Tracking Scammers Disguised as Famous People! — Imagine getting an email from Vice President Kamala Harris, informing you that she has $50 MILLION dollars for you! The overwhelming majority of people who get this absurd email recognize it for what it is, an advance fee scam, and hit delete.  But not our friend Rob! He jumped into action and replied, eager to collect his $50 Mil! Though he never received it, he got to wondering… Where in the world are these “famous” scammers located? And then, remarkably, Rob received an email from First Lady Jill Biden! Rob reached out to us for help and, together, we were able to track the First Lady to another country across the world! In fact, in the last two months, we helped Rob track lots of people who claimed to have money for him if he would only pay the fees to release it, including money from First Lady Jill Biden and President Biden! Nearly all of these scammers were located in the same country! (Most were in the same city! This is not a coincidence.) Think you can guess the country? Join us as we trick many of them into revealing their location, including a very wealthy district in a famous city!

On Wednesday, Aug 9, 2023 at 4:38 AM, Rob received an email from the “US OFFICE SERVICE” using the free Gmail account (and misspelled “office”) called <oficeline09 @ gmail.com>  It said:

GREETINGS BENEFICIARY,

THIS IS MRS KAMALA HARRIS THE VICE PRESIDENT OF UNITED STATE OF AMERICA WE’VE BEEN TRYING TO REACH YOU BUT YOU’VE NOT BEEN PICKING OR CALLS OR REPLYING OUR TEXT MESSAGES WE ARE TEXTING YOU CONSIGNING YOUR BANK CHEQUE WORTH THE SUM OF $50  MILLION USD YOUR BANK CHEQUE HAVE BEEN HERE IN OUR OFFICE SINCE THE 6RD OF AUG 2023 AND WAS DROPPED IN OUR OFFICE BY A AGENT NAME PAUL MICHAEL HE ALSO DROPPED YOU OWNERSHIP CERTIFICATE IN OUR OFFICE SO TELL US IF YOU WANT YOUR BANK CHEQUE DELIVERED TO YOUR HOME ADDRESS OR SHOULD WE SHIFT IT TO THE TREASURY DEPARTMENT IF YOU WANT IT DELIVERED YOUR FULL INFORMATION IS NEEDED TO AVOID WRONG DELIVERY.

HOME ADDRESS ………………

ID CARD ……………….

CLOSEST AIRPORT ……………

COUNTRY ………………………….

EMAIL ADDRESS ………………

PHONE NUMBER ……………………..

NEXT OF KIN ……………

NEXT OF KIN PHONE NUMBER ………..

YOU ARE TO CONTACT ME ON MY EMAIL ADDRESS AND ALSO MY PHONE CALL #1(724) 320-2049

My email address: kamaladharris15 @ gmail.com

THANKS WE WILL BE WAITING FOR YOUR REPLY

THE VICE PRESIDENT OF UNITED STATE OF AMERICA.

=========================================================

Of course, Rob replied via email in his usual curt manner and simply asked “why him?” And “how did you get my email? What do I need to do?” Vice President Harris responded about 6 hours later with this email.  It included this very awesome, super-official, delightfully clear, Government-issued document that you’ll see below. (Note: The fractured “SID” in PRESIDENT was NOT our editing. The file came this way.) This official document contains at least 4 grammatical and capitalization errors, as well as awkward English. Not what you would expect from the United States Whitehouse!

———- Forwarded message ——––

From: Kamalad Harris <kamaladharris15 @ gmail.com>

Date: Wed, Aug 9, 2023 at 8:13 PM

Subject: Re: GREETINGS BENEFICIARY,

From 1600 Pennsylvania Avenue NW

Washington, DC 20500, USA

private email address:

Kamaladharriss655 @ gmail.com

Phone #1(724) 320-2049

Greeting Beneficiary Rob

Regarding the message I received from you, view the attached copy of your ownership certificate.

