Forward scams to - remove your name and email address first! TO CONTACT US CLICK HERE INSTEAD

Scam email #255145 - Re: Release of your Accrued Interest Payment via Certified Bank Draft.

Email info

The email was sent on 2018-11-08 19:15:02 and appeared to be from jamesohagtb@gmail.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to ecobnkplc00000@net-c.com which was the scammer's actual email address.
It was probably sent from 209.85.219.193 in Unknown, United States

Email header

Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it

Header field	Description	Value
X-Apparently-To:	Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to	[email address removed] Thu, 08 Nov 2018 16:15:01 +0000
Return-Path:	The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path	[email address removed]
X-YahooFilteredBulk:	The IP here was blacklisted by Yahoo for sending spam	209.85.219.193
Received-SPF:	Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info	pass (domain of gmail.com designates 209.85.219.193 as permitted sender)
X-YMailISG:	A unique ID added by the Yahoo Inbound Spam Guard	NlZkhksWLDuaTKDEWyKBtjJthsz2r4R0cfR8xvjPANdh297f TSmskjlW8rvVoKHQcjEJMcTZaKD_xpb4WpYqVfahP0Puihh5w2u03Wjig_yY wfnUduywrmQUo.m0JsQMBOZj4yBVVVPs6BiT._MdJ2VYBQXVq0R75DsCkd_C jWR05hmduQb3KDgOeqEhmhc3AiRnO2iwHOgS_UQJsQyT9kOJwqyMQNCvgJJo IyoC3Qt0g81lADx9Vkq56ORnbmVDEfq4ski4XRmXqZ4Lqz1FONHv0M_9oMIm geic2UktOQqgypzDAfgWQK_zbZb6EbMS8INaYMHN5nKS8qkZy4EfB6VtcHas zD9zNdBkRJRyLUZ.GOTD99FUsG.x8Wn.X3bAawEuBqtAoBm.wXOrIarCpG5r ePoDpS5rck4NIXHvKYih7pC.C0ltYql19WiFwkJULQ42EuH_0ZXqXuJO0vS. 8ww4t_Ue4.X.ljljbdqCUuGVVXjJ4aoe7m_MtAdUexNGklkKwHn99.AtnxqN 8sYWrezwF5futUFcInEfcQS7cSBlyWBvf6ElJLI7RRid14A73sudcKn1sOxg MLW.JPS1JVCP9QV0hX9MsG21QWvy8yfMnMI0CQ_Ht7xCQ_xmbn3.tuNsV2Yc scpLTtJvHwEnPDDqxv9oKpfE6IDfCC3cJaP3JHePIh0eXBbkZyWVt8o0tYoH r6wnfFeKJOLKEOdcRDfL3JPkfvqhlA.2YevDD6Kzy.X.I07UcVNqq4ndFZlT GTTJhNOlDgQvajLeUknUyjXwpFJp7loBhmXd3YdCa5qRiLu8oMTiPv.RXB9V McsGLLu8jEev3Mns34bUKJsyYxu50Hda8We1krqlYXKDAx8WGT_fWRonEIJe VkUxkTu.H4BJQU8mfuO5zc9vzxdyNl1UiiIDhP7ONjzfrHPN6RzadSs8DPko LWQVdb7jnnIMGUlwtZh_Fh2F5Prd6S4bOeVEMjxxg7WuysJApoWkAFVl.bKH 3onbVkgJ5oKHPYmfrGF68yJDrmqEtvD_BsMENq18KZyK41piQbsgqKhowp0j 205_BdDyIY5.BpTVGJSD4U.fGnkf2IKZfVzDyOQeZXVuWoq2LRl1_rEDfNhu zQFp4B_Tw3HPeLvvYepV5GBsq3aiip4C.bpTSKvKFPp3Xvl2Q1hB9I2c64bj EYApXLE5SmHJgeI0wJU8rlv0P4rKxM8GPlQyJ11kZp85le4.OyELtBrJTdkN uQ--
X-Originating-IP:	The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from	[209.85.219.193]
Authentication-Results:	Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info	mta4482.mail.bf1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=pass (ok)
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from 127.0.0.1 (EHLO mail-yb1-f193.google.com) (209.85.219.193) by mta4482.mail.bf1.yahoo.com with SMTPS; Thu, 08 Nov 2018 16:15:01 +0000
