Forward scams to - remove your name and email address first! TO CONTACT US CLICK HERE INSTEAD

Scam email #255384 - Federal Reserve Bank

Email info

The email was sent on 2018-11-30 15:02:51 and appeared to be from ffoffice1231@yahoo.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to federalreservebankwdc@aol.com which was the scammer's actual email address.
It was probably sent from 74.6.134.123 in Unknown, United States

Email header

Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it

Header field	Description	Value
X-Apparently-To:	Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to	[email address removed] Fri, 30 Nov 2018 12:02:51 +0000
Return-Path:	The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path	[email address removed]
X-YahooFilteredBulk:	The IP here was blacklisted by Yahoo for sending spam	74.6.134.123
Received-SPF:	Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info	pass (domain of yahoo.com designates 74.6.134.123 as permitted sender)
X-YMailISG:	A unique ID added by the Yahoo Inbound Spam Guard	8SXbN2gWLDtEWwMXewv9MiODScXw89EeDR6drrr7Z5CYoOFi s3_CPticUGzGYa1KSQvMw42iyIGShXOnFvDPv7nMDDpoMCsTwoV_6P62nMRT g3cL5e21pvlTuBe8PzFzHFSvDMxw3MSnizeO.bpcT87nr5i._AxPz65Vo7H. jmlVXCjmyYCqJkBTClZX7T3R_OCju2h86huS1CJSWczoef64n9Gl5j5LZmvd 9N0g83ylCo2tqiyvyz6J63Mvq584GZlgDUYv60zaFT6jOCAPfH.2fBz9RAqp HlWwK._mjRSEO0PLojutR6m191Pgn_Ok7avF4hhcKEPRPw5IfXaNagNhyghd 0JieFaYd1F.nLldwnbDuqGa5N.ey0sPjgU04VhVn6Ap4Obl9xxpFCbk545wB 2Wckdx6eFmDvZS0BBHWchxeYuE5EZQq8iiQ9JmUhB3vfn4VyVF.PElMzoK_R 4L3xoMfALAtRwJ.YA_ngf0q1DfDfLvMNKGG0pZN7IAeJ7HLsEg6S9bE5TDMA 6kKNPfwVC9g8UNdUZi4oxU9yfyJjKm.EMlscgstzJDs5tVQ1Qg6fg3YV0U0k sMHxw2K3tcY8Gr3f.hYTRHae5F1xBRM3jp8h1N_P_f8N415TxLYWk0sajvQg uS2ZcBrmVYF2RaDhte8k2CXb.geNHsKkOYi0IEfALxkF8Lp_KbKkWum4TGXa Z0lsEFGiMZsE.uzcNjDZ9Zsf4bdVIwAmkX1XMiESJGa1U_aLa2rdWAZPb55i 6mFhO.D.6LiAmA2pJ2RW8XsOPmdJD7SBfViLtabG6aOgF4ck8S3eYwgQAcpa V43u6budGOK2QQ4PD4TewRSJGNmhyk17hxylELdFOxcRAIlSjJG4_03MY13f n7ApK9qwxsnyUfmqaYaNSvY8ZJAktGn.dwXKcYwyfmqJTjrnzBjNDglatmaC mrn63pgm4Bx87eeRRAccF8Ote4OJIWWyc5S3vmtl9UG5OkvcwAvnuAhxdjSy K_t_g46rSjNvyHaHAv6z6N_DuKjX8T0rb77WYSx2wxxC6k.rCgSxlDbV1agf LIeLxhlxQxi5pRqhs9aDQvWVkG8E_1s9CaiwE6VU89kbgk.P1GUmfg.Z1m9l AT9MBFHx8ngumXLV.14k3r5gJC2EQ8vWmrIzdMTpET08FY.x3j4jL4H5M7R8 zp2i0sHMbA.Gb1e5.rPMC10bRCCeRP1e5QvbNcbHClsGmAiiDU5g4SYSZeMW 51lp7PgsE.I3K6.l53bQ
X-Originating-IP:	The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from	[74.6.134.123]
Authentication-Results:	Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info	mta4281.mail.gq1.yahoo.com from=yahoo.com; domainkeys=neutral (no sig); from=yahoo.com; dkim=pass (ok)
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from 127.0.0.1 (EHLO sonic315-13.consmr.mail.bf2.yahoo.com) (74.6.134.123) by mta4281.mail.gq1.yahoo.com with SMTPS; Fri, 30 Nov 2018 12:02:51 +0000