THANKS WE WILL BE WAITING FOR YOUR REPLY

Mrs Kamala Harris

Vice President of the United States

==========================================

Rob never paid the $355 fee and, sadly, never received his $50 Million dollars. Of course the REAL Vice President doesn’t contact people like this using various free Gmail addresses and offering millions of dollars. And we doubt she’s sending emails at 4:38 AM or including her phone number for people to call. Other websites have reported scammers pretending to be Kamala Harris, such as Scamsurvivors.com and twelve reports on Scamwarners.com between the summer of 2021 and 2023!  But this wasn’t the first time that Rob had been contacted by the Vice President! Back in October, 2021, he received an email from Mrs. Kamala Harris Vice (brhvgc2337 @ gmail.com) with the Subject line “MY LAST WISH DO NOT IGNORED YOUR $55.500,000.00 MILLION DOLLARS.” Interestingly, when he hit reply to that 2021 email, the reply-to address went to a mailbox in Russia! (Joseph.williams @ inbox[.]ru). But where in the world are these scammers really located? Read on…

Many of our readers will easily recognize these scam emails correctly as “advance fee scams.” There are two tell-tale signs of an advance fee scam. (But do you know where most of them originate?)

1. Someone claims to have LOTS of money to give you and she/he contacts you via email to let you know. All YOU have to do to get that money is pay some small fee in advance. And if you make that mistake, there will be many more fees to come and you’ll never see the money promised to you!
2. When you receive your initial email about the money waiting for you, you’ll either be asked to contact someone else at another email address OR when you hit reply, you should notice that the reply-to email address is different than the original sender’s email. This is standard practice for these scammers!

Fortunately for us, Rob plays with advance fee scammers every week!  On August 18, nine days after being contacted by Vice President Harris, he received an email from First Lady, Dr. Jill Biden! This time, Dr. Biden told Rob that she had $50 BILLION DOLLARS for him! That’s right Billion with a B! All Rob had to do to receive his billions was to send Dr. Biden a $100 Apple Gift card to cover the “transfer fees” required to send his money. (We don’t make this stuff up, people!) Dr. Biden’s email account was a free Gmail account called FirstLadeyJillBiden146. (We wonder about the other 145 Jill Biden’s before her?)

This is where our story gets really interesting. Rob was curious to know where Dr. Biden might be located on planet Earth during this exciting moment. He asked us for our help to create and provide a tracking link associated with the Apple Gift card. We were happy to help! Rob then replied to Dr. Biden’s email, attaching the small image of the Apple gift card. It was so small that anyone wanting to read the exposed scratched gift code would have to click on it to enlarge it. The click, however, informed us exactly where Dr. Biden was located at that moment. It was Lakoja, Nigeria! In fact, Dr. Biden clicked Rob’s image 3 times in about a minute, trying to make the graphic large enough to read the scratched code.

As a Professional Scambaiter, Rob spends a lot of his time wasting their time. Rob tells us he gets about 15-30 scam emails per day that come into his several email honeypot accounts. That’s a whopping 105 to 210 scam emails every week! He told us that he answers every one with the same two line meaningless response. The same is true when the scammers respond to his first email. If they send a third email then he starts to read them and respond more meaningfully. Sometimes, he tells us, these email conversations with scammers go on for many months or longer! The longest ongoing conversation with a scammer who still hopes to trick Rob into sending him money is now well over two years! Rob tells us this scammer may write every few weeks or months (for whatever reason) and Rob starts his meaningless responses all over again.

As we said earlier, Rob has lately been tricking many of these scammers into clicking tracking links tied to images of scratched Apple gift cards or Google Play cards, with our help. Nearly every one of the many scammers who have fallen for his trick show up in Nigeria, and usually Lagos!  Check out this example from an email exchange that began in early July between Rob and a man claiming to be James F Kennedy. Mr. Kennedy claimed to represent the U.S. Government and, of course, to have money for Rob. On August 20, Rob finally paid his “release fee” by sending another scratched Apple gift card tied to a tracking link.

