Forward scams to - remove your name and email address first! TO CONTACT US CLICK HERE INSTEAD

Scam email #255815 - UBA United Bank for Africa

Email info

The email was sent on 2019-01-20 01:57:09 and appeared to be from barisster40@yahoo.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to companyt57@gmail.com which was the scammer's actual email address.
It was probably sent from 74.6.130.42 in Unknown, Benin

Email header

Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it

Header field	Description	Value
X-Apparently-To:	Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to	[email address removed] Sat, 19 Jan 2019 22:57:09 +0000
Return-Path:	The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path	[email address removed]
X-YahooFilteredBulk:	The IP here was blacklisted by Yahoo for sending spam	74.6.130.42
Received-SPF:	Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info	pass (domain of yahoo.com designates 74.6.130.42 as permitted sender)
X-YMailISG:	A unique ID added by the Yahoo Inbound Spam Guard	LHInalQWLDvsSQF5A.JUS8AsWtIbwcp9RLh6M7Ds_1DRiKdu xBRPThkRE2vuiCQ1H8sITGlDjzbdYymJVqIIojftQkcDPmntrKpKJCAJdw0e Ph1yFx4EZabPjzdBHGN1Q6Lz8WXjkxkCAdfjhKlDc9NCdsTSGSUXLys45osH VApUI6qCzBkaGBUz5Uzppg_MA8_jsriREdlE2rP.rH5bZXcdz4R5_bywehik U18FNmoQkFuAI67D3I6EaoQL.wZ__JaNQZdoo7X9C2IfYSPc9ukMGdRUz0uK 9nn9ieNgGJP88AbFcz2NO3jPCAcpHVLY0eIRMq4b9EXnwTk.XmusvEvmyvNK LTX_bN5GgXJcpQphwYz3AvKJwIeRfHa7fx3RRxKPF2QENJON20d6AtkhS7N1 51ZDiRvQGCrSBWy5elXDMJOOkpbl1h2QlRGqoJBJp9NB97vIuZzLY7N98_m9 VOM6qgoigwNqLHZor9PJ8ZyVw2ugWdHeZF93z0cs6YOj.NDDo5yonH3l7Bdp 9E2_QStTDrbB0AvNIeYY2PDj0rkagvyS2CmNNzIH3p3S4aAn5mDq_aepZ3Pe Hx2BiISYL89vfucInm_34fZY.A1EiQsGXO8H90nLe_3eAmxXlj5siZXKu9Ko lWXwH6UrfV9JUmYLb0qh8Gx8w_8ixKQqMHaAlVX.w8rcxRzK7PkhiXMUZrUR BA3HmLTyMlA9TD8.vgwd2cpksvpWUfKEwLCpiWdj84zgDvGIQPfnhkExlPzy daWA9jOGSzDMGeRgbG4b6R2EOrW_XMYRessoVLxywpEyiJQpZMpcZDADFZvP Z8.ky9E5hmSGeGN7iTi2sFTs9Cz2dC811B0Xew1kFTrNwL_.11TUInTxNvvc o0.K1RRp_4tearraYwUPgSFoGcRxjC1o9LV3rEzwDoK0UCFIKlR6k1Zy5xjL j152PUYeyXzsC8iPq8jY01vOCR.XStp1l_FlKgIIJVoODMeTY3CVnR3jS3JY terLnh17mvl8z0IxL95v0MBEZBsDE6_6MuQFtztUqV1v8_ogehioV1BiEHIN 6BMED3.H9b39raLyUffRX_g0t0PG53LEgo5PxNfwGG8JE0oGbLRDJOaUNlZN Kq8dj910UKZTztzk1CVx73ay8ThZgGKkPA4jX_ZPRpEXjfRpZUKDFU9X1Xic rhp1e2Ad8.pLrr.f5GTXcR_wZ.Y-
X-Originating-IP:	The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from	[74.6.130.42]
Authentication-Results:	Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info	mta4264.mail.bf1.yahoo.com [email address removed] header.s=s2048; dkim=pass (ok)
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from 127.0.0.1 (EHLO sonic308-3.consmr.mail.bf2.yahoo.com) (74.6.130.42) by mta4264.mail.bf1.yahoo.com with SMTPS; Sat, 19 Jan 2019 22:57:08 +0000
