Weekly Alert | October 25, 2023
Woman Loses $6650 to a Puppy-Selling Scam — Last week, we heard from another woman in Canada who found a post on Facebook from someone selling Havanese puppies. We were told the account was called Havanese puppies for sale. (We have no link or screenshot to share.) She contacted them in late July. After liking the photos of a 3-month old puppy she saw, and learning the details, she was eager to purchase a new family member! However, after purchasing the puppy for $500, along with some fees, she learned that she had to pay an increasing number of other fees associated with having the puppy shipped to her area of Canada. Though surprised by these unexpected costs, she had already made the commitment to buy her puppy. Are you familiar with the expression “in for a penny, in for a pound?” (Expression meaning) She continued to pay these fees, until about 2 months later she still didn’t have her puppy and she had had enough! Learn from her story how she lost $6650 to these scammers and what we found on Facebook when we went looking for puppies for sale.
To protect this victim’s identity, we’ll call her Rosa. Rosa tells us that she is 68 years old, disabled and depressed. This is why she was looking for a loving dog to help support herself emotionally. In her first emails to us last week, Rosa said “I got scammed. I kept every email from them Havanese puppies for sale. The shipping agency that the seller used wanted all the money and the seller kept on saying they know what they’re doing. They’re not scamming you! I never did receive the puppy after all the money I sent him, which was $6650. I didn’t realize that I sent them that much money until I figured it all out. They were charging me for…
$500 for the dog which is OK
$800 for insurance for the courier
$1100 for tax and clearance
$900 for a nanny which I never never authorized
$1000 for a city permit
$500 for a crate, which is air-conditioned
$800 for a custom stamp
$950 for food
All the money was supposed to be refunded except for $500 for the dog. I reported this to the police, and the bank scam departments. I think the shipping company has recently contacted me to return my money but it’s been a week now, so I don’t think it’s really gonna happen. [It didn’t!] The police also got in contact with Facebook to shut down their website. I don’t know if that happened they can just open up a new one under a different name.”
We have reported on this type of fraud in the past on our website in our feature article titled Fake & Suspicious Dog Selling Websites. Besides losing the deposit for her new puppy, she lost most of her money to circumstances surrounding the shipment of her puppy to her home destination. After paying the cost for the dog itself, she was told that her puppy would be shipped to her through a special shipping service called Ocean Pacific Express, but its website was called GlobalLogistic[.]site. Notice that the domain name doesn’t match the business name. It turns out that the domain globallogistic[.]site was registered about 4 months before Rosa learned about the puppy on Facebook.
Since almost the entire set of financial loss was through this so-called shipping company, we focused our attention on it. We discovered many anomalies on their website, including grammatical errors, poor English, a CEO who’s name was given as “John doe” and crazy repeated “Lorem Ipsum” text in their “About Us” section of the website. Anyone who works in web design knows that “Lorem ipsum” is filler text to hold space in a website template. (This article from Media Genius describes the origin of this practice using “Lorem ipsum” and that it actually comes from work by Cicero, believed to be written in 45 B.C.) The scammers who created this bogus website disguised as Ocean Pacific Express, and using globallogisistics[.]site, likely copied the “Lorem ipsum” latin text and pasted it into Google translate before returning the translation to their web page.
On July 24, Rosa was asked to use Interac e-Transfer to make an initial payment to someone named “ANHAO CUI” who used the email address: alexcui31707@gmail.com. She sent $200. After an exchange of emails, on July 31 Rosa demanded that she be sent her puppy and then she would hand over $500 in cash for him. But eventually she relented and sent her $500 payment for her puppy through Interac e-Transfer to an account named “jason hemsward” who used email address: jackhermsword@gmail.com. But her problems were just beginning and the shipping company informed her that, unfortunately, there were other issues that had to be addressed. Check out this email exchange about the increasing costs to ship her puppy….
