GARAGE
The Garage Page

MOTORCYCLES  

Buying a used BMW
Selling a used BMW
New Owner FAQ

Rants & Raves

The BMW K75

My K75RT
My K11RS
My K75S

Insurance FAQ
Motorcycle Links

CAR 

SITE
HOME
GARAGE
STUDY
ENTRY
REC ROOM
OFFICE
HEAD
KITCHEN
PATIO

Ted's House
FREQUENT RANTS
RANTS 
Intro

11/02/10
The (not in the) UK Scammer
07/22/10
Losing Things
03/25/10
What is in your tool roll?
07/15/05
Planning Your Trip
05/18/01
Buying Online
10/22/00
Riding Partners
07/11/00
Starter Bikes
06/17/00
My Bookshelf
03/20/00
Emergency Card
11/25/99
Where to Start?
11/12/99
What was that?
07/07/99
Clubs, Should I?
04/22/99
GPS & SA6
04/15/99
Being Prepared
02/03/99
Riding Gear
01/31/99
Club Webpages
01/27/99
The Rally Virgin

November 02 , 2010
A Cautionary Tale - The (not in the) UK Scammer

I see a lot of things in my job as a moderator of the BMW MOA Forums. One thing I didn't expect was a note from a user of the BMW MOA Online Flea Market that he had been scammed by someone who had answered his ad looking to buy parts for his bike. How the scammer accessed the members-only Flea Market area I have no clue, I wouldn't put it past them to steal a password or even actually join the BMW MOA. I have moderated online motorcycle communities since the mid-90's and have had a lot of experience with these scammers, though they are usually active in the free online classifieds areas like Craig's List. Basically they have two ways of operating…

The first method they use involves selling a bike. They will make up a story about having moved to England and put the bike in the care of a shipping or storage company. If you wire the purchase price or even just a deposit to them, maybe even using a fake escrow service, they will have the bike shipped to you for you to inspect and either accept or refuse for a full refund.

The second involves selling you things. They will offer an address and phone number in England and ask you to wire the money to them in return for sending you the parts.

Of course in both cases there is no bike or parts and once you wire the money off, it is gone for good. Both of these scams have several things in common and it all starts in the internationally recognized hotbed of online scams, Nigeria.

I decided to do a little investigative work and placed an ad in the BMW MOA Flea Market seeking a new old stock or excellent condition OEM BMW K-Bike Bulb Kit. A day or so later I received an e-mail from "prince008@netzero.net" ostensibly a Mr. Andrew Morgan of Barlow Moor Road, Manchester, UK:

Hello,

This is Andrew Morgan from the United Kingdom.You placed a wanted Ad over the internet and i still have for sale in good and perfect condition.

My Mobile Number is +447024074843

Thanks

Andrew Morgan
Barlow Moor Road, Chorlton cum Hardy, Manchester, M21 8AE

With this I decided to dig a little.

The E-mail. The scammer's e-mail will usually be from a free e-mail service like Gmail or NetZero and will include an offer to sell the parts or bike, as well as an address and phone number in England. Fortunately the Internet usually tags e-mail with the location of the Internet Service Provider someone uses when they send an e-mail. I opened up the header information in my Outlook e-mail program by selecting "View" then "Options" and gave it a good look. Near the middle I saw these two lines:

Received: from [41.211.234.17]
X-Originating-IP: [41.211.234.17]

These two lines tell me which Internet Service Provider ("ISP") the person who sent me the e-mail was using when he actually sent me the e-mail. A bit of background here, the string of numbers, here "41.211.234.17", is called an IP Address. When a person connects to the Internet he is given one of these unique to him by his ISP, services like Cox Internet, Comcast Internet, and even T-Mobile, and the Internet uses that IP address to direct things like e-mail and web pages to and from the user. Each ISP is given a range of IP addresses to give to its users to connect to the Internet. So I turned to a favorite tool of mine, http://network-tools.com, entered the IP Address "41.211.234.17", selected "Lookup" and hit the "GO" button. This is what I got back:

Host name: 17.234.211.41.client17.directonpc.net
41.211.234.17 is from Nigeria(NG) in region Southern Africa

Hmmmm. Well, it appears the e-mail did not come from the UK after all but from someone using DirectOnPC, an ISP based in Lagos, Nigeria. Note that each e-mail program is different in how it displays header information, a good guide can be found here: http://tinyurl.com/3xece

In the words of Billy Mays, "But wait, there's more."

I moved on to the telephone number given, "+447024074843." First the Country Code - +44 is indeed the Country Code for the UK. This seemed oddly legitimate so I did a little more digging. In Googling "4470" I immediately found out that phone numbers beginning with "4470" belong to UK call forwarding services that forward calls anywhere in the world without the caller having any idea they are not actually talking to someone in the UK. It also seems these services are a favorite of scammers.

So at this point we have someone in Lagos, Nigeria pretending to be from the UK, using a UK telephone number used to forward calls anywhere in the world (in this case I think a safe bet would be to, you guessed it, Lagos, Nigeria…)

So how does this play out?

Here is the reply to my "Yes I want to buy from you" e-mail bait:

Hello Ted,

Thanks for the Email.I have BMW OEM Bulb kit for a K75/K100/K1100. I do not have images but condition is good and excellent.

I have made shipping inquiries and total price shipped is a $160.I will be shipping via Ups or FedEx which ever you prefer and will accept payment via Western Union or Money gram.Whats your shipping address?

As you can see, the seller is insisting I use Western Union or MoneyGram. Why you might ask? The answer is simple - because regardless of where and to whom the money is intended to be sent, it can be picked up by anyone quite anonymously anywhere in the world (such as Lagos, Nigeria) simply by having the wire confirmation number. Almost every scam I have ever seen involves Western Union or MoneyGram. On that same note, in all my years moderating sites with online marketplaces I think I have seen one, maybe two at most legitimate exchanges using these services.

It is a safe bet that were I to wire money off to "Mr. Morgan" I would not receive anything in return other than a bit of grief knowing that someone in Lagos is probably enjoying a very nice celebratory dinner on my dime. These guys are very good and take advantage of the close and trusting BMW community. So what can you do if you have been taken and want to help others from suffering the same fate?

First, notify the managers of the online marketplace and if possible post on the associated message boards. In our case I posted to the BMW MOA boards and then wrote to every person who posted a "Want to Buy" ad on the BMW MOA Flea Market in the previous four weeks. Almost all had been contacted by Mr. Morgan with the same initial response e-mail I had received. Interestingly enough, this was the first response I received:

Thanks for the heads up.... I just got a second email from Andrew Morgan today. If it weren't for your warning I would have sent him money later today because he quoted me a good (not Great) price.

Second, you might notify the e-mail service at "abuse@", in this case "abuse@netzero.com" that the person using that e-mail has scammed you. Make sure to attach the e-mails from the scammer to the complaint. Lastly, you can file a complaint with the FBI's Internet Crime Center here: http://www.ic3.gov. The IC3 has additional resources as well.

It pays to be cautious when buying and selling on the Internet, even when using a closed community like the BMW MOA's Flea Market. A little groundwork can quickly uncover most of these scams and help ensure that your buying and selling experiences are, like most, ones you would happily repeat.

1995-2016, Ted Verrill

Comments? <contact@verrill.com>

"Red Light Insight" is copyright Ted Verrill, 1999