.85.161.171]:60236)
Sender: oforidankwa05@gmail.com
Date: Thu, 6 Oct 2011 00:41:21 +0100
X-Google-Sender-Auth: pXWfyzBrIfvo4RaNYio4MyOMB6I
Message-ID:
Subject: Supply Inquiry
From: Amason Ventures Ltd
To: undisclosed-recipients:;

Dear Sir

There is an on-going tender for the purchase of your products in large quantity, I will like to know if you can handle the supply order of your company's product to the Government of Ghana in West Africa. I am a commission agent.

Please Can you furnish us in full details about the standard of your products.We will appreciate it more if you can give us with detail specification/price lists to avoid making a wrong choice of product.

Please Reply directly to myemail:amasonventuresltd@msn.com

Ricky Tetteh E.
amasonventuresltd@msn.com

Scam Email: Patrick Doe

2011-10-05T07:48:00.000-07:00

This came from the same servers I saw on a different scam email I posted Monday, so clearly the same scammer is exploiting the same server to send out their massive mailings. And will likely continue to do so until the owners of those servers realize what is going on and plug the security hole.

Return-path: [dientito@gitserver2net.gitserver2.net]
Delivery-date: Wed, 05 Oct 2011 09:25:28 -0500
Received: from gitserver2net.gitserver2.net ([173.192.23.66]:55184)
Subject: Order Enquiry
From: Patrick Doe [patdoe@blumail.org]
MIME-Version: 1.0
Content-Type: text/html
Message-Id: [E1RBSPX-00059d-Pc@gitserver2net.gitserver2.net]
Date: Wed, 05 Oct 2011 09:25:27 -0500

Hello, This mail is to make inquiry on the below question. 1- Do you carry overseas? (though i already know of a freight forwarder that will pick my packages from you,since they ship lesser than any other courier and they are so effective in shipping my goods to me here in Giza, Cairo, Egypt is estimated to be Next Day Service and 3-4days) I have used their services in the past and it was splendid. 2- Do you accept credit card for payment(U.S.A Master and Visa card to be precise)? Kindly let me know your comments on these, before i send the items I am interested in purchasing from you.

Patrick Doe
Store Owner

Scam Email: John Cool

2011-10-03T05:22:00.000-07:00

Got two scam emails in succession last night, one at 12:34 am and the second at 12:57 am. It was probably the same scammer sending out a massive mailing because both had similar characteristics - generic fake first name with no last name, both signed just "purchasing manager", and the email content and format basically identical, and sent so close together in time. So I'll post both of them below.

first one received:

Return-path: [dientito@gitserver2net.gitserver2.net]
Delivery-date: Mon, 03 Oct 2011 02:34:37 -0500
Received: from gitserver2net.gitserver2.net ([173.192.23.66]:58112) Mexico
Subject: Order List
From: john [johncool461@gmail.com]
X-AntiAbuse: Sender Address Domain - gitserver2net.gitserver2.net

Good day,

We browsed through your web page and we are interested in ordering some of your products,we are located in Finland,we will like to know if you have the items in stocks,so kindly get back to me with the right contact person email,phone # and confirmation of website so that we can place my order quickly, and i want to know if you have your own personal shipper or can the order be picked up at your store,please advise so that we can proceed by going ahead to place the order.

Regards
Purchasing Manager

second one received:

Return-path: [anonymous@megatron.webapptron.com]
Delivery-date: Mon, 03 Oct 2011 02:57:18 -0500
Received: from [209.216.201.191] (port=55203 helo=megatron.webapptron.com)
Received: (qmail 25906 invoked by uid 48); 29 Sep 2011 18:10:06 -0700
Date: 29 Sep 2011 18:10:06 -0700
Message-ID: [20110930011006.25882.qmail@megatron.webapptron.com]
Subject: Email order
From: smith [sec@yahoo.com]
Reply-To: smithpayne91@yahoo.com

Good day,

We browsed through your web page and we are interested in ordering some of your products,we are located in Norway,we will like to know if you have the items in stocks,so kindly get back to me with the right contact person email,phone # and confirmation of website so that we can place my order quickly, and i want to know if you have your own personal shipper or can the order be picked up at your store,please advise so that we can proceed by going ahead to place the order.