Rosa ended up paying these fees but shortly thereafter, in early August, she discovered that she was required to purchase insurance for the purchase and transfer of her new puppy! She was also told that this money would be refunded, and she didn’t have a choice to accept it or not. It was required…
Once again, Rosa caved in to these demands because she had already invested so much money, time and effort to receive this puppy! (“In for a penny, in for a pound!”) This back and forth demand for fee payments continued for two months! And the company, Ocean Pacific Express, as globallogisistics[.]site, assured her that she would get back most of her money once her puppy was safely delivered and the special air-conditioned crate was returned to them.
And then last week, when Rosa demanded her refund of $6200 that she had sent to these scammers, they tried to play one more scam. They told Rosa that there is a minimum requirement of $8000 for a refund to be sent. Therefore, they were asking her to send a final payment of $1800 to bring her $6200 refundable payments up to the required $8000! This is, of course, absurd!
Last Friday, on October 20, the scammers continued to push back and insist that a final payment of $1800 was needed in order for Rosa to meet the minimum requirement of $8000 for a full refund. Rosa had had enough! She replied angrily, saying that she was going to report these scammers and make sure their website was taken down! She even said to them “I have nothing to do all day but make your life miserable!” The scammer’s reply to that was simply “Okay, go ahead.” In a final effort to bring some satisfaction to Rosa that these bastards are far away and NOT who they say they are, we provided Rosa with a tracking link connected to a gift card graphic to send to the scammers. She sent it out on Saturday, October 21 at about 6:30 pm, along with the message to them that she was still angry at them but was hoping a $100 gift card would be enough to finalize this purchase. About 90 minutes later we had a click. The scammer who clicked the link revealed that he was located in Jakiri, Cameroon, a country just south of Nigeria in Africa.
We decided to visit Facebook and search for puppies for sale. We found dozens of listings. Amongst those listings we saw was a listing for “Maltese Puppies for Sale.” We believe it is clearly a scam because of how little information it contained, as well as the few number of followers, likes and no posts. In addition to that obvious fraud, we also found several other suspicious listings. They had few likes, followers, or contact information. Also, the few images/posts shown on some pages were all made on the same day, and not recently. One listing, for example, showed posts of Golden Retrievers added only August 26. If you are considering using social media to find a puppy, we strongly suggest you only consider listings that have active and recent content containing reviews by other buyers or comments from multiple people, listings with lots of photos, likes and followers. And be sure the listings have full contact information, including a phone number and supporting website. And, if you do call and speak with the owner to inquire, tell them that because of the amount of fraudulent listings, you want to video chat with them and have them SHOW YOU the puppy your are interested in! If they say “no can do” then move on!
Sadly, we’ve since learned that Rosa has had health problems due to a stroke last year. Her health problems have impacted her judgment and she described it to us like this…”I had to change my bank account so that they couldn’t access them, and I refused to do that again. That was so much hassle for me because of my stroke I am not in the best shape for my brain, but I am in my faculties not to send them any more money!” She also revealed that she had been successfully targeted before and sent scammers a $1000 in Apple Gift cards before her daughter showed her why it was a scam. This is another sad example how low-life scammers take advantage of the elderly or someone who is suffering some form of impairment due to declining health. But the scammers couldn’t care less who they hurt, or how much. They’ll do whatever they can to steal money.
Beware of Product Tester Job Scams — Seeking ways to become an Amazon product? Watch out! Scammers have been creating fake Amazon product tester application websites – Check out and protect yourself with this 100% FREE, all-in-one tool.
