The 419 nigerian frauds - step by step live explanation

[Guest guest]

This message was sent to you from the SecuriTeam web site

located at http://www.securiteam.com

If you would like to automatically receive security bulletins

simply forward this message to: list- (AT) securiteam (DOT) com

Comment from sender:

The 419 nigerian frauds - step by step live explanation

-------------------------------

This is the complete story about Zone-H faking to fall in one of the infamous

Nigerian 419 advanced fees frauds. The story begins with the first mail and it

ends with the last telephone call with the fraudsters in which we agreed upon

details of our trip to Nigeria, where a limo sent by the gangsters would wait

to kidnap us upon our arrival at the Lagos Airport. The story includes all the

fake certificates produced by the fraudsters.

All the details below are provided by Zone-H.

************

Notes:

- ALL THE MAIL IN CAPITAL LETTERS ARE THE MAIL THE NIGERIAN FRAUDSTERS SENT TO US

- All the mails in smallcaps are the mail we sent back to the fraudsters

This is the first mail we received:

FIRST BANK PLC

TEL: 234-8033062755

FAX: 234-9-2721428

MY NAME IS DR.DICKSON EZE, I AM ONE OF THE SENIOR MANAGERS IN THE FIRST BANK PLC

AND I WORK UNDER THE DIRECTOR OF FOREIGN EXCHANGE OPERATIONS (INTERNATIONAL

REMITTANCE). I AM CONTACTING YOU PRESENTLY BECAUSE I NEED YOUR URGENT

ASSISTANCE IN A BUSINESS TRANSACTION THAT WILL BE OF IMMENSE BENEFIT TO BOTH OF

US.

I NEED TO TRANSFER SOME MONEY THAT HAS LONG BEEN DECLARED UNCLAIMED BY THE

CHAIRMAN AND SOME MEMBERS OF THE BOARD OF DIRECTORS OF OUR BANK.THE MONEY IS

THE CLOSING BALANCE OF ONE OF OUR BEST CUSTOMER, LATE ENGR. GEORGE BENSON. I

WAS HIS PERSONAL ACCOUNT OFFICER BEFORE HE DIED. GEORGE BENSON WAS AN AMERICAN

CITIZEN AND THE AMOUNT INVOLVED IS $20.5M USD (TWENTY MILLION FIVE HUNDRED

THOUSAND UNITED STATES OF AMERICA DOLLARS) HE WAS AN INTERNATIONAL CONTRACTOR

WHO SUPPLY AND INSTAL EQUIPMENTS WITH A COMPANY CALLED CREEK CONTRACTORS

LIMITED.NOBODY HAS EVER COME FORWARD TO MAKE A STATEMENT OF CLAIM BECAUSE HE

DOES NOT HAVE A NEXT OF KIN.

I HAVE DISCOVERED HOWEVER THAT THE CHAIRMAN AND THE BOARD OF DIRECTORS WANT TO

CLAIM THESE MONEY FOR THEIR OWN PERSONAL USE. THOUGH, MY COLLEAGUES AND I HAVE

MADE SEVERAL ATTEMPTS AT LOCATING ANY PERSON OR PERSONS THAT COULD BE REMOTEDLY

RELATED TO ENGR.GEORGE BENSON, THOUGH, WE HAVE BEEN DOING THIS FOR THE PAST FOUR

YEARS AND NOBODY HAS COME FORWARD FOR THE MONEY DUE TO THE FACT THAT THERE IS NO

NEXT OF KIN.

