I’ve been looking for new contracts through Kijiji and Craigslist, and while following up leads have been approached by quite a well organized group of scammers. In this article, I’m going to go through the way they operated, the warning flags and the eventual smackdown of them when I got tired of dealing with their nonsense.
The first contact was a job posting for “administrative assistant”, requesting resumes. I sent mine, and got an email back (sent several times) from an address registered at hotmail.
Dear Employee (Personal Assistant)
Your email is recorded.I explained to you via email job description,hours and lot more but again here is the details.
You will be working with my Boss James Scott who will be arriving location in few days but before he arrives you will pay for his hotel and also hire a car,he will drive himself.
So payment you got is for the purpose,deposit payment in your bank and wait 3-4 days to clear,when it clears you will then take care of hotel.
I WILL OFFER THE FOLLOWING COMPENSATION:(1) Weekly pay $350 for 2 hours daily (Monday – Friday)= 10 hours weekly
(2) Tips comes regularly
(3) Will keep up to my salary payment even before the week ruins outUPFRONT DUTIES:
1.deposit payment
2. Pay for hotel and car hire service
3.You will take off $350 when funds clear for your weekly pay.
4.Download a yahoo or msn messenger and add me on (mary.mac1@live.com) so we can chat for more directives.Contact me when payment is deposited.
Mary
A couple of things to note here. First of which, this came from a yahoo address (personalasstmary@att.net – yahoo run the att.net email system) and it directs the victim to contact a hotmail (live.com) address. It also asks for the person to add them to a messenger program, because instant messengers work faster and are less trackable.
Initially I ignored this message, so it wasn’t long before another one appeared, again from att.net:
Dear Employee (Personal Assistant)
Your email is recorded.I explained to you via email job description,hours and lot more but again here is the details.
You will be working with my Boss James Scott who will be arriving location in few days but before he arrives you will pay for his hotel and also hire a car,he will drive himself.
So payment you got is for the purpose,deposit payment in your bank and wait 3-4 days to clear,when it clears you will then take care of hotel.
I WILL OFFER THE FOLLOWING COMPENSATION:(1) Weekly pay $350 for 2 hours daily (Monday – Friday)= 10 hours weekly
(2) Tips comes regularly
(3) Will keep up to my salary payment even before the week ruins outUPFRONT DUTIES:
1.deposit payment
2. Pay for hotel and car hire service
3.You will take off $350 when funds clear for your weekly pay.
4.Download a yahoo or msn messenger and add me on (mary.mac1@live.com) so we can chat for more directives.Contact me when payment is deposited.
Mary
I ignored this one too. Then came the most plausible part of the scam. A check arrived in the post, posted from a residential address in Toronto. The check, as you can see, looks quite authentic (I’ve added the watermark to make sure nobody else tries to download and use this check):
Unfortunately the accompanying letter was less convincing:
APPROVAL LETTER
This is an approval letter to inform you that you have been approved to work with my Boss for 1 year, 2 hours weekly. We apologise [SIC] for the long delay.
Task: Verify the attached check, and contact MARY MAC at mary_mac1@live.com for more directives. Payment is for Hotel and Car hire. There are a few more tasks when JAMES SCOTT arrives at your location.
Thanks
Sandra Goaty
Accounts
The accompanying letter had no signature.
So let’s look at red flags that result from this check:
- What company sends out $5,000 checks from a residential address?
- The signature on the check is clearly scanned, there’s distortion around it and around the amount and payee details
- At the top it says “This document has a colored background and microprinting”. There is no microprinting
I’m particularly amused that the letter instructs the victim to “verify the attached check” – there’s a reason for this; if you suspect the check to be a forgery (which it is) and you take it to the police, you’ve passed what’s called “Due Diligence” and thus have not been defrauded. As long as you didn’t deposit the check, no offense has been committed and the police are powerless to act. If you didn’t verify the check YOU have committed the offense because you’ve passed a forged check to the bank without due diligence. It’s a neat getout to the scammers.
However, once the victim has the check the scammers have to hurry, because if the victim does deposit the check, there’s only a limited amount of time before the bank discovers the forgery and reverses the transaction. Their aim is therefore to get as much real money sent back to them as quickly as possible, before the transaction is reversed.
So, as the letter asked for a hotel booking and car rental, I responded thus:
Dear Mary,
To confirm check number 1237 in the value of $4,900 arrived this morning. In order to proceed with bookings we will need to know the following information:
- FULL NAME that the car is to be booked in – the car hire company will also require a photocopy of the drivers license for insurance purposes. This license must be the same as is shown when picking the vehicle up
- Whether or not the vehicle is going to be returned to the same car hire point or whether it is on an A to B hire, and will be dropped at an approved dropoff point different to the pickup point
- Flight time, number and airport if appropriate
- Which hotel your boss wishes to stay at and the full name to be used in the booking.
Please furnish these details to continue.
