Forward scams to - remove your name and email address first! TO CONTACT US CLICK HERE INSTEAD

Scam email #255715 - International Monetary Funds Annual Compensation

Email info

The email was sent on 2019-01-05 14:20:03 and appeared to be from drchrisnwose789@gmail.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to customoffice826@yahoo.com which was the scammer's actual email address.
It was probably sent from 209.85.222.194 in Unknown, United States

Email header

Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it

Header field	Description	Value
X-Apparently-To:	Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to	[email address removed] Sat, 05 Jan 2019 11:20:03 +0000
Return-Path:	The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path	[email address removed]
X-YahooFilteredBulk:	The IP here was blacklisted by Yahoo for sending spam	209.85.222.194
Received-SPF:	Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info	pass (domain of gmail.com designates 209.85.222.194 as permitted sender)
X-YMailISG:	A unique ID added by the Yahoo Inbound Spam Guard	8VSOPREWLDvvObLtvK6kswI7Ofy9u9osbI1l99NhYJlfQmbD Oe4k1NUrrP5FsT3nXMIUhEp_381f5CLLBObK_fO3VYggM0HmYSzU2V3thq6M 9mhkUJNh8S4soGqKt8cKTl3JPwMqkWhVbbvSiq6ulmRiq_h.ZrDZ72CSjheZ SNFdgn9QFzfeGBXuwPYvzcsOc4dOphr4utddycgqBqYMXOboylL1DDOFmhR0 muZXsYRAMyateNnrdkYFAZTJ7fgfsXayRb.Qfba_VLz3vfkzoQYP49P.2vCi mf4IY36LBn9h69NZnKMDLTGXGS8Y7iJvNSFzprNAmtdDpmT4rE6nxTZjDaDb 8TLEg0ZI65b4_AimIV5ZR_dmtGcM4mx.5ovtJi0GXP9QVSl4I2eQhSOOOPLn g5JcbzvpmWNBh5lXW76uFxaGjX6brcXxH2ud5Kypi_KvFYCfUihbkDNtuOe5 RdpQCgUn0uFz80ikpX6Elb9hYO1Ov9NPm5elb5gtJmoMkgmjhd6O2G7ym2Im E2wYCNOzz_VxoNLD6QWFNSFtLdaGIqN3nstLZLwbHnKka5265LDeYxQYkcgF LXv2RXOU4SeTKtSoye3cpvEvV9v5YPuNrnKefgwRxmkgv_yAXcx9a6leDjvj PEguAhTn4bseEbUCrinhbQi.9o6C8yiC_3oYAQ4EA9O2GNZj9N6rjycP6oN5 vz7dN8WF4klVXUhPODGbYZ.hXW6YEDnma0L4uSrCCmoNlb6aT5TbAL1NMb7J 9wv2HaKHSfvoPKjoLPBr7nYqHW_RNhoMY8iGU9nmW.Ujpb6WYsGWfSu_PswV wPsi5fDtkozhDjxqgui6erwWXzmVRIVf9IUEzPLalXdEaiFv_kF7i9oSZjei z0STVr2XuRYJzZaFpiMqMPJkLFxHYqpbFoiyEazYvx3EVclkgASdOzQcMPfz AKiW3vv.EKo4sVZ7ecP9_wLY9aBTpXbEqBxUJ6rLnR6Mi95NDFVxAQsAdqE4 UnKGQyfphHohy18jsgem_GPoi0qVgQ8EJHlII30VxS9dcMwAI1IGVD1gmT8r EvK6q69ItmkMluk2MAVPcRxPhfo8XkSHvGHYlSa94R76tCOeV8EaCLB175i8 weZ6pcIKrkTA7vQMVPnEI5Pt5jdWz06cf.Lxain7pD.G_cS38Em16783fyx2 mp.vnTReCCnRPAYl57HYJtqildJEBJHOCNdmu.q2WWRi2iW8KqwNPv.Q_wcY NXQN9N.B1rQak6TVkB236sof8aNDClEscIa8EiWO
X-Originating-IP:	The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from	[209.85.222.194]
Authentication-Results:	Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info	mta4479.mail.ne1.yahoo.com [email address removed] header.s=20161025; dkim=pass (ok)
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from 127.0.0.1 (EHLO mail-qk1-f194.google.com) (209.85.222.194) by mta4479.mail.ne1.yahoo.com with SMTPS; Sat, 05 Jan 2019 11:20:03 +0000
