THE NEWSLETTER  |  09.09.26  |  V06N31
  Co-Founder/Content: Doug Fodeman  |  Co-Founder/Creative: David Deutsch  |  Scambaiter: Rob M

Victim Loses Over $150K & Can’t Admit It Is Fraud!

We have a very sad story to share with readers this week and, honestly, we don’t fully understand all the details. This fraud has been going on for many months! In late August we were contacted by a woman who wanted our opinion about a shipping company that had raised concerns to her. That shipping company is called HIYAKU INTERNATIONAL COURIER and uses the domain hiyaku-intl-courier[.]com. It turns out that this suspicious shipping company was just the proverbial tip of the fraud iceberg. And, as we learned, this fraud hadn’t targeted her. It was part of a long, ongoing con that has successfully targeted her 58-year old husband. And it is still going on. The woman told us that her husband has already sent more than $150,000 to the scammers behind this fraud, and he can’t seem to stop himself! She said that he is not cognitively impaired or battling dementia. He is simply so sucked into their narrative that neither she, nor her two sons (ages 18 and 21) are able to convince him that he is being scammed. He now believes that a court will be awarding him $2.5 Million dollars in this crazy narrative. We felt so horribly for this woman and her boys. We have offered to help convince her husband why this complex and changing story he’s been living in is 100% a scam. But so far, he’s unwilling, uninterested or simply too deeply hypnotized by these scammers to hear from us or his wife and boys. He’s now pushing away his family and it is heartbreaking, as well as costly for them all. And he’s a farmer so it isn’t likely that he has the deepest financial pockets. Have you ever heard the expression “you can’t help someone who doesn’t want to help themselves?” This man clearly needs an intervention…

On August 26 we received an email from a woman we will call Barbara, to protect her identity. She said that her husband had received the following email shown below. She asked if the business called HIYAKU INTERNATIONAL COURIER, using the domain hiyaku-intl-courier[.]com, was legitimate or a fraud. Barbara said “This was sent to my husband’s email address. He was told that a package he ordered was coming by this company. When he asked why it was not delivered they sent him a response. When he asked for a phone number and documents to verify with local customs, they blocked him.”  It wasn’t a surprise that this supposed Courier company was asking for an absurd Customs clearance fee of nearly $44,000!

 

With 100% certainty, we confirmed that the business called Hiyaku International Courier Limited Logistics, at the website hiyaku-intl-courier.com is a fraud. We have investigated hundreds of bogus shipping websites similar to it. We have seen the same fake “Team Members” photos on many other fake shipping sites, as well as the names John Smith, Sarah Johnson, Michael Chen and Emily Davis. (e.g. two of these names, Michael Chen and Sarah Johnson, were used in a fraud we reported on 6/4/25.) We’ve also seen the same fake testimonials on lots of fake shipping sites, such as the names Steve Hardy, Jessica Carter and Chris O’Conner. Also, their About Us webpage says they were founded in 1971 but their domain was registered just last November in 2025!

After reporting this information back to Barbara, she then revealed that her husband has been deeply involved in a fraud to which he has given more than $150,000 to scammers! And yet, she still could not convince him that it is a fraud! This was what Barbara first told us on August 26…. “In April my husband revealed to me that he has been “helping” a lady who’s in the hospital doing dialysis in Wyoming but [she is] from Boulder CO. She can’t afford to pay to “open” a safe that is in her house she owns (but that she doesn’t live at). It has LOTS of money in it and she’ll pay him back with interest if he helps her. Apparently for some time he has been buying Apple Gift cards, sending them to her to pay for each level to unlock. He only told me because the amount was now larger than he could hide from me. $2500 a day. I tried to explain why this was a scam and was very much against it. He informed me he was going to do it with or without me. There had been a flag put on apple cards in our [TOWN REDACATED] area because many people have been buying $500 cards in large quantities. Now she [i.e. the scammer] wanted him to use Paypal, Chime or Zelle to send her the money. When I asked what her name was I was told Matta Boss. As for the name to use on the Paypal, she gave a strange name that brought up multiple options. He asked what her options were? She then gave him another name to send to a guy friend [but] Paypal wouldn’t let him send anything over $50 and flagged it [as risky.] She then told him to use Zelle to send it. But the bank wouldn’t allow him to send money to her account since it was not in the USA. (Even our bank flagged it!) She used the guy’s name again. His name was Donald Mcphail (donaldmcphail07@gmail.com) This is when my husband started sending $2500 a day to her.” Barbara showed us a bank record that showed her husband had sent $14,000 over the course of just one week to this Donald Mcphail. (NOTE: Why would Matta Boss’ Zelle account be outside the US if she lives in Boulder, CO? This is another red flag!)

