Forward scams to - remove your name and email address first! TO CONTACT US CLICK HERE INSTEAD

Scam email #254861 - YOUR PAYMENT VIA HSBC-VISA ATM DEBIT CARD.

Email info

The email was sent on 2018-10-16 09:05:53 and appeared to be from revmarkwilliams190@yahoo.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to revmarkwilliams22@yahoo.com which was the scammer's actual email address.
It was probably sent from 66.163.185.146 in Unknown, Nigeria

Email header

Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it

Header field	Description	Value
X-Apparently-To:	Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to	[email address removed] Tue, 16 Oct 2018 06:05:53 +0000
Return-Path:	The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path	[email address removed]
X-YahooFilteredBulk:	The IP here was blacklisted by Yahoo for sending spam	66.163.185.146
Received-SPF:	Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info	pass (domain of yahoo.com designates 66.163.185.146 as permitted sender)
X-YMailISG:	A unique ID added by the Yahoo Inbound Spam Guard	edqrs.4WLDvErb.tKuCBdzQhFvzVKTpsYfrSalu9czKDwNad .3NTrcGb4jnSouhoiBAw4vc.UVxS6et5TncOtmwup3B0tr35nOPArwm5iIA. F.lTO.czXcj4hLb52uePyj2tlRUfQhqw2YYPn16o0WYnMRazUWjMLcKAO6Go TDHYrWHykrFOJZQHSBVF6xMxj.gE4kCrgm_cL4HtD68TlSorWVjtXMPtV3hv K08xEaAnjoYD5i61xCUzdzMu9Qre7wc._6UUj0w3j2dFNjAClwxNLy7sP8kC ircuxlcsE1w8mZGA3Uu7LqQ5H.TsMrgKE0yECEqgWg_.2jW9bLxht5MAoZDW AjmO2OEMoR82dT4uypc4X.i3Nf1uT1npnsRL5v2POZC_4LKJjL77X7AOp0HG yt7u_xbAzxxfSLxbljr_B4tGuvsf05AUNSesdXUFjHWnD2BGtFLpMYatTkC7 Ps6_1YbFuy.kvPSJeos0TRlz3s2xb6bvZpJGBTYhysX00F.8QT3k9IcJsZr3 mci2iO2q_Y8rxjGRmFo9fC_y1VY28OlHhbOG8Eg0ERYbJsXcBREoefDXRwaW ZjWG2u7rrH7fNM2zXC.YcUqHaS9huL5sbgD7jJw34SPS04jwD2vQyLR64xTK zwEgbNBeETZt3jeGP8I9KNKJx.ubpTms7pe2dL.ZrO_2P6eoGyzE7dCGQrvQ niFRa7DdVI1RMaTkzGg8mbwh15fyfBzhPKv5ZiJeRN.b.fQrDkjC.H7izsEE SU14gT2tE6awQdtK_MuZLwEOmXN58hTcvf17jTnyZ5ElRJsoRvTUZ0kX99.L 9J8MVUWUEIDOEDzGDC_dzTjnWLAdMTVbo__PbiV7rJp_nwJBgwwCwT3Nnx25 Bn1LRrrLyN2vhrRerTPXg7z.rbsdfiO55B_zX3Ocb5SgKd9Owva2EJ.RZiuy n05vAZ41PDTR.pIpyRmMm0_znCL7KERgxnTwt.eWSb4CJBon3iPhMwUWBiIK ZmPbaVypViDbHK61kwH9D50td8XdwGm_4On5_wmr_nmts4LQKjbblqD1fnqF 3GCxbuJC2z0rM20z_i3UoXykFu526a3qkAm09e13cc2JB.7xZpF0q4JjZfGk HSUcvTkoE2Rgz_6d6vbpGaVK951PDAASbW0W3U1POiwN6NC26H0yZVuK5XwL K8j_5.04V4kfCRe2u4aPBvs.Y98OCbm_HFwQtKivI.3jNb0PkVNh.L0Q0.Ex RczvxbeJrDO7Yf5p
X-Originating-IP:	The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from	[66.163.185.146]
Authentication-Results:	Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info	mta4339.mail.gq1.yahoo.com from=yahoo.com; domainkeys=neutral (no sig); from=yahoo.com; dkim=pass (ok)
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from 127.0.0.1 (EHLO sonic305-20.consmr.mail.ne1.yahoo.com) (66.163.185.146) by mta4339.mail.gq1.yahoo.com with SMTPS; Tue, 16 Oct 2018 06:05:53 +0000