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	by mail-qk1-f194.google.com with SMTP id g125so22940912qke.4 for [email address removed] Sat, 05 Jan 2019 03:20:03 -0800 (PST)
DKIM-Signature:	Used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:reply-to:from:date:message-id:subject:to; bh=oJBSCMW77TYx5K05+9dVBUWvOIvT9oKCTNF+ympI6u4=; b=HdXSnbL+raKuHg+tv4Ot5LWPNNl0bXO7DBr/4A4QCp5PB/FTgVCR0itiBDMRrwhxzv CDc5hlGBM4HU+haicVU/mriZAm/8kizKLdP4pbrCIIADaekv7YkS6iat0ILwGfjq0D5v ScyoQnIjKTv46QuSod8iPO4YpeHelMuy6jwrLyxt3O5yVsIcB9bOIz+ZWzQvVPA/Mbpc 3DCmv9fw00fHx5k22LnqemSY/XFsENoningchEc5+PdQ67MjIVgJSJlSnQbh0I/2KCu8 ydfj14eCx5xDftKKL4J8A1utdFicM/lzjIL0rkOe/rxkkyXiDN9GD40Hiz6d4GR7AKiN kWzw==
X-Google-DKIM-Signature:	Google Mail adds this to all their headers, it is used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:reply-to:from:date:message-id :subject:to; bh=oJBSCMW77TYx5K05+9dVBUWvOIvT9oKCTNF+ympI6u4=; b=T64IXyPrN/apCrGwd1upeEqCO3ZytPeSLEjrOM1LOw9MbB0y1EGcDlPedQ8PKNSilm 9nvoHA4Faa+JG/1nbMumHejkTzjUb8QRinUdufGK0rsp+8Ag26DT8pR2DBf7r4TpoTnW ItnruBa8bCtLP7BGCrnolYk/YS48JVO09tj40KiYxLcdOg4194Gb2LjIuPP95P1WyFkJ N64UJ8E2OnSkPPz6PZRuPmjzWk3p91WxBXs2PN6qGaLEOh53l1wxaS5FnZjPiCPfqLQH twUDrAEQ9bNckkDdIQJaUFhN9NYpSAtS76qYbxW2ardIE1jQVSGVHsGb/GbiaoCmEKS0 0+6A== X-Gm-Message-State: AJcUukeQrW64e7Ei9JfdcjWB3J4CX0c9hvZEoe+VYX+uz189NCvGprxS lebV5LbEA3osEuyyD3inD5E8XFG1ehPDLPyDyfQ= X-Google-Smtp-Source: ALg8bN4CeYWCBfK9PRkedZJbKSKMsZpt0PrBsvY9vDBBS/4Ajdmlm7x48WrBbbFm66ErZ955JHjU9maaOy89N01RVo8=
X-Received:	Just like 'Received'. Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	by 2002:a37:ac5:: with SMTP id 188mr50615866qkk.135.1546687202798; Sat, 05 Jan 2019 03:20:02 -0800 (PST)
MIME-Version:	Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)	1.0
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	by 2002:a0c:9063:0:0:0:0:0 with HTTP; Sat, 5 Jan 2019 03:20:01 -0800 (PST)
Reply-To:	This is the email address any reply would be sent to by default	[email address removed]
From:	This is the address the email was apparently sent from	"Mr. Samuel Etemeh" [email address removed]
Date:	The date/time the email was sent	Sat, 5 Jan 2019 12:20:01 +0100
Message-ID:	A unique ID assigned to the ID for reference purposes	[email address removed]
Subject:	The subject of the email	International Monetary Funds Annual Compensation
To:	The email address(es) the email was sent to	undisclosed-recipients:;
Content-Type:	What type of content the email usually is, usually text/html, and what character set is used	text/plain; charset="UTF-8"
Bcc:	Email addresses the email was secretly copied into, this field is usually blanked so even by viewing the email header you can't see who was secretly copied into the email	[email address removed]
Content-Length:	The size of the email, in bytes	2488