 

The above photo is but one example of many that her husband purchased Apple gift cards and sent them to help this woman named Matta Boss, who claims to be in a hospital on dialysis. Barbara demanded the hospital information from her husband to verify that this wasn’t a fraud, but he wouldn’t give her that information. She did get, what appeared to be, a staged photo from him of someone hooked to a machine. But the photo showed no face of the person and wasn’t verifiable in any way, she said. This is, of course, extremely suspicious and supports that this hospital story is a fraud. Think about it. All it would take to confirm the authenticity of this circumstance is for her husband to ask Matta Boss for the hospital name, floor and a nurse’s name where she is having her daily dialysis. He can then tell Matta Boss that, in order for him to continue supporting her financially, she must tell the hospital that he has authorization to call them and inquire about her health since he is paying her bills! And then Barbara told us that her husband’s story got even more bizarre….

Barbara then said “A new part of the story… Now he tells me there’s some lady locked in the house with the safe and can’t leave until it opens. She is from a foreign country and Matta has her passport (supposably the house is in [LOCATION REDACTED]). The day before the last level opens some security team breaks in and kidnaps the lady, taking the safe with them. This next part is now the security team contact, named Nikolai Patrushev Peter aka ‘Peter Robert’, messages my husband saying they have it all. Also, some diamonds they will give him, along with the money, when it opens. They say they are from Russia. They’re the ones who have the lock on the safe and will be going after Matta to arrest her. But he can’t have his money until the investigation is over. But they say he is entitled to the $2.5 million claim, he just has to pay the taxes to the Russians for it. $15,865.00 in taxes. And YES, my husband paid it! He did a wire transfer to an account. Then they give him some story about it needing to come from Japan so he needs to pay another $5,853 for it. I started really going off on him about all this but he still doesn’t believe me about it being a scam! There are a lot of things he stopped telling me but I guess they sent him the tracking number to the fake shipping company. That is where the new fake email comes in, wanting money. [That is the email that Barbara shared with TDS and shown above.] He’s still trying to get them to tell him what the fee is for, so he can get the package.” (NOTE: We have often seen stupid, made up names like using 2 first names “Peter Robert” created by fraudsters. Usually, these particular scammers are located in and around Nigeria based on our experiences of tracking scammers.) Below are two of the fake documents that were texted to the husband to support this part of the scam story. We can see, in part, that these fake documents were texted from an email account. That’s NOT how real government agencies operate! Even those in Russia! We guarantee that if the husband were to show these documents to any US foreign diplomat, they would immediately tell him these documents are fake.

As a part of this fraud story, the scammers sent Barbara’s husband a 4-page “CBP SHIPMENT NOTIFICATION” document (as a pdf file) about the shipment of his black box. Keep in mind that CBP stands for the U.S. Customs & Border Protection agency. Below are screenshots of pages 1 and 2. When we looked this document over, we saw absolute proof that this document was also a fraud!

Here is the proof that the above pdf document, supposedly from the Customs & Border Protection service, is a fraud….

