Romance Scams Targeting Men — We have published many articles over the years about romance scammers who target older women, especially a man we call a “Professional Love Scammer from Zimbabwe.” (We’ve identified 38 aliases tied to this man and his likely location.) However, older men are also heavily targeted by romance scammers who present as beautiful young women, typically in their 30’s. Our friend Rob has been “playing” with about twenty of these scammers during the last few months and we wanted to give you an update on some them. Rob caught one of these scammers lying to him and others completely ignore Rob’s emails in which he tells them he had a serious injury from a biking accident, indicating that they don’t even read all or most of his emails. They simply follow their playlist. But it’s very clear that they LOVE HIM SO MUCH and can’t wait to spend the rest of their lives with him! If only he would send them money to pay for their visa and travel arrangements! Buckle up! You’re going to need that protection as we wade on into these gushing and effusive emails!

We couldn’t help but notice that several of these women who claimed to be falling in love with our friend Rob, sent their emails from an unusual domain called rephotomail[.]com. This included a woman calling herself “Lilia.” She routinely sends her email from an account name called Felicitcofe @ rephotomail[.]com. Last week we investigated her email service, rephotomail[.]com, and discovered that it was registered just over 8 months ago (October 16) and is hosted on a server in Moscow, Russia.  

When we used Google to search for the domain rephotomail[.]com, the first link is FOR THIS WEBSITE but Google offers ZERO information from this site! This typically means that the website instructs Google NOT to search it for any information. However, the next 6 links were ALL related to websites exposing romance scams! Check out this screenshot from our search…

But never mind our suspicions, let’s focus on the love! Rob and Lilia met via email in early May. By mid-June, Lilia was so in love with Rob that on June 12, Lilia sent Rob an email containing 96 exclamation marks extolling her love for Rob! (Although we wondered why her statement “I want to go shopping with you” had NO EXCLAMATION marks at the end. We asked our wives about this one, and all we got were rolling eyes. Whaaaat?) Rob calls this email “love bombing.” This is especially funny since Rob has been telling Lilia for weeks that he seriously injured himself on his off-road bike and it became infected! Lilia’s response? “I hope you get better.” But Rob didn’t get better! He told Lilia that he got worse and he may have to go to the hospital. Here response? She ignored him! But she did love-bomb him with 96 exclamation marks.  Come on, if you can throw 96 his way, why not hit 100!

Oddly, Lilia has also used another email address, pupsiklyalya25 @ gmail, in her exchange with Rob. We know it is the same woman as “Felicitcofe @ rephotomail[.]com” because she usually includes photos of herself in her emails. In fact, the 10th email that Rob received from “Lilia” on May 23 had two very sexy photos attached that we aren’t comfortable republishing in our newsletter. 

Another woman Rob met through email is named Tina. Tina claims to be a Realtor from Kazakhstan, a country along the southern border of Russia. Rob first heard from her in early June and they have exchanged several emails over the 2 weeks that followed. However, Rob quickly caught her in a lie, showing, once again, that she is just another romance scammer, like the many other women who have sent unsolicited emails to Rob! Rob told us that he gave her a list of cities he would like to visit, including in Turkey, Denmark, Poland, and Italy. He asked her if she had been to any of them. She said she had only been to Turkey…

However, another email Tina sent to Rob included this lovely photo of her, but the photo was HORIZONTALLY REVERSED! Rob couldn’t help but notice the text on the signboard behind Tina. He flipped the image to correct the text and then zoomed in to see that Tina was visiting the Caramel Cafe. In fine print, the Caramel Cafe shows that its website is Caramel.dk and it is located in Denmark! (English version of their website.) “Tina” clearly lied to Rob about never visiting Denmark! What a surprise, right? By the way, Tina’s email account also uses the name Temii, and not Tina.

A disturbing change in these romance scams that Rob has told us about is the fact that most of the women contacting him since early May claim to be from Ukraine. In every email they share stories of doom, rape, and other horrors. These horrific events are happening to real women in Ukraine which makes these scammers even more offensive to use these events to gain sympathy. Below is one such email from Irina who uses an email address kallirisha @ gmail. Irina’s email didn’t even acknowledge the fact that Rob also told her about his serious bike accident, resulting in an infection!  Rob was considering telling Irina that his infection got so bad that he had to have his leg amputated, just to see if he could get any acknowledgement from her!

———- Forwarded message ———

From: Irina <kallirisha@gmail.com>

Date: Sat, May 27, 2023 at 11:27 AM

Subject: Have a good day

To: Rob <EMAIL REDACTED>

Hi how are you?

