Collateral Damage from a 4-Year Old Scam — When our friend Rob first told us that he had baited yet another “419” advance-fee scammer and wanted to share his experience with us, we had no idea this particular scam had such a long history and included an unanticipated victim. During our ten years reporting scams and educating the public how to avoid them, it’s unusual to find the exact same scam successfully operating for this long. (The best exception to that statement has been the “underage girl sext scam” which we’ve documented targeting nearly 950 men over a 4 year period.) But now, it appears we have another scam to rival the success and longevity of the “underage girl sext scam.” The 419-scam we’re talking about landed into one of Rob’s inbox’s on October 1. He received an email from a supposed lawyer who identified himself as Christopher Landis, of Santa Cruz, California. That was a lie, of course. We spoke with the real Landis Law Firm of Santa Cruz, California and that’s when we learned how deep, how successful, and how bizarre this advance-fee fraud has been. Read on and we think you’ll be as surprised as we were about this fraud and the collateral damage it has caused.

On October 1, Rob opened the email below, knowing full well that it was a scam and got excited to start playing with another scammer. He enjoys hitting back by wasting their time, and just maybe, making them feel badly about what they are doing. For example, on between October 17 – 20, Rob played a scammer who pretended to be someone named Ken Bowan (kbowan08@gmail.com), an “Assigned Delivery Officer” who contacted Rob about the delivery of $4.5 Million dollars to him. Finally, after four days of back-and-forth conversation leading him on, Rob called him out as a scammer and low life, with a colorful punchline that we would rather not reprint.  Remarkably, the scammer replied with 2 words…  “Well done.”

As you read this email from “Attorney Landis Christopher (Esq), it’s important to know the following…

1. The sender claims to be Attorney Chris Landis but sends his email from a free Gmail account called wubond1950.

2. The sender claims to be contacting Rob about an overdue “winning prize/compensation fund, contract and inheritance fund” valued at $12.5 Million dollars BUT doesn’t even include Rob’s name or any other personally identifying information about Rob other than his email address. (People’s Email addresses are easily available online and found by the millions on the dark web too.)

3. The sender ends his email with the full name of his law firm and address BUT that doesn’t mean it is true! In fact, we learned from the REAL law firm that this scammer has been using the Landis Law Firm name and information for at least four years now.

.

Later that same day, Rob replied to “Attorney Landis” and asked only three simple questions:

1. How did you get my email?
2. Why me?
3. What do I have to do now?

But Rob’s reply was not sent to wubond1950 at the Gmail account.  Nearly ALL 419-scammers make it a practice of using a different “Reply-To” email address than the address they use to send their initial email. This makes it harder for email services to protect victims. For example, if a scammer uses one email address to send out 10,000 emails in a few hours, it is likely to get attention from a service provider. If service providers look at the account and notice the fraudulent email, they will, hopefully, shut it down. But it doesn’t matter because the Reply-To address is different and, very likely, less than 1% of recipients will respond to the scam email. Rob’s reply went to: landislawfirmcaliforniaq “@” hotmail.com.  (This is a free Hotmail account and NOT any real email address belonging to the Landis Law Firm.)

(Fraudulent Footnote: Did you notice that “Attorney Landis” sent his second email at 6:11 a.m.? Other emails were sent as early as 5:38 a.m.! These are Rob’s time on the East Coast (EST), not California time. California time would have been three hours earlier, at 3:11 a.m. and 2:38 a.m. Does Attorney Landis work these crazy hours? The majority of these 419 scams originate in Nigeria, which is 5 hours later than EST. For example, 5:38 a.m. EST is 10:38 a.m. in Nigeria.)

In the second email from the scammer, it is easy to see the fraudulent request that begins with $50. Notice that  the scammer doesn’t ask for it via any insured banking method that typically includes security or monitoring by employees who might help a possible victim of fraud. He wants Rob to purchase gift cards (like iTunes or Steam Wallet). This is where our story becomes heartbreaking… 

Rob thought it would be helpful to inform the REAL Landis Law Firm that their personal information was being used by a scammer. He spoke to a woman named Andrea at the Landis Law Firm, only to learn that they were WELL AWARE of this scam because of the crazy collateral damage they have suffered. Rob urged us to speak to Andrea. Andrea, as it turns out, is a 47-year old woman and daughter of the REAL Attorney and owner of the firm, Christopher Landis.  Attorney Landis is a personal injury lawyer, and not practicing law that is in any way related to inheritance or contracts. (Landis Law Firm: Santa Cruz Personal Injury Law Attorney) Andrea has been working full time for her dad for about five years, but in various ways since she was a teen, she told us on October 18.