DKIM-Signature:	Used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1539669952; bh=3CJXP1PJkEoL5Wmfdj5F95BMWJezusxlcDxrAgCFQWY=; h=Date:From:Reply-To:Subject:References:From:Subject; b=CIpm9w1WNqF2SXdTIiiOzkrgtlDATh4AVNH1cJH56DSr9jsn5eqlV3f6ZpfI4T77dgkSwo1vCB7bFwLoWEzMT4QC33b+34BLorOTBfmscA8nHxKVod+cuFW5oOftUUpPWzZImAjGEvq5GiPQ5Rk07B01HpPJEjAKhwZdCwJdK62QDWuyHT5Ie/V63dUAlc1C5S575/q9ngHlXCFg3QN43APoEwavaQecefgiHKb1Be8RGRSaExJ+07Deukp3CYwMoPpZ1qR5EeifXehzg32t4gagLVFcMqx8D1g+/3Fjuwng8Zdu0jFG3AGPyndy0nsezfb7lKKeQm8c/BnrPk0cug==
X-YMail-OSG:	A unique ID added by the Yahoo Outbound Spam Guard	3BCdcUUVM1nunEpd0nTkWKxGtbgIRC7loqVB1Fq732BEZcsD4gTtebm3XcS4.hQ djUAaA.2gQzR1QnGdGZ3BiOSTakA8SCqr5N3nko90NacCmjgZ_cgmbdkicNTyXU6EuvDlfCzQ6e7 s2j3T8R1kMLyA2u09L_0B7Up1jt.qrVcmgiozg8.sUfXWFwPLZ9UfuMaHsEhgWOtXAC5DPiItBer EbXBC24uFSrP5rzhnkpuXKFM.7yyR2R2zdD5owfjAsAhWnLEwLG.VpvxYtLA05Gtq59hqFBV3Dls DdbChfA6tAZUcUcMg9Jy28WaYk8.HKnJJp87RXhWm47jwVf9P09zK01Sm54mUt8mbPDQS2vFWLdR FN43baVszJHar7_y0kT0ifbCFPtuM3btkM6E0D6NaILb84CQkeDgsxmOLwwt.rwCmESCt1v4v0.J 1LNsUCR3xa_MvsjEPEMooIjyEqFIL80tICBTZXrvcfi60Xtv1sbbF7B4QLhsatMJ6Nt7ikNlZqwz QerXVDhwBRrZrUMpHjnkCFZsmonFTyITTj21BD8M0mN1Gwz0DTFy4Frxg.elvzP14GVzXdIZSIWh 4xv069Z9X52u1kpWejx1UMT5qcO7bDXn1Dju80pXVEUHrv_pno5PbS9uGUPnx57BL.1Lb3jihUOm X3_Zcppc.tO2pJr8T.T9nY37yFj5St.VDlZ._Vx.aF2fkDXyNNF4mJTCXgHnMZz3DMvMzjHBKHTg I5HlzFHeqUwPlzgJjw3y092tIdF.M4o1cqh7IbpeOFC7M_uwS8vpXW_cyH7D6rt08m2nuhatOUzg gFcX3VDvHXioxn9QWCkR3ErkQs1P1ZCKLZHzz.r4MNbtwZJnmmr9U_WVfxI2aVGUwYXfuYu3ZSM3 PTmmfyxMC1YTJ5qax2EGdOqzjWsu8gAJpZEFseptl_pUzT97vhSSp3am2sVAxfmMMnFukAjqocG9 Ln_j58MZXeWwWg1xgWhs7q1hZQXftxZtHnjdULeSBxu008SmJjHSkXB42MYdHno6ej5cpPbrxlF_ QKACghufoIE4Hh_j3KvqWAXn73U9PlWHeKVbiUqF_bA1WPJTTea.Y9.kyEqY-
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from sonic.gate.mail.ne1.yahoo.com by sonic305.consmr.mail.ne1.yahoo.com with HTTP; Tue, 16 Oct 2018 06:05:52 +0000
Date:	The date/time the email was sent	Tue, 16 Oct 2018 06:05:50 +0000 (UTC)
From:	This is the address the email was apparently sent from	Rev Mark Williams [email address removed]
Reply-To:	This is the email address any reply would be sent to by default	Rev Mark Williams [email address removed]
Message-ID:	A unique ID assigned to the ID for reference purposes	[email address removed]
Subject:	The subject of the email	YOUR PAYMENT VIA HSBC-VISA ATM DEBIT CARD.
MIME-Version:	Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)	1.0
Content-Type:	What type of content the email usually is, usually text/html, and what character set is used	text/plain; charset=UTF-8
Content-Transfer-Encoding:	How the email has been encoded to comply with regulations (e.g. maximum characters per line)	7bit
References:	Facilitates the threading of emails; helps the email client piece together which emails belong together in a conversation	[email address removed]
X-Mailer:	The software used to send the email. Spambots, including those used by scammers, often falsify this as a version of Outlook or Outlook Express to get through some spam filters	WebService/1.1.12512 YahooMailBasic Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Content-Length:	The size of the email, in bytes	1972