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	by mail-yb1-f193.google.com with SMTP id g9-v6so8537779ybh.7 for [email address removed] Thu, 08 Nov 2018 08:15:01 -0800 (PST)
DKIM-Signature:	Used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:reply-to:from:date:message-id:subject:to; bh=7okfC+aLwHhkeT5Cr6Rq6f9DZmLNRskDzaLOHwFNSDM=; b=BqrUDhJGlldlkhoDokEnFpduJnK5q0vUxYZ+Stx4RhDIS7xdZNvHJLfK8JqwLv5QLh MZCePS2ZRLweyu7XfH7itQopRQCQFYyFcTp2x3Ow6XiU7ECs7gf5BTa/TJe3KvOXcapu bf9UnwCMHbjQvJr2NAOkhEGz2rawE3YodOn0gLXTacMaudmA7cENPWGSA1e44FJwuU2L 0y8UotcdngoSP5Fi8QmWtqHzadJZ6z+uJ9tgmZMQ6PSj6Sr/kPt0sj3/LGhzdSgq1eze 1ZyX/UDwEajrE5fUWHFlaVeq557G5swYYROL6vtfv9EOxeQEBBe/+Md7a3T7rZG5ptZi rtQg==
X-Google-DKIM-Signature:	Google Mail adds this to all their headers, it is used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:reply-to:from:date:message-id :subject:to; bh=7okfC+aLwHhkeT5Cr6Rq6f9DZmLNRskDzaLOHwFNSDM=; b=GhaW4qoVL9G9zCdyjIBzyXH55wyGGMAZ4YW+/1Wj1LVQWxY1GYMjmexlP8CqzeLXY2 ghg3exX+8WEzzWg+fwnFC9onthxjZqmYll24Rf5CZiOuWz1TZ3XhHgzGTFKdLLVVMtGv ILE8PmexvzFRXudtiNCdbunZGhO+JPFHfJdur1v/rg03z7l0Q8EI5ZQgR/T+IgmM/oHp dFX/rK3n/a508qd4B6InAMdjiU09iMoolzsndc4afxcRAA+l9bqRuicr0a0mY4MJntfr jjGJcniEvoDggT7yUe0bt1R8y5lphVTJLc772opeTjms/KIhIGTS4dX2yNCBwC/fuBag jYxw== X-Gm-Message-State: AGRZ1gLLj0Gipz1PmrI7o/k4entNDzcT3ZslEdgvDdp/AsFb8j9spPQy ts6w/XhV4NmVjO0QF7CxZd0FkuqBWc8IHYMLc+A= X-Google-Smtp-Source: AJdET5f6mIJ1J/gYKPExSU1a8t2HH3NxvNHDwmD9Eg1HAEmDyxw0g+HHcPZW5Zx4u8guJK5ADHumRZqfPZxXE7X9kcE=
X-Received:	Just like 'Received'. Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	by 2002:a5b:9ce:: with SMTP id y14-v6mr5052319ybq.83.1541693701067; Thu, 08 Nov 2018 08:15:01 -0800 (PST)
MIME-Version:	Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)	1.0
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	by 2002:a25:8248:0:0:0:0:0 with HTTP; Thu, 8 Nov 2018 08:15:00 -0800 (PST)
Reply-To:	This is the email address any reply would be sent to by default	[email address removed]
From:	This is the address the email was apparently sent from	"Dr. Michael Collins" [email address removed]
Date:	The date/time the email was sent	Thu, 8 Nov 2018 17:15:00 +0100
Message-ID:	A unique ID assigned to the ID for reference purposes	[email address removed]
Subject:	The subject of the email	Re: Release of your Accrued Interest Payment via Certified Bank Draft.
To:	The email address(es) the email was sent to	undisclosed-recipients:;
Content-Type:	What type of content the email usually is, usually text/html, and what character set is used	text/plain; charset="UTF-8"
Bcc:	Email addresses the email was secretly copied into, this field is usually blanked so even by viewing the email header you can't see who was secretly copied into the email	[email address removed]
Content-Length:	The size of the email, in bytes	1901