I AM HEREBY SOLICITING FOR YOUR ASSISTANCE TO PROVIDE ME WITH A PRIVATE FOREIGN

ACCOUNT WHERE THIS MONEY CAN BE DEPOSITED FOR OUR USAGE AND ALSO FOR THE

BENEFIT OF THE LESS PRIVILEDGED IN THE WORLD. I HEREBY SUGGEST THAT PROVIDING A

GOOD ACCOUNT WILL MAKE YOU HAVE 30% FOR YOUR HELP, 10% FOR THE LESS PRIVILEDGE

IN THE WORLD LIKE CHARITY HOMES OR MOTHERLESS BABIES HOME ETC.AND 5% FOR ANY

EXPENSES INCURED FROM YOUR SIDE OR MY SIDE. THIS WILL BE BETTER THAN ALLOWING

OUR CHAIRMAN AND THE BOARD OF DIRECTORS TO ACQUIRE THESE MONEY FOR THEIR

PERSONAL USAGE.WE HAVE WORKED OUT A PERFECT PLAN TO STAND YOU AS A NEXT OF KIN

TO ENGR.GEORGE BENSON AND I WILL ALSO PROVIDE YOU WITH ALL THE INFORMATIONS YOU

WILL NEED TO ANSWER ANY SECURITY QUESTION THAT MAY COME UP.IF YOU FOLLOW MY

INSTRUCTIONS CAREFULLY, EVERYTHING WILL BE COMPLETED WITHIN TWO WEEKS.

THEREFORE, CONTACT ME ON MY PRIVATE PHONE NO.234-8033062755 OR FAX

NO.234-9-2721428 OR EMAIL:travelegg (AT) eircom (DOT) net

THANKS FOR YOUR KIND CO-OPERATIONS,

DR.DICKSON EZE.

This is how we answered. The name Marq Bellini is totally invented (it happens

that I have a Marq friend down to www.securitynewsportal.com)

Hi there, I might be interested in the deal.

Can you be a little more precise explaining me the details ?

Regards

Marq Bellini

Here's their reply:

DEAR SIR,

I THANK YOU FOR YOUR REPLY TO MY EMAIL.WE ARE ABOUT THREE OFFICIALS INVOLVED IN

THIS TRANSACTION AND WE ARE MEN OF GREAT HONOUR IN OUR VARIOUS FIELDS.BEFORE

CONTACTING YOU,WE HAVE ALREADY SET ASIDE SUBTAINTIAL AMOUNT WHICH WE BELEIVED

WILL BE OKAY TO CONCLUDE THIS NOBLE TRANSACTION.ALL WE NEED FROM YOU IS HONESTY

AND CONFIDENTIALITY TO JOINTLY ACTUALISE THE PROJECT.

HOWEVER,IT IS IMPORTANT YOU SEND DOWN YOUR BANK PARTICULARS,COMPANY'S NAME PHONE

AND FAX NUMBER TO ENABLE US PROCESS THE RELEASE OF THE FUNDS INTO YOUR NOMINATED

ACCOUNT.YOU CAN AS WELL CALL ON MY MOBILE NO.234-8033062755 FOR MORE DISCUSSIONS

IF THERE IS ANYTHING YOU DID NOT UNDERSTAND OR YOU CAN AS WELL SEND US THE

NEEDED INFORMATIONS THROUGH OUR FAX NO.234-9-2721428.YOU CAN BE REACHING ME ON

MY PRIVATE EMAIL ADDRESS FOR SECURITY REASONS.THE ADDRESS IS oboms2001

HOPING TO HEAR FROM YOU TODAY.

REGARDS,

DICKSON EZE.

As you saw, they asked for my data and bank details. We invented a totally fake

bank account, fake address etc. , knowing that the fraudsters would have never

checked it…

We also invented a Rome (Italy) address and we purchased a brand new GSM

rechargeable card to allow them to call us in total anonymity.

Hello there.

Sorry for the delay but I couldn't reach the internet for the last week or so.

I am still interested in the deal so here are my data:

Name: Marq Bellini

Address Circo Massimo 34 - Rome - Italy

Bank: Banca popolare di Lodi, agency 29 Roma

Bank account 400882-380001/1

Phone contact : +39 348 8861XXX (the last three numbers are covered cause I am

still using that number…)

Before proceeding, I'd like to know more details about the deal as you didn't expalin to me.

I'd like to know how did you get my mail contact.

Regards

Marq

After this mail, we let them wait one week or so, just to get them anxious…

>

>"Sir Lancelot / H.M. Zone-H messaging servant"

>URGENT.