Andrea said that they began to hear from victims in 2018. Sometimes they have had as many as ten phone calls a day from people asking why they haven’t yet received their money (inheritance, etc.). (For a while, callers asked to speak to “Shirley Perez,” a name never associated with their firm.) Andrea has even found copies of emails online from sites exposing scams that show her father’s name and law firm address. During the last 4 years, Andrea estimates that she has picked up and responded to several hundred phone calls from victims. She tells that all of the callers she has spoken to are from the East Coast. In addition to this unbelievable number of callers is another 500-1000 calls, she estimated, that she doesn’t pick up. (The Caller IDs show East Coast area codes.) The victims are all angry at Attorney Landis because they have paid lots of money for transfer fees, taxes, and other fees for their inheritance but have still not received their money! (None of this makes any sense, of course, if you look online and see that the REAL Landis Law Firm is a personal injury law firm!)

Sometimes, Andrea says, the victims stories and actions are crazy and even border on dangerous. Even after explaining to victims that they, too, have been defrauded and the real Landis Law Firm is not involved, some victims will call back twenty times in a row! Andrea has had to block their calls. She also tells us that she has been yelled at by victims and therefore blocks their calls. Many victims did not believe that the law firm didn’t have their money and would say to Andrea “I have the email from you!” Of course, Andrea pointed out to victims that their name, address and even Bar number was stolen and misused. And if they looked carefully at the email address used by the scammer, they would see that it wasn’t from landislawfirm.com. But for many victims, that wasn’t enough!

One day in 2019, Andrea was sitting in her office when two men walked in. One said “I am here for my inheritance” in a tone that was uncomfortable to Andrea. (She says he was dressed “oddly.”) He then demanded his inheritance and said that he already paid $5,000 to their law firm and still hasn’t received his inheritance!  This immediately got Attorney Landis’ attention from inside his adjoining office and he came out to confront the man. As you might imagine, this led to an argument. Unbelievably, the two angry visitors said that they were going to call the police and Andrea’s father said “Please do!”  When the police showed up and assessed the circumstances, they laughed, said Andrea. Apparently, the two men had borrowed money to pay for their flights to California since they had nothing left after sending their last dollars to the scammer. They had decided to do this to confront Attorney Landis. It was sad, scarey and weird, Andrea said.

Even to this day, the Landis Firm may get five calls a day about this scam. In every instance, when a victim reveals why they are calling, they say that their contact with the Landis Firm began with an email. (If only people would do some Google searches to look up the law firm’s real email or recognize that the source of an email is critically important to seeing through fraud.) But by the time victims call Andrea, they’re already suspicious or angry at her father.  Some callers have told Andrea that they are being screened and blocked by the scammer’s phone number too.  Other victims have reported to her that their email exchange with the scammer contained a lot of religious references, which have influenced the victims (as intended) to believe the person they are communicating with is very religious and can be trusted as a result. These victims are then more confused when the scammer starts yelling at them (as he reportedly has) during their phone calls, and even uses foul language! The scammer’s accent has been described as either Asian or Indian, to Andrea. Out of frustration, in 2019 Andrea called the phone number for “Attorney Christopher Landis” found in these bogus emails. A man answered the phone and she called him out as a fraud…”You are using our name!  Why are you doing this?” He simply replied with “F-you” and hung up. Andrea thinks he has since changed the number he uses for his scams. On October 3, the email sent to Rob by this scammer included the phone number +1 (559) 239-8588.

As much as we empathize with the hundreds (thousands?) of victims of this fraud, we can’t help but feel badly for Andrea and her father, Christopher Landis. Andrea tells us that her father has been practicing law for more than 40 years. He registered and has used his domain, landislawfirm.com, since 2006. However, he is thinking about retiring in the near future. The question that comes to our mind is when Christopher Landis retires, who will this scammer next pretend to be? The next law firm should know that they’ll soon be the collateral damage of a scammer who doesn’t care about the pain he causes on the lives of others.

