Please be sure to read my Nigerian Scams Home Page

Things I Did, Below

I, personally, receive email in HTML format. The following was received (and looked) like I received it. At the time, I was more interested in the message than the headers and do not have the original. This is a copy I forwarded to myself as I sent it to my father.

• I removed my email addresses. These came to various accounts and some no longer exist. There are places on this site you can get hold of me if you wish or need to. They are protected from spambots using JavaScript, but all you have to do is click on them.
• All scammer and related email addresses, and any actual website links have been changed, at least putting spaces into them. They appear as underlined blue links, though they aren't.
• Any notes I added in the actual letter are in square brackets ("[" "]"), are bold, red in color, and highlighted. If what I found "behind the links" (email or website) are different than what was displayed, I will include them in this type of note.
• All spelling, spacing, line-wrapping, and punctuation errors are the ones that appeared in the original received email. (I may or may not analyze some or all of these.)

Scam Example
Received 12/22/2006 (TWO of them, same time codes, same sender, same email address for me, etc.)

Email Headers

[DO NOT send email to any of the following email addresses]

I received TWO copies of the above email, on the same day, both time-stamped with the same time. Both went to the same address, both sent by the same person. The only real differences I see in the headers, below, seem to have more to do with the time and message id (which SHOULD be different for each email). The differences between the two I see are marked in red.

Now, whether this means my email address is listed twice in a large database (which is possible), is listed in TWO different databases (also possible), or the idiot emailer is typing in names and they didn't sort them first to drop duplicates (also possible), I have no clue.

I hope the "peon" they pay to send these emails doesn't get beat, but his/her SUPERVISOR does!

Received 12/22/2006 at 07:58AM (#1)

Received 12/22/2006 at 07:58AM (#2)

Notes

Problems I see:

• Obvious (to me, anyway) errors:
  • There WAS no "To:", and, through the headers, you can see there appears to have been a list in BCC:. If this were sent only to me, it would have shown my email address.
  • Any email like this with the word "Nigeria" in it, IMMEDIATELY puts me on alert.
  • The email was sent from "peters_ude22 @ terra.es", yet it states it's from Donald Kuberuka. Even were it to be sent from his secretary, why is the email domain NOT adbg.org?
  • "Title Case" - Almost every word is capitalized, as if it were a title. No professional in the world would allow letters to go out this way.
  • Grammar and word-choice problems, which would NEVER occur in an official document from a bank president. (I'm sure when they deal with foreign-speaking (to them) countries, they have SOMEONE on staff who can translate letters SMOOTHLY and COMPETENTLY using the correct language. Basically, it shouldn't sound "stilted".)
  • Why would an email from a bank/bank president include a "tag-line" link (in Spanish) like Incredimail, Yahoo Mail, etc., and link to what appears to be their free (gratuita(?)) email site New Window (based on appearance, my fading memory of Spanish from school, etc.)
  • Email addresses appear in parenthesis (not the more "normal" angle-brackets) and the last one includes the word "email". (They used a "," instead of a ":"). Again, no professional would/should allow an email or letter to go out with errors like this in it.
• With a little research:
  • From the African Development Bank Group New Window site:
    • It DOES state that the bank president's name is Donald Kaberuka
    • There's nothing on the site about the situation described in the email which should be NEWS, right?
    • The addresses listed on the contact page of the ADBG New Window site are Tunisia and Cote d'Ivoire (Ivory Coast), with field offices in Addis Ababa (Ethiopia) and Cairo (Egypt), NONE of which are Nigeria, the address listed in the email.
  • NONE of the phone numbers listed on the site start with the Country Code of "234". And, according to Reverse lookup for country code 234 New Window, the country is, again, NIGERIA.
  • Two different email address domains, neither of which are listed on the African Bank site:
    • The email was sent from the domain terra.es (a Spanish domain - See www.terra.es New Window.) Again, they provide what appears to be a free (gratuita(?)) email service. New Window.)
    • The "bank president's" email domain is indiatimes.com (an Eastern Indian portal - See www.indiatimes.com New Window), which provides free email addresses New Window.

 

---

Send comments/questions about this page to Bill Sanders at:

Go to Next Nigerian Scam Example (Last in list is not a link)
Return to OFPv2/SSFF - Scams - Nigerian Scam Home page

Send email to Bill Sanders ()
with questions or comments about this page or site.

This site, all text and graphics (unless otherwise noted) on it
were designed, developed and published by Bill Sanders of Orange Frog Productions.
It and it's CSS was validated and complies with both the: CSS and HTML 4.01 validators from W3C.
NOTE: All CSS validates except the "New Window Buttons" which include some invalid code (ie: hacks),
added PicoSearch Tables, and warnings for using transparent backgrounds when color foregrounds defined.
Copyright © 2003, 2004, 2005, 2006, 2007 by Bill Sanders / Full site last modified: October 21, 2006
Any reproduction, printing, or selling of this content is prohibited without express written consent from William D. Sanders.