DKIM-Signature:	Used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1547938628; bh=v/9wupxGit4piZoKNRVDLrXxAjkCxRPM0qj4ScAFQ1k=; h=Date:From:Reply-To:Subject:References:From:Subject; b=AwRm58AVWykNFTnBI+xay5HBd1NMO29aznpTeFDPGjZ36J2T30O28mc0+FxhAzGUFqHo0pg8wOH7J+HRHUNe0etDyLgNibbEKkAehltEkwZkMHjbfC5S77r6NlbIs99mqmw/VT41TPaUQ80ObXw3nd+6C7AA9vuPzadz9K/OCM5+GnkPWr1cfRxjrLz8r/GwBENkIPkjprYbPqe5MgVaMTy3/Y5drPoNK9OYI6Zcq/buARK+HlsoMwEkbInRkjJm2L9yTYLmwNdj2O30EKWhJLGaKlkOZVWF+f7eXrjwx6fCQRPLD8YCmqANhfDZB/6i7n5+LIKBaDVF17ZkWnicEg==
X-YMail-OSG:	A unique ID added by the Yahoo Outbound Spam Guard	Uzjx0FcVM1mzZODAqP0WSd6G7C0K98NHF7alPDqrUuk2Ba1siScXkmVNGmZnOOQ 7LfYgyk596w9nAq3klJbSMROqbTS5bgjN_LEN21frrJjLQho3riDTV60v.71bzcmD.TT0Yo4DF5s eieZDphxz4xVKRcW9Xwa3Sspb2F3EA.wXzfRr4dURhYDJW0Z_hC5Fd3XBbm1r6TZPk976g0Y8zni dAmA.KY_DAV251ttzUs0xTITYhkVyh53SRXcW4iqd60zpTXzdOPR9Lwz2of3.cfR_VkwhWfF6EuN HuPafdF9N2.9hMGYC6WxqmOrdAI2LpxQ9ZQxd3LfEG0XnP9ustIBGpJ.h5b7b76kr4.vKMex8Hn0 lV0CBimkryA4vd.s4a5m94_fbzPfwHFSjXlL8U_Mhsj5gEJTqI2NolrZZHFv9PowNJh8G8a0S2gI _p08hJRbNMp50NKQVgB0rxGMFs1nOTuZLA8PYOgZC4oD33xklSH1VqdxZHjR.dub9VaIaZ81Vd3b U_.LgI87Y0LUjvM9DiV9nhjzF.IdmEGnl0k9DHjRHjVru6dDoyZlCoR.mc7d6TFmDb3D_iQnGvFG Dm7PJ3StROIiwmMnoIv0WzL5fykblVHPMIikJWfTT.w850ffMgEA.DZSNeg_UApJFnoszV0JfuuH e.Qca9NK6ThIcc8CzOfwhoU2FDdeFW3eJ0GV4pdYBer7KJogZOLBCUUt3vMb.UX41UBEz6J2vxT8 63om3_fH4bgoNuh1ehZxcnFJHT0AJWF3MUOMjgXa3wufq8ka1UhAdULHuvlhe6QtFPgGDnQp2BvC SPA8VHPiEwIv5bun4yLmVwLKjnYYbtfHLwZHzl5W6ifVesTgHnQmewnNODHYo9xlQ.qiTMblulmI ANNepP9AkbqrDmZ6bJ6ZYzPVIHfNWkE.OU1rhzf1sQ3o4._POZuxggzGT4.0ES5IaejOBu2k6usR seGPE1zYdZPSsO4dF0QP2LHKRbAitgvyZ3cHTLxLloTmYybqM3Po9dc3qe6ifUE46LDO2sG9josP oTV6JroyEVIFW7vNWK8hSzwfl3HRVceMboxs3OWBskDNPALsXRQgDXkPfYasWFcbHuJRjcUNAFlM J6r6rT2FaEcf8
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from sonic.gate.mail.ne1.yahoo.com by sonic308.consmr.mail.bf2.yahoo.com with HTTP; Sat, 19 Jan 2019 22:57:08 +0000
Date:	The date/time the email was sent	Sat, 19 Jan 2019 22:57:04 +0000 (UTC)
From:	This is the address the email was apparently sent from	philip morris [email address removed]
Reply-To:	This is the email address any reply would be sent to by default	philip morris [email address removed]
Message-ID:	A unique ID assigned to the ID for reference purposes	[email address removed]
Subject:	The subject of the email	UBA United Bank for Africa
MIME-Version:	Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)	1.0
Content-Type:	What type of content the email usually is, usually text/html, and what character set is used	text/plain; charset=UTF-8
Content-Transfer-Encoding:	How the email has been encoded to comply with regulations (e.g. maximum characters per line)	7bit
References:	Facilitates the threading of emails; helps the email client piece together which emails belong together in a conversation	[email address removed]
X-Mailer:	The software used to send the email. Spambots, including those used by scammers, often falsify this as a version of Outlook or Outlook Express to get through some spam filters	WebService/1.1.13016 YahooMailBasic Mozilla/5.0 (Windows NT 6.1; rv:55.0) Gecko/20100101 Firefox/55.0
Content-Length:	The size of the email, in bytes	1386

