Posts Tagged ‘scams’

Tis the season for Tax Fraud Spam

This scam is the sort that’s going to really heap up trouble on top of misery.  It starts out with an email titled “Government Offers Tax Reduction of 88%, See If You Qualify!” or “remove IRS penalties” or “Pay Only 1% Of Your Tax Bills!” and the sender is often a name like “Tax shield” —  because if they used their REAL name, “Tax Scam”, nobody would ever fall for it.


These spam mails and schemes are targeted towards struggling middle income bracket people with emails that usually read something like this:

It’s taxes time. Make sure you receive the amount you were expecting. If you have any debt, or any problems with your Taxes or IRS. We can help you to void that Debt. With the new Obama’s law for Tax Debt, some of you may qualify for a complete void of their debt. Check at no cost now.


As you have probably guessed, the truth is pretty far from the claim there.  In the case of that email, you do not get redirected to a tax advice site when you click it.  Instead, you go  through clicks (which give the sender money) and show you to some sort of clickbank product.  Some of the spammer links there capture your account information.   There’s a variant on this email (which also shows up as a tv ad) which will also get you into trouble:


Other emails promote anti-tax schemes that the government is VERY familiar with; cases that the government has won constantly.:,,id=106500,00.html


In fact, if you fall for some of these, you’ll not only get hit for back taxes and penalties, you may ALSO get entangled with the “frivolous lawsuit”.  Some of them offer a “home business” setup that the IRS is very aware of and in fact, will “flag” your tax return if you use any of the deductions the spammer tells you to use:,,id=133870,00.html


Another scheme advises you to submit a “substitute W-2 form” or a faked “1099 form” to the IRS that shows almost no wages or 1099 income, along with a letter saying that this is a corrected form (for various reasons.)  Again, the IRS knows all about this one and in the end, you’ll STILL be out the amount of taxes you use plus penalties plus other penalties.


The bottom line is that if you want to reduce your taxes, talk to an accountant or a tax professional or a certified financial planner (make sure they’re certified.)  Both my husband and I have used certified financial planners and I can say that they really do a remarkable job helping you manage money and lower your taxes legally.

Of COURSE We Want To Hire You — Would We Lie?

Ahhh, the good old spambox Inbox

They never seem to miss a trick, do they?  This time there’s an email from “google-thanks” thanking me for my resume (this to an email account opened three weeks ago, mind you).  It reads

We just received your resume and would like to thank you for your interest in working at Google. This email confirms that your application has been submitted for an open position.

Our staffing team will carefully assess your qualifications for the role(s) you selected and others that may be a fit. Should there be a suitable match, we will be sure to get in touch with you.

Click on the attached file to review your submitted application.

Have fun and thanks again for applying to Google!

Google Staffing


Nooo, I’m not going to click on that dear little file.  I’m not that stupid.  Nor did Google hunt me down all over the universe and shriek, “OMG!  THERE YOU ARE!! WE NEED TO HIRE YOU!!!”  — and send it to my NON-Gmail account.   Nopenope.  Attached is a nice little bit of poisoned malware which is now decorating my trash can.


But this wasn’t the only bit of amusement passed along this week.  I was also told (well, the mailing list inbox at was told)”


You have received a Hallmark E-Card from your friend.

To see it, check the attachment.

There’s something special about that E-Card feeling. We invite you to make a friend’s day and send one.

Hope to see you soon,
Your friends at Hallmark

In case you haven’t figured it out, that “e-card feeling” here was going to be malware in the zip file they attached… and the REALLY special feeling was going to be the sucking sound as my bank account drained and they plundered accounts OR the chuffing sound my computer made as it was turned into a spam robot.


Nope.  Not my kettle of spam, thankyew thankyew.

Oh… the FBI (yes, that would be the Federal Bureau of Investigation) approved my …refund.  No, really.  Just look! 

I particularly love the last line where they assure me, “IN AWARNESS OF THE FBI IN OTHER TO ENHANCE ITCH-FREE INTERNET PROBLEMS.”  Who knew the Internet had itchy problems?


Dear Citizen,

We sincerely Apologies, for the delay of your payment and all the Inconveniences and Inflict that we might have indulge you through.However, we  are Having some minor problems with our payment system, this is Inexplicable, And have held us stranded and Indolent, not having the Aspiration to devote our 100% Assiduity in accrediting foreign payments.We Apologies once again!from the Records of outstanding winners due for payment With {ONLINE CYBER PROMOTION} your name and Particular was discovered as next on the list of the outstanding winners who are Yet to received their payments.

