Aug
15
2008

Caught in the Spam Filter

I got an amusing e-mail a few days ago. First, let's look at some relevant header lines. 

From webmaster@owl-tipps.de  Sat Aug  2 09:40:03 2008
Return-Path: <webmaster@owl-tipps.de>
Received: from s556.evanzo-server.de (s556.evanzo-server.de [62.140.23.56])
        by jaffrey.unh.edu (8.13.8/8.13.8) with SMTP id m72DcGfs003417
        for <pas@unh.edu>; Sat, 2 Aug 2008 09:38:18 -0400
To: Peter@PSDT.com
Subject: COMPENSATION TO SCAM VICTIMS
From: BRITISH HIGH COMMISSION <secretary.consular.office@gmail.com>
Reply-To: consularbhc2008abuja@aol.in
  • The subject line might as well say: If you've been gullible in the past, you're probably a prime target to be swindled again!

  • The envelope's From says it's from 'webmaster@owl-tipps.de', which is Germany. And the message was received from some German server. OWL Tipps is (as near as I can tell) a travel site for the East Westphalia-Lippe region. I smell a hacked account.

  • Ah, but the message has its own From: line, which is the BRITISH HIGH COMMISSION. Sounds official. But why would the BRITISH HIGH COMMISSION have a Gmail address, secretary.consular.office@gmail.com?

  • Best of all, the message has a Reply-To: consularbhc2008abuja@aol.in. (Many mailers will send your reply to the Reply-To: address without asking.) It's in India.

  • The To: line doesn't contain my address; which means my address was probably in the Bcc: line of the message, along with (almost certainly) a few hundred others.

On to the message itself:
BRITISH HIGH COMMISSION

Metro Plaza, Plot 991/992

Zakari
Maimalari Street

Cadastral Zone AO,

Central business district
Abuja.

This is the most accurate part of the message. That's actually a valid Nigerian address, but it currently appears to be a Visa Application Center for the UK, run by VFS, a commercial partner of the British High Commission. (Google indicates the address used to appear on the BHC website, but doesn't any more.)

Needless to say, it's unclear why the GMail-addressed BHC in Nigeria might be sending this important e-mail out through a German travel site server with an Indian reply-to address.

Onward:

Attention,

The BRITISH High Commission in Nigeria, Benin Republic, Ghana and Bokinafaso received a report of scam against you and other British/US citizens and Malaysia Etc. […]

Right. The 'Etc.' is a nice touch. A New Zealander receiving this message might otherwise think it was bogus.
The Countries of Nigeria, Benin Republic, Ghana and Bokinafaso have recompensed you following the meeting held with the Four countries' Government and various countries' high commission for the fraudulent activities carried out by the Four countries' Citizens.Your name was among those scammed as listed by the Nigeria Financial Intelligent Unit (NFIU).
A skeptic might note the unusual wording, dodgy punctuation, non-standard capitalization. And then there's the spelling: "Bokinafaso" is probably "Burkina Faso" and "Nigeria Financial Intelligent Unit" is probably meant to refer to the "Nigerian Financial Intelligence Unit (NFIU)", both of which actually exist.
A compensation has been issued out to all the affected victims and has been already in endorsement to all the victims. Yours was among those that was reported unpaid as at on Friday and we wish to advise you to see to the instructions of the Committee to make sure you receive your compensation immediately.
Ooooh! Compensation! And it's coming immediately! What do I have to do?
We advise that you do the needful to make sure the NFIU endorse your payment on Monday. Contact the office of the consular for an advise on how your recompense will be effected to you.

consularbhc2008abuja@aol.in

I need advise on how to do the needful to get my recompense effected to me? And I thought you said the compensation was "already in endorsement to all the victims." I'm confused!

I'll give the author this, however: they get the distinction between 'affect' and 'effect' right, a feat that eludes (or "alludes") many American college students.

Be advised that you should stop further contacts with all the fake lawyers and security companies who in collaboration scammed you.
"Don't talk to all those other fakers! Talk to us!"
Immediately to check if the endorsement date suits you.
Um, sure. That was "Monday", right?
Yours in Service,

Joy Daniel
Secretary

I'll be in touch, Joy!

(Other versions of this: here, here, here.)