Anatomy of a 419 Scam

A few weeks ago, I received the following scammy e-mail:

Received: from real.edu.ee ([195.250.188.110] [195.250.188.110])
Received: from localhost (unknown [127.0.0.1]) by real.edu.ee (Postfix)
Received: from real.edu.ee ([127.0.0.1]) by localhost (server [127.0.0.1])
Received: by real.edu.ee (Postfix, from userid 30)
Reply-to: peg.morrison@yahoo.dk
From: Peggy Morrison <peg.morrison@yahoo.dk>
Subject: Hello
Sender: wwwrun@real.edu.ee
To: alecm

From: Lady Peggy Morrison,
4 Old Church Street,
Chelsea, SW3, England.

Here writes Lady Peggy Morrison, suffering from cancerous ailment. I am married to Engineer Richard Morrison an Englishman who is dead. He was into private practice all his life before his death. Before his death, he deposited the sum of 20Million ( 20Mil lion Great Britain Pounds Sterling) which was derived from his vast estates and investment in capital market with his bank here in UK. I have decided to donate this fund to you and want you to use this gift which comes from my husbands effort to fund the u pkeep of widows, widowers, rphans, destitute etc. Awaits your reply.

Lady Peggy Morrison.
peg.morrison@yahoo.dk
4 Old Church Street,
Chelsea, SW3, England.

…I just love the grammar of these things (Here writes Lady Peggy Morrison, suffering from cancerous ailment, vast estates, etc) reflecting perhaps a post-colonial grammar combined with poor education, nor the badly forged headers (from Denmark via Estonia?) but the thing which caught my eye about this was the address. A 419-scam in Chelsea, dahling?

That an address was given at all was unusual, and that it cited a truncated postcode (“SW3”) to lend credibility was even more amusing — in case you don’t know, British zip/postcodes are in two parts of the form “SW3 1XX” or similar, the first part designating a large region, the latter part narrows the area to within a few houses, perhaps only a dozen. To cite a partial postcode in your own address is sloppy, ignorant or poseurish, depending on your intent.

I was due to have dinner with a friend who lives in that area, that very evening. A quick GoogleMap showed the address to be 200m from the restaurant we were dining, so after a lovely dinner at Cheyne Walk Brasserie (try the salmon tartare) – we wandered over to take a look.

Intrepid Co-investigator

intrepid co-investigator

I’d forgotten the exact address by the time we got to Old Church Street, but as soon as we saw the house I knew we’d found it…

The Address

the address

…a house out of action, under renovationwhere letters can be delivered and stockpiled by builders, perhaps innocently or perhaps in association with the scammers who will pick up the mail once a week in exchange for a small stipend, perhaps.

The Door Doorbell Extremely Out of Action

the doorway (detail)

Curiously (amusingly?) there is a security camera:-

Security Camera

camera?

…but given the state of the interior I strongly doubt that it is working and/or would be able to record anything.

Renovation Renovation

interior undecor

So that’s how it works, folks – a classic Dead Drop with amateur funding and intent to rip-off the ignorant, trusting masses. I’d speculated upon turning up with fake creds, pretending to be a tax inspector insisting Lady Peggy must submit to a tax assessment for death duties, but alas…

Oh – and walking further up the street, we worked out the reason for the truncated postcode:

Hmmm...

They couldn’t even be bothered to use the postcode finder.

Not merely scammers, but lazy gits, too.

15 Replies to “Anatomy of a 419 Scam”

  1. re: Anatomy of a 419 Scam

    hello, i have been contacted by this lady peggy.

    I can not believe how people can be so nasty, i have a real poorly son and when she give me the contact of her lawyer he sounded so real.

    I would like to say that people like that should be in jail

  2. re: Anatomy of a 419 Scam

    I’m a webmaster for two websites and i’m in charge of creating the email accounts, which is why i am amazed at the quantity of emails i receive from those scammers every day!!!

    It’s either a lottery, money lenders, some old geezer wanting to give me all his money or some (really) late president/official/government authority wanting help in laundering their money. Needless to say i am still keeping my day job….

  3. re: Anatomy of a 419 Scam

    Just Receive a letter similar to this one and the name of the sender is lady Rita Mosley,I do think the same person is responsible for this scam.

  4. re: Anatomy of a 419 Scam

    Awesome…. !

    Nice work mate…. Every word of your post was echoing my feelings 🙂

  5. re: Anatomy of a 419 Scam

    HI, I have just received a copy of this scam she has changed her name to Lady Catherine Levett. !! I am so fed up with reading these letter! Especially the ones that ask you for all your details.

    I hope they people doing this rot in hell as they are so fond of mentioning god!

    Don’t fall for this scam.

  6. re: Anatomy of a 419 Scam

    I HAVE BEEN CONTACTED THE LADY SAID SHE WAS RITA MOSLEY HOW DID SHE GET MY EMAIL ADDRESS

  7. re: Anatomy of a 419 Scam

    a stupid lady tryin to make fun of dem people. she shud grow up an behave her age!

  8. re: Anatomy of a 419 Scam

    I am so tired of getting this scam email, every time i open my mail i get the same thing and same person i keep writing them back to tell them not to send me no more but they keep on doing it.

  9. re: Anatomy of a 419 Scam

    hilarious. I just got that scam letter too and googled it because the name lady peggy morrison was just too irresistable. That is hilarious that you guys cased the joint. good work.

  10. I just received my second letter from Madam Catherine Davis. It’s all the same. Surely people really don’t fall for this s#@t!

  11. I just got this email a little changed words but the name is Madam Mary JohnPaul!. This is absolutely rediculous and childish. Why speak of the Lord and lie through the whole message and as well speak of yourself have a deadly disease.

Leave a Reply to cindy jonas Cancel reply

Your email address will not be published. Required fields are marked *