  1. The CBP shipment notification about the black box states that the official email for their CBP office is cbp.denver.collections@customsprotection.com. This is a fraud! ALL US Government email addresses (with only rare exceptions) for Customs & Border Protection use cbp.gov, NOT “customsprotection.com“. (e.g. https://www.cbp.gov/about/contact ) In fact, according to a WHOIS tool, the domain “customsprotection.com” was once registered, but is not currently registered and for sale again! (As of 9/4/26)
  2. The signature used to represent Rosario “Pete” Vasquez was actually a dummy signature stock image found here on the website called PNGItem.com.
  3. The US Customs and Border Protection service does sometimes submit penalties as invoices that must be paid. But they also provide a way to look up your penalty ID information. We submitted the penalty ID found in this pdf document to the real CBP website: https://epet.cbp.dhs.gov/search. The results said that no information could be found for that reference ID. (We STRONGLY urged Barbara and her husband to call the phone number found on the real US Customs & Border Protection website to ask about this penalty document. We are sure they would tell them it is a fraud! Unfortunately, they haven’t called.
  4. We already made it clear that the shipping company Hiyaku International Courier is a fraud. Scam-Detector rates their domain/website as 19.5/100 meaning suspicious/dubious and that shipping website was been identified as being on blacklists. In case our prior points weren’t enough, here are 4 more…
    a) Their contact page offers NO phone number: https://hiyaku-intl-courier.com/contact. There’s a button but it doesn’t do anything!
    b) Their website offers NO addresses anywhere in the world, other than saying they have locations in Tokyo and Russia, etc.
      c) They invite visitors to download their Mobile App but there are no working links to do that because they don’t have an app!
      d) Their website shows links to 4 social media services and NONE of these links works.

    ALL of these facts are signs of fraud.  Barbara’s husband is absolutely being taken advantage of by scammers. Including another small but important clue that we learned recently. Barbara told us that all of her husband’s communications with Matta Boss, the Russian Security service, the shipping company and others, are all carried out using the Signal App. The Signal App is a private and secure form of communication that uses end-to-end encryption. It’s exactly the type of app used when you want to hide something from others. Why would a woman needing dialysis to stay alive use it to communicate with her benefactor? Why would a shipping company employee use it to communicate with a client? The answer is easy….because they are fraudsters who want to hide the trail of their fraud.

We spoke to Barbara last week by phone about all of this insanity that has taken control over her husband, and impacted her life and that of their two sons. In that conversation, we learned that her husband had likely met Matta Boss in some porn chat room or app. We also learned that he had been sending money to her for many months and deceiving his wife. Barbara didn’t learn about his relationship and the fraud behind it until April of this year. She said that she kept finding scratched-off gift cards everywhere… in the car and around the house. Barbara works in IT and has a good understanding how online fraud operates. When she confronted her husband, he admitted that he had been helping this woman deal with her medical bills, and their conversation about this degraded from there. And he got angry at her. He has now locked her out of his phone so she cannot go looking for evidence of his activities in this scam. He is clearly incapable of seeing what should be obvious to everyone, including his wife! 

And very sadly, we learned that her husband had depleted their savings account and was now taking money from their farm business checking account to send to this woman and to pay the many fake fees, bills, and  taxes that support the scammer’s narrative. This story is a crazy fraud, especially because this 58 year old farmer is so deeply manipulated that he can’t see the many obvious signs for fraud! For example, Barbara added…. “When I demanded a real phone number and address of where this Peter [Russian security fellow] was [located] I was given 302-287-2505 as a phone number. I Googled it and it showed up connected to a Tiktok account for Kimberly-grant writer. Of course if you call the number no one answers, only text messages. On Instagram it shows Kimberly and a abigailfly0 connected to that phone number. [See screenshot below.] The wire transfers he sent went to Norris Hydralic [sic] Ariel repair. There are only a few things I can give you right now that have some proof. To me there are thousands of red flags saying scam but he is so convinced this is all real and that I’m wrong.”  According to Google, there is a business in North Carolina that was registered in 2025 and uses the misspelled name “Hydralic” instead of hydraulic. We learned that Barbara lost a lot of evidence when her previous phone died and had to be replaced. She was unable to recover photos and screenshots, for example, that were about this fraud. At least she can turn over some evidence to the FBI, such as where some of the wire transfers were sent.

