Forward scams to - remove your name and email address first! TO CONTACT US CLICK HERE INSTEAD

Scam email #255859 - FIDELITY WORLDWIDE INVESTMENT BANK: ATM CARD PAYMENT NOTIFICATION

Email info

The email was sent on 2019-01-24 19:56:13 and appeared to be from email.offic@yahoo.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to mr.thomasstevenson@yahoo.com which was the scammer's actual email address.
It was probably sent from 74.6.129.43 in Florida, Location found from phone number in email

Email header

Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it

Header field	Description	Value
X-Apparently-To:	Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to	[email address removed] Thu, 24 Jan 2019 16:56:13 +0000
Return-Path:	The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path	[email address removed]
X-YahooFilteredBulk:	The IP here was blacklisted by Yahoo for sending spam	74.6.129.43
Received-SPF:	Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info	pass (domain of yahoo.com designates 74.6.129.43 as permitted sender)
X-YMailISG:	A unique ID added by the Yahoo Inbound Spam Guard	ywlZRCAWLDscwZQcrj5Vj_pznvXZeX8lMrrKmk5pIGI70wYw APVPvhfgdkfLfG14EL55HCOS15lwj5Aegr7ldmrGUgqNUcGNjyZ1gdwKx0qx KCnUr6NjvCtwvJP89usDuUy38H7of8NaZsNbYCHh2w7Xckzcjj9LV8GzzfW4 CM2Bb.m41B535vLDTXOgNhxzJyVUX1T.DWB.BVNXJmxAikevSk4TCxUUNBSg sQRbBNQgIKACgXN0FMR1Ph.SaY2fzXwZrK709h6rJ8M7Xbe8fPNysbtJv0lA L7z_JNKD.Yi5uPtVfSbFjp.wDY6xJdVYA5CH2pIa51hdQk7H1EOgLlD5uP9e pmbbP5s2l7ZJo2MZi1UcbAq30xBwVA9YZiTf6bf6_B5JB.R_3NJJKt7ng2XB qlGHjiT6hwhwYGkrId0s90FowtTyrlRtsanZd1q59rfqzT45lkqDjdc0dmzJ S1iX5qtCzqWshSP46ZVolp0sf0gyicba3q2_bf.KLlgChfA23mgcygQLl9lS 4wL_exP1ckOEL.pduSbSxp7Le4bE1YrSOzaoFshbqb796NskHSZ.pJDvBE_k KBqZqbSAxKNyJdNxwxLC54A80YtJoRNWUJbE_NoVa26kwrBx5s8WVnNmkq63 z98DlzNJfYzHpmud9ftu91z7QnpDsAaZdEFGi3vcC9013E9lbvRtlRm6GxiX YQkOm1e6b__qwfc9tDKn5yI4ppyQp53DTQI.wFGBEeCtI.pzvdUB46KRD5mG YxbE4fViyYQGZCcXVm6RYBu8qxWiVcxR_c2c_8W0rEJEXIQVWMYLUiiYgsR1 rZ3BaUaOZZOaDOdBio80VYrC0noN0FhN5JOlOXQER2zjnr5osJy2CqJEYLGd Jc7QqLCLeCYZmtQ4wZ2kvZrs9L_EAhFawP.7YGXq7BOUUJwLskNvJWBJd.B6 p3XQNCE.WptVDYnSh0Fo_yMHO1xnUaXCZa6Cc4hkqkPWK9.U7CTpEJvAXcU2 BiNFrKv.shDzYj8BVO5Qj8_K_7UNPMWbwCf8hAslxