Phishing Email Archives - Online Phishing Scams

Mageed Yahia Sent Me An Email…

Apr 10, 2024 | My Email Communications, Phishing Email, phishing email without link or attachment

Yesterday I received an email from a person claiming to be Mageed Yahia. He said that he is Director of Payment in the UN Foreign Office. I don't know what is UN Foreign Office, but let us leave it at that. What is interesting however is that though he claimed to be from UN, he used an email that had nothing to do with UN – nextage@nit.ne.jp. I fail to understand why UN personnel should be sending an official email from a .jp domain? A clear indication that it is a fake email phishing for information to defraud me.

In the email he informed me that my compensation/winning payment was approved today by the Board and Directors of the United Nation Committee on Rewards and Compensation. He did not tell me how much money I would be getting. My email communication with him is reproduced below. My comments on his email are in red.

Email from Mageed Yahia

From: Mageed Yahia <nextage@nit.ne.jp> UN personnel sending email from this email id?
Sent: Monday, April 8, 2024 9:07 PM
Subject: Attention: Beneficiary.</nextage@nit.ne.jp>

Attention: Beneficiary.

I am writing to inform you that your compensation/winning payment was approved today by the Board and Directors of the United Nation Committee on Rewards and Compensation.

You are therefore advised to reconfirm your details to enable the financial department to release your payment to you without delay. Thus, Reconfirm the following:

1.Your Full Name
2. Address:
3. Your Direct phone number:

We look forward to your prompt response via: mageedyahia@aliyun.com (In my experience, a phising email sender asks for reply on another email id. Not on the same email address from whcih the email has been sent. I wonder why? Also it is interesting to note that the reply email domain is aliyun.com – Alibaba Cloud, a Chinese company)

Thank you.
Mageed Yahia.
Director of Payment,
UN Foreign Office

My reply to Mageed Yahia

Dear Mr. Mageed Yahia

Thank you for your email informing me about approval of my compensation / winning payment having been approved by the Board of Directors of the United Nation Committee on Rewards and Compensation.

I don't know what this is for. I did not apply to the UN for any compensation. I also dod not participate in any competition. SO what is this for. Can you please highlight so that I can share my details.

best regards

Sanjeev Sharma

Let us now wait and see what reply I get.

Dan Okeke Sent Me An Email Offering 18.5 Million USD!

Aug 31, 2022 | My Email Communications, Phishing Email

Below you'll find my communication with one Mr. Dan Okeke who claimed that he was the Executive Director of United Bank for Africa PLC. I googled the name Dan Okeke and found that he was Executive Director of United Bank of Africa till August 2020. Interestingly, I had received the email from the person claiming to to be Dan Okeke in November 2020 – almost 3 months after he ceased to be holding that position.

Why I chose to write to “Dan Okeke” after almost 2 years

I replied to the email only today because I wanted to check the life of an email address of a scammer! Let us see if I get any reply to the email.

Email from “Dan Okeke”

From: unitedbankafrica109@gmail.com <unitedbankafrica109@gmail.com>
Sent: 18 November 2020 14:02
To: sanjeev@emaildomain.com
Subject: [Norton AntiSpam]Dear Friend,

Google forms

Dear Friend,

I wish to use this medium to inform you that your compensation payment of USD$18,500,000.00 (Eighteen Million Five Hundred Thousand United States Dollars) from United Bank for Africa have been approved for onward transfer to you via an ATM DEBIT CARD which you will use to withdraw all the USD$18,500,000.00 in any ATM SERVICE MACHINE in any part of the world, but the maximum you can withdraw in a day is USD$10,000.00 Only.

In regards to the recent meeting between the Africa Union and the Present United Kingdom Government to restore the dignity and Economy of the Nations, Base on the Agreement with the International Monetary Funds Assistance to help and make the world a better place for all with the sole aim of abolishing poverty. We have been having a meeting for the passed 5 months which ended 2 days ago. The National Central Bureau of Interpol enhanced by the Government of United Kingdom and Federal Bureau of Investigation have successfully passed a mandate to the Government of Nigeria to boost the exercise of clearing all foreign debts owed to Foreigners and Compensate all that have lost their hard earned money to the Nigerian Fraudsters.