Zimbabwe Scammer Strikes Again, Selling Merch Online and Car Decal Scam! — In last week’s newsletter we shared a sad story about a 46-year old woman who was victimized by a romance scammer. It was a summary of the extensive fraud that had targeted her. However, late last week I finally had the time to fully review all of the dozens of emails and photos this woman had shared with me of her exchange with “Boyan Chumak,” as well as the hundreds of lines of text exchanges with him on WhatsApp and phone. I was shocked when I came upon a few critically important connections between “Boyan” and a scammer that we’ve written about several times since 2018. Because of a tracking link this particular scammer was tricked to click by one of his many victims, we know him as the Zimbabwe Love Scammer who lives in a wealthy neighborhood in South Harare, Zimbabwe. It turns out that Maggie’s scammer is this same man! If you read our full article just published on our website, you’ll see the logic behind our accusation. Check out: The Zimbabwe Romance Scammer Strikes Again!
Have you ever thought to post an item for sale on Craigslist, Facebook Marketplace, Ebay or elsewhere? If you have, you’ll very likely be hearing from scammers! Our friend Rob ran an ad in Craigslist last Saturday to see if he could sell an old surround sound system, before buying a new soundbar. Within minutes, he tells us, he received the two messages below. They are essentially identical but came from 2 different people with different names. Though he strongly suspected these were scammers, Rob did what Rob loves to do. He followed up on one just to see what response he would get. Sure enough, the next response, from “Cedric,” confirmed that this was a scammer pushing an advance-check scam. We can 100% GUARANTEE that Cedric’s check will bounce in 5-7 business days. There are 2 ways that this scam can work… We’ve heard of people who have actually shipped their item to the scammer, sometimes out of the country, thereby having their item stolen. And we’ve also heard that sometimes the check received turns out to be for more than the asking price of the item being sold. The sender (scammer) will say this was an accident and asks the seller if she/he will refund the overage amount via wire transfer. And yes, the check bounces days later!
SCAMMER #1:
From: barre parnell <dd64f41d35003598aea60800b2db5a47@reply.craigslist.org>
Date: Sat, Oct 21, 2023 at 2:39 PM (57 minutes ago)
Subject:
To: Rob [EMAIL REDACTED]
I am interested in buying it. Where are you located? Can we meet tomorrow? I never check craigslist email, My email is jemmiehandeh5@gmail.com
——————————————–
SCAMMER #2:
From: potencia sariann <c9679fed3fa437708ac7f40c637214f4@reply.craigslist.org>
Date: Sat, Oct 21, 2023 at 2:50 PM
Subject:
To: Rob [EMAIL REDACTED]
I am interested in buying it. Where are you located? Can we meet tomorrow? I never check craigslist email, My email is tehsinlodon84@gmail.com
——————————————–
Two minutes after replying to the first scammer, Rob received the email below, but it came from a different email account with a different name…
Cedric FDsilloon <cedricfdsilloon@gmail.com>
Date: Sat, Oct 21, 2023 at 3:36 PM (2 minutes ago)
Subject:
To: Rob [EMAIL REDACTED]
Thanks for getting back to me.. I’ve been working really long weeks at work. So I won’t be able to meet with you but I am OK with the price and condition as shown on the advert, I’ll go ahead and issue a check to you and when you receive the payment and it clears, I’ll make arrangements for pickup. So please kindly get back to me with the below details ASAP
Full Name:
Address:
City, State, Zip Code:
Your Cell Phone Number:
Last Asking Price:
As soon as the above information is provided, payment will be overnight to you and I’ll let you know once it’s mailed out with Tracking # sent to you. I’ll also add an additional $50 for holding it for me till the Check gets to you and please delete the posting that it has been sold.
Thanks and many Regard
———————————————-
And the next day, Rob received an email from “Cedric’s wife” offering $90 more than asking!
From: Angel Jones <angeljones4951@gmail.com>
Date: Sun, Oct 22, 2023 at 12:13 PM
Subject: Re: re Craigslist listing
To: [EMAIL REDACTED]
Thanks for returning my husband’s message regarding your item. We are satisfied with the price & the condition listed on the CL, so kindly withdraw the advert and consider it sold. I would have come in person for it but can’t due to my tight work Schedule and we are also busy because we are in the process of moving. My husband will proceed in issuing a Certified Cashier’s Check Or USPS Money Order to you and when received and cleared your bank, We will make arrangements for the pick up. Additional $90 will be added with the original price for reservation till the check gets to you.