This time, Mr. Kennedy’s click revealed that he was located on a very exclusive island in Lagos called Victoria Island!

But Mr. Kennedy was never able to read the code on the gift card that Rob sent! He wasn’t happy. The next day, he sent Rob two emails a few hours apart. Mr. Kennedy doubled-down and claimed that while Rob was playing around with him, other Americans were getting their money!

These “Advance Fee” scams are also often called “Nigerian 419 scams.” They are given this name based on section 419 of the Nigerian Penal Code. (Source: Wikipedia) Our experiences have taught us that most of these types of scams come from criminals in Nigeria. Very often, the scammers will try to collect these fees as part of the shipping costs to send a “suitcase full of US dollars” to an American citizen whose name is listed as the owner. Once again, here’s an example that Rob was able to track to a scammer in Nigeria after “paying the fee” with another scratched gift card….

Over the years working with Rob and others, we’ve learned a lot about these particular scammers. They are persistent. If you call their effort a scam, they’ll push back that you are wrong, over and over! They spend months before they give up and, if you take the bait once, they come back BIGGER, BADDER and BETTER! Less than a week after his last email with Jill Biden, Rob heard from the President himself! That’s right! President Joe Biden contacted Rob to tell him about $50 BILLION dollars he had waiting for Rob! (**EYE ROLL**) After several back and forth emails with the President over 4 days, Rob managed to trick him into clicking a locator link on August 28. In fact, President Biden clicked it 7 times in 1 minute!  Guess what! The President was with the First Lady in Lagos, Nigeria! 

FOOTNOTE: As we say over and over, it is exceptionally easy to deceive others online! People routinely pretend to be someone else.  Check out this article/podcast on Malwarebytes.com about scammers who pretend to be celebrities, often engaging in romance scams:

https://www.malwarebytes.com/blog/podcast/2023/08/an-influx-of-elons-a-hospital-visit-and-magic-men-lock-and-code-s04e18

Online scams are the most reported type of crime. Most countries now state that between 20 to 50% of all crimes reported are related to online fraud. This is only the tip of the iceberg, as only 7% of all scam victims report the crime to law enforcement. With nearly $55 billion lost last year and more than 300 million consumers scammed fast action is required.

On October 18–19, 2023, the 4th Global Anti-Scam Summit (GASS) will take place. The goal of the GASS is to bring governments, consumer & financial authorities, law enforcement, brand protection agencies, and (cybersecurity) companies together to share knowledge and define joint actions to protect consumers from getting scammed.

In 2022, we had nearly 1,300 virtual guests and 120 physical participants from 70+ countries. This year the event will be organized hybrid again. Last year, we defined 10 Recommendations to Turn the Tide on Scams. This year, we will focus on further defining these solutions and showcasing the best practices from around the globe.

Schedule  |  Book Tickets

October 18-19  |  Ramada by Wyndham Lisbon Hotel, Portugal & Online (Zoom)

Top Phishing Scams of the Week — Apple, USPS, FedEx, Netflix, and MORE. Can you spot all these scams? Check out and protect yourself with this 100% FREE, all-in-one tool.

Back in August we posted a story about a man who kept seeing lots of ads for sneaker sales on Instagram that turned out to be fake stores or knock-off stores in China. Recently, another young man read that story and notified us of something else that happens to him a lot on Instagram. He thinks our readers should be aware of it. It concerns Instagram users who are invited to promote products for other online retailers. According to this fellow, at first these “request for promoters” seem like they’re ok, but he says that “they often target content creators and will try to get them to be ‘ambassadors’ for a brand that may or may not be real and will get the person to pay for a product to advertise for “exposure” or a very small commission.”  Here are a couple of recent examples of Instagram accounts that contacted this fellow and asked him to be a promoter….

He told us that “honestly I am not sure if they fit the official definition of scams but some of them seem sketchy.

