Forward scams to - remove your name and email address first! TO CONTACT US CLICK HERE INSTEAD

Scam email #255121 - United Kingdom Chancellor of the Exchequer/Your Funds Payment.

Email info

The email was sent on 2018-11-06 21:46:38 and appeared to be from osbornegeorge95@gmail.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to osbornegeorge95@gmail.com which was the scammer's actual email address.
It was probably sent from 209.85.221.169 in Unknown, United States

Email header

Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it

Header field	Description	Value
X-Apparently-To:	Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to	[email address removed] Tue, 06 Nov 2018 18:46:38 +0000
Return-Path:	The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path	[email address removed]
X-YahooFilteredBulk:	The IP here was blacklisted by Yahoo for sending spam	209.85.221.169
Received-SPF:	Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info	pass (domain of gmail.com designates 209.85.221.169 as permitted sender)
X-YMailISG:	A unique ID added by the Yahoo Inbound Spam Guard	F0HIackWLDt7LJBAdFpgKMiRAosqnyey.VOh47TYngKnnox6 75ssSplggYw8_ny4_1GaIZ_fK80uV9KvlrBbnpiPZOZ1gll_AT0c1rMm_KDM 4kfi5MY4iKFmVB6XJG3J3nsw.Zv2.8.9_g6CNc4DlgzbYjs6nwOlMOxCucEy FWXfsM5V_8Qe_NcY7hUzggq7CsD2ccVSE3J_bwokOzsu.iWanWTWQsURpSFU iCWQCW2ZXGAyfSMJoOxPKmKTLtfPe66TFbG6aSSE1tssuuDa70U5T4VAHMEh 7n0KDwHN8tWD0dibjQTpmJBvWxp3GU4aqebAevod_6z6LABdHVTk_C5I_09u c1GvE.oSDEOtOzcoGNUB6I_xhC71dBO_mpPW6Mhl4u2rU.Llmr5alehCVGug 4tYcZNh4RkcCTq2TwcRnc2zV6DC4S1SCbt_gpxXfbjjNvC3tlGy9TX4Guauz wVGYp2zMkrYEHoJTLubikKhztC3k.aZX3KSgKWX4pt9dTa8K38yCAct1.FrZ E1pwu.3igadEAz5EnAXvRybAcJY3tyLMC8qqxk0iLaaWSXlKWpt14q62LGFf QYhyjCMVfnNDU6l5rBOw9ci65BaRsOpimqNZSlEnQg4HRLcw3YcpsKnGjQyZ FNuTRyKBWKBbvQLKJVIvAXgEM..LOx98aV.Eeu35gHEyGUiq6ja1w1iSN8ed lGj6L_92gMbxyVWrRQc0_vgD5.gtH90AE7p47jix.QChfEEoDgo1YoS7sUm. .vzrcUlsJzS7DhwF9wi7wSUk4his8GlZcKY6PK14vkuiWWWRvHKsMSH6AikW DvR3ClMFtagac4Kw_Q3Xnwa6y4lCE1HBI85plZvwejDZ9KPQK3uWYfuysb_O cYDMx.gXSv5Hnt.GbFrtYZrxrPSnFn7tLMos9E_1PLd9x_CndHRpFdcANHMg NPr1t36sIdU4hnfsTt7qvN4ahLe0xcPlIGy7gqXeY8o.xtNSrFKkXvjuw9oF 2ucxcWpkDNg2TBHDEz1e4xQxuHT5m.EY6tGMQof5oWbKsiOnQkk56GCmTC.Q QyAGnMd6ElswFsUp_W_CxTzwgxuvloAJ5gYrqo1NOSzPcld6BnglVGaFcroT 0oOMScE9Hnk7__8gNx1HehKQIknfB7euOsHn5qyVAisJRs_6VDPQL_oKEFJ2 y4y8dxWAI7nCzeu.DOScW9.jHQYQvn8.0egRqGb4KaUzbJFMzPIV
X-Originating-IP:	The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from	[209.85.221.169]
Authentication-Results:	Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info	mta4384.mail.gq1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=pass (ok)
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from 127.0.0.1 (EHLO mail-vk1-f169.google.com) (209.85.221.169) by mta4384.mail.gq1.yahoo.com with SMTPS; Tue, 06 Nov 2018 18:46:37 +0000
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	by mail-vk1-f169.google.com with SMTP id t127so3119422vke.8 for [email address removed] Tue, 06 Nov 2018 10:46:37 -0800 (PST)
DKIM-Signature:	Used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=MraQQnL/BhOK/T8XqKqb8XV8Hk1CN9diTy0UZ5kI2n4=; b=ZfqIQecmKC7LOCi9/w95wvyAgwLKMWrva5Di+E63LGgiqOtnAVX5odjHiHMD+rIOJt XMNlwYPbu0Ytc+Pl4oLf9lwewBbHmwrZ8/l2NK1lJm7pzUf0As7ye0UTN83qI97t+o8Y svU+oSAWf6XKc5mKY+W0TjuTnaZBmOIYzHYxYK68hPRF2LRgauyTQphA+F1eQOAq1T75 M+oUCV3PRPJgcDcW2vmAPiurPiD9NHLPW7jc9MLLEBDrAYFl1HXu45kNLPOYnfTWWFJM gd01gNl6iNdZ0ief7NgBGtx/+iv1BkztGOy4mO+MvIhjo+HiIuipXL3jaB5uIPouMiQ5 IVcQ==
X-Google-DKIM-Signature:	Google Mail adds this to all their headers, it is used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=MraQQnL/BhOK/T8XqKqb8XV8Hk1CN9diTy0UZ5kI2n4=; b=mHdxeQ0IZvJ0nKjFFaZH8jZenBekO2jAv/dpMSdrpBKmWYY07t5p6XlJtShgpMqQTg WLtzfDi8E1z1xReb+OmoDoECW2yXIw3tHqFd2I+phaIO8nQa4c7eqle4sDFYTYES09As DZadCafcgF+0LX1EFcmHQ1aE9rjvJcwYlCVW0wQYJ226DTAVcgB4ABEm7qvD/2CR9nGz OXuM0P2M5vOpIAw8qptv/jQULK/865ZxCWLSxh7feC6A/X/gfRcequAnIcGRKuRuQ8rQ tPuAHJU8bfeLwFufHHs+XgAqv1RyMsErVNwiE25kw8RTyCBnmEXnKxNr9dlELlu2aML6 V6lw== X-Gm-Message-State: AGRZ1gIgEn1pEKvGZnzBanHqG3/OABrBYM0ZIfqa1JQRjkupRjhFH23X qKZpH1DU0bDb7Dux/b6rSNkUtIFfucDzG/6ldF8= X-Google-Smtp-Source: AJdET5ftp4VKNIYIkoKlLBDpMUgkIyrTI76EHGVzQzGZNcWtZBOgf+jCCfsRl2m6HdXOzWTt+4Pvsb8/SSzWhxoS4RQ=
X-Received:	Just like 'Received'. Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	by 2002:a1f:c111:: with SMTP id r17mr7086078vkf.35.1541529996975; Tue, 06 Nov 2018 10:46:36 -0800 (PST)
MIME-Version:	Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)	1.0
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	by 2002:a67:8584:0:0:0:0:0 with HTTP; Tue, 6 Nov 2018 10:46:36 -0800 (PST)
From:	This is the address the email was apparently sent from	george osborne [email address removed]
Date:	The date/time the email was sent	Tue, 6 Nov 2018 18:46:36 +0000
Message-ID:	A unique ID assigned to the ID for reference purposes	[email address removed]
Subject:	The subject of the email	United Kingdom Chancellor of the Exchequer/Your Funds Payment.
To:	The email address(es) the email was sent to	undisclosed-recipients:;
Content-Type:	What type of content the email usually is, usually text/html, and what character set is used	text/plain; charset="UTF-8"
Bcc:	Email addresses the email was secretly copied into, this field is usually blanked so even by viewing the email header you can't see who was secretly copied into the email	[email address removed]
Content-Length:	The size of the email, in bytes	1254