I’ll need the following information to overnight the Payment today.
Name to issue out the check to……
Mailing Address to overnight the check….
Final Asking price and the Cell # to contact you ….
Thank you in anticipation of your understanding and awaiting the information requested to overnight out through UPS and delivered to you within 48 hours.
Regards
Unfortunately, anyone posting anything for sale online must be on their guard! We strongly advise that you only accept cash in person, and in a public meeting place. Never ship your item unless you can be 1000% certain that funds transferred to you are CONFIRMED by the bank/transfer company to be 100% legitimate and deposited, before delivering any merchandise. And if you are suspicious because a buyer only uses text/chat/email to communicate, INSIST on a video chat, especially if someone tells you they can’t be there to make the purchase. Finally, REAL BUYERS will never pay more than the asking price or pay you to “hold” an item for them! (Real buyers will usually try to negotiate a lower price!)
Often, certain types of scams come and go, or they evolve into something different. Between 2018-2020 we used to see lots of advance-check scams disguises as “car decal” or “car wrap” advertising offers. They all but disappeared by 2021. But just a few days ago, one of our readers sent us this email he received as a text on his phone from jkii@noteadvance.com. Notice that this did not come from Sysco.com. This “promotion program” for “Sysco Restaurant” was sent by someone from a domain, noteadvance[.]com, that is completely unknown by Google.
We often tell our readers that “online privacy” is an oxymoron. Much like “jumbo shrimp” or “clearly confused.” Consumers are often clueless to recognize or control the tremendous amount of data that is collected, sold and used by companies (real companies, data brokers, and scammers) to target them. This is especially true of some of the free apps we install and use on our phones. (Check out this Time Magazine article posted in 2022 about apps collecting personal data.) This recent article on ConsumerReports.org has information about a valuable app to help you take some control back concerning the privacy of your personal information held by companies:
As you might expect, scam charities are taking advantage of the war in Israel. For example, read Rebecca Rutherford’s article for the Los Alamos Daily Post about Israel and Gaza Charity Scams. Whether your intention it to support the people of Israel, Gaza or both, do your DUE DILIGENCE! This article on the FTCs website is a great place to begin with tips on how best to evaluate whether or not the charity is legitimate AND most of your donation will go to where it is intended:
https://consumer.ftc.gov/consumer-alerts/2023/10/safely-donating-response-israel-gaza-crisis
A final note again about AI. Bob Sullivan produces “The Red Tape Chronicles” about crime. Recently, he intentionally used AI to artificially manipulate his own voice for a scam just to show that it was easily possible for AI to do. Read “Someone made a deepfake of my voice for a scam!” AI (Artificial Intelligence) has some serious risks for the public, in addition to the benefits it can bring to societies. For the record, we want our readers to know that we never use AI to create any of our content. Ever! We use DI…. Doug’s intelligence 😉
Fedex Delivery on Hold and Netflix Account About to Expire — Bogus emails, texts and DMs (Direct messages in social media) pretending to be about a missed or held package delivery are now pouring into people’s devices/accounts. These can be a variety of different scams but a large number of them are phishing scams, trying to collect personal information including credit card details. Checkout this Fedex Delivery package email to one of our readers on October 12. Of course, the email clearly didn’t come from Fedex.com and the links don’t point to Fedex.com! In fact, the links point to a website, nucleacham[.]co[.]uk, that is located in the UK and was registered less than 3 weeks earlier. But that’s not your final destination. Sucuri.net tells us that this UK website will immediately forward visitors to another malicious website called blickpaytonzeml[.]net. You know….just like Fedex!