>Mon, 10 Feb 2003 19:11:36 +0000

>

>DEAR SIR,

>I HAVE WAITED TO HEAR FROM YOU TO NO AVAIL.I WANT TO KNOW WHETHER YOU ARE STILL

INTERESTED BECAUSE WE DON'T HAVE TO WASTE TIME AS OUR AIM IS FOR THIS MONEY TO

BE RELEASED TO YOUR ACCOUNT WITHIN TWO WEEKS.

>

>PLEASE,IF YOU STILL INTERESTED,SEND DOWN THE NEEDED INFORMATIONS ASAP INORDER

FOR US TO PROCESS THE RELEASE OF THE FUNDS INTO YOUR NOMINATED ACCOUNT.

>REGARDS,

>MARTINS. (who is Martins? One of the three guys?!?)

After this mail, they called me and they told me : (resume)

- May God bless you

- We are like brother in this deal, and God wanted us to meet

- Keep this deal secret, don't even tell it to your wife

- Follow exactly our instructions and you will get your share of money

- We need a fax number to fax you some documents, ACT NOW! (they screamed it to me)

- You cannot cash the money as private person, you must provide us a legal

entity. What's your company' name?

Oh oh… we are in trouble! They want a fax number… what shall we do?

We couldn't give them a real fax number so we d one of the many Free

Internet Fax Receiving services. The one we choose allowed also to use an

Italian city prefix, so we choose Rome (06) to make our fake as real as

possible.

Moreover we had another problem: our mailbox was zoneh_org (AT) hotmail (DOT) com so we had

somehow to justify this name. So we invented a Bellini Zone Hotels company. This

would justify the usage of Bellini name in conjunction with Zone-H spare

mailbox. So we mailed them:

Hi, as requested by you here is my fax number:

+39 06233230995

the details of my company:

Bellini Zone Hotels spa

via Prenestina 16, 10100 Roma (Italy)

waiting for your answers

Best regards

Marq Bellini

They answered:

DEAR SIR,

I THANK YOU FOR THE INFORMATIONS YOU SENT.I HAVE SUBMITTED THE APPLICATION AND I

HOPE IT WILL BE OUT TOMORROW.SO ONCE EVERYTHING IS OKAY TOMORROW,I WILL SEND

THEM TO YOU FOR YOUR PERUSAL.

AGAIN,I WILL LIKE US TO BE COMMUNICATING HENSEFORTH THROUGH MY PRIVATE EMAIL

ADDRESS:oboms2001

HOPE TO HEAR FROM YOU SOON.

REGARDS,

DICKSON.

Note that every time we make a step ahead in the transaction, they will tell us

to change email address or telephone numbers.

This is because they sent so many scam letters around the world AND THEY

ACTUALLY RECEIVE A LOT OF ANSWERS so they have the problem to manage all those

mails.

To solve the problem they use different mails and phone numbers for each step of

the fraud so that if you call them on a certain phone instead than another one

it will mean for them that you already are at step X of the fraud scheme,

helping them to better manage the large amount of involved victims

Wow! What a surprise, things are getting serious now!

I received the first set of documents from Nigerians.

Please note that it appears they opened a company named Bellini Zone Hotels Llc.

This is because they told us we need a local legal entity to cash legally that

money.

Also, note that the certificate appears backdated to 1991 so to have a legal

entity that appears being working with Nigeria since a long time.

Please pay also attention to the fact that all the fees and stamp duties on the

certificates are expressed in US Dollars, while the official currency in

Nigeria is the NAIRA.

Nigeria must be more expensive that Dubai! In fact the fees to open a company

appear to be 25.500 USD !!!

Now this is nice: because we finally have a Bellini Zone Hotels legal Nigerian

entity, we will be able to be recognized by the Nigerian National Petroleum

Corporation (the company fraudsters said they will use to transfer the money

from) as one of their accredited contractor. This will allow NNPN to release us

an official payment for the promised 20.5 Million USD

After receiving those faxes, we mailed them:

Hi I got your faxes.

What to do now?