The brands themselves will often be really cheap mass produced clothing marked up at really high prices. The conversation I got into with one brand had a T-shirt that was marked on their site for $60, for example.”  So, dear readers, we are NOT calling these Retailers scams. However, as the fellow informed us, we suggest that Instagram users who are contacted should proceed with caution. Below is a conversation that this young man had with another Retailer who contacted him. Once he heard about what was required of him to be a promoter / ambassador,  he walked away from this “deal.”

Paypal and Norton LifeLock — This Customer Service email came from a free Gmail account. (What a surprise!) The scammer who sent it pasted the email addresses into the TO field, and not the BCC field.  The TO field showed more than 450 targeted victims!  We cut out most of them. Of course, the phone number posted in this email is a scammer’s number. Time to take out your airhorn cans and tell them what you think of these scammers!

It’s important not only to recognize what scammers put into these phishing emails, but also to realize what they leave out! Where is your name and address? Where is your credit card and account information used to charge you? None of that important information is found in 99.9% of phishing scams because they don’t have it!

Do NOT Answer and Win! — For YEARS we’ve been reporting on the escapades of a cybercriminal gang who have been using the same “Answer & Win” crap emails disguised as various products and brand names. They use these clickbait to collect information from consumers and sometimes to deliver malware. Check out this lame email claiming to be from Walmart, but from a free Gmail account called MahalMahal401. “Mahal” is Indian, meaning “palace” or “mansion.” (Source: Wikipedia. We find this most interesting since we believe that the cybercriminal gang very likely responsible for these malicious emails is a gang in India whom we used to call the Hyphen-Poopy gang! We wrote about them in August, 2022 but they have since changed their “hyphenating” practices because we shamed them so many times!  Well, they are STILL poop-heads in our opinion!)

If you make the mistake and click the link, you’ll end up on a website filled with lies, trying to collect your personal information.  Here are some of their lies….

• The top of the page always tells you that millions of dollars in offers have already been given out. LIE!
• If you take the survey, they have another reward for you, usually $50 or $90 or products. LIE!
• This offer is only available today, says a note in the page. LIE! That date updates daily.
• The bottom of the page says that your offer expires in 6 and ½ minutes. That is also a LIE!  If you let the counter count down to zero, it simply restarts again.  Believe us, we’ve watched this dozens of times.
• Often times you may see consumer reviews at the bottom of the page with quotes from people talking about the wonderful free products and awards they’ve received. These are also lies!

And in case you weren’t certain about the maliciousness of the link in that Walmart “Answer & Win” email, here is VirusTotal’s assessment…

Another one of our longtime readers also gets hammered by these “Answer & Win” clickbait from the Hyphen-Poopy Poophead cybercriminals in India. He sent us this lovely email offering a brand new jumpstarter from AutoZone.  Except that AutoZone uses the domain autozone.com and not Gmail! The shortened link at the bottom of that email is CLEARLY not safe to click!

Deeeeeeleeeeete!

Suspicious Virus Detected —We’ve seen these emails before! They pretend to be a report from Google telling you that a suspicious virus was detected on your device.  Guess what?  GOOGLE DOESN’T REPORT THIS TO PEOPLE! The Security Check link in the email misuses a marketing service called SendGrid. Your SendGrid click will be redirected to a website hosted on a server in Germany called AmberRight[.]space. Sucuri.net thinks that malware may be lying in wait for you in Germany. What a surprise! (Interestingly, “Amber Wright” was a 15-year old killer who murdered her boyfriend in 2011 – according to ReadySteadyCut.com.  Perhaps these cybercriminals are trying to channel those vibes?)

Until next week, surf safely!

Copyright © 2023 The Daily Scam and Scamadviser. All rights reserved. You are receiving this email because you
have subscribed to it via Scamadviser.com or thedailyscam.com

Keurenplein 41, UNIT A6311  |  1069CD Amsterdam, The Netherlands

Contact Webmaster