Your content is below the advert

The scam

United Kingdom
Chancellor of the Exchequer
Department Member Of The Privy Council
House of Commons, London, SW1A 0AA
Fax: +44-20 7219 8214
Email:george.osborne.mmp@parliament.uk
http://www.georgeosborne.co.uk

Dear Sir,

Sequel to the subsequent meeting with the authority of world bank on
Debt Matters, you are among the Contractors that will receive their
overdue contract funds payment through oil reserve account in Hong
Leong Bank Malaysia.

You are advice to send your contract details below for us to
facilitate the transfer process and also for us to send you the
contact of the paying bank Hong Leong Bank Malaysia.

1.YOUR BANK NAMES AND ADDRESS.-----------------------------------------
2.YOUR BANK SWIFT CODE AND ROUTING CODE.-------------------------------
3.YOUR BANK ACCOUNT NUMBER.--------------------------------------------
4.YOUR INTERNATIONAL AND WORKING ID CARD.------------------------------
5.YOUR PRIVATE CELL PHONE NUMBER.

Finally as soon as you send the required information's above the
contact of the bank where your funds will be paid will be given to you
to contact them for easy communication for the release of your funds
payment.

Waiting for your urgent respond.

Thanks,

Rt Hon George Osborne MP.
Parliamentary Department.

SpamAssassin Report (spam score: 3.4)

 pts rule                         description                                       
---- ----------------------       --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE           RBL: Sender listed at http://www.dnswl.org/, no   
                                  trust [209.85.221.169 listed in list.dnswl.org]   
 0.0 TVD_RCVD_IP                  Message was received from an IP address           
 0.0 TVD_RCVD_IP4                 Message was received from an IPv4 address         
 0.0 DKIM_ADSP_CUSTOM_MED         No valid author signature, adsp_override is       
                                  CUSTOM_MED                                        
-0.0 SPF_PASS                     SPF: sender matches SPF record                    
 0.0 FREEMAIL_FROM                Sender email is commonly abused enduser mail      
                                  provider (osbornegeorge95[at]gmail.com)           
 0.2 FREEMAIL_ENVFROM_END_DIGIT   Envelope-from freemail username ends in digit     
                                  (osbornegeorge95[at]gmail.com)                    
 1.7 DEAR_SOMETHING               BODY: Contains 'Dear (something)'                 
 0.1 DKIM_SIGNED                  Message has a DKIM or DK signature, not           
                                  necessarily valid                                 
 0.0 URIBL_BLOCKED                ADMINISTRATOR NOTICE: The query to URIBL was      
                                  blocked. See                                      
                                  http://wiki.apache.org/spamassassin/DnsBlocklists…
                                  #dnsbl-block for more information. [URIs:         
                                  georgeosborne.co.uk]                              
 0.1 DKIM_INVALID                 DKIM or DK signature exists, but is not valid     
 1.2 NML_ADSP_CUSTOM_MED          ADSP custom_med hit, and not from a mailing list  
 0.0 T_FILL_THIS_FORM_SHORT       Fill in a short form with personal information    
 0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)