Marq Bellini

Here's their answer:

DEAR MARQ,

THANK YOU FOR YOUR MAILS.THE NEXT STEP NOW IS TO WAIT TO HEAR FROM THE FINANCE

MINISTRY.WHATEVER HAPPENS,I PROMISED I WILL COMMUNICATE YOU BECAUSE WE BOTH ARE

IN THE BUSINESS.I WILL ALSO LIKE YOU TO BE CALLING ME ON DAILY BASIS SO THAT I

WILL BE GIVING YOU THE DETAILS OF THE WHOLE TRANSACTION.MY MOBILE IS

234-8033062755.

REGARDS.

So we called them. They told us that we would receive a phone call from the

Ministry of Finance' lawyer.

And it happened. A new SERIOUS voice called us asking for our credential.

He asked us to take a copy of the documents they previously sent us by fax and

asked me about reference numbers etc, this to play like if he was really

concerned about my ID.

After having verified by phone that I was the real Mr. Bellini, he told me to

wait a fax of confirmation from the Ministry of Finance.

Which arrived:

Please note that in the fax is stated: NOTE THAT INCOME TAX CERIFICATE OF YOUR

COMPANY IS NOT IN YOUR FILE. DO SEND IT DIRECTLY TO CENTRAL BANK OF NIGERIA.

We believe this will be a phrase they will use to steal from us some MORE money

in case, later on we would have flown down to Nigeria to cash our money, like

asking some extra bribes to let our income tax certificate appear like magic in

the file of Central Bank of Nigeria (which has nothing to share with this fraud,

look at their official page statement: http://www.cenbank.org/419effort.htm ).

After a few days we received this fax from the Central Bank of Nigeria, stating

the approval of the payment execution on our bank account. NOTE THAT CENTRAL

BANK SHOULDN'T HAVE ANY POWER TO RELEASE APPROVAL FOR SUCH PAYMENTS

Note also the amount of APPROVED stamps… it gave us a good 30 minutes laugh!

After this fax, Mr. Musa Danjuma the lawyer of the Central Bank of Nigeria (a

fake one, of course) called me urging me to proceed with the payment of the due

fees in order to release our 20.5 M USD. He gave me two possibilities :

1) to pay 16.500 via Western Union to their legal office so that the lawyer

would act on our behalf to release the money

2) to come to Nigeria personally to endorse the money, this procedure would cost only 6.500 USD

The fees I had to pay are the one stated in this fax:

So we mailed them…

I received your fax which talks about the legal fees are necessary to be paid in

order to proceed with the 20,5 M endorsement (16.500 USD).

My question is: would it be possible to withdraw that money from the total sum?

It doesn't really make any sense to me to pay money in order to receive money.

Moreover, I don't trust this kind of online transaction between people they don't know each other.

Can you please suggest an alternative solution that would ease out the process?

Maybe I could come there by the end of next week as I am coming anyway to visit

our hotels in Kenya with corporate airplane, it wouldn't take so much to jump to

Nigeria as well.

Marq Bellini

And they answered…

DEAR BELLINI,

MUCH THANKS FOR OUR PHONE DISCUSSIONS TODAY.INSHORT,I MET WITH THE GOVERNOR OF

CENTRAL BANK OF NIGERIA TO KNOW EXACTLY WHAT TO BE DONE NEXT TO REMIT THE $20.5M

USD INTO YOUR ACCOUNT SINCE THE WHOLE MONEY HAS BEEN APPROVED.

HE TOLD ME THAT YOU CAN CLEAR THE MONEY INTO YOUR ACCOUNT BY USING THE LAWYER OF

THE BANK OR YOU CAN ALSO COME DOWN PERSONALLY AND DO ALL THE ENDORSEMENTS.I

SHALL PROVIDE YOU WITH ESCORT THAT WILL PICK YOU FROM THE AIRPORT TO ANY HOTEL

OF YOUR CHOICE.I HAVE TOLD YOU THAT I AM A MAN OF HONESTY,HIGH INTERGRITY AND

HONOUR AND YOUR COMMING TO MY COUNTRY WILL ALSO GIVE YOU THE OPENINGS INTO MANY

BUSINESS CLIMATE IN THE OIL INDUSTRY.