Your content is below the advert

The scam

--
From: Dr. Michael Collins
Director, NDIC Unit
Ecobank Nigeria Plc.
Tel:+ 234 7013576747

Attn: Sir/Madam,

Re: Release of your Accrued Interest Payment via Certified Bank Draft.

The management of Ecobank Nigeria Plc through International
Collaboration/Networking of Nigeria Deposit Insurance Corporation
(NDIC), wishes to inform you about your interest sum of US$870,000.00
that was accrued from your inheritance sum, which we have been notify
by the International Association of Deposit Insurers (IADI) of World
Bank of Switzerland to release to you.

We want to use this medium inform you that the above interest has been
approved for payment to your through International Certified Bank
Draft, and the draft has been raised in your favor and ready for
delivery to you, which you are required to provide us with your full
name and current contact address together with your direct telephone
number for the delivery of your draft to you.

Meanwhile, be informed that we shall be delivering this draft to you
through DHL Express Delivery to your house address, which you shall
lodge to any bank of your choice, and it will take only 48hrs to get
to you.

More so, you are to note that you should take care of the draft
delivery fee of US$85 is payable to the DHL Express delivery chief
cashier officer here in Nigeria, and this courier service charges
should be made either by western union money transfer or money gram.

In view of that, the above offices will not be held responsible for
your inability to respond to this official letter within 2 banking
days, because the World bank has given us a 4 working days mandate to
conclude with this transaction.

In case if you need any clarification, do not hesitate to ask, we are
always there to meet your needs.

On behalf of
Ecobank Nigeria Plc

Dr.Michael Collins
Director, NDIC Unit
Ecobank Nigeria Plc
Call my direct number +234 7013576747

SpamAssassin Report (spam score: -0.8)

 pts rule                   description                                       
---- ---------------------- --------------------------------------------------
-1.9 BAYES_00               BODY: Bayes spam probability is 0 to 1% [score:   
                            0.0000]                                           
 0.0 TVD_RCVD_IP4           Message was received from an IPv4 address         
 0.0 TVD_RCVD_IP            Message was received from an IP address           
-0.0 SPF_PASS               SPF: sender matches SPF record                    
 0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail      
                            provider (jamesohagtb[at]gmail.com)               
 0.0 DKIM_ADSP_CUSTOM_MED   No valid author signature, adsp_override is       
                            CUSTOM_MED                                        
-0.0 RCVD_IN_MSPIKE_H2      RBL: Average reputation (+2) [209.85.219.193      
                            listed in wl.mailspike.net]                       
-0.0 RCVD_IN_DNSWL_NONE     RBL: Sender listed at http://www.dnswl.org/, no   
                            trust [209.85.219.193 listed in list.dnswl.org]   
 0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not           
                            necessarily valid                                 
 0.0 LOTS_OF_MONEY          Huge... sums of money                             
 0.0 T_HK_NAME_FM_DR        No description available.                         
 0.1 DKIM_INVALID           DKIM or DK signature exists, but is not valid     
 0.9 NML_ADSP_CUSTOM_MED    ADSP custom_med hit, and not from a mailing list  
 0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information    
 0.0 MONEY_FORM_SHORT       Lots of money if you fill out a short form        
 0.0 FORM_FRAUD_5           Fill a form and many fraud phrases

Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)