Almost scammed...

[brad3117]

Hey everyone,

I almost bought an macbook pro from craigslist.

The dude gave me the speel that he was out of the country and could make a deal through "paysafe", the company that works as a "middle-man" and has the laptop. I was told to email my name and address, which he would forward to paysafe - who would then contact me on how to move forward with payment. I did a quick google search on "paysafe" and found an old-ish looking webpage that looked legit. There was also a wikipedia entry about paysafe that made me think it should be fine.

I was an idiot and actually sent my name and address to this guy before figuring out that this was likely a scam. I searched the craiglist sites for other provinces (I'm in canada) and found almost the exact same listing and people posting messages that this guy is a scam artist.

Here's his info that he sent through "paysafe":

"Kevin Wilkin" wkevinlki@yahoo.com

96 Mount Street, London, W1Y 5HG, UK

Turns out it is a retail store!

The "agent" he wanted me to send the money to is:

Robert Daniells (paysafe-support@insurer.com)

322 Kings Road, London, SW3 5UH, UK

Also a likely bogus address.

This guy keeps emailing me to ask whether I "heard from paysafe" and if I still intend to buy the laptop. I almost want to tell him where to go... but don't know if that would just encourage him. What can I do to nail this bastard?

Thanks.

[sond]

could you post the mails with full headers, i'd like to see..

Thanks

[brad3117]

could you post the mails with full headers, i'd like to see..

Thanks

From : Kevin Wilkin <wkevinlki@yahoo.com>
Sent : March 18, 2007 4:00:38 PM
To : [ME]
Subject : Re: MacBook Pro 17" 2GB 120GB Apple Care WINDOWS XP PRO - $1800

Hi,
The laptop is in perfect cosmetic and working condition. The macbook was slightly used in the last 4 months so you will still have 2 years and 8 months Apple Care warranty left on it. The price I will sell it for is $1,800.00, which is including all the shipping charges.
I live in Victoria but currently I am with work in United Kingdom ( London ) for the next approximately 5 months. Anyway, there shouldn't be any problem, because I am using PaySafe services so I can sell the laptop without difficulty.
I left the laptop in their custody before leaving overseas. They will take care of the delivery. There's a 10 days return policy included so you will have the chance to inspect it before final decision.
So if you want to purchase it, let me know and I will explain you how PaySafe works and how we can move forward.
I am waiting your email.
Thanks

After saying that I was interested, he sent me the following:

From: Kevin Wilkin
To: [ME]
Subject: Re: MacBook Pro 17" 2GB 120GB Apple Care WINDOWS XP PRO - $1800
Date: Sun, 18 Mar 2007 18:37:45 -0700 (PDT)

Hi again [ME],
It has 2.16 Ghz processor speed, with ATi Mobility Radeon video card
X1600 with 256 MB GDDR3. The laptop is in Edmonton (at PaySafe official
location).
Let me explain you how PaySafe works and how we can proceed:
In order to start the official transaction, I need to know your full name and shipping details. As soon as I receive this information, I will forward it to PaySafe and as soon as they have all the details, they will start the transaction and notify you with all you need to know regarding it (payment instruction, shipping, my account status etc) As soon as the payment is complete, you have to send them the payment information, they will verify it and proceed with the shipping. You will have 10 days return policy, so you will have the chance to inspect the laptop and decide either you keep it or not. If you decide to keep it, they will release me the funds, if not, you will have a complete refund within 3 days.
I am waiting your email.
Thanks

I had a deadline for getting a laptop, so thought it couldn't hurt to give the guy the info... like I said, I checked out paysafe and everything looked legit. I also planned on talking to someone at paysafe in Edmonton to make sure this was all legit before sending any money. Then I got an email from "paysafe:"paySAFE <paysafe-support@insurer.com>

It was a legitimate looking detail of the transaction that was supposed to occur with graphics similar to the paysafe website. The real kicker that turned me off, was the one from the "paysafe financial department" saying that the payment would be done through western union money transfer...

Seller Information:
First Name: Kevin
Last Name: Wilkin
Street: 96 Mount Street
City:London
Zip code:W1Y 5HG
Country:United Kingdom

Agent Details:
You have to send the payment to:
First Name:Robert
Last Name:Daniells
Street:322 Kings Road
City:London
Zip code:SW3 5UH
Country:United Kingdom

Why in the hell would I send money to some bloke in London!!!???

After doing some searching, I found others who figuring this guy out: http://denver.craigslist.org/sys/294963251.html

Hope this helps - I wish someone could nail this bastard!

[sond]

Well, thanks for posting the mails. It gives us all more information about the kind of people we are dealing with.

When I asked for the full headers I mean't the ones that show the IP of the mail sender. That is to see ( if possible) from what country is the guy sending the email.


Thanks,

Sond

[suziecue]

How to get full headers for a variety of email applications -- http://www.haltabuse.org/help/headers/index.shtml

[brad3117]

MIME-Version: 1.0
Received: from web63108.mail.re1.yahoo.com ([69.147.97.3]) by bay0-mc1-f23.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Mon, 19 Mar 2007 18:39:26 -0700
Received: (qmail 31915 invoked by uid 60001); 20 Mar 2007 01:39:25 -0000
Received: from [172.166.84.125] by web63108.mail.re1.yahoo.com via HTTP; Mon, 19 Mar 2007 18:39:25 PDT
X-Message-Info: LsUYwwHHNt3660MmjhEvYg2f34OAemlK+ZzoV09lDsZmbz8QigGIQtU5Yvr3lK0P
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:
Received: Date: From: Subject: To: In-Reply-To: MIME-Version: Content-Type: Content-Transfer-Encoding: Message-ID; b=oyj/yTY9WAXDnpz6eg78RNtuLiBn2RapTrdiEZONz/uZr/ <Manual Break Added> MF8kFJL72qsKbdLzX2baT3TNdlMxWJJrhFBMqdi5psU4lfvMbVvm31TSUiatat6Vfd/ <Manual Break Added> N7I+jaRqZuj4mQ9k8fl0PObrXOyYaanFXtY2yir50JurJZIn+DihWQRp6M=;
X-YMail-OSG: yaSwm6IVM1n7eS0oH.bN6aG4_z4qlZGWwO1DFChK9jzaHTID3d. <Manual Break Added> BOM4HNkmBBRRJKsR70ioEdBZvliPV6GYf23YnohDhqmLDybzn6As0oU0bNMoFKq6UGHJ34jKJkQc-
Return-Path: wkevinlki@yahoo.com
X-OriginalArrivalTime: 20 Mar 2007 01:39:26.0206 (UTC) FILETIME=[980B49E0:01C76A90]

Hope this helps... I'm not sure how to make sense of this stuff.



Admin Edit Added Breaks in to the lines to prevent scrolling on the screen which makes the forums very difficult to read. These can be denoted by the <Manual Break Added> in the message

[sond]

Well, no way.
All private data is protected i gmail. I didn't notice that you had gmail.
Can't see the IP numbers in the gmail full headers. A pity.

Thanks anyway.
Thanks Peg for the link, very useful.

Sond

[JaxHot]

qmail = Qmail not Gmail
The originating IP address starts with 172 which indicated the scammer is using an AOL Europe account.

[sond]

you're right
When I read the message I must be asleep (sure I was)..!!

Ok, Thanks for the comment

Sond

[peg]

Well, no way.
All private data is protected i gmail. I didn't notice that you had gmail.
Can't see the IP numbers in the gmail full headers. A pity.

Thanks anyway.
Thanks Peg for the link, very useful.

Sond

Thanks for the credit... Did I provide you with a link?

I think that was Suziecue.