DKIM-Signature:	Used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1543579370; bh=V7HEeBMySszhf01tbaLoZmeKqeL0tCj3G93VKTV3Osc=; h=Date:From:Reply-To:Subject:References:From:Subject; b=ecO1/3NVA4Ia6xNwZPNsdq/LGBjW4dAH/1Z1kMbNahT1jvIglWN56K9GHYK3TkNYt2kLchTwhCMB5nwQfpMCbpg8npleHA8Nd8Vr1Lh8if2SvMwm+5uD70D34LFIgJ/PyYNdIM98q/NB2X6e+pjlNYBrZK6TkoSJyLKc1B1MwWA7rlu1U5+QUc99hlYkzTxnt/b/j+Lij7s0h6ukKOh8+RY+3AeWMbSdYhfppkRW4SPqUMhjSPLj2cCmYyfx0RHBMbK6RDdkkOVvvNrZg5ewcvB+5hFfXz0bkplvgC1FoZPzo3aSdGDkbj/5qabd+nCkVj8PenAzngS22JiEewgS/Q==
X-YMail-OSG:	A unique ID added by the Yahoo Outbound Spam Guard	8EXeZPcVM1khqF0_bxhdPU3vdN4OzdlHBmgvDHI5k6EQcLGwCisdlJ9b8a_DsWf s_X.rwmDrd4NkgA0Wr0x4r_tsJkvXYOFWDnyeDKXzVwu9ncFmdQXlLpHOLQZEE69.14pmbPt5Nl4 se070fjaAz_YI1OfbQKV88k0jtEcZj225Y8SQHbVnMovV.NkD2tAvriu65qaQ5LAnRtu9xe7qbGB hRLx9l1V9AOPH6B0gEMtTCiPRFXxFTff0FS5np57UeKIwKqF2D3APj2kmJs_DdM89WNVaLnLgJSz oobwPIPre39NvXZCKLwxJRaiGuiq8uu_lLOq9qJSy9gq3yLMCw1pL6pVN8V92GkfauRZlNzkQu.A LoZI78rd87LHtuZpj.zw90ob3DkhUVNVQnBpXjmaeZzpGjnbGoAJTjkzj9PArjCwyapP31qEd_a7 68qnIoy5myv7iLXXCLGUmjpRFcKP.otHuFmXc0cGKeQY1hL7BM.utb8i7KPBejZSaeqyI.iY1eah Tmjc4JWK9RwpvqAdjtk_jVA79eI88kJ3FqrZVUY_sCgHHBz5ptY0vR5Yknc4GpafXe_nvD0KUJ3O xh3pGqb2RUzdoQPLwBZgRyAgB6eRS58e3mQysEuEyFE0jXIEvXhly5e6JHi9k6BwmxDAJPjqLlj0 19jSXf2SQv0Ke6LnWCjxZcku5vB7TqSwtkRfwS1tmbDdXorCB4CiU01PEIfWSo8nJzPB8IhwMoTB Nx4NlKcqvHRQ7wDj0QIjtzIEY77lwG_1cTLmY9HY5c4MSPKj.bpt4Xw_smIrjpzOiG2oysW6hV3e m.Os9wbQok9gtx13CWAM.lqbYyAdUtwVegkQjgyltlZVtHPsJy_vtnVmiWKLvXUqWMMPuw5Ur4GJ xXmYq7DB1x_Dx4ffGrWSpIYBU0F692_xa4pwjJFlQPe_yBCMLY_N7IyHT7yGW5lS.j8KMsGs8z4C TdwqcW20xXyokP.mUtQCYR36DyyWf9RoJT2oexIN9XJ3gGz3iOBjapf1lpwc2_UBmbe7wc7v7_AE qQmDSaOMjp3DKUO7W8EJUBPtybQHQfurHMBQlgDNWtm_GO7Ame6g5MYE8lkLNhyRY4cvS73uUHQn psA--
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from sonic.gate.mail.ne1.yahoo.com by sonic315.consmr.mail.bf2.yahoo.com with HTTP; Fri, 30 Nov 2018 12:02:50 +0000
Date:	The date/time the email was sent	Fri, 30 Nov 2018 12:02:46 +0000 (UTC)
From:	This is the address the email was apparently sent from	FEDERAL RESERVE BANK USA [email address removed]
Reply-To:	This is the email address any reply would be sent to by default	FEDERAL RESERVE BANK USA [email address removed]
Message-ID:	A unique ID assigned to the ID for reference purposes	[email address removed]
Subject:	The subject of the email	Federal Reserve Bank
MIME-Version:	Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)	1.0
Content-Type:	What type of content the email usually is, usually text/html, and what character set is used	text/plain; charset=UTF-8
Content-Transfer-Encoding:	How the email has been encoded to comply with regulations (e.g. maximum characters per line)	7bit
References:	Facilitates the threading of emails; helps the email client piece together which emails belong together in a conversation	[email address removed]
X-Mailer:	The software used to send the email. Spambots, including those used by scammers, often falsify this as a version of Outlook or Outlook Express to get through some spam filters	WebService/1.1.12827 YahooMailBasic Mozilla/5.0 (Windows NT 6.1; rv:47.0) Gecko/20100101 Firefox/47.0
Content-Length:	The size of the email, in bytes	2733

