Job scam quick guide: it's a scam if...

  • they want you to collect and forward money in any way (a "money mule" job). You'll wind up engaged in money laundering, personally defrauded via expertly forged cheques, money orders, etc, or defrauding someone else who pays for goods that never arrive.
  • they want you to receive packages and reship them somewhere else. The goods will have been obtained fraudulently, and they're just using you to make the shipping address appear local. You will be aiding fraud.
  • they want up-front payment (either to them or someone else) of any sort for anything before you can get the job. This is advance fee fraud: there is no job -- it's just a big con to extract money from you.
  • they want you to buy any kind of "membership" or "kit" in order to start. Forget it -- it's not a real job at all: they're trying to sell you something, and they're probably making a bunch of other false claims about it if they're pitching it as a "job".
  • it's a job offer, and it's spam. There are LOTS of these scams about, as you can see.

Monday, August 04, 2008

MCB Finance (a.k.a. EFG - Group Oy)


A correspondent warns me of a job scam found advertised in an Australian newspaper. I've heard of such ads being placed in print media in the USA, but this is the first such report I've had from Australia. As happens from time to time, the scammers haven't been entirely consistent with their false identity, and the email they sent contained links to two different (but highly similar) websites: MCB Finance, and EFG Group. I've reported on an "EFG" scam before, and I strongly suspect it's still the same gang. Also, there was an IFN Finance scam which used the same banner graphics. Basically these guys favour three letter acronyms (TLAs), and change name to "FOO Finance" or "BAR Group" on a roughly monthly basis. It's always a money mule scam.

See also the document MCB_Application_Australia, which was attached to the email.

Domain ID:D153445557-LROR
Domain Name:MCB-GROUP.ORG
Created On:25-Jul-2008 14:12:52 UTC
Last Updated On:25-Jul-2008 14:12:52 UTC
Expiration Date:25-Jul-2009 14:12:52 UTC
Sponsoring Registrar:Directi Internet Solutions Pvt. Ltd. d/b/a PublicDomainRegistry.com (R27-LROR)
Registrant Email:oliver.w@safe-mail.net
Name Server:ERDOMAIN.MERCURY.ORDERBOX-DNS.COM
Name Server:ERDOMAIN.VENUS.ORDERBOX-DNS.COM
Name Server:ERDOMAIN.EARTH.ORDERBOX-DNS.COM
Name Server:ERDOMAIN.MARS.ORDERBOX-DNS.COM

Domain ID:D24464714-LRMS
Domain Name:EFG-GROUP.INFO
Created On:14-Apr-2008 07:09:26 UTC
Last Updated On:26-Jun-2008 13:00:17 UTC
Expiration Date:14-Apr-2009 07:09:26 UTC
Sponsoring Registrar:Directi Internet Solutions Pvt. Ltd. d/b/a PublicDomainRegistry.com (R159-LRMS)
Registrant Organization:PrivacyProtect.org
Name Server:ERDOMAIN.MERCURY.ORDERBOX-DNS.COM
Name Server:ERDOMAIN.VENUS.ORDERBOX-DNS.COM
Name Server:ERDOMAIN.EARTH.ORDERBOX-DNS.COM
Name Server:ERDOMAIN.MARS.ORDERBOX-DNS.COM

---------- Forwarded message ----------
From: MCB Finance Group <mcb.group@safe-mail.net>
Date: Sun, Aug 3, 2008 at XX:XX
To: [redacted (privacy)]


Good day and thank you for enquiry. I have attached following documents for you: 


* Application_Australia.doc (Position description and application form) 

* Client_Agreement.rtf (Independent Contractor Agreement) 



What you have to do now: 


1) Download and open an application form and job description (Application_Australia.doc) first. 

2) If you agree with conditions please fill the form out and forward it back to us via e-mail 

(mcb.group@Safe-mail.net) (which is more preferable) or fax it to one of these numbers +1-973-215-4895,

+358-9-23-194-104. 

3) Fill the contract out (Client_Agreement.rtf) and send it back to us after one week of trial period(*). 

Once your personal details are received and processed, we will make our decision within 10 days and 

inform you when the first transfer occurs. Thank you and have a nice day. 



P.S 

* Trial period. It is not required to sign the contract in the beginning of your employment as the position 

we offer is part time. After one month of trial period we will reconsider you for full time employment.

PDF copies of all documents are to be found on our website (employment section). If you can not 

download them please let us know and we will send forms directly to you.


______

Oliver Lesken,

Billing Department,

MCB Finance Group,

http://mcb-group.org,

VOICE/FAX: +1-973-215-4895,

FAX: +358-923-194-104 (Finland).


Friday, August 01, 2008

ZenexFinance Inc

Quite a while ago, I reported a "Zinex Finance" scam. I won't hazard a guess as to whether the similar name here, "Zenex", means that it's the same scammers. It's the same old money mule recruitment scam, though, and they're not a company, they're organised crime.