I AM IN THE OIL FIELD AND YOU WILL ALSO MEET WITH SOME IMPORTANT OFFICIALS AND

THIS WILL PAVE THE WAY FOR MORE BUSINESS BETWEEN US.I HAVE ASSURED YOU THAT

$20.5M USD IS JUST A TIP OF ICEBERG ONCE YOU ARE HONEST WITH ME AS I WILL BE

100% HONEST WITH YOU.IT IS ALSO IMPORTANT TO BE VERY CONFIDENTIAL BY NOT

DISCLOSING THE TRUE NATURE OF THIS OUR NOBLE TRANSACTION TO ANYBODY EITHER IN

YOUR COUNTRY OR MINE.I HAVE DONE A PERFECT HOME WORK AS REGARD TO THIS OUR

TRANSACTION AND I PROMISE YOU THAT THE SKY IS OUR LIMIT.

THE GOVERNOR TOLD ME THAT YOU MUST COME DOWN WITH THE STAMP DUTY AND AFFIDAVIT

FEES IN CASH SINCE THIS IS BEEN PAID TO THE HIGH COURT AND IT IS ONLY $6500

USD.YOU WILL ALSO NEED A CLEARANCE TO LAND YOUR PLANE IN CASE YOU ARE COMMING

WITH A PRIVATE PLANE.THIS I BELEIVE YOU CAN DO YOURSELF BUT DO NOT TELL ANYBODY

YOUR TRUE MISSION.JUST SAY YOU WANT TO EXPLORE NIGERIA AS AN HOTELIST AND A

TOURIST TO EXAMINE HOW YOU CAN INVEST OR DO BUSINESS HERE IN NIGERIA.LET THE

SECRET OF THIS BUSINESS BE KNOWN TO YOU AND ME ALONE AND I ASSURE YOU THAT WE

WILL CLEAR MORE MONEY INTO YOUR ACCOUNT AFTER THE REMITTANCE OF THIS $20.5M USD.

I AM LOOKING FORWARD TO WELCOMMING YOU IN MY COUNTRY NEXT WEEK.SEND ME ALL YOUR

ARRIVAL DETAILS TO ENABLE ME GIVE YOU A PERFECT ARRANGEMENT HERE.YOU MAY SPEND

ONLY THREE DAYS TO CONCLUDE THE TRANSACTION.IT SHOULD NOT BE WEEKEND BUT WORKING

DAYS.

THANKS,

SINCERELY YOURS,

MARTINS EBERE.

DEAR MARQ,

I THANK YOU FOR YOUR MAIL TO ME TODAY IN RESPECT OF YOUR CONTRACT PAYMENT IN THE

CENTRAL BANK OF NIGERIA.IT IS PERTINENT TO LET YOU KNOW THAT IF YOU CAN COME TO

NIGERIA YOURSELF FOR THE ENDORSEMENT THE BETTER BECAUSE IT WILL COST YOU JUST

$6500 USD NON NEGOTIABLE FEES FOR STAMP DUTY AND AFFIDAVIT.

I WILL ADVISE HOWEVER THAT YOU SHOULD TRY AND COME DOWN PROBABLY BY NEXT WEEK AS

YOU RIGHTLY PROPOSED BECAUSE THE FEDERAL GOVERNMENT ARE PAYING FOREIGN

CONTRACTORS RAPIDLY NOW DUE TO THE ON COMING PRESIDENTIAL ELECTION AND ANY

CONTRACTOR WHO FAIL TO RECEIVE HIS CONTRACT SUM NOW WILL FIND IT DIFFICULT AFTER

ELECTION.

PLEASE,TRY AND GIVE ME A CALL IMMEDIATELY YOU ARRIVE MY COUNTRY SO THAT I WILL

BE AWARE YOU ARE ARROUND IN CASE YOU MAY STILL NEED MY ASSISTANCE.MY MOBILE

NO.IS 234-8033260176.

REGARDS,

DR.MUSA DANJUMA(SAN)

--

Note that they want me down to Nigeria. The Central Bank lawyer is also giving me his mobile phone….