Your content is below the advert

The scam

Federal Reserve Bank
20th St. and Constitution Ave. N.W
Mail Stop K300
Washington, D.C. 20551

Your payment files from three (3) different banks, Natwest Bank of London, Central Bank of Nigeria and Bank of America was compiled and submitted to my desk this morning for review. The total sum owed to you by the 3 banks mentioned above was sum up to the tune of US$1.5m (Five Million United States Dollars).Now the fund has been totally lodged in one particular Escrow account (non deductible) here in the Federal Reserve Bank on your name, while waiting for accreditation

to your personal bank account in any part of the world. Meanwhile, after due scrutiny and verification, I confirmed that you have fulfilled all the necessary obligations that will enable the release of your payment to you, but yet your payment was not released to you due to one flimsy excuses or the other from the Bank officials in charge of your payment, because they had the intention of diverting your funds to their private accounts in order to satisfy their selfish interest.

You are however lucky that we the management of the US Federal Reserved Bank detected their evil plans and therefore call for the submission of your payment file to us so we can personally handle the payment assignment to ensure that you receive your funds accordingly.Now, all modalities regarding your fund release has been put in place here in the Reserve Bank of America, thus, your funds has been made ready for transfer in our sophisticated macro transfer system, what we need from you now is to provide to us the bank account of your choice which you want us to transfer your funds so we can expedite action for the accreditation of your funds into your account immediately.

Below are the information needed for now for your transfer.

1. Personal Details:

Full Name:
Current Address:
Age/Gender:
Occupation:
Direct Mobile Number:
Passport Copy, ID card or DL:

2. Banking Details:

Bank Name:
Bank Address:
Account Name
Account Number:
Routing Number:
Swift Code:

Note: If you prefer to receive your funds in form of a Visa Card, we could load and ship your Visa Card to your address which will permit you a daily withdrawal limit of US$3000 or write a draft check which can be deposited in any bank and send to you. So our wire transfer cost here for transferring the total sum into your account over there will cost $490 while delivery check or ATM Card to your home address is $390.00. So make your choice and request for receiver details where you can send it now. You have only 48hours grace.

Call or text us at +1-470 298 8155

Yours sincerely,
Janet Louise Yellen
Incumbent Chairperson
Federal Reserved Bank
E-mail address ( federalreservebankwdc@aol.com )

SpamAssassin Report (spam score: 5.6)

 pts rule                       description                                       
---- ----------------------     --------------------------------------------------
-1.9 BAYES_00                   BODY: Bayes spam probability is 0 to 1% [score:   
                                0.0000]                                           
 0.0 TVD_RCVD_IP                Message was received from an IP address           
 0.0 TVD_RCVD_IP4               Message was received from an IPv4 address         
-0.0 SPF_PASS                   SPF: sender matches SPF record                    
 1.0 MISSING_HEADERS            Missing To: header                                
 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit     
                                (ffoffice1231[at]yahoo.com)                       
 0.0 DKIM_ADSP_CUSTOM_MED       No valid author signature, adsp_override is       
                                CUSTOM_MED                                        
 1.6 FORGED_YAHOO_RCVD          'From' yahoo.com does not match 'Received' headers
 0.0 FREEMAIL_FROM              Sender email is commonly abused enduser mail      
                                provider (ffoffice1231[at]yahoo.com)              
 0.0 MILLION_USD                BODY: Talks about millions of dollars             
-0.0 RCVD_IN_DNSWL_NONE         RBL: Sender listed at http://www.dnswl.org/, no   
                                trust [74.6.134.123 listed in list.dnswl.org]     
 0.1 DKIM_SIGNED                Message has a DKIM or DK signature, not           
                                necessarily valid                                 
 0.1 DKIM_INVALID               DKIM or DK signature exists, but is not valid     
 0.0 LOTS_OF_MONEY              Huge... sums of money                             
 1.6 REPLYTO_WITHOUT_TO_CC      No description available.                         
 1.0 FREEMAIL_REPLYTO           Reply-To/From or Reply-To/body contain different  
                                freemails                                         
 0.9 NML_ADSP_CUSTOM_MED        ADSP custom_med hit, and not from a mailing list  
 1.0 MONEY_FRAUD_8              Lots of money and very many fraud phrases

Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)