Emails were selected anonymously through a Computer ballot system from over 35,000 companies and 70,000 individual E-mail addresses all over the world and your e-mail address emerged as the winner of the 11 selected email address. This program is promoted and sponsored by Orient software corporation (Orient Networks) in collaboration with The Online Cyber International.Due to the imposters that we notify that have been contacting people without our notice we have make sure that we endorseD these with the  LONDON METROPOLITAN POLICE AND FEDERAL BUREAU OF INVESTIGATION(FBI).So here are the info FBI approve for you:

Your Winning Ticket Number: 230-365-3071
Your Serial Number: 710-43
Your lucky draw Numbers are: 8, 5, 6, 24, 19, 34 Bonus Number 51
Your INSURANCE Number: FLD718/470D/GMSA

I wish to inform you now that the square peg is now in Square whole and can be voguish for  your payment is being processed and will be released to you as soon as you respond to this letter. Also note that from our record in our File, your outstanding winning payment is $850,215.00(USD)(Eight HUNDRED AND FIFTY THOUSAND, TWO HUNDRED AND FIFTEEN DOLLARS).Payment will be made to you through WIRE TRANSFER into a nominated bank Account of your choice OR through SWIFT ATM CARD PAYMENT CENTRE because your money is ready for you sO as soon as you get in touched with the Financial Officer,ask her to WIRE your money because it was all programme to be easy for individual to get there money.Here is her info so contact her in her email address and give her the FBI codenumber(FBI-0411) they made for you only so they will know yes it is so when they reach the FBI to ascertain it. So below is her info so write her direct :

Miss Caroline Billy (Financial Officer)

PLease you have the right as well to choose the delivery company you will want him to use in sending you the draft(if you want the money to be sentt to you through draft) OR you let her use the best VALUED delivery company he have been using to deliver others that have collected there money to enhance itch-free transaction and 100% assurance.Provide him with the following details, as this will enable him to process and release of your cash prize without any delay.Foward her your credentials :

1.FULL NAME ……………………
3.PHONE AND FAX NUMBER…………………………………………..
5.SEX/MARITAL STATUS…………………………………………….
5.POSTAL CODE…………………………………………………..


Yours Sincerely ,
Mrs Elliot becker,
FBI representative.

Click here to leave questions and comments at our discussion board!

My Good Friend Dave’s Amazing Riches!

I’ve had some fun this week checking out things sent to Invisible Dave.  Readers of this blog will remember good old Invisible Dave — the nonexistent who gets so much email.  Well, last week the FBI tried to send him a refund.  This week, Dave’s a gazillionaire at a casino, a PhD, in Who’s Who, almost in AARP and could actually be a published author (that’s if he ever gets his invisible self motivated to ghost write a book.)


Alas, poor Dave.  His gazillionaire riches turned out to be from something which was supposed to be a Russian casino (Invisible Dave seems to have a gambling problem.  A need to talk to that boy!)  That link actually zipped you through a SECOND link, which tried to add something to your computer.  And it wasn’t for your enjoyment.


But that’s not all, because Invisible Dave is now a rising star in the social world.  An ex is searching for him (you remember that spam trackdown, right?) another version of Who’s Who  wants to honor Invisible Dave, and an institution that nobody ever heard of wants to grant him a fake PhD.  But, Invisible Dave may not be up to it — he may be getting old and creaky, so I got somewhat bold and clicked on the “AARP membership” link – just like I told you NOT to do.  Yes, I did it — on my phone (again, they’re not writing viruses and malware for this particular type of old phone.)


FakeAARP bounced me off one site (they’d hijacked) and hung up totally on the second site (where they kept trying to send my poor phone some sort of code (hijacking it) which, of course, was like trying to put a pair of knitted booties on a full grown polar bear.  Ain’t gonna work.


Another scammer based (so it says) in Nevada came to tell Dave that he was overpaying his rates.  It didn’t say what KIND of rates… just rates.   Could it be that he’s being overcharged for his artistic license?   I decided to see what sort of rates Dave could be saving on, so I clicked… but I used my phone to click on the link.  As I suspected, it swept me off through Cyberspace (bouncing through two different pages) to a third page where my phone informed me that some sneaky owlhoot was tryin’ to persuade it snitch on me.  Luckily my phone’s operating system is so outdated that it is snitch proof.


Here’s the fraud in all its glory.  Notice that they copyrighted the spam (but they didn’t do it properly.)

Courtesy Notice on Your Rate ChangesPolicy Notice: New Rate Effective July 16, 2011 to July 16, 2012 – No Waiting Period


Statistics show you may have overpaid your current policy by about*: 523.00 USD
* your amount may be much higher (or lower) than this estimate

Enter Your Zip Code On Next Page To Verify If You’ve Overpaid

You do not need to wait until your current policy expires to take advantage of your new rate.

