Ghana Gold Scam / Alluvial Gold Dust scam
We have received some unsolicited emails from senders in Accra, Ghana offering gold for sale. The sellers claim to be in possession of large quantities of gold dust, which they are willing to sell at below market prices. The catch is that you, the buyer, will have to send money upfront and the seller can walk away at any point with virtually no risk of being caught by the police as all contacts are via anonymous free webmail accounts accessed from Internet cafes and via prepaid mobile phones. The would-be buyer is made to send money for travel of the seller, for insurance, for shipping and for refinery assays before they would receive anything of any value. If they receive anything at all, the yellowish metal powder will turn out to be powdered brass. In any case they will lose thousands to tens of thousands of dollars.
Any email from a stranger in West Africa offering gold dust or diamonds for sale is an Advance Fee Fraud!
Here is a typical example, that immediately raised several red flags, see below:
From: "rockmining_co" <email@example.com>
Here's what immediately caught my eye:
Here is an example of an actual email exchange with a Ghana Gold scammer:
From: "harrison hayford" <firstname.lastname@example.org>Where's the catch? To get that "gold" shipped to you, you first have to wire money to Ghana for shipping and insurance. What if you never receive it or it turns out to be powdered brass?
We contacted these guys and asked about shipping modalities. They replied from a different address at a different webmailer, using a satellite broadband ISP that services West Africa and shows up in many Nigeria scams:
From: "deputy manager" <email@example.com>Sending network:
inetnum: 18.104.22.168 - 22.214.171.124 netname: GILAT-SATCOM-BLOCK-16 descr: SKY2Net ltd remarks: For abuse issues related to Gilat, email firstname.lastname@example.org notify: email@example.com country: GB admin-c: GS3350-RIPE tech-c: GS3350-RIPE status: ASSIGNED PA mnt-by: AS9116-MNT mnt-lower: AS9116-MNT changed: firstname.lastname@example.org 20040912 source: RIPE route: 126.96.36.199/18 descr: Goldenlines remarks: For addressing issues, email email@example.com remarks: For abuse issues, email firstname.lastname@example.org origin: AS9116 mnt-by: AS9116-MNT changed: email@example.com 20041121 source: RIPE role: Gilat Support address: Gilat Satcom address: 21D Yagia Kapaim st. Petach-Tikva, Israel phone: +972 3 9255000 fax-no: +972 3 9217938 admin-c: DR5299-RIPE admin-c: GE2074-RIPE tech-c: DR5299-RIPE tech-c: GE2074-RIPE trouble: firstname.lastname@example.org e-mail: email@example.com nic-hdl: GS3350-RIPE mnt-by: AS9116-MNT changed: firstname.lastname@example.org 20040909 source: RIPE
From: "Yaha Amed" <email@example.com>
The spam email was not sent through Yahoo.co.uk but directly from an ISP in Africa. There it was not from Guinea, Conakry either but from Mali:
inetnum: 188.8.131.52 - 184.108.40.206 netname: ML-IKATEL-20040609 descr: IKATEL SA descr: PROVIDER Local Registry country: ML org: ORG-IS28-RIPE admin-c: SD2024-RIPE tech-c: MA1231-RIPE status: ALLOCATED PA mnt-by: RIPE-NCC-HM-MNT mnt-lower: MNT-IKATEL mnt-routes: MNT-IKATEL notify: firstname.lastname@example.org changed: email@example.com 20040609 source: RIPE route: 220.127.116.11/20 descr: IKANET origin: AS30985 mnt-by: MNT-IKATEL changed: firstname.lastname@example.org 20040923 source: RIPE organisation: ORG-IS28-RIPE org-name: IKATEL SA org-type: LIR address: IKATEL SA Immeuble SONAVIE ACI 2000 BP : E 3991 BAMAKO, Mali phone: +223 4999900 fax-no: +223 223 08 35 fax-no: +223 499 90 01 e-mail: email@example.com admin-c: DH1500-RIPE admin-c: SD2024-RIPE mnt-ref: MNT-IKATEL mnt-ref: RIPE-NCC-HM-MNT mnt-by: RIPE-NCC-HM-MNT changed: firstname.lastname@example.org 20040415 changed: email@example.com 20040604 changed: firstname.lastname@example.org 20040609 source: RIPE person: Sekou DRAME address: IKATEL SA address: Immeuble SONAVIE BP: E 3391 address: Bamako ACI 2000 phone: +223 6299908 e-mail: email@example.com nic-hdl: SD2024-RIPE changed: firstname.lastname@example.org 20040331 source: RIPE person: Mohamed Aboubacrine address: IKATEL SA address: Immeuble DT BP 3991 Bamako Mali phone: +223 499 9932 phone: +223 629 9932 nic-hdl: MA1231-RIPE changed: email@example.com 20040607 source: RIPE