Best regards,
Edward Sheldon
While the scammers pontificated, I ran some background checks just to be certain. As I had predicted, the background checks proved this payment to be a complete forgery. There is no Sandra Goaty or Mary Smith working for Compass Group Canada. Also, their address on the check is wrong, and their check numbering system is totally different.
Suddenly in the scammers next email, the flight isn’t booked, and the rental car isn’t needed:
* FULL NAME that the car is to be booked in – the car hire company will also require a photocopy of the drivers license for insurance purposes. This license must be the same as is shown when picking the vehicle up- DO NOT BOOK FOR A CAR ANYMORE,HE GOT OFFERS FROM A COMPANY ALREADY
* Whether or not the vehicle is going to be returned to the same car hire point or whether it is on an A to B hire, and will be dropped at an approved dropoff point different to the pickup point
* Flight time, number and airport if appropriate- NOT BOOK FLIGHT YET NOW* Which hotel your boss wishes to stay at and the full name to be used in the booking.
SEND LIST6 OF 5 STAR HOTEL CLOSE TO YOUQUESTIONS FOR YOU
HAVE YOU DEPOSITED PAYMENT
2.SELECT YOUR HOURS SO WE CAN WORK IT OUT HERE
3.ADD ME ON MSN CHAT, MARY.MAC1@LIVE.COM SO WE CAN CHAT
I AWAIT YOUR EMAIL
Note she STILL wants me to add her on a messenger. Emails are both time consuming, and can be traceable, and she doesn’t want to leave any bigger trail than necessary.
Even though I have no intention of banking the check, I claim that I have. I also knock on the head ANY chance of using a messenger:
1) Yes, there should be news from the bank on Wednesday or Thursday
2) Any time during normal business hours is good
3) We DO NOT USE instant messenger programs, including MSN. They are insecure and open to abuse by hacking or security loopholes.
Edward
This puts pressure on them, because if the check IS indeed in the clearance system, then this means that there’s only a limited amount of time until the bank discovers the fraud. They have to get the money quickly if the scam is to work.
So they go for the goal of the scam. I receive this email:
Hello
How are you and hope you okay. At this point your email is clear and Scott instruct me to inform you that you need to contct his fabric supplier and order 30kg of swedishlace fabricsI am not sure if i inform you that he his opening a clothing line and needs orders
Have this done and inform me soon
her info is
NAME- THAMINA HAQUE
EMAIL- haquethamina@yahoo.secontact her and inform her you are the assistant to James Scott and need to place order so you need price
Mary
Again, note how this new contact also is an anonymous email address, this time at Yahoo. I’m curious to find out how greedy the scammers are, so I send this email to the yahoo address given:
Dear Thamina,
We have been asked to approach you on behalf of James Scott and ask for a quotation for the following materials:
30kg Swedishlace Fabric
Please forward a link to your online catalog and ordering system.
Best regards,
Edward Sheldon
The reply is not long in coming:
Ref- 001Here is Thamina Haque and from recommedation from Scott here is the price of your order plus insurance to Toronto will cost $4500You will have to send payment toEnamul HaqueAddress- 43 normarz strcity- FarstaState- SwedenCountry- Sweden$4500 By western unionContact me with details when sent,then you orders will be processed and delivered within 3 working daysI am sending copy of email to Scott our customer for years.Thamina Haque
Wow! They want almost all of it back… or should I say, they want me to send them legitimately, the amount they pretended to send me. Note how they want payment by western union, which would involve the victim paying that amount in cash at a western union office. Once an amount is paid in cash, that cash is gone to the recipient. There is no chance of ever getting it back.
Note also that they quote a price in dollars. This I use to trip them up. I respond immediately:
Hi Thamina,
Please choose an alternative payment method. Western union is not a payment method we support.
Best regards,
Edward Sheldon
The reply is almost indignant, but contains a major flaw:
Ref-002Due to country differences in currency we wont be able to use any means ONLY MONEY GRAM OR WESTERN UNION,so you can use money gram,check location around you.When are we expecting payment so orders will be ready.THIS IS THE WAY SCOTT ALWAYS SENT FUNDS TO US,CONFIRM FROM HIMThamina Haque
Waaaaait a minute… Differences in currency? What differences in currency? You quoted me in dollars, didn’t you? I respond, in a clearly suspicious tone:
What differences in currency? Your quotation requested payment in dollars, did it not?
I also write to “Mary Mac” and tell her I have a price, but I don’t tell her I’m suspicious of the western union part. The next reply from her was so bad my spam filter dumped it in junk mail and I didn’t find it till later:
Hello
I am aware that payment is delivered, The list of hotel must be sent to me for selection because my boss arrives few days to come.
he also PREFERS YOU CONTACT HIS FABRIC SUPPLIER VIA EMAIL- ( THAMINA HAQUE – EMAIL- haquethamina@yahoo.se )
Order for 30kg swedishlace fabric,find out cost and inform me here,she will be contacted too.
My boss so far appreciate your effort ,email me if you have any question and also deposit payment.
Lastly,Add me on chat messenger so we can chat some more very importantly ( mary.mac1@live.com)Mary
Despite the earlier admonition that I don’t use messengers, there she goes again with the messenger thing. Showing some impatience, I respond:
Hello Mary,
I will reiterate: Messengers ARE NOT USED during work hours. It is not that I cannot add you, it’s that I won’t add you. The use of messengers during work hours is grounds for disciplinary action.
I have contacted Thamina, and I forwarded her quotation to you. However she seems a little mixed up over payment currencies, having given a quote in dollars she’s now asking for a different currency to be used, and hasn’t specified what currency yet.
Please let me know which airport your boss will be flying into, and the flight number, so that we can book appropriate hotels. There is no point in booking a hotel miles away from where he wants to be or where he’s landing as gas prices are prohibitively high and car rental companies charge by the kilometer if you go over the agreed distance allowance. Believe me, that can get VERY expensive – we want to do this right in order to minimize costs.
Payment was deposited Friday, it should be clear tomorrow or Thursday.
Edward
The flight’s a red herring. The hotels are a method of fishing for local information so that future scams will look more plausible. It’s always more plausible to appear to know what hotels are local, it gives the impression that they know the area because their staff travel there frequently. I’m not about to feed that. I’ve also now told her that there’s going to be a problem getting the money via western union. While I wait for her next move, I send off a quick email enquiry to Western Union asking if there’s any way they can put a notification on a fake transfer that the recipient is involved in fraud and needs to be arrested. Now they know they need to hurry – this last email in its subject header emphasized how the tasks contained therein were to be completed TODAY. If I had indeed banked the check last Friday, the hours are rapidly counting down until the bank would discover the fraud and reverse the payment.
After several hours, they respond again:
ref-004i mean currency difference wont permit us to accept credit card or bank to bank transfer? we use swedish koranThe best option is western union or money gram since Scott want order within 3 daysThamina Haque
This is looking weaker and weaker. For a start, they can’t spell “Krona” (the Swedish currency) correctly. Secondly, any international transfer of funds is handled by a bank in native currency. If you use, for example, paypal, to send money to Sweden, and the person in Sweden has their account registered to accept Swedish Krona, Paypal will translate it into Krona automatically (minus their cut, of course). It’s not that it can’t be done, it can – it’s that they don’t want it to be done. They want as much of the money being banded around as they can get.
Now sounding considerably pissed off, I respond (BCCing “Mary Mac” who is, of course, also “Thamina Haque”) with this:
1) What Swedish natiional mistakes their currency, the Krona with an Islamic holy book?
2) 4500 Swedish Krona is $630.66 according to paypal, who, incidentally, work in Canadian dollars, US Dollars and Swedish Krona. So which is it that you are wanting payment in? 4500 Swedish Krona ($630.66) or 4500 Canadian dollars (which works out at 31,895.43 Swedish Krona – a bit pricey for fabric, even given customs fees and international postage)
3) Paypal can guarantee a secured delivery to ANY email address within seconds, and you don’t even have to go to a receiving point to pick the money up. A Paypal payment is backed by one of the biggest international payment companies in the world.
Why are you insisting in payment by western union?
Edward
At this point I’m about to draw the scam to a close – it’s by now blatently clear they’re scam artists, I’ll allow them one more attempt to get hold of the nonexistent money before closing the net.
Before long, the response comes back:
Ref-005We do not use paypal here and reason why we prefer money gram or western union is because it is realible and fast,bank to bank transfer takes 7 working days to get here from over sea company,so that not okay knowing that shippment must depart tommorrowhave a great nightThamina Haque
The “have a great night” is another amusing touch, given that it would now be late evening in Sweden – another indicator that this isn’t actually a company.
So there we have it. Time to end this.
Well, it’s been fun folks, but now it’s time to end this scam. Fact is, I didn’t deposit your fraudulent check on Friday because it was a blatant forgery. Instead I took it to Detective Gajkowski of Waterloo Regional Police’s fraud squad. He’d very much like to talk to you, Mary or Thamina or whatever your real name is. Go on, call him, I dare you – 519 653 7700 extension 8375.
Credit where credit is due, that was quite a photoshop job on the check. But it’s still absent several security features, and gives the wrong address for the company it pretends to be issued by. Nontheless, I did conduct due diligence – after all, your own letter said “verify the attached check”. Well, I contacted the Compass Group and they’ve never heard of Sandra Goaty, your supposed accountant, or Mary Smith who supposedly signed the check.
But you still have a lot of mistakes in your little act. Cancelling the car was good, and nice try fishing for local information about hotels but that ain’t gonna wash either. Getting the Swedish currency mixed up was a bit of a giveaway, as was getting mixed up with the exchange rates. Also, not knowing how the international banking system works was another red flag.
So there we have it – nice try, but no prize. Go try scam someone else, your reverse check fraud isn’t going to work on me, even if it was fun to lead you on for a while. And it made great material for a blog article and further lectures to my students about things to look out for spotting this kind of fraud.
Have a nice life. Losers.
I don’t expect to hear from them again, but I’ll update this post if I do.

