Work-at-Home Scam - December 14, 2007 Example  (Partner-Remittance)

Please be sure to read my Work-at-Home Scams Home Page

Things I Did, Below

I, personally, receive email in HTML format. The following was received (and looked) like I received it. At the time, I was more interested in the message than the headers and do not have the original. This is a copy I forwarded to myself as I sent it to my father.

• I removed my email addresses. These came to various accounts and some no longer exist. There are places on this site you can get hold of me if you wish or need to. They are protected from spambots using JavaScript, but all you have to do is click on them.
• All scammer and related email addresses, and any actual website links have been changed, at least putting spaces into them. They appear as underlined blue links, though they aren't.
• Any notes I added in the actual letter are in square brackets ("[" "]"), are bold, red in color, and highlighted. If what I found "behind the links" (email or website) are different than what was displayed, I will include them in this type of note.
• All spelling, spacing, line-wrapping, and punctuation errors are the ones that appeared in the original received email. (I may or may not analyze some or all of these.)

Scam Example
Received 12/17/2007

This was spam email, as while I have a resume at CareerBuilder at this time, it was sent to an email address which I do NOT use for job search. (I just double-checked.)

NOTE: To allow search engines to find them, I've left the links in this email. Be careful if you check them out for yourself.

Email Headers
Received 12/14/2007

Ok... Time to check the WhoIs of Partner Remittance, Inc. (or PR, Inc. - Note that there are hundreds of legitimate "PR, Inc."s.) After double-checking that the link was simply to the link (no identifying information was included), I went to http://partner-remittance.biz/vacancies.php, the link in the email, and thence to the home page http://partner-remittance.biz/.

Red Flags, for Me

Ok... The email looks kind-of legit... The site looks legit... What raises the red flags for me?

1. From the email itself:
   1. I have received NUMEROUS job offers, in the last couple of weeks for the same type of job, many purporting to be responding to my resume on CareerBuilder. While I am looking for a job, and have a resume there, the email address I use there is NOT the one to which this email was sent.
   2. According to the website, the vacancies they have are: "Client finances operations department employee" and "Commodity circulation control department employee." - Based on the website, I DO fit their "position requirements", but so do most executives and menial workers! (But the email says they sent me this based on my resume ... But there's NOTHING there "sociability," "higher education in the field of finance,", about my having "not less than 2 years of working in the field of finance," and nothing about "working experience" or good knowledge of the banking system." So how does that make me "good for a [sic] vacancies we [they] suggest"?
   3. The description of the process for both positions is the same as KNOWN reshipper/money transfer and strictly reshipper work-at-home job scams:
      1. Reshipper/Money Transfer: Deposit checks into your or a new account you set up, withdraw cash from the account, wire the cash overseas. The problem occurs when the banks find the checks are bad/forged, pull the amount of the check out of the account, and demand that YOU cover the rest of the amount. If you don't, you may be prosecuted for passing bad checks.
      2. Strictly Reshipper: "They want you to receive packages and reship them somewhere else. The goods will have been obtained fraudulently, and they're just using you to make the shipping address appear local. You will be aiding fraud." If you aren't required to "check" the goods, they could be drugs; counterfeit money, stocks or bonds, etc. They may also "slam" you with multiple deliveries of packages you must "break down" and ship, and, when you can't handle it, or figure out they're scamming you, you end up with a bunch of packages that YOU have to cart to the cops or Postal Inspector.
   4. Spacing, grammar, spelling, and word usage errors are rare from a legitimate site offering a job. Numerous people have read those, from HR to Legal to the person who wrote it. SOMEONE would catch the errors.
   5. The email address FROM which this email was sent, tevgr@abenaquicarriers.com, was NOT the same as the company offering the job. While I realize that consultant and contracting companies could be sending these emails out, there is absolutely NO indication that this is from anyone but the company, itself.
2. From the email headers:
   1. The email address FROM which it was sent was tevgr@abenaquicarriers.com. Again, why wasn't it sent from a partner-remittance.biz account, and why can't I simply reply to the email to get information?
   2. According to GeoBytes Spam Locator (just cut-and-paste email headers), this email was sent from IP 78.37.196.5, of which they say "We are unable to locate the IP address "78.37.196.5" at this time. The related header entry may have been forged.." Why doesn't this match the email address of the sender (Erwin Rice)? ... or the site to which I am to apply?
3. From the WhoIs of the (apparent) site:
   1. The email for the registrant, administrator, billing, and technical contacts are all support.princ@gmail.com, a free email account. While this in itself doesn't mean much, it does raise a flag to look further.
   2. The address given for those contacts is in Russia! (Again, not much... The site DOES appear to come from Poland
   3. The contact phone number given (+4.8226578011) is from Poland (format +48 xx xxx xx xx (outside Poland) [Source: http://en.wikipedia.org/wiki/%2B48]
4. From the website:

   1. The contact numbers listed use an area code of 845.

      Area code 845 is a State of New York telephone area code which serves the Hudson Valley counties of Rockland, Putnam, Orange, Dutchess (except the northeastern corner), Ulster, and Sullivan, as well as small portions of Delaware, Greene, and Columbia counties. It was created from Area code 914 when that code was retained by Westchester County. Permissive dialing for area code 845 began on June 5, 2000.

      [Source: Area code 845 - Wikipedia, the free encyclopedia]

       

5. With such a mish-mash of addresses and contact locations, it makes me wonder even MORE why I am receiving an email for this job. And with so many red-flags... GEEZE!

End Notes

Send comments/questions about this page to Bill Sanders at:

Go to Scams - Work-at-Home Scam Home page

Send email to Bill Sanders ()
with questions or comments about this page or site.

This site, all text and graphics (unless otherwise noted) on it
were designed, developed and published by Bill Sanders of Orange Frog Productions.
It and it's CSS was validated and complies with both the: CSS and HTML 4.01 validators from W3C.
NOTE: All CSS validates except the "New Window Buttons" which include some invalid code (ie: hacks),
added PicoSearch Tables, and warnings for using transparent backgrounds when color foregrounds defined.
Copyright © 2003, 2004, 2005, 2006, 2007 by Bill Sanders / Full site last modified: October 21, 2006
Any reproduction, printing, or selling of this content is prohibited without express written consent from William D. Sanders.