Scamwatch AU

In news that will probably shock anyone who has ever met us, we’re actually not as stupid as we look. Not that this fact seems to have filtered through to the more inept internet scamsters, going by the increasing amount of emails we’re getting, all coated temptingly in fictional money. Quite often, they’ll be SO inept it’s actually funny, like this email we received earlier today.

spamfail Wow, we didn’t know British Telecom were now being run by rick-willey@sbcglobal.net! That’s a hostile takeover you’d have expected to have made the newspapers. Maybe Rick Willey is the name of the character played in the BT adverts by that bloke from My Family, and to make the corporate behemoth seem more cuddly, all business transactions are to be conducted via that email address. It all makes sense! We’re SO replying to him!

imageBut, things get even wilier. Tonight, we received an email purporting to be from “John Nguen” of “Ralf Financial Services Pty Ltd”. The text of this email is as follows:

image image So, it’s a scam about asking people to transfer money via their bank accounts. Quite why the money would need to sit in someone’s account isn’t really explained (especially with UK bank transfers taking a few days to process so that the banks themselves can play with it on the overnight money markets during that time), but whoever the person behind this scam is, they’ve made more effort than your common or garden internet scam artist. The email was sent from ‘job@ralfrecruiting.org’ – they’ve gone to the trouble of registering a domain name and everything (though the WHOIS record for “ralfrecruiting.org” doesn’t give any address), and trying to visit the website itself only results in a 403 error.

 

Interestingly, ‘Ralf Financial Services Pty Ltd’ does seem like it MIGHT be an actual company based in New South Wales. Here’s the entry for it at business.com.au, though that does seem to be the only record of this company on the entire web:

image And, indeed, it’s based in Randwick, NSW. But, the address given IS different to the address on the email. And looking at “13/4-6 Cowper St, Randwick” in Google Street View, what do we see?

image Looks like an apartment block, to us. Not to say businesses can’t operate from apartment blocks, of course. What about if we Google the address itself?

imageSeveral apartments in the same building are available for rent, and it’s pretty clear these are all residential, NOT commercial properties.  And, quite curiously for a company supposedly dealing in huge financial transfers, “Ralf Financial Services” don’t even seem to have a website. Or be mentioned on more than half a dozen websites, anywhere in the world.

So, how about the other address we have for the company, the one on the email, also in Randwick? (Which we’ll mention in text form here, in case other people are doing a search for the address: Ralf Financial Services Pty Ltd, 168 Carrington Rd, Randwick, NSW, 2031, Australia.)

image Hardly looks like a bustling financial powerhouse carrying out hundreds of international money transfers every day, does it? And what about that address of “168 Carrington Road” itself? Well, a quick Google reveals that it’s a place that has been made available to rent, and recently let to somebody:

image Nice place. If you’re going to prey on the vulnerable and needy, might as well do it in some comfortable environs, hey? And, a quick Google of the name “John Nguen” reveals Bob the Bear’s article on fraud carried out by a company calling themselves Abcat Finance, which contains similarly worded emails from their ‘staff manager’, a certain John Nguen.

Basically then, It’s yet another scam aimed at the impoverished and desperate, albeit one that had a little bit more token effort put into it than most. Hopefully, this post will serve as a bit of a warning to others. Be careful, folks! Don’t be the internet equivalent of Road Runner stopping to peck up an improbably positioned plate of Free Bird Seed. In real-life, those responsible for putting it there are seldom crushed by falling anvils. More’s the pity.

13 comments:

Matthew Rudd said...

Quite brilliant.

Anonymous said...

I've received that email by John Nguen from Ralph Financial Services only today!

Anonymous said...

just got the same one my self, as the article says, quite a clever one this, and when I say clever I mean devious as hell! worded well with just enough to effort to bring a wry smile, but ultimately, what a c**t!

Anonymous said...

Thanks for posting this information on the net!!! It's great to know that I and others can check this out...although it did seem a shafty deal from the beginning...:-)

Anonymous said...

scam make you use western union of same crap like, once money is transferred and the buyer of goods do not hear, the cops knocks door, but you have already transferred the money to scammer by western union. They used your account for payment, but you have to transfer to them by western union, which is untraceable.

Another bunch of scammers based in Nigeria or Ghana, spend all day long sending email they gathered from financial webiste

Lanka Thilina said...