Your content is below the advert

The scam

FEDERAL REPUBLIC OF NIGERIA
REMITANCE ON ATM PAYMENT
(RESOLUTION PANEL ON PAYMENT)PLOT 8/23 WUSE GARKIABUJA-NIGERIA

CENTRAL BANK OF NIGERIA
DR.Chima Aloy
Director, Foreign Operations
ATM Card Department
Central Bank of Nigeria
Email: reply to(revmarkwilliams22@yahoo.com)

Attn: Beneficiary

YOUR PAYMENT VIA HSBC-VISA ATM DEBIT CARD.
Account normalization of your banking details has been delayed by
International Monetary Fund (IMF) and Financial Services Authority
(UK). This has made it necessary for your contract/inheritant payment
to be programmed into HSBC Visa Atm Debit Card. The total fund in
question is $8,300,000.00 This is the first part of the Payment of
which the
balance will subsequently be paid into same account.

The Central Bank of Nigeria, (CBN), working in relationship
with
HSBCLondon/Bank of America has concluded to issue you a VISACARD with
which you can access your contract amount$8,300,000.000 This card
center will send you an ATM card which you will use to withdraw your
money in any ATM machine in any part of the world, but the maximum is
Twenty Thousand United States Dollars($20,000.00) per day. So if you
like to receive your fund in this way,

please let us know by contacting the ATM payment department and also
send the following information as listed below:

1. Full name
2. Phone and fax number
3. Address were you want them to send the ATM card to (p.o box not
acceptable)
4. Your age and current occupation

However for the purpose of proper verification of your Identity, among
other relevant information are release of your HSBC Visa Atm Card to
you, it is important you contact the office of the Director, Debit
Card Dept for a special payment at the below listed address or
directly reply to this
Email.

kindly find below the contact person:
Rev Mark Williams
Director, ATM payment department
Cell: +234 816 154 0752
Email: reply to(revmarkwilliams22@yahoo.com)

Regards,
Good day!!
DR.Chima Aloy
DIRECTOR,DEBIT CARD

SpamAssassin Report (spam score: 9.9)

 pts rule                       description                                       
---- ----------------------     --------------------------------------------------
-1.9 BAYES_00                   BODY: Bayes spam probability is 0 to 1% [score:   
                                0.0001]                                           
 0.0 TVD_RCVD_IP                Message was received from an IP address           
 0.0 TVD_RCVD_IP4               Message was received from an IPv4 address         
 1.5 SUBJ_ALL_CAPS              Subject is all capitals                           
 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit     
                                (revmarkwilliams190[at]yahoo.com)                 
-0.0 SPF_PASS                   SPF: sender matches SPF record                    
 0.0 DKIM_ADSP_CUSTOM_MED       No valid author signature, adsp_override is       
                                CUSTOM_MED                                        
 0.0 FREEMAIL_FROM              Sender email is commonly abused enduser mail      
                                provider (revmarkwilliams190[at]yahoo.com)        
 0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit          
                                (revmarkwilliams22[at]yahoo.com)                  
 1.0 MISSING_HEADERS            Missing To: header                                
 1.6 FORGED_YAHOO_RCVD          'From' yahoo.com does not match 'Received' headers
 0.0 T_DEAR_BENEFICIARY         BODY: Dear Beneficiary:                           
 0.1 DKIM_SIGNED                Message has a DKIM or DK signature, not           
                                necessarily valid                                 
-0.0 RCVD_IN_DNSWL_NONE         RBL: Sender listed at http://www.dnswl.org/, no   
                                trust [66.163.185.146 listed in list.dnswl.org]   
 0.0 LOTS_OF_MONEY              Huge... sums of money                             
 0.1 DKIM_INVALID               DKIM or DK signature exists, but is not valid     
 1.6 REPLYTO_WITHOUT_TO_CC      No description available.                         
 1.0 FREEMAIL_REPLYTO           Reply-To/From or Reply-To/body contain different  
                                freemails                                         
 0.9 NML_ADSP_CUSTOM_MED        ADSP custom_med hit, and not from a mailing list  
 0.0 MONEY_FRAUD_8              Lots of money and very many fraud phrases         
 3.5 ADVANCE_FEE_5_NEW_MONEY    Advance Fee fraud and lots of money

Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)