What Is Spam and How To Stop It! – Keep receiving spam text messages and feel annoyed? Block spam texts with this FREE, all-in-one tool! Learn more:

Playing with Scam Phone Callers, Data Privacy, and More About Pet Scams – Have you ever heard of a “park police benevolent association” before? We hadn’t, but Rob has. Though there is one in New York state, any call trying to raise money for it is a scam call. According to this article posted on the Binghamton, NY homepage, the New York State Police Benevolent Association does NOT solicit for donations via phone calls. If you listen to this 2 minute call, it sounds like two dueling AI masters, that is, until the call is transferred to a real woman who tries to collect the donation. She hangs up in frustration with Rob’s AI Bot! Lots of people are complaining about these scam calls on Thee Rant. One man asked the caller what percent of his donation actually goes to support the State Police.  The answer was 15%. He hung up.

Rob also sent us this lovely phone call from a man with a subtle Indian accent who is trying to sell CBD oil products for pain reduction to Rob’s AI Bot. We’ve shortened the 8 minute call down to 5 minutes but it should be VERY clear to listeners how frustrated the caller is when Rob’s AI randomly interjects things into the call to waste the caller’s time. We hear that the Bot’s oven and kitchen lights are now doing just fine!  Enjoy!

And finally, Rob sent us this exchange between his Bot and a scam call from “your utility company.”  It begins with the scam caller’s Bot saying “Hello, this is a call from your utility company. You have been paying more than your consumption for the previous few months.” Apparently, they want to give you a refund. But in so doing, they’ll trick you to give them your bank account information and then steal your money! ConsumerAffairs.com recently published an article about this scam called Scam Forecasters Predict a Cold Winter and a 70% Chance of Utility Company Imposters. Enjoy listening to Rob’s Bot against this scammer!

In response to last week’s story about scam puppy websites, we heard from several of you who reported other scam sites, including sites selling exotic pets and parrots. On October 20, one woman told us she was scammed by a puppy dealer whom she found online. She was looking for a boxer puppy and could not find one in her area. This online dealer (She couldn’t recall the website name) charged her $900 for the puppy, then came back asking for another $500 to put him in a protective crate to fly him to her. This surprise “crate fee” for delivery is TYPICAL of these scams! She did pay the additional $500 but later realized she was being sammed out of $1400. She thinks he was from outside the U.S. though he said he was in Colorado. Luckily, she paid thru Paypal!  Paypal went after him and was able to retrieve her money by reversing the transfer!  

Data Privacy: We’ve repeatedly urged our readers to be careful how/where they share their personal information. Scamadviser.com has posted an excellent article called Data Privacy: Why You Should Care and What You Can Do. It is worth reading!

On October 19, another reader reported a scam puppy site called paradiseyorkieshome[.]com. The site was selling purebred Yorkie puppies for $650.00. The woman informed us that the seller wanted the money transferred from Walmart! He added that in order to ship the puppy, he needed another $1500.00 transferred the same way! These are MAJOR RED FLAGS of a scam! Sadly, the scam domain paradiseyorkieshome[.]com has been used for more than two years. These scam websites get taken down but then scammers keeps re-registering it months later! The recent re-registration of paradiseyorkieshome[.]com was just about 3 weeks ago, and the website was again taken down last week.  This website was reported as fraudulent back in 2020 on PuppyScam.com.  (We now have 56 scam pet-selling websites posted in our article.) We also heard from a woman who told us about some of these scam sites popping up as ads on her Facebook feed! She informed us of a Facebook Support Group fighting back against Parrot pet scams…

Parrot Scammer Awareness Support Group on Facebook (Private group; request to join)

Footnote: Here are a couple other worthwhile articles concerning cybercrime that may interest our readers…

From Fidelity.com: Could You Be a Target for Cybercrime? Understanding the Potential Threats Can Help Keep Your Accounts Safe Online.

From Yahoo Sports: Millions of Americans lose money to scams every year. One group of YouTubers is trying to help.

(Many thanks to our contributors this week, Rob and Andrea, for their time and effort to help fight against online fraud.)

Netflix, Xfinity Agreement, Paypal, and Geek Squad – Lots of people use Netflix. This email actually appears to come FROM netflix.com but it is a well-crafted phishing scam.  You are asked to restart your membership because your payment couldn’t be processed.  However, mousing over the red button clearly shows that you’ll be headed to a website called dubaitailoring[.]com.  Need a new suit, or something hemmed? Go for it but it’s likely to be a long delivery time. Otherwise, delete!

