02 , 2010
I see a lot of things in my job as a moderator of the BMW MOA Forums. One thing I didn't expect was a note from a user of the BMW MOA Online Flea Market that he had been scammed by someone who had answered his ad looking to buy parts for his bike. How the scammer accessed the members-only Flea Market area I have no clue, I wouldn't put it past them to steal a password or even actually join the BMW MOA. I have moderated online motorcycle communities since the mid-90's and have had a lot of experience with these scammers, though they are usually active in the free online classifieds areas like Craig's List. Basically they have two ways of operating
The first method they use involves selling a bike. They will make up a story about having moved to England and put the bike in the care of a shipping or storage company. If you wire the purchase price or even just a deposit to them, maybe even using a fake escrow service, they will have the bike shipped to you for you to inspect and either accept or refuse for a full refund.
The second involves selling you things. They will offer an address and phone number in England and ask you to wire the money to them in return for sending you the parts.
Of course in both cases there is no bike or parts and once you wire the money off, it is gone for good. Both of these scams have several things in common and it all starts in the internationally recognized hotbed of online scams, Nigeria.
I decided to do a little investigative work and placed an ad in the BMW MOA Flea Market seeking a new old stock or excellent condition OEM BMW K-Bike Bulb Kit. A day or so later I received an e-mail from "email@example.com" ostensibly a Mr. Andrew Morgan of Barlow Moor Road, Manchester, UK:
With this I decided to dig a little.
The E-mail. The scammer's e-mail will usually be from a free e-mail service like Gmail or NetZero and will include an offer to sell the parts or bike, as well as an address and phone number in England. Fortunately the Internet usually tags e-mail with the location of the Internet Service Provider someone uses when they send an e-mail. I opened up the header information in my Outlook e-mail program by selecting "View" then "Options" and gave it a good look. Near the middle I saw these two lines:
These two lines tell me which Internet Service Provider ("ISP") the person who sent me the e-mail was using when he actually sent me the e-mail. A bit of background here, the string of numbers, here "220.127.116.11", is called an IP Address. When a person connects to the Internet he is given one of these unique to him by his ISP, services like Cox Internet, Comcast Internet, and even T-Mobile, and the Internet uses that IP address to direct things like e-mail and web pages to and from the user. Each ISP is given a range of IP addresses to give to its users to connect to the Internet. So I turned to a favorite tool of mine, http://network-tools.com, entered the IP Address "18.104.22.168", selected "Lookup" and hit the "GO" button. This is what I got back:
Hmmmm. Well, it appears the e-mail did not come from the UK after all but from someone using DirectOnPC, an ISP based in Lagos, Nigeria. Note that each e-mail program is different in how it displays header information, a good guide can be found here: http://tinyurl.com/3xece
In the words of Billy Mays, "But wait, there's more."
I moved on to the telephone number given, "+447024074843." First the Country Code - +44 is indeed the Country Code for the UK. This seemed oddly legitimate so I did a little more digging. In Googling "4470" I immediately found out that phone numbers beginning with "4470" belong to UK call forwarding services that forward calls anywhere in the world without the caller having any idea they are not actually talking to someone in the UK. It also seems these services are a favorite of scammers.
So at this point we have someone in Lagos, Nigeria pretending to be from the UK, using a UK telephone number used to forward calls anywhere in the world (in this case I think a safe bet would be to, you guessed it, Lagos, Nigeria )
So how does this play out?
Here is the reply to my "Yes I want to buy from you" e-mail bait:
As you can see, the seller is insisting I use Western Union or MoneyGram. Why you might ask? The answer is simple - because regardless of where and to whom the money is intended to be sent, it can be picked up by anyone quite anonymously anywhere in the world (such as Lagos, Nigeria) simply by having the wire confirmation number. Almost every scam I have ever seen involves Western Union or MoneyGram. On that same note, in all my years moderating sites with online marketplaces I think I have seen one, maybe two at most legitimate exchanges using these services.
It is a safe bet that were I to wire money off to "Mr. Morgan" I would not receive anything in return other than a bit of grief knowing that someone in Lagos is probably enjoying a very nice celebratory dinner on my dime. These guys are very good and take advantage of the close and trusting BMW community. So what can you do if you have been taken and want to help others from suffering the same fate?
First, notify the managers of the online marketplace and if possible post on the associated message boards. In our case I posted to the BMW MOA boards and then wrote to every person who posted a "Want to Buy" ad on the BMW MOA Flea Market in the previous four weeks. Almost all had been contacted by Mr. Morgan with the same initial response e-mail I had received. Interestingly enough, this was the first response I received:
Second, you might notify the e-mail service at "abuse@", in this case "firstname.lastname@example.org" that the person using that e-mail has scammed you. Make sure to attach the e-mails from the scammer to the complaint. Lastly, you can file a complaint with the FBI's Internet Crime Center here: http://www.ic3.gov. The IC3 has additional resources as well.
to be cautious when buying and selling on the Internet, even when using a closed
community like the BMW MOA's Flea Market. A little groundwork can quickly uncover
most of these scams and help ensure that your buying and selling experiences are,
like most, ones you would happily repeat.