By the end of our conversation, it was very clear that Barbara was both frustrated and sad that her husband had fallen so deep into this chasm of fraud. She said “I’m watching him go into a hole and I don’t know if he’ll come out of this.” And she said that he won’t discuss anything about these circumstances with her any more. He’s shut her out, and his boys.I told her that there were resources that might help her. For example, the Center for Mental Health and Aging produced a podcast and a supporting webpage titled “My Aging Parent Won’t Stop Giving Money to a Scammer. What Can I Do?” This offers some suggestions that she might consider. I also told her that in extreme circumstances, we’ve known of families that have had a lawyer present the facts to a judge, in an effort to have an alleged victim’s rights removed or limited to various financial accounts to protect the rest of the family. She might also decide to contact APS, Adult Protective Services in her state. Adult Protective Services (APS) are government programs that investigate reports of abuse, neglect, and exploitation of vulnerable older adults and people with disabilities. It is also deeply saddening to think that if Barbara decides that it is necessary to intervene with any of these last few suggestions, it may poison her marriage irreparably. Then again, that already seems to have happened based on the way her husband hid much of his support and interaction with Matta Boss and her scam team for months. All the while, he was depleting their financial stability in ways that will likely have serious long-term consequences for their entire family and his business. Thanks to scammers.

WE HAVE LOST THE FIGHT, Interesting Update to Last Week’s Story & More!

 

Scams targeting Americans are at an all time high, according to this article from the Associated Press, published on U.S. News & World Report. According to their report, data suggests that nearly every single (Adult?) American has been targeted by fraud. According to another study published by APNews, 3 out of every 10 people report having lost money or personal information to fraud, though many do not report the loss. And, not surprisingly, about 80% of Americans when polled say that our government is not doing enough to prevent scams targeting our citizens. Adding insult to injury, the article also reports something we have seen over and over…. Victims of fraud are often targeted again. Experience has taught us at TDS that scammers will try to target a victim again and again if they have had any prior success with that victim. And as if all of that wasn’t bad enough, Investigative Reporter, Brian Krebs just published a BOMBSHELL article last week. He learned through a Russian cybercriminal forum that the Driver’s licenses, as well as other IDs & documents on more than 170 MILLION Americans and Canadians are available for purchase and download on the dark web! You can read his article here: https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/  Of course he has informed the FBI and they are investigating it but the site that was selling this information has disappeared. For now. What Brian also discovered about the information stolen is that it is also connected to lots of travel records of the people named on the licenses. This data breach is a new level of insanity and clearly demonstrates that the United States has completely LOST the war against digital protection and cybercrime. Our country needs to completely review, rethink and renew how it safeguards digital records and protects its citizens. This failed effort is probably because we’ve been bringing a 2” boy scout knife to a fight against people using grenades and machine guns.

We have a very interesting update to report on last week’s Top Story. The story was about a former police officer who lost more than $12K to a scammer in Cameroon when he tried to buy a used boat engine. “Jerry” reached out to us late last week to say that he received the following email below from a man named Joe Cullen. Mr. Cullen said “I received a request from a legal team” and “for a legal case.” It implies a lawsuit. We are 100% confident that this email was sent by the scammer in Cameroon to Jerry to try to intimidate him! Read the email and then we’ll explain below how we arrived at this conclusion…

Here is how we know that the email above is a fraud and meant to intimidate a victim we call Jerry by a scammer we tracked to Douala, Cameroon….

