Forward scams to - remove your name and email address first! TO CONTACT US CLICK HERE INSTEAD

Scam email #254873 - Re: Release of your Accrued Interest Payment via Certified Bank Draft.

Email info

The email was sent on 2018-10-17 17:48:32 and appeared to be from collinsobi14@gmail.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to ecobnkplc0000@gmail.com which was the scammer's actual email address.
It was probably sent from 209.85.166.196 in Unknown, United States

Email header

Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it

Header field	Description	Value
X-Apparently-To:	Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to	[email address removed] Wed, 17 Oct 2018 14:48:32 +0000
Return-Path:	The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path	[email address removed]
X-YahooFilteredBulk:	The IP here was blacklisted by Yahoo for sending spam	209.85.166.196
Received-SPF:	Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info	pass (domain of gmail.com designates 209.85.166.196 as permitted sender)
X-YMailISG:	A unique ID added by the Yahoo Inbound Spam Guard	BnqmIT8WLDuNIXD.Cl2IpPh5FflvH81CKGqCQLAsXxDeu9QI bN2Qwc4nSGt_zK1awiYji_fazNVfnt.71Dh95O_RtnXRczAdYqN0Jz.m2oln 2RDhqCkgcnYugjA.4X1b0MRL5yRXueV2k44u2F3HyhaoF54_J8t6X9EhICGd Yu8MI3EpllRKv4NclsiKbw1vI3cujBA4mQhlAWaCLMs9Jd7oGY20G4Px1z2g gQFZW5Pdrt9PxsF7OA6XLRqmbCaMbFoU9Kz8bdL0nDpI4xPf6ZV8MTBxV.VE 4DmHfmenXOKMMDjkmBdOXXCCJ8QpaQOl6P4VR4Mbn7t9uqEY3FrtHfV3PIsk UNtEZuHuAY4BS8_1sj7eBpGOjICjoX2LlaYPwo9qSpHdAq22QnQHB8Um.bx8 VIT12fWkScZlBOQy9AcJmp7hB.OySzyyjtaUJFifjS8ofg27io_K8UANDCxU updLDTptPds9PRoyviGBNxCdHNAPLa6hEUhegvEMstR7Q._6QgD1yP5__17W d7oPmEvh.Qvt6ATTxVRWcuIkSMXoKdxUU4_idIr0E62L3urxLCy5DmLSCiNl bEFKh0h3I49de9xv29bRkP1hJG_0ikP_XwH1cHGBL0y3TnoHgpDSkiiocifp uCwsh6hQzo1IWQQgbRfu6UmN5svXNRXjbk1P85kiIydy0GD75GBVwOqTXBVO YWc0fwtDWjdmoFeXBIP__7CkhUSlx.l7YkF0kDwXiNhZn4GkT7UvJZG_9VTa hCfE2NhygcI3ArHw1u_mS_PQgKfWptQGuxRHlE1H0V3GlkBGzTRYrO9EYwGG uXj9u7IVmJ82ZT3yCgew0EdPRHSzvsfOnnY1tEMnz7UQq7L56kz.j8pRWiqd _.lh.p6ZfJ9KV8iSNK4zx8ntlIqjLAYpYxvJ31_kEtbETUMlPvnNeYCNKJBU X0U4C.SxOQYqsypM19N3hpmttfpvfqwdEIYl_w9Q42sA2K1B4PnEYa72Fda5 jJBN95OaSlehlEIEe5FaFaFTmeB7iRhbW0GTWpZYSwTE.AL96N0dgGswHsd8 l7ZbOU8wJF1hjk9bIybyhyQSQM6Wxa.ne1TeAMFjnN7oQUipG9Vlb7pAyUDq jwCZycHR50V_7npGyyscAinUR8P9FMTzF9xQ3Lx_XJLuvHjkWgPioLDi7DDj 3Qgsm53cab0ELY2Kryz6.kZmQiENB0oPwJxpNJXAMSm9rPWdDyAQjy1C8w--
X-Originating-IP:	The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from	[209.85.166.196]
Authentication-Results:	Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info	mta4157.mail.ne1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=pass (ok)
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from 127.0.0.1 (EHLO mail-it1-f196.google.com) (209.85.166.196) by mta4157.mail.ne1.yahoo.com with SMTPS; Wed, 17 Oct 2018 14:48:32 +0000
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	by mail-it1-f196.google.com with SMTP id q70-v6so2611328itb.3 for [email address removed] Wed, 17 Oct 2018 07:48:31 -0700 (PDT)