Job Offers for You – In this week’s Your Money column we would like to turn our attention to fake job offers and interviews. Starting with this email shared with us by one of our readers. It seems that the HR Manager from Ocado Group, named Mrs. Jasmine Barb, reached out to the woman about a job interview. Ocado Group is a British retail company. Fortunately, the woman was savvy enough to see that the email DID NOT come from their domain, ocadogroup.com. Also, she was asked to reply to a free Gmail account called ocadogroupplchirenow.  That’s NOT how businesses operate!  This is one of hundreds of job interview scams that we’ve detailed in our article titled Job Interviews in Google Hangouts and other text-only environments.

Last week one of our readers sent us a link to this bogus recruitment site on Facebook for Amazon jobs.  We suspect a 10-year old can also see the flaw on the web page. Even though this is job recruitment for Amazon, there is a sentence saying this is a job offer for Walmart! Adding insult to injury is the fact that the link on this Facebook page doesn’t point back to either Amazon or Walmart.  It points to a free Google Site page identified as part-time “work from home” Amazon jobs!  BUT the link to “Apply Now” actually contains a hidden redirect to a malicious website called shadowcpa[.]com.  This murky website also contains another dangerous redirect on it to a website called go2affm[.]com.  Step back from this landmine!  This is NOT a job offer from Amazon.com or Walmart.com!

While we’re talking about Amazon, here’s an email claiming to offer you a $100 AMAZON Gift Card Opportunity. Except that this clickbait came from unlockyouhip[.]shop!  That sounds like Amazon.com, right? That open hippy-dippy website was registered just 8 days earlier.  We all know what that means. RUUUUUUN!

Problem Delivering Your Items and Paying Your Invoice –This next scammer’s trick is VERY DANGEROUS! It appears to be an alert from United Parcel Service (UPS) that your package could not be delivered.  They’ve attached a PDF file with details. HOWEVER, if you were to open the pdf file, you’ll see that it is blurred and a message says your “browser memory is full.” You are therefore asked to click a link. CLICKING IS DANGEROUS!  If you clicked that link, you would be sent to a website identified as a phishing site, called courire[.]org.  BUT this phishing site also contains an external script associated with a 6-day old website called cargopattern[.]shop.  This “container” site likely contains malware ready to hit you. Deeeeeeleeeeeete!

The Daily Scam has received more than a dozen emails representing many companies claiming to pay us for an invoice we never sent, or some other business nonsense.  They want us to download a pdf file of the invoice, like in the email below. However, details matter! We want you to notice that the file name Bank details.pdf is followed by DOT-z.  That “z” shows that the file is actually a Zip file! Zip files can contain malware along with instructions when they are opened.  No thanks, we’re good!

Dangerous Path to Claim Your $100 Gift – One of our longtime readers continues to get hammered with texts that have proven to contain dangerous links. This week we decided to show you some of the details we see when we use tools to follow the threats in these links.  Let’s begin with this text she received on October 17 for “Venmo User” and offering a gift of $100. The link points to a bizarre medieval-sounding name swordoccur[.]com and NOT venmo.com!

The domain swordoccur[.]com was registered in the Bahamas on October 17, just hours earlier on the day she received the text.  The fact that the domain is barely a day old means that this sword isn’t a noble offering, like from Sir Arthur’s “Excalibur.” This is a threat.  When we used the Sucuri’s Site Check to evaluate the link, it told us that this cutting domain redirects people to another domain called lolameraz[.]com. VirusTotal.com then informed us that lolameraz[.]com is a known phishing scam site, according to the security service AlphaMountain.  But that’s not the only redirect on swordoccur[.]com.  We also learned from the Zulu URL Risk Analyzer that this malicious website cuts both ways because it contains another embedded connection to a malicious website we’ve seen used in many other clickbait, called prizeforsurveys[.]net.  All of this can be seen in the graphics below. Bottom line….Don’t click. This particular reader also told us that she’ is grateful to us for teaching her how to recognize fraud. Mission accomplished!

Here’s another example of these day-old domain threats.  This next text contains a link to messyypush[.]com. That domain was also registered just hours before the text was received on October 18. Deeeeleeeete!

Until next week, surf safely!

Copyright © 2021 The Daily Scam and Scamadviser. All rights reserved. You are receiving this email because you
have subscribed to it via Scamadviser.com or thedailyscam.com

Keurenplein 41, UNIT A6311  |  1069CD Amsterdam, The Netherlands

Contact Webmaster