  1. That email came from controlledair.com. Controlledair.com is the official website for Controlled Air, a commercial heating, ventilation, air conditioning (HVAC), and energy solutions provider that’s been around for many years. Why would such a service send this type of email to Jerry when he has never done business with them? We suspected that the sender’s email account account had been hacked and misused to send this email. Jerry called this company and told them about this strange email. Their IT staff confirmed that Joe Cullen’s email had been hacked and misused and they were now dealing with it! The REAL Joe had not sent that email!
  2. The link in Joe Cullen’s email above points to a website called latinserver[.]net. A little strange, don’t you think? According to Google, latinserver[.]net is an “e-commerce website that appears to function as a spoof, drop-shipping storefront, or highly questionable reseller platform targeting Japanese consumers.”. VirusTotal found no problem at latinserver[.]net BUT it did report that it contains MULTIPLE redirects to other sites, including a website called multiscreensite[.]com. The redirect to this site begins with a misspelled subdomain name. The subdomain is misspelled as “aceess” instead of access. This is evidence of an idiot scammer mistake.
  3. The email Jerry received also included an email address for someone named Maura Eudy from fundadvisorybenchmarkgrp[.]biz. This domain was registered on June 16, less than three months ago, making it HIGHLY suspicious! There is no website to be found at this domain, as of 9/3/2026

As if that isn’t interesting enough, Jerry told us that last Wednesday he posted the link to his fraud story on about 50 other used motor engine selling accounts he found in Facebook. The next day (last Thursday) he discovered that most of them had removed his post! We didn’t have the time to investigate all these Facebook accounts to try to understand why they would remove his posts, but we did visit one of these sites. This Facebook account is called Outboard Motors New & Used Engines. This account sounds unbelievably credible because it has 69,000 followers! This account frequently posts pictures and reels of engines for sale. However, when we visited their Transparency page on Facebook, we discovered that this account is managed by someone in Cameroon! This FB account also states that their website is ymscoutboards.com, located in Thailand. Why would a business in Thailand, post engines for sale in the US (in English) and be managed by someone in Cameroon? (Note: the domain ymscoutboards.com was registered on March 13, less than 6 months before we found it.)

Recently, a woman named Megan Daly said hello to her new NextDoor community. But she messed up the name of the town she claimed as her new home, calling it Kingston, instead of Stoneham! When one neighbor called her out on this mistake, and suggested she wasn’t real, Megan pushed back. But this led me to do a reverse image search of Megan’s photo. I discovered that she took that photo from the profile of a woman named Savannah on her TikTok account! NextDoor quickly closed her account and removed her post after it was reported as a likely fraud. Thankfully!

If you use Chrome on any device, please be sure to update it immediately! There are many serious security flaws that were uncovered and fixed by Google for Chrome.  Don’t let a malicious website take advantage of these flaws!  Here’s a worthwhile article about this problem….

https://www.malwarebytes.com/blog/bugs/2026/08/update-chrome-before-you-browse-again

Brushing scams are increasing! Don’t know what that is? Read this article about them on the FTC website:

https://consumer.ftc.gov/consumer-alerts/2026/08/unexpected-package-you-got-could-be-brushing-scam

Scammers are low-life, subhuman creatures and they don’t care who they target or how much pain they cause. For example, this article describes how scammers are using AI to scour obituaries to find and target widows! One widow lost $7000 after being tricked into believing that her deceased husband left an unpaid tax bil. Read…

https://www.msn.com/en-us/news/other/it-s-so-disgusting-ai-powered-scammers-are-scouring-obituaries-to-target-widows-one-lost-7-000-after-being-told-her-late-husband-evaded-taxes/ar-AA2aOfuC

According to this MSN article, odd calls where the person calling says nothing are simply reconnaissance calls to verify that someone answers at the number. Then that number will be used for future scam calls!

https://www.msn.com/en-us/technology/tech-companies/why-scammers-say-nothing-when-they-call-and-how-to-respond-safely/ar-AA1XbopI

Check out this very interesting article explaining how scammers exploit our emotions…

https://gasa.org/knowledge-base/blog/the-emotions-scammers-exploit-how-social-engineering-influences-our-decisions

Interpol published this article in late August about a global effort that resulted in 58 arrests in West Africa, and 263 suspects involved in fraud….

https://www.interpol.int/News-and-Events/News/2026/58-arrests-in-global-effort-to-dismantle-West-African-organized-crime-groups

Netflix Payment Declined & Document Access Notification

Check out this first smelly phish that wants you to believe it came from Netflix. They claim that your Netflix payment was declined and your subscription has been put on hold. That’s a pretty easy thing to verify by just opening Netflix and launching anything to watch! This phishing fraud came from a website called tripplan[.]info. This domain is currently for sale and no longer has a website on it. The link in the email to update your payment information looks like it points to Google.com. However, if you look carefully at the link you’ll see that it contains a redirect to a website called parttimevagabond[.]com and that is not Netflix either!