I am very glad that you wrote to me again. Yesterday I couldn’t sleep, I was afraid that something bad might happen,  the men in the camp drank a lot of alcohol and it’s good that they sleep in another tent a little further from us. They started yelling at each other and fighting,  and it seemed like they even took someone to the hospital.  Then a few hours after all this, I still managed to fall asleep, but I slept very badly and today I feel tired. I had to get up at 7 am today to do the cleaning and lay the tables for breakfast.  Everything else is fine, don’t worry. At night, when I couldn’t sleep, I lay in bed and thought a lot. I would very much like to leave here to another place, to a more peaceful and safe place.  There are a lot of bad people here and I don’t feel safe. 

I am very afraid that they can rape or cause other harm here, because almost no one is guarding us. I heard that a few days ago, several girls were raped here, but everyone is silent about it. I do not know their language and it is difficult for me to communicate. I understand and can speak English and it is not perfect. We were told that we could be transferred to another city and it would be even worse there. I am very worried now, but I try not to think about it. I sincerely hope that I can come up with something and escape from here, but right now I have absolutely nothing. Tell me how your day is going and what you are doing now. I hope you are doing well and your day is better than mine. Now I have a lot more to do. 

I am waiting for your letter, the only way I can calm down and get  a little distraction from this whole nightmare.

Your friend Irina.

===================

For the record, and thankfully, there’s nothing wrong with Rob’s leg. He didn’t injure it in biking accident, but none of the women he’s corresponded with have really acknowledged his “accident.” As Rob has told us, many of these romance scammers can already be found on websites that expose romance scams. Here are two examples of women who have been communicating with Rob AND are on these sites as scammers….

1. Oleksandra on Scamsurvivors.com
2. Irina on DatingScams.cc (This post includes a heartfelt story written by a victim about how Irina had also claimed to be suffering in Ukraine due to the war with Russia.)

If you are in an online-only relationship with someone overseas, please, please share this fact with people whom you trust and know you well. Ask their opinion about your circumstances! And, if you are willing to contact us, we will ALWAYS give you an honest, objective evaluation AND we will protect your privacy! You can reach us at spoofs@thedailyscam.com.

If you want to read more about these threats, we last wrote about Rob’s experiences with a romance scammer named Aida (and others), on April 19, 2023.

NOTE: Typically, we would tell people that if your online love-interest always has reasons why she or he cannot video chat with you, then she or he is absolutely a scammer. However, Rob has told us that a few of these female romance scammers have actually been willing to video chat! Beware!)

Top Scams of the Week! — Scams of the week: USAA, NatWest, USPS, and Costco. Can you spot all these scams? Check out and protect yourself with this 100% FREE, all-in-one tool.

One of Clarise’s friends knows about us and reached out for our help. It wasn’t long before we were talking with Clarise to help her minimize and mitigate her risks. Remarkably, two unusual circumstances saved her from significant financial losses! When scammers gain access to a personal email account, which we consider to be the digital keys to your kingdom, they typically set up a “backdoor” to the account in case the victim changes her/his password to the account. This backdoor is typically done by setting up email forwarding to a scammer’s email that looks nearly identical to the victim’s email. We learned from Clarise that unless you have a Yahoo PREMIUM account (she doesn’t), email forwarding is not allowed! The second circumstance has to do with the fact that most people use their email password for LOTS of other accounts, including credit card, banking and social media accounts. Thus a victim can suffer serious financial harm and/or their friends and family can be targeted by scammers. But it turns out that Clarise didn’t do that!  She specifically kept a unique password for her email to avoid the chance of being victimized this way! (If YOU use the same password for critically important accounts as your password to your email account, PLEASE CHANGE IT!  You’ll be VERY glad you did!  Even if you just add 2 characters to the beginning and end of it!)

This screenshot shows two recent types of email samples sent by scammers to try to get your attention. Don’t fall for this manipulative crap!