, July 16, 2011 – It’s IMPORTANT you read this because auto and
truck insurance discounts are being given out effective July 16, 2011.

You May Get A Large Reduction Effective Immediately If Any Of The Following Apply To You:
– You drive less than 40 miles per day
– No tickets in the past 3 years
– No accidents in the past 3 years
– Over 30 years of age
– Over 50 years of age
– Carrying Unnecessary Coverage
– Many other qualifications may be available

You do not need to wait until your current policy expires to take advantage of your new rate.

In this recession, getting a few hundred back for something
you already do (being a good driver)
just makes sense.

Enter Your Zip Code On Next Page To Verify If You’ve Overpaid

HOW THIS WORKS: Enter your zip code on the next page to see
competing rates on your zip code. You will see how much
you are currently overpaying.

Copyright © 2011



Popular Reeking Lumps of Unmentionables that plopped  into the mailbox this week include:

  • Ink for printers (one is just plain affiliate spam, but the other led to malware site)
  • Publishers (not really) are dying to have Dave publish his autobiography (not really) (this is a common publishing deal that authors warn folks away from)
  • GrandVacationRewards (dot com) is spamming the inbox.  When the sucker victim clicks on the thing, you end up in an endless loop of offers (and you have to pick 3 or more) and THEN you get entered in a “sweepstakes” for airline tickets, resort vacations, etc (no guarantee that they actually HAVE these prizes, mind you.)
  • And someone wants to make Dave a millionaire… if he’ll just join their downline.
  • Susansbusinessblog (dot com) wants to make him thousands of dollars a day.  This leads to a site where even my trusty phone screamed about “security certificates” (this is not a good sign, folks.   It means someone’s grabbed that site and has probably virused it up.)  I took a quick gander at the registration over at Godaddy, and of course as you might guess it’s not owned by anyone named Susan.   And it was created in April by “Six Figure Program” (which also owns a lot of sites claiming to be other people who WERE struggling and are now making gazillions with “Six Figure Program.”  I’m rating this one a “pass.”


Click here to leave questions and comments at our discussion board!

How to Lose Your Credibility as a Business

Hire a spammer.  Fastest way in the universe to show “I have no clue what I’m doing!”

Now, you’d think folks would actually KNOW better than to hire some goombah they never heard of to run an email promotional campaign for them… but they don’t.  Yes, some of them send out professional looking ads, but that “client list” you’re paying for includes people (like good old Nonexistent who aren’t real.  And email systems have filters on them nowadays, so the ad campaign that you just spent $$$ on to deliver your ad and make an impression on people only made an impression on the spammer’s wallet (a happy one) and on almost everyone’s “bulk mail” (spam) box.

For instance, we got one from “Fundraising4Pets” which was addressed to another nonexistent person over at dear ol’ FIB (I swear, I’m going to round up all these folks with FIB accounts and put them to work for me!)  Now, this was interesting because when I went to look them up, I found “benchmarkemail” as the sender (they specialize in ad campaigns.)  Then I pulled up THIS old item on Fundraising4Pets which makes them look rather bad:


typical spammer disclaimer
The above is an advertisement sent by a third party.If you wish to unsubscribe from all future mailings, please Click Here or write to: NAPW, 1305 Franklin Avenue, Suite 300, Garden City, NY 11530 2011 NAPW, Inc. All rights reserved.

The National Association of Professional Women certainly didn’t send the email out… but clicking on the link to remove yourself from the spam list OR clicking on the “free registration” link will get you in a world of hurt (as we say here in Texas.)

Bosley Hair Loss has also been popular this week as a “trojan horse” message that will lead your computer straight to a trojan virus (it’ll take over your computer, possibly turn your computer into a spamming computer, as well as steal any information it can get (emails of your friends, possible passwords, etc.)

And at least one spammer whose ad is about installing solar panels claims that they’ll stop spamming you … err…  you can “stop receiving emails” if you send a letter to “8930 State Road 84, Davie, FL 33324 ”  That’s a UPS store.  I’m pretty sure they don’t do spam.  I have a feeling that if you send a note to that address, one of two things will happen to it:  it ends up being thrown away because there ain’t nobody there -OR- it confirms that you’re a live email and your address gets sold to other people.


Popular gimmicks that spammers use to entice you to click:

And this week’s winners were:

  • Apple is giving away a brand new I-pad – voucher inside (nope, but malware IS inside)
  • Ford Clearance Event (I’m sure they are going on all the time, but this sure wasn’t from a Ford dealer!
  • $250 McDonalds’ Arch card
  • “Acai berry” Facebook link.  No, don’t click there.  Ever.  Even if you’re on Facebook.  PARTICULARLY if you’re on Facebook.
  • Subway Gift card – Vote for your favorite sandwich.  Unless your favorite is “spam and malware”, don’t do it!
  • And finally, someone seems to be running a pump and dump scam on Bebevco stock.  I do buy stocks, but I’m going to sit this one out, thanks.