Your content is below the advert

The scam

Hi,Urgent Attention:Beneficiary

With this letter we hereby acknowledge receipt of your payment file from
the formal director of this Bank,Based on the record in your payment file,
your overdue fund payment is($5.500,000.00) only. At United Bank for
Africa, and the Central Bank we are committed to help you by providing
affordable,reliable and convenient payment services so that you will not
encounter that delay again. We have a wide range of money transfer products
to choose from which you prefer to receive your fund, choose one of the
options and get back to us together with the information OK

Below are our methods of payment:
1. By Cashier check
2. By Corporate ATM card

We believe in giving you choice; which is why we offer a range of services
to pick and choose from, so you really can't go wrong. In order for us to
work as efficiently as possible, it is understood that your co-operation is
greatly appreciated,fill this information and return it to me immediately
to start up the process,bear it in mine that you will pay $150:00 to sign
for the release order documents file in this office.

Full Name:__________
Country:__________
City:__________
Home Address:__________
Occupation:_____
Phone Number:____
Age:______
sex:______
companyt57@gmail.com
Yours sincerely,
philip morris
Director ATM CARD PAYMENT
Phone +22966056756
UBA United Bank for Africa

SpamAssassin Report (spam score: 7.6)

 pts rule                       description                                       
---- ----------------------     --------------------------------------------------
 0.8 BAYES_50                   BODY: Bayes spam probability is 40 to 60% [score: 
                                0.5000]                                           
 0.0 TVD_RCVD_IP                Message was received from an IP address           
 0.0 TVD_RCVD_IP4               Message was received from an IPv4 address         
 0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit          
                                (companyt57[at]gmail.com)                         
 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit     
                                (barisster40[at]yahoo.com)                        
 0.0 DKIM_ADSP_CUSTOM_MED       No valid author signature, adsp_override is       
                                CUSTOM_MED                                        
 0.0 FREEMAIL_FROM              Sender email is commonly abused enduser mail      
                                provider (barisster40[at]yahoo.com)               
-0.0 SPF_PASS                   SPF: sender matches SPF record                    
 1.6 FORGED_YAHOO_RCVD          'From' yahoo.com does not match 'Received' headers
 1.0 MISSING_HEADERS            Missing To: header                                
 0.0 DEAR_BENEFICIARY           BODY: Dear Beneficiary:                           
-0.0 RCVD_IN_DNSWL_NONE         RBL: Sender listed at http://www.dnswl.org/, no   
                                trust [74.6.130.42 listed in list.dnswl.org]      
-0.0 RCVD_IN_MSPIKE_H2          RBL: Average reputation (+2) [74.6.130.42 listed  
                                in wl.mailspike.net]                              
 0.1 DKIM_SIGNED                Message has a DKIM or DK signature, not           
                                necessarily valid                                 
 0.0 LOTS_OF_MONEY              Huge... sums of money                             
 0.1 DKIM_INVALID               DKIM or DK signature exists, but is not valid     
 1.6 REPLYTO_WITHOUT_TO_CC      No description available.                         
 1.0 FREEMAIL_REPLYTO           Reply-To/From or Reply-To/body contain different  
                                freemails                                         
 0.9 NML_ADSP_CUSTOM_MED        ADSP custom_med hit, and not from a mailing list

Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)