DKIM-Signature:	Used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:reply-to:from:date:message-id:subject:to; bh=7okfC+aLwHhkeT5Cr6Rq6f9DZmLNRskDzaLOHwFNSDM=; b=cyM+PHOeZUYR5KjIunVXoGOdtvMJI3EhteJ3GTT54NWBdSRDKHdOeXsoHC9UkmhkyS 4ptTvuv+h8NcBCt8NJTDMWkIkB3n+gtCHT/pBGfArGiW4ue3avC5PtOtWFpUnHXpSp1f WXMtyHo7+dkmEUj4bgWDMQJj27ACMVfRPkPmdv9GLUmQ7UD+vLsw9BvhNv1gfVh4HfNm GitReK3afi8FuGsJXdLnrAiUTCLpKFVAYsRwzmuH4jK1/5jtt5ggjknVSTrIldTqjIEN /eQQ+3oFlTHqT343hawlhKCL59eDGsOxFwzAjVcXg01b1CyOOl52AFr6/TLeGwYMy5ha q7jg==
X-Google-DKIM-Signature:	Google Mail adds this to all their headers, it is used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:reply-to:from:date:message-id :subject:to; bh=7okfC+aLwHhkeT5Cr6Rq6f9DZmLNRskDzaLOHwFNSDM=; b=uOrYzXJk4+jNg1oWpv6829NHB4VGhOP1/Ci/nCoMMuMC5a9TL7Jtw82lluLgHLIC8/ f7AoJwJhvH/t/5JgPf6xpKA/Roo8Gcrvap3Qc5ma0xLhtGmF3cwXMGjcgN8bGyvjSjuh E1/6619zpo9oTFeR3q/1n21yDeTCVjTG1DyYSmT62nd3efXR8+lUcEK9ls9GTZkCTmT9 NNXJh8xhhcdGfQtGgosJC4CrnNO/xVsNE3B/aATaEgJcK4AT8rk2UwqEY/FZMNUHera5 rkEbsTKw7GnXyl5ker1HzT7q0ZHps8pc6NYqKn9gUF0mTiEZv8jMzDdFgzMnEVjWvLi6 3BNQ== X-Gm-Message-State: ABuFfoh4f7qMUjE+YRWZS4M/sEQ4Hw97QD5SnIynmBhFrgQOse42wAYz NmpTBNnVpTeEuRN4q0xMJ1W7j6lWqnvM17ecZlU= X-Google-Smtp-Source: AJdET5e0pze+wimRcgaHYQ8bbRaEQjRbgm8uD1sh35pWg55dAsNlAmgOuPNBi9DZH7tlkqGlRvzD8if89k7AAoOL0vo=
X-Received:	Just like 'Received'. Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	by 2002:a24:cb05:: with SMTP id u5-v6mr2075512itg.157.1539787711513; Wed, 17 Oct 2018 07:48:31 -0700 (PDT)
MIME-Version:	Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)	1.0
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	by 2002:a6b:b9d4:0:0:0:0:0 with HTTP; Wed, 17 Oct 2018 07:48:31 -0700 (PDT)
Reply-To:	This is the email address any reply would be sent to by default	[email address removed]
From:	This is the address the email was apparently sent from	"Dr. Michael Collins" [email address removed]
Date:	The date/time the email was sent	Wed, 17 Oct 2018 15:48:31 +0100
Message-ID:	A unique ID assigned to the ID for reference purposes	[email address removed]
Subject:	The subject of the email	Re: Release of your Accrued Interest Payment via Certified Bank Draft.
To:	The email address(es) the email was sent to	undisclosed-recipients:;
Content-Type:	What type of content the email usually is, usually text/html, and what character set is used	text/plain; charset="UTF-8"
Bcc:	Email addresses the email was secretly copied into, this field is usually blanked so even by viewing the email header you can't see who was secretly copied into the email	[email address removed]
Content-Length:	The size of the email, in bytes	1901

Your content is below the advert

The scam

--
From: Dr. Michael Collins
Director, NDIC Unit
Ecobank Nigeria Plc.
Tel:+ 234 7013576747

Attn: Sir/Madam,

Re: Release of your Accrued Interest Payment via Certified Bank Draft.