This email is to all the people that have had an unfinished transaction in any part of the world, the Africa Union have agreed to compensate them with the sum of USD$18,500,000.00 (Eighteen Million Five Hundred Thousand United States Dollars) This includes every foreign contractors that may have not received their contract sum, and people that have had an unfinished transaction or international businesses that failed due to Government problems, Contracts Sum, Lottery/Gambling etc. Your name and email was in the list Submitted by our Monitoring Teams of Economic and Financial Crime Commission (EFCC), International Monetary Fund (IMF) and the Federal Bureau of Investigation (FBI) Observers and this is why we are contacting you, this have been agreed upon and have been signed.

You are advised to acknowledge this message. This funds has been credited in ATM CARD for security purpose ok? So we shall send it to you by DHL delivery Company, UPS, FedEx or by any means of your choice and you can withdraw in any ATM Cash Point Machine Worldwide at the daily limit of $10,000 usd. Acknowledge this message immediately for your ATM VISA CARD Delivery with the following information.

1. Full name: ============================== ========
2. Phone number: ============================== =====
3. Home address for the Delivery====================
4. Date of Birth========================= ===========
5. Your Occupation==================== ==============
6. A copy of your driving license. =================

We are very sorry for the plight you have gone through in the past years. Thanks for adhering to this instruction and once again accept our congratulations.

Contact E-mail: unitedbankfrica20@gmail.com

Best Regards.

Dan Okeke
Executive Director
United Bank for Africa PLC

Link to Google forms

My heartfelt reply to Dan Okeke

RE: Dear Friend,

Sanjeev Sharma <sanjeev@emaildomain.com>
to unitedbankfrica20

Dear Mr. Dan Okeke

Thanks you sooo much for your email. I am really sorry that I am sooo late in replying. I was unwell. Had got covid and then I was ridden to the bed for a long time as I was very week. My family had lost every hope that I will live. But they say that old bones are strong. And my bones are old but strong. SO I live.

I think I live because I will see 18.5 million US dollars in my account. I will give thumb to all who thought that I had no money. I have so much money with you bank. Thanks you Mr.. Dan. You are GOd.

I will give thank you to you and Goverment of Uniteg Kingdom and NIgeria and Monetary Fund and everyone who is honest.

Tell me how I can get the ATM card. I am healthy and I can come to Nigeria to collect if you want me to do that. I will have the honor of meeting with you also in that way.

Thanks you

Sanjeev Sharma

Email Quarantine Phishing Message

Jul 18, 2022 | Emails with dangerous links, Phishing Email

Email quarantine phishing messages contain dangerous links. While talking about phishing , in one of the earlier articles – Fraudulent Email Selling Viagra – we mentioned that many a times you get a suspicious email with dangerous links. The intention of the fake email sender is to get you to click the link in the email

The end objective of this phishing email could be one or more of the following:

1. Solicit your personal information which could endanger your financial security

2. Infect your computer / device with malware for later gains for the scammer.

3. Take over your email or computer to spread malware…

Email Quarantine phishing is an example of the phishing email with the objective to get access to your email account. Such an email stating “You have quarantined messages” is given below

Email Quarantine message

This email is purportedly sent from my email server. The email quarantine phishing message sender has cleverly tried to use the images of email servers such as Horde and Roundcube.

In the image above I have marked 3 locations where the person initiating the phishing attack has tried to convince the email recipient about the genuineness of the email

1. My email server domain name is mentioned – as if the email is originating from my own email server. This is a classic email quarantine phishing message. The from email domain however gives away the game. The from email domain is mail-notification.com. More about it a little later (in another article)

2. The email is addressed to me. My correct email address is used. As if the message sender knows my account.

3. Again my email address is used for attention.

The fact that the email is originating from a domain which is not my domain name, made me suspicious.

This suspicion is reinforced when I review the link that the Call to Action – REVIEW – directs to.

email quarantine phishing

Safe browsing extensions are the saviors against Phishing attacks

As you can see, the call to action button – REVIEW – directs to a domain authsvssecure.com. This is different from both my own domain and the domain from where the email has been sent. This is clearly a phishing attack. Ideally one must not click such a link. However, since I was confident that I am protected by an anti-virus, I clicked on the link and as predicted, the Norton safe browsing extension on my system gave me the following warning:

deceptive site ahead