So I decided to tell them by phone that giving the fact that my hotel chain had

already one hotel in Kenya and I would be visiting that hotel a week after, I

could have taken my private corporate plane and jump down to Nigeria, after all

it's only 1 hour flight…

They also told me to bring some cash to pay the fees.

DEAR MARQ,

I THANK YOU FOR YOUR CO-OPERATION TO JOINTLY ACTUALISE THIS OUR NOBLE

PROJECT.PLEASE,I WILL LIKE TO HEAR FROM YOU TO KNOW EXACTLY WHEN YOU WILL BE

COMING SO AS TO MAKE SOLID ARRANGEMENT IN WELCOMING YOU.TRY AND CALL ME ON PHONE

TODAY.EVERYTHING IS IN ORDER SO MAKE SURE YOU SEND ME YOUR ARRIVAL SCHEDULE.

REGARDS,

MARTINS.

We decided to play around a little with them, so I didn't call them for around 10 days…

DEAR MARQ,

I WROTE YOU YESTERDAY BUT I DID NOT HEAR FROM YOU.I ALSO CALLED YOU TODAY BUT

YOU PHONE WAS IN ANSWERING MACHINE.PLEASE,TRY AND CALL ME AS SOON AS YOU RECEIVE

THIS MESSAGE FOR ME TO KNOW WHEN YOU ARE COMING INORDER TO PICK YOU UP IN THE

AIRPORT.MY MOBILE NO. IS 234-8033062755.ALSO SEND ME EMAIL ABOUT YOUR SCHEDULE

INORDER TO PREPAIR WELL FOR YOU.

WAITING TO HEAR FROM YOU TODAY.

REGARDS,

MARTINS.

Then finally I wrote them…

Hi, sorry for the delay but I have had health problems and I got hospitalized for a week or so.

But now I am back and fortunately feeling well.

My trip for Nigeria is planned this week.

I should arrive Thursday, departure on Sunday.

I will communicate the private plane flight code as soon as the pilots will file

the flight plan to Lagos control tower.

Visa is already arranged, maybe you can suggest me a nice Hotel accommodation.

Marq.

After other phone calls we finally settled an arrangement:

Hello,

I have finally the copy of the flight plan filed by my pilots. I will be landing

at Lagos Airport approximately at 09.15 AM on Thursday 6th March 2003 and I will

depart Sunday afternoon.

The code of my flight will be acx2002 (I don't know if you need it) and I will

fly with American tail N69326.

I would like to know the schedule of our meetings as I would like to organize my

free time otherwise.

I also would like to know if you can deliver the limo directly to the airplane

parking lot or if I should eventually manage myself the Custom Border

immigration procedures.

I have never been to Nigeria so I am not aware about the private flight

custom-immigration rules there …

Marq

Note that at this point the scam becomes dangerous. In fact, if we agreed to pay

the 16.500 USD fees by money transfer, we just lost our money and that was it.

But given the fact that we decided not to transfer the money but to rather go

to Nigeria to cash the big payment by our self, we put our life in a situation

of extreme danger. In fact the fraud scheme might conclude (as it already

happened) with the kidnapping of the victim once arrived in Nigeria. Some of

them have been freed after having paid a ransom, some other have been killed.

Of course, they are still waiting us with the limo down at Lagos Airport landing path…

-----------

Additional InformationThe information has been provided by www.zone-h.org.

You can refer to the official 419 Nigerian frauds page at the USA embassy' website:

http://www.nigeriaembassyusa.org/419statement.shtml

or you can have a more extensive analysis at Zone-H special scam section:

http://www.zone-h.org/419fraud

---------------------

If you found this article interesting,

you might like to take a look at the following articles:

Verity K2 Toolkit Query Builder XSS Vulnerability

Statement on the Announced Defacement Challenge (Zone-H.org)

Verity K2 Toolkit Query Builder XSS Vulnerability

Buffer Overflow Vulnerability in Adobe Acrobat Reader

Aprelium Abyss Webserver X1 Arbitrary Code Execution and Header Injection