Regards

Purchasing Manager

Scam Email: Thomas Morris

2011-09-26T09:05:00.000-07:00

This interesting thing to note about the scam below that was forwarded to me is that the scammer got really confused about his faked name. Is he Thomas Morris like in his From field, or Abbot Morris like in his email address, or just "Morris" like how he signed off on his email (who in their right mind would sign their email by just their last name... this scammer is making it easy to spot this as fake).

Here is the email I received this morning:

kathleen-- I and another artist friend received the following email this morning. The only difference was the subject line--each was the name of a piece we had made...gotten off of our website.

I was suspicious and googled the name and came upon your blog. Thank you for what you are doing to help us all!

Rory

Begin forwarded message:

> From: Thomas Morris [abbotmorris1@gmail.com]
> Date: September 26, 2011 5:21:01 AM CDT
> To: Rory
> Subject: Legacy II
>
> Hello,
>
> Happy new day, I have interest in this your piece of work i came
> across through my searching and i really
> want to make a request if you still have it available for purchase,
> meanwhile email the price you are willing to sale it.
>
> I hope to read more about the piece from you,
>
> Your's Morris.

Scam Email: Bill Richard

2011-09-12T07:01:00.000-07:00

Notice the ugly altered "Return-path" on this scammer's email. They were somehow able to route their scam via AOL servers while altering all the headers to reveal any legitimate source of the email.

They've taken to always lately asking the person for their website address in initial emails like this. That way they can send out hundreds of thousands of these and not break a sweat trying to personalize anything. If someone does reply and actually does provide their website address, then the scammer can customize and personalize all other emails from the content they find on the website, making it seem like a legitimate purchase. But who would be purchasing from your "store" without first going to it on the internet. Doesn't make sense. But still people fall for it. Don't you.

I've also noticed lately a trend towards scammers just putting a first name only. Weird. Though in this particular scam email, I can tell their faked last name as well within their email address - which is disposable. The rest of the content of this scam email is the same ole same ole crap.

Return-path: (bjlhjkhjkjkhjhjk@fgfgfgdgdfdfg.com)
by chakra.lunarbreeze.com with smtp (Exim 4.69)
(envelope-from )
X-Originating-IP: 172.191.3.109 (AOL-172BLK)
X-Sender: bjlhjkhjkjkhjhjk@fgfgfgdgdfdfg.com
From: Bill (billrichard2010@ymail.com)
Subject: Order Inquiry

Hello Sales Dept,

I want to place an order in your store,and I will like to know if you ship to Portugal and my payment will be remitted via Visa/Master Card issued in US bank. So please let me know if you can assist me with the order,and please do not forget to include your website in your reply.Your quick response will be highly appreciated,I will be very glad if you treat this email with good concern.

Regards,
Bill Richard

Scam Email: John Cool

2011-09-07T08:18:00.000-07:00

I got two of these, the second one coming only 9 minutes after getting the first one, both identical. This scammer decided not to even bother with a fake name.

Return-path: [geaveens@charon.e-dentify.nl]
Delivery-date: Wed, 07 Sep 2011 09:43:16 -0500
Received: from [94.100.20.18] (port=55062 helo=charon.e-dentify.nl)
    (envelope-from )
    id 1R1JLQ-0004W7-AV
Received: from geaveens by charon.e-dentify.nl with local (Exim 4.69)
    (envelope-from )
    id 1R1JL8-0001lD-8q
Subject: Order Inquiry
From: john [johncool461@gmail.com]
Reply-To:
johncool461@gmail.com
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 8bit
Message-Id: [E1R1JL8-0001lD-8q@charon.e-dentify.nl]
Date: Wed, 07 Sep 2011 16:42:58 +0200
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Originator/Caller UID/GID - [700 696] / [47 12]
X-AntiAbuse: Sender Address Domain - charon.e-dentify.nl

Good day,

We browsed through your web page and we are interested in ordering some of your products,we are located in Finland,we will like to know if you have the items in stocks,so kindly get back to me with the right contact person email,phone # and confirmation of website so that we can place my order quickly, and i want to know if you have your own personal shipper or can the order be picked up at your store,please advise so that we can proceed by going ahead to place the order.

Regards
Purchasing Manager