Anyone willing to bet that the various certificates promised are any more genuine than the sender address or the origin of the email? I certainly am not :-)
"Mary Saxon - South African gold from Chad (Nigeria)
Email headers:From: "Mary Saxon" <firstname.lastname@example.org> To: <undisclosed-recipients:> Sent: Wednesday, 09 February, 2005 23:51 Subject: [ADV] hello Hello, I know you will definitely take this as a deceptive e mail,because of the swindle news we hear everyday and now it happens am from Sourth Africa where it seems to happen more often.Let me first of all inform you,i got your e.mail id from an e-mail directory and decided to e-mail you for a permission to go ahead. I am Engr.SAXON MARY of loops engineering group of company,located in CAPE TOWN SOUTH AFRICA. Actually,i and my colleague (Engr Nelson.K.) took the hazard,informing you without even knowing who you may be. We are in possesion of some raw Gold, which worth about US$17,500,000. Ironically, i and my colleques discovered them in cape towm, we had to leave south african for security reason.And decided to go on 2 months vacation to enable us sell the gold abroad. Meanwhile, We've relocated to West AFRICA precisely N'DJAMENA in CHAD,where we can get our travel document prepered.Right now,we are also in the middle of discussions with some possible buyers,that's if all things go fine. SO,what we need from you now,is to get acquanted to eachother. And would love to let you know all documents have prove with us,incase you want to be sure. What we want from you now Are: 1.Help us pose as partners,should incase the possible buyers want someone in the USA to discuss with. 2.Furnish us with a safe airline to book down to your State. 3.Name of a suitable hotel we can lordge as soon as we get there. 4. If you can pick us from the Airport on our arrival date As we don't have any siblings in your country,And your reward will be 20% as soon every thing is done. Best regards, as i will be expecting you urgent reply. Yours fortunately, _________________________________________________________________ http://fastmail.ca/ - Fast Secure Web Email for Canadians
Received: by mail.interchange.ca (Postfix, from userid 555) id 77AC6861339; Wed, 9 Feb 2005 09:51:15 -0500 (EST) Received: from 18.104.22.168 by fastmail.ca with HTTP; Wed, 9 Feb 2005 14:51:15 +0000 (UTC) Date: Wed, 9 Feb 2005 14:51:15 +0000 (UTC) Subject: [ADV] hello From: "Mary Saxon" <email@example.com> X-Fastmail-IP: [22.214.171.124] MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Priority: urgent Message-Id: <20050209145115.77AC6861339@mail.interchange.ca> To: undisclosed-recipients: ;
inetnum: 126.96.36.199 - 188.8.131.52 org: ORG-BL4-RIPE netname: NG-BROADBANDTECH-20000327 descr: BT Limited descr: PROVIDER Local Registry country: NG admin-c: IO243-RIPE tech-c: IO243-RIPE status: ALLOCATED PA notify: firstname.lastname@example.org mnt-by: RIPE-NCC-HM-MNT mnt-routes: BT-LIMITED-MNT mnt-lower: BT-LIMITED-MNT changed: email@example.com 20000327 changed: firstname.lastname@example.org 20001003 changed: email@example.com 20010507 changed: firstname.lastname@example.org 20010704 changed: email@example.com 20011214 changed: firstname.lastname@example.org 20020419 changed: email@example.com 20020423 changed: firstname.lastname@example.org 20020613 changed: email@example.com 20030211 changed: firstname.lastname@example.org 20040406 source: RIPE organisation: ORG-BL4-RIPE org-name: BT Limited org-type: LIR address: BT Limited address: 8B Ademola Street, address: Off Awolowo Road, address: S. W. Ikoyi, address: Lagos, Nigeria. phone: +234 1 2693192 fax-no: +234 1 2693192 e-mail: email@example.com admin-c: IO243-RIPE admin-c: IO243-RIPE mnt-ref: BT-LIMITED-MNT mnt-ref: RIPE-NCC-HM-MNT mnt-by: RIPE-NCC-HM-MNT changed: firstname.lastname@example.org 20040415 source: RIPE person: Israel Oyeleke address: BT Limited address: 8B Ademola Street address: Ikoyi S.W. address: Lagos, Nigeria phone: +234 1 2673532 fax-no: +234 1 2673203 e-mail: email@example.com nic-hdl: IO243-RIPE notify: firstname.lastname@example.org changed: email@example.com 20010605 changed: firstname.lastname@example.org 20030917 source: RIPE