Your content is below the advert

The scam

International Monetary Funds Annual Compensation

We are instructed by Federal Government of Nigeria and the reparation
committee in conjunction with the International Monetary Funds Annual
Compensation been set up by the countries of West Africa to transfer
your fund to you via our service (western union transfer) so you will
be receiving 5 reference number of $5,000 usd each daily until we
complete the correct amount of ($500,000usd). meanwhile you are
required to fill the remittance form and send the release order
charges which is $120 usd for the release of your 1 control number of
$5,000.00 usd that we have already remit to your name because without
that you cannot pick the money for it is on hold.

Note: the reason why we need you to pay the $120 usd is that we tried
to deduct the release order fee out from your fund but the ministry
administrator trust fund of Nigeria told us that no one has access
over your fund as it has been signed and stamped that no money should
be deducted until it get to you to avoid any misunderstanding because
if any one has access to that it will involve you losing your fund, no
one has to be trusted even your mother or your father.

Here is the information of the 1 reference number of $5,000.00usd usd
which we will send today to you but the 1 control number of $5,000usd,
will remain on hold until you pay the release order charges of $120
before we can releases it to you so you can track it with our web
site.

Money control number : 952 950 9620
Sender's first name: Samuel
Sender's last name: Etemeh

Control number :# 952 950 9620 track the control number by
visit:::::::::
https://www.westernunion.com/us/en/self-service/app/tracktransfer )
make sure you track number and see if the money is there or not.

Finally update us with the filled remittance form and the $120 usd to
enable us proceed on your payment immediately, below is the
information you will use to remit the $120 usd via Western Union
transfer been the release order charge for your 1 control number of
$5,000usd.

Western Union payment information

1. Receiver name= CHINASA AGETUE
2. Country= Nigeria
3. State: Lagos
4. Amount= $120 usd

Most important now, you have to re-confirm your current receivers

As soon as we received the payment information of the $120 you will be
able to cash the $5,000, call me or text me as soon as you make the
payment here is my direct phone number:+2348035294585

Mr. Samuel Etemeh
Manager director for western union

SpamAssassin Report (spam score: 5.9)

 pts rule                       description                                       
---- ----------------------     --------------------------------------------------
 0.8 BAYES_50                   BODY: Bayes spam probability is 40 to 60% [score: 
                                0.4659]                                           
 0.0 TVD_RCVD_IP4               Message was received from an IPv4 address         
 0.0 TVD_RCVD_IP                Message was received from an IP address           
 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit     
                                (drchrisnwose789[at]gmail.com)                    
 0.0 FREEMAIL_FROM              Sender email is commonly abused enduser mail      
                                provider (drchrisnwose789[at]gmail.com)           
 0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit          
                                (customoffice826[at]yahoo.com)                    
 0.0 DKIM_ADSP_CUSTOM_MED       No valid author signature, adsp_override is       
                                CUSTOM_MED                                        
-0.0 SPF_PASS                   SPF: sender matches SPF record                    
-0.0 RCVD_IN_DNSWL_NONE         RBL: Sender listed at http://www.dnswl.org/, no   
                                trust [209.85.222.194 listed in list.dnswl.org]   
 0.1 DKIM_SIGNED                Message has a DKIM or DK signature, not           
                                necessarily valid                                 
 0.0 LOTS_OF_MONEY              Huge... sums of money                             
 0.1 DKIM_INVALID               DKIM or DK signature exists, but is not valid     
 0.0 HK_NAME_FM_MR_MRS          No description available.                         
 1.0 FREEMAIL_REPLYTO           Reply-To/From or Reply-To/body contain different  
                                freemails                                         
 0.9 NML_ADSP_CUSTOM_MED        ADSP custom_med hit, and not from a mailing list  
 2.5 MONEY_FRAUD_5              Lots of money and many fraud phrases

Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)