The management of Ecobank Nigeria Plc through International
Collaboration/Networking of Nigeria Deposit Insurance Corporation
(NDIC), wishes to inform you about your interest sum of US$870,000.00
that was accrued from your inheritance sum, which we have been notify
by the International Association of Deposit Insurers (IADI) of World
Bank of Switzerland to release to you.

We want to use this medium inform you that the above interest has been
approved for payment to your through International Certified Bank
Draft, and the draft has been raised in your favor and ready for
delivery to you, which you are required to provide us with your full
name and current contact address together with your direct telephone
number for the delivery of your draft to you.

Meanwhile, be informed that we shall be delivering this draft to you
through DHL Express Delivery to your house address, which you shall
lodge to any bank of your choice, and it will take only 48hrs to get
to you.

More so, you are to note that you should take care of the draft
delivery fee of US$85 is payable to the DHL Express delivery chief
cashier officer here in Nigeria, and this courier service charges
should be made either by western union money transfer or money gram.

In view of that, the above offices will not be held responsible for
your inability to respond to this official letter within 2 banking
days, because the World bank has given us a 4 working days mandate to
conclude with this transaction.

In case if you need any clarification, do not hesitate to ask, we are
always there to meet your needs.

On behalf of
Ecobank Nigeria Plc

Dr.Michael Collins
Director, NDIC Unit
Ecobank Nigeria Plc
Call my direct number +234 7013576747

SpamAssassin Report (spam score: 9.9)

 pts rule                       description                                       
---- ----------------------     --------------------------------------------------
 0.0 TVD_RCVD_IP                Message was received from an IP address           
 0.0 TVD_RCVD_IP4               Message was received from an IPv4 address         
 0.0 DKIM_ADSP_CUSTOM_MED       No valid author signature, adsp_override is       
                                CUSTOM_MED                                        
-0.0 SPF_PASS                   SPF: sender matches SPF record                    
 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit     
                                (collinsobi14[at]gmail.com)                       
 0.0 FREEMAIL_FROM              Sender email is commonly abused enduser mail      
                                provider (collinsobi14[at]gmail.com)              
 0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit          
                                (ecobnkplc0000[at]gmail.com)                      
-0.0 RCVD_IN_MSPIKE_H2          RBL: Average reputation (+2) [209.85.166.196      
                                listed in wl.mailspike.net]                       
-0.0 RCVD_IN_DNSWL_NONE         RBL: Sender listed at http://www.dnswl.org/, no   
                                trust [209.85.166.196 listed in list.dnswl.org]   
 0.1 DKIM_SIGNED                Message has a DKIM or DK signature, not           
                                necessarily valid                                 
 1.5 YOU_INHERIT                Discussing your inheritance                       
 0.1 DKIM_INVALID               DKIM or DK signature exists, but is not valid     
 0.0 T_HK_NAME_FM_DR            No description available.                         
 0.0 LOTS_OF_MONEY              Huge... sums of money                             
 1.0 FREEMAIL_REPLYTO           Reply-To/From or Reply-To/body contain different  
                                freemails                                         
 1.2 NML_ADSP_CUSTOM_MED        ADSP custom_med hit, and not from a mailing list  
 0.0 T_FILL_THIS_FORM_SHORT     Fill in a short form with personal information    
 2.0 MONEY_FORM_SHORT           Lots of money if you fill out a short form        
 3.5 ADVANCE_FEE_5_NEW_MONEY    Advance Fee fraud and lots of money               
 0.0 FORM_FRAUD_5               Fill a form and many fraud phrases

Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)