Phishing Scam — Facebook support has sent you a message

Actually, no, they haven’t.

But a “phisher” (someone who wants to grab control of your computer and get your passwords, email contacts, and all that) certainly sent a support message pretending to be from Facebook.

This one got caught in my spam filters (and besides, the account that it’s on doesn’t HAVE a Facebook account) and has an authentic enough look that someone might be fooled.  The scumbeezle copied a Facebook notification message which included a clickable link that started with “”.    Of course, when you hold the mouse over the link (and NOT click on the link), you can see that it’s not leading to a Facebook link.

I amused myself with the basic techniques I showed on the ScamCheck page of this blog and determined that this particular spam came from another hijacked computer tied to a Portuguese account.

By the way, this same spammer with a different hijacked account was also sending out “Clearance prices on all Ford Vehicles” spam.  Again, the links are Not Safe To Click.


Colon Cleansing Laptop???

In a rather hilarious turn of events, a notification came to the spam box saying “Shipment Pending – Dell XPS M1530 Laptop”.  The spammer, who can’t quite decide which sales pitch to use, gives a return address as “Shipping Notification” (which is faked, of course) and then tells me that Dell is giving away a brand new laptop and that it’s shipping today and that you can get your free laptop now.  I took a close look at the link (of course) and discovered someone’s hijacked a “colon cleansing products” site.  Apparently it’ll clean your colon if you get your wallet cleansed and purified and your computer hijacked by this spammer.

It Came In The Mailbox (lurid tales of webmaster spam)

In my snarkier moments, I would love to have a transmorgrifier zaps scumbeezles who prey on older people and puts THEM in the shoes of their victims. I don’t know if I’m putting out an “old” vibe, but for some particular reason, Ye Olde Mailbox was filled with these scams this week.


Speaking of “old”, we can start with “AARP Deals” (the header check says it’s from NOT from AARP but someone named “1204157575john” who has an email address at cityrecordings-dot-com. It appears that someone’s email at cityrecordings may have been hijacked.) In any case, the message title annouces “We Have Great Low Rates For Seniors who want AARP: You Can Now Get all the great benefits of membership in AARP for only $16 a year.”

Guess what? AARP membership only costs $16.00/year. That’s not a “low rate” — that’s their usual rate. The rest of the message is actually copied from the AARP website except for the bottom part, which is an awkward looking URL (which doesn’t include “AARP” in it) and an amateurish redirect to tojan/spyware.

The real AARP does send out bulk mail — but doesn’t send out email spam. The cost and benefits are copied directly from the AARP site.


I think they want us to fund their “retirement home” –  Someone with an email address of “storage5″ at “air1moveins” wants to help me find a retirement home out of a “free” directory of retirement homes. They are purportedly doing business as “our parents place” — a site which bills itself as a “trusted resource” and which has a rather disturbing privacy policy.  Their website states “OURPARENTSPLACE MAY SELL OR TRANSFER INDIVIDUAL INFORMATION TO THIRD PARTIES FOR ANY LEGALLY PERMISSIBLE PURPOSE IN OURPARENTSPLACE’s SOLE DISCRETION.

I don’t know about you, but “trusted” and “sell your information” aren’t in the same section of my playbook. And the last thing you need when you’re struggling with trying to find care for a disabled spouse or parent is a mailbox full of spam.

Search for “active retirement communities” is a fast trip to malware — This time, an email from Kohengooma (an “org” domain) is mailing out spam titled “search for active retirement communities” and has an image about retiring in Florida. Google’s web cache shows that it’s really just a blank page and that the “Retirement Community” link in the spam is a redirect which is going to send you someplace and do something nasty to your computer.


Also Hovering Around the Inbox –  “Get The Power Chair Advantage from Hoveround” spam isn’t from Hoveround. It’s from a hijacked domain, and the “unsubscribe” link leads to another hijacked link. One of these “power chair” spams (with links that lead to places you should NOT visit if you value your computer) has the amusing disclaimer, “The Scooter Store values your privacy and would never intentionally send email without your permission. The Scooter Store is not the sender of this email. Oh goodie, you say.  So why did I get this in spam mail?  The fine print continues:  “You have received this email because you registered with the list owner to receive email messages on relevant products.

That’s kind of unlikely, given that the recipient was a nonexistent email at


So watch out for those — and if you hear an older friend or relative discussing these offers, find out if the offer came from spam. If it did, suggest they virus and malware check their site quickly!