---------- Forwarded message ----------
From: [redacted (false, random)]
Date: 2008/7/31 UTC
Subject: The Best Opportunity Nowadays to Make Cash!
To: [redacted (privacy)]


Dear Sir/Madam! If you are looking for an EXTRA INCOME - this is for you!
Successful foreign company - ZenexFinance Inc., is currently seeking for Australian residents for a Banking Courier position. Make $1000-$1300 AUD a week and enjoy the job itself. If you are 18+ y/o, if you are able to check your e-mail 3-4 times a day, if you have 1-2 hours of free time Mon-Thu - this job is for you! Very nice and rare opportunity for making extra income! If interetsted Reply with 'More Information' to: maincontact.zfc@gmail.com    One of our representatives will provide you with full information within 48 hours! Thank You and Good Luck!

Employer:
ZenexFinance Inc.
USA, California
Los Angeles,90025

Wednesday, July 30, 2008

A&E Textiles

Search this blog for "textiles", and you'll notice that it's a popular theme with scammers. No, I have no idea why -- just one of those things, I guess. As usual, there may be a real company that operates by this name, but the name is purely incidental. The scam is almost certainly check forgery: the scammer wants you to bank forged checks and send most of the money to him. You can draw on a forged check, but the bank can also deduct it back out of your account after you draw on it, so guess who loses money.

---------- Forwarded message ----------
From: job vacancy <bndunguru@hotmail.com>
Date: 2008/7/30
Subject: IMMEDIATE JOB OFFER IN USA
To: [redacted (privacy)]


Hello,
 
Would you like to work online from home and get paid weekly? A&E Textiles needs a book-keeper in the states, so I want to know if you will like to work online from home and get paid weekly without leaving or affecting your present job.
 
Please if you are interested in this position make sure you get back to me on the private e-mail address below:
mail to:Grahamgreen207@gmail.com
Send me your Full Name,physical address,telephone and fax numbers.
 
Thanks


Connect to the next generation of MSN Messenger  Get it now!

Monday, July 28, 2008

Felles Logistics

A correspondent notifies me of "Felles Logistics" at http://felles-group.com/ who appear to be looking for suckers to act as reshippers (receive and remail packages). The job description is like so.

Persons who will be accepted for this position will follow these simple instructions:
1. Receive correspondence from our suppliers to his/her residential address.
2. Report to our managers.
3. Fill in forms and papers as it will be shown in our managers' instructions (you will receive an email with the instructions for each box and PREPAID shipping labels).
4. Mail packages out. You can do this at your local Post Office or we can order a courier pick-up.
5. Provide scans of the mailing receipts.
6. Receive money from our company for each shipped out package.

The usual catch in this kind of work is that you are reshipping goods which have been purchased using stolen credit cards. This creates all sorts of legal complications for the "employee".

The "Felles Logistics" website claims that the company was founded in 1994, but their website is less than a year old.

   Domain Name: FELLES-GROUP.COM
   Registrar: ESTDOMAINS, INC.
   Whois Server: whois.estdomains.com
   Referral URL: http://www.estdomains.com
   Name Server: NS1.RUBY6644.COM
   Name Server: NS2.RUBY6644.COM
   Updated Date: 20-mar-2008
   Creation Date: 28-oct-2007
   Expiration Date: 28-oct-2008

TransWest Pacific

This particular spam makes it look like they are recruiting money mules, but the job vacancies section of their website also contains a reshipper job description. Maybe these guys specialise in recruiting suckers generally, providing this as a service to organised crime on the black market. It wouldn't surprise me, given the degree of specialisation already out there.

   Domain Name: TRANZWEST.COM
   Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
   Whois Server: whois.PublicDomainRegistry.com
   Referral URL: http://www.PublicDomainRegistry.com
   Name Server: NS1.DUOHOST.RU
   Name Server: NS2.DUOHOST.RU
   Updated Date: 05-jul-2008
   Creation Date: 05-jul-2008
   Expiration Date: 05-jul-2009

---------- Forwarded message ----------
From: freeland cimarron <5dansimac@iskon.hr>
Date: 2008/7/28 UTC
Subject: Company is seeking for responsible, literate and honest persons!
To: ideceive@gmail.com


Financial manager position in United States and Canada!
Company TransWest Pacific is seeking for responsible, literate and honest persons for the positions in transaction services to be financial manager.

1. Be able to check your email several times a day

2. Be able to respond to emails immediately

3. Be able to work overtime if needed

4. Be responsible and hard working

5. Be able to open bank account for company needs (if needed)

6. Should have personal bank account


You will be asked for punctuality, managerial abilities and responsibility. You will also receive detailed instructions for subsequent actions from our manager, with information how to process the money.

Please contact us by mailto:application@tranzwest.com

best redgards, TransWest Pacific
_www.tranzwest.com