Last week, we reported on the scam that successfully targeted a woman, beginning with the fact that Google was poisoned to deliver a scammer’s phone number when she went searching for customer support. A few days later we learned that Investigative Reporter Chris Elliott had reported an identical story about this type of scam on his blog! Check out:  https://www.elliott.org/featured/warning-airline-scammers-are-posing-as-fake-call-centers/

Last week a TDS reader sent us a very unusual scam that arrived into his mailbox via US Mail! Check out the photo below. It is a “FINAL NOTICE” from “Home Warranty Dept” and seems to include a check for $199, but it is NOT a check.  Notice that NO BUSINESS name can be found on this fraudulent warranty notice!  In fact, if you were to search for the phone number, 877-671-1027 in Google, you’ll find several links about this scam including a very negative post on the Better Business Bureau website:

   https://www.bbb.org/scamtracker/lookupscam/673953

   https://800notes.com/Phone.aspx/1-877-671-1027

   https://www.scampulse.com/877-671-1027-reviews

And finally, despite it being unregulated, cryptocurrency investment continues to grow and expand. So, too, do cryptocurrency scams!  Check out this excellent article by James Greening at Scamadviser on the truth about recovering money lost to these scams:

https://www.scamadviser.com/articles/the-truth-about-recovering-cryptocurrency-lost-to-scams

Amazon Account Locked, Quickbooks Malicious Mimics & GeekSquad — Our first phishing sample this week looks like it came from Amazon.com. However, that email address was placed into the NAME field. This email actually came from a server in Columbia and was sent to 10 people who use email through Juno.com. Don’t worry, your Amazon account isn’t locked and if you mouse-over the link to “Verify Account” you’ll see it points to another domain in Columbia! Deeeeeleeeeeete!

For several weeks we’ve reported on phishing emails disguised as emails from Intuit’s Quickbooks service. Here’s another one that a TDS reader sent us. The links in this rotten phish point to a malicious mimic called bookintuit[.]com and not intuit.com! A WHOIS look up shows us that bookintuit[.]com was registered on June 2 from a Registrar in Japan. Lunge for the delete key! Arrigato!

In this next Intuit phishing scam, the link points to an absurd domain registered by scammers. HOWEVER, this scam employs a trick in which the scammers set up a subdomain on their website using the name intuit.  Subdomains precede a full domain name and are separated from them by a period.  ANYONE who controls a website can set up a subdomain to say ANYTHING at all! Don’t fall for this trick!

Finally, check out this very common phishing scam pretending to be sent “By Geek Billing Team!” This bogus invoice is just a trick to get you to call the scammer’s phone number where they will try to inflict serious financial harm! Delete!

Lower Credit Card Charges & Claim Your Compensation — Last week we noticed an uptick in the number of scam robocalls hitting our phones. So has Rob! Check out this playful call he took from “Jacob” at the “Visa / Mastercard Credit Card Department.” (Like such a thing really exists!) He turned on his AI and played with them for nearly 10 minutes. (We removed most of the long pauses so the call is just less than 7 minutes.)  Enjoy!

Also noteworthy about these scam calls is the fact that many have pretended to be from the “AMER RED CROSS” and also “Non-Profit” and a private infrastructure company called APTIM. None of this is true and these phone numbers cannot be connected to these businesses/services. Here’s one screenshot of 4 calls in one afternoon…

Scammers will often target people using malicious emails disguised as compensation from lawsuits concerning consumer products such as this email about RoundUp Weed Killer.  The Monsanto company, manufacturer of RoundUp, has settled a class-action lawsuit and is providing compensation to Americans who’ve suffered from exposure to this product. HOWEVER, this email is a trick and doesn’t represent any legitimate service related to this settlement! It came from a free email account at Gmail and the link points to a mail-list service that redirects visitors to a MALICIOUS website called zstvoip[.]com! (NEVER click “unsubscribe” in these emails because clicking that link will just send you into the jaws of malware!)

Netflix Account and Photographs from John — At first we thought this “Netflix” email from blendjet[.]com was just another phishing email to capture your Netflix password so scammers can share your household and binge-watch The Walking Dead. But we were wrong! This fake email, sent to 10 people at once, contained a shortened link that we’ve traced directly to malware!

Ouch! Lunge for the delete key!

And finally, here’s another behavioral engineering trick sent to people to entice them to click a link pointing directly to malware! No doubt, the real “John’s” [LAST NAME REDACTED] email got hacked and his contact list was stolen. This email actually came from a Tania Michelle and her University email account at Unitec University in Honduras. The link in this clickbait points to a domain, oiwadoix[.]com, that was registered on the very day this clickbait message was sent. You know what to do!

Until next week, surf safely!

Copyright © 2023 The Daily Scam and Scamadviser. All rights reserved. You are receiving this email because you
have subscribed to it via Scamadviser.com or thedailyscam.com

Keurenplein 41, UNIT A6311  |  1069CD Amsterdam, The Netherlands

Contact Webmaster