BE CAREFUL. RALF FINANCE IS SCAM!!!!!

Yesterday I got mail from John and today I received application form. Now he is in more steps forward than normal scammers. He/She has create a web site nicely. I checked WHOIS; they gave below details.

WHOIS information for ralfrecruiting.org :
[Querying whois.publicinterestregistry.net]
[whois.publicinterestregistry.net]
NOTICE: Access to .ORG WHOIS information is provided to assist persons in
determining the contents of a domain name registration record in the Public Interest Registry
registry database. The data in this record is provided by Public Interest Registry
for informational purposes only, and Public Interest Registry does not guarantee its
accuracy. This service is intended only for query-based access. You agree
that you will use this data only for lawful purposes and that, under no
circumstances will you use this data to: (a) allow, enable, or otherwise
support the transmission by e-mail, telephone, or facsimile of mass
unsolicited, commercial advertising or solicitations to entities other than
the data recipient's own existing customers; or (b) enable high volume,
automated, electronic processes that send queries or data to the systems of
Registry Operator or any ICANN-Accredited Registrar, except as reasonably
necessary to register domain names or modify existing registrations. All
rights reserved. Public Interest Registry reserves the right to modify these terms at any
time. By submitting this query, you agree to abide by this policy.

Domain ID:D159816461-LROR
Domain Name:RALFRECRUITING.ORG
Created On:04-Aug-2010 08:15:43 UTC
Last Updated On:04-Aug-2010 08:15:44 UTC
Expiration Date:04-Aug-2011 08:15:43 UTC
Sponsoring Registrar:Directi Internet Solutions Pvt. Ltd. d/b/a PublicDomainRegistry.com (R27-LROR)
Status:TRANSFER PROHIBITED
Status:ADDPERIOD
Registrant ID:PP-SP-001
Registrant Name:Domain Admin
Registrant Organization:PrivacyProtect.org
Registrant Street1:P.O. Box 97
Registrant Street2:Note - All Postal Mails Rejected, visit Privacyprotect.org
Registrant Street3:
Registrant City:Moergestel
Registrant State/Province:
Registrant Postal Code:5066 ZH
Registrant Country:NL
Registrant Phone:+45.36946676
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:contact@privacyprotect.org
Admin ID:PP-SP-001
Admin Name:Domain Admin
Admin Organization:PrivacyProtect.org
Admin Street1:P.O. Box 97
Admin Street2:Note - All Postal Mails Rejected, visit Privacyprotect.org
Admin Street3:
Admin City:Moergestel
Admin State/Province:
Admin Postal Code:5066 ZH
Admin Country:NL
Admin Phone:+45.36946676
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:contact@privacyprotect.org
Tech ID:PP-SP-001
Tech Name:Domain Admin
Tech Organization:PrivacyProtect.org
Tech Street1:P.O. Box 97
Tech Street2:Note - All Postal Mails Rejected, visit Privacyprotect.org
Tech Street3:
Tech City:Moergestel
Tech State/Province:
Tech Postal Code:5066 ZH
Tech Country:NL
Tech Phone:+45.36946676
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:contact@privacyprotect.org
Name Server:NS1.PORTUGALWAY.NET
Name Server:NS2.PORTUGALWAY.NET
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
DNSSEC:Unsigned

Lanka Thilina said...
This comment has been removed by the author.
Lanka Thilina said...
This comment has been removed by the author.
Anonymous said...

i recieved the exact same email in my junk box being from the uk i was wondering why would someone in au offer me a job so googled the address and found this site along with the street map i kinda knew it was a scam as i have had a few scammers email me in the past varying from such a person has died and your the only person with the same surname s you inherit his money
hopefully this person gets caught soon as there will be some poor person who gets scammed by this person

Derek Williams said...

To anyone affected by this scam could you please email your name, address, phone number, credit card numbers (including numbers on end of signature strip), bank account number and sort code to..freemarketeconomy@(snip! - BrokenTV)jo

Anonymous said...

Now all you've done by replying to the opening mail is have yourself added to the "this guy responds!" list.

Mark X said...

The trick is to always have a secondary Gmail account for such things, that you can easily just walk away from when it's full of spammy badness.

Anonymous said...

its a money laundering scam the funds come mainly from pakistan saudi arabia and afganistan