Our readers and family are seeing a jump in bogus phishing emails pretending to be from Netflix. Your subscription is about to expire! Oh no! Here are two recent examples. And, we’ve noticed that 2 malicious domains often used to support these scams are similarly called processinfosolutions[.]com and processinginfo[.]net. Fortunately, our friends at Scamadviser easily recognize BOTH of these domains as untrustworthy!
Lunge for the delete key!
Walmart Halloween Gift Card! — Cybercriminal gangs often take advantage of various holidays to create content meant to trick you into clicking a link you shouldn’t click. With Halloween just a few days away, the holiday clickbait games begin! Beware, these malicious clickbait will continue right through Valentine’s Day in February! Check out this supposed $200 Walmart Gift Card with the Halloween vibe. But the email didn’t come from walmart.com and the links point to Googleapis.com. This legitimate service is often misused by cybercriminals, as Virustotal.com reports in the screenshot.
Deeeeleeeete!
Our Top Story this week makes it crystal clear that cybercriminals will target senior citizens because their age and health may make them easier targets. For weeks, we’ve tried to bring attention to many examples of malicious clickbait intended to get the attention of Seniors as well. Here is one more example. This email wants you to think it came from an organization called “My Senior Perks” but it clearly did not! And the links in this clickbait point to a malicious domain called holidayolympices[.]com. However, in our investigation of the real website for “My Senior Perks,” we found ourselves going down a rabbit hole of confusion! For example, we discovered registered websites as…
- My-senior-perks[.]com
- My-seniorperks[.]com
- Senior-perks[.]com
- USAseniorperks[.]com and others…
Some of these sites seemed legitimate and yet had terrible reviews or complaints online. Our advice to seniors is to be extremely cautious when a website tells you it has special deals and prices for you unless it is the actual manufacturer or service provider itself informing you of those discounts!
Apple Security Center and Attached Files — A friend asked for our help recently. While searching Google for a steel skillet from Costco, she misspelled the name of the business and wound up clicking a link that sent her to a website disguised as the “Apple Security Center.” What also startled this woman is that this popup included a banner text that scrolled across the bottom of the screen while an audio file of an AI female told her that her computer was “locked up.” She was instructed to call the number on the screen. What she did was to call me! When I sat down on her computer, I showed her that she had been sent to a website called pelitahari[.]com, hosted on a server in North Ossetia, Russia.
Your computer is locked up
We cannot say it enough…. NEVER, EVER click on attached files to emails that end in DOT htm, html, shtml, php or js. These files are dangerous because they contain instructions for your web browser, such as… go to a particular website, download and install a malicious file. Here are 2 recent examples…
Tax Refund, Package Delivery Problems and More Pig Butchering Scams — Imagine getting this text, supposedly from the IRS, telling you that you have a $573 tax refund waiting! But the text came from an International phone number beginning with +66. That’s the code for Thailand! We want readers to look closely at the link that is provided. We expect people to recognize irs.gov BUT this is followed by direct-paying[.]com after a period. This means that both “irs” and “gov” are subdomains! The real domain in this malicious link is the direct-paying[.]com! This domain was registered just a few days earlier in Afghanistan!
Our readers continue to tell us that they are overwhelmed with these malicious texts pretending to be about packages from the US Postal Service. The fact that these 2 samples come from phone numbers in the Philippines and contain links to crap domains tell you everything you need to know about these scams!
One of our readers reported getting these 2 texts one day apart from two different unrecognized phone numbers. They both came from “wrong numbers” but we strongly believe these were no accidents! These were the start of pig butchering scams. DO NOT engage with these fraudsters! Don’t become their new friend! Trust us, it won’t end well for you.
Most likely you know that scammers often use Email to send their malicious texts. Check out this article about this fact:
Until next week, surf safely!
Copyright © 2023 The Daily Scam and Scamadviser. All rights reserved. You are receiving this email because you
have subscribed to it via Scamadviser.com or thedailyscam.com
Keurenplein 41, UNIT A6311 | 1069CD Amsterdam, The Netherlands