Deeeleeeeete!

Apparently, you have received a document access notification from Docusign. The word “Docusign” is entered into the text field of an email address. The email came from “madison” using olloum[.]com. This is a fashion store in Malaysia! The link in this phishing fraud points to a subdomain at the website contabostorage[.]com. VirusTotal.com has 9 security services that identify it as malicious! Deeeleeeete! Remember to report your smelly phish to us and Google!  https://safebrowsing.google.com/safebrowsing/report_phish/

This verified sponsor shows phishing statistics from around the world

Cut Your Electricity Bills!

Scammers often use cost saving efforts as malicious clickbait to trick people into clicking their nasty links! Below is a recent example that appears to come from EcoWatt Team. With utility bills rising, who wouldn’t be interested to save money on their electric bills! But this clickbait came from a free Gmail account, not the legitimate website for EcoWatt Power Saver! Also, the links in this clickbait point to a malicious website called lawsy[.]org. It was registered about 2 weeks earlier on July 31 and identified as a phishing fraud by a security service on VirusTotal.com!

 

Delta Airline Partnership Registration & Facebook Invitation

Recently, a small business reported to us that they received this very strange email from “Delta Airline United States delta” but coming from a website in Canada called biodesign[.]ca. This business was invited to participate in Delta’s “Vendor/Contractor Partnership” registration process. The REPLY-TO email was set to go back to a website called deltatendergroup[.]com. But this website had just been registered in early July in the Netherlands! Why would Delta Airlines register this domain through someone in the Netherlands? NONE of this email made sense. We strongly suspect it was a trick to gather a lot of information about a business, and possibly including an account password.

I received a birthday party invitation from a friend named Rick at the end of August. But Rick’s invitation seemed rather odd because he had never done anything like this before, nor ever used an online evite service! When I moused over the “RSVP HERE” link, it revealed that it points to a malicious website called hiibco[.]com, recognized by several security services on VirusTotal as malicious! When I contacted Rick, I learned that his email account had been hacked and his contact list was stolen and abused. WARNING! If you ever get a digital invitation from someone you know, do not assume it is legitimate! Carefully mouse-over the link to see where it points! If you are not sure, call the person who allegedly sent you that invitation!

From Your Local Tree Service….in Venezuela!
 

Over the few months, I probably received more than a dozen texts from “local team” such as a “local tree service” telling me that they are in my area doing work. They asked if I wanted a quote. I have learned from prior investigations and research that Pakistani scammers are behind this fraud. Well I was very surprised that it’s not just Pakistan using this fraud scheme! Here’s one recent text from “Sam.” Whenever I ask these people texting to tell me the name of their business and website, they rarely respond! However, look what happened from the second text below… 

 

After getting this text below on September 3, I wondered if I could trick the sender into revealing his exact location. The sender claimed to be from my town’s local tree service. However, our town doesn’t have a local tree service! I don’t want to reveal the trick I used but the sender fell for it and I learned that his real location is in Caricuao, Venezuela…a district of Caracas! These scammers collect job interests and then sell them to services in the persons area. The problem is that they sometimes send these requests for work to people who are unskilled or do a poor job! Don’t fall for this BS. If you need home service work done, contact a local trusted company you know or heard from one of your neighbors about!

 

Until next week, surf safely!

Copyright © 2026 The Daily Scam. All rights reserved. You are receiving this email because you have subscribed to thedailyscam.com

Marblehead, MA 01945

Contact Webmaster