From: "thankgod nelson " <email@example.com>
From: "JEFF NANA OFORI" <firstname.lastname@example.org>
Received: from [184.108.40.206] by mk-cpfrontend.uk.tiscali.com with HTTP; Wed, 13 Jul 2005 04:38:44 +0100 Date: Wed, 13 Jul 2005 04:38:44 +0100 Message-ID: <428DEEE80012AC9E@mk-cpfrontend-3.mail.uk.tiscali.com> From: email@example.com Subject: Gold Offer
inetnum: 220.127.116.11 - 18.104.22.168 netname: GILAT-SATCOM-BLOCK-31-32-40-46-53 descr: Gilat-Satcom remarks: For abuse issues related to Gilat, email firstname.lastname@example.org country: GB admin-c: GS3350-RIPE tech-c: GS3350-RIPE status: ASSIGNED PA mnt-by: AS9116-MNT mnt-lower: AS9116-MNT source: RIPE # Filtered role: Gilat Support address: Gilat Satcom address: 21D Yagia Kapaim st. Petach-Tikva, Israel phone: +972 3 9255000 fax-no: +972 3 9217938 admin-c: DR5299-RIPE admin-c: GE2074-RIPE tech-c: DR5299-RIPE tech-c: GE2074-RIPE remarks: trouble: email@example.com nic-hdl: GS3350-RIPE mnt-by: AS9116-MNT source: RIPE # Filtered abuse-mailbox: firstname.lastname@example.org % Information related to 'GS3350-RIPE' route: 22.214.171.124/18 descr: Goldenlines remarks: For addressing issues, email email@example.com remarks: For abuse issues, email firstname.lastname@example.org origin: AS9116 mnt-by: AS9116-MNT source: RIPE # Filtered
Here's a report I received about a victim from Croatia who travelled to meet the scammers in West Africa:
I DO know this guy from Split, Croatia. We even went together to university. He fell for 419 scam from Nigeria. The pressure was very high since the scammer already skinned him and his asocaiates for several thousand dollars and my friend was already in Frankfurt awaitnig for instructions how to meet the "son" of some "late" state official who knows where are millions of $$$ and he "needed to sign" the "release documents". Then he recieved phonecall from Croatia, from his associates, that they recieved an e-mail saying that this guy is afraid to cross the border of nigeria since that police is very near to find what he is trying to do and that is of outmost importance that he comes to Nigeria to sign this documents. He fell for that, went to Nigeria and it took about three weks until relatives and familly collected 20,000 $ ransom and even more for travel costs, so one of the familly went to Lagos, Nigeria and asked police to help him. Yes, they helped to deliver the ransom and kicked out of nigeria both of croatians, since, aparently, it is not a crime if nigerians take money from someone abroad.
Received: from mail-ww0-f66.google.com (mail-ww0-f66.google.com [126.96.36.199]) by indigo.pobox.com (Postfix) with ESMTP id CD3B420067A for <myemailaddress>; Mon, 22 Mar 2010 10:28:28 -0400 (EDT) Received: by wwb17 with SMTP id 17so124443wwb.5 for <myemailaddress>; Mon, 22 Mar 2010 07:26:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:date:message-id:subject :from:to:content-type; bh=EeySvWYFqcYBQW/jlESN2nIYFdltVdzNQ+CTNcOaLd8=; b=XDIIDZScJrTFIYrUtUeXANMp27CT2jY4JICOa+k86ZlV0bhnIyLH/QLWleZ0bzNAiG gIxGo4ozxPmQMp6ohT83NAdzhaDg5OPz/kXwFIGo3cnzA9ojO4OhNT5VWXMWLxRWtXFd wJxGg0ZcX/BHs54BVE335A7HMKsMJq7HEt7XM= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=HlNw+P1/IEeGv4pRgeS3e4TeljZgjrT5Awh3Wv5dc9CyCCWWdh3stRF9xkxtPIdqyU mYtedPa3yedoVV0HWOY4QfhHq2c+MTJ+6ujinHh8q0xF/SiD6LOQBvIxSUUX2OZNRu8o 3li3sg2WbZ879JBgLNhbMJDQGbk8+BVJxRf5A= MIME-Version: 1.0 Received: by 10.216.85.194 with SMTP id u44mr3248635wee.65.1269267970144; Mon, 22 Mar 2010 07:26:10 -0700 (PDT) Date: Mon, 22 Mar 2010 14:26:09 +0000 Message-ID: <email@example.com> Subject: Gold Offer From: Simon Ewing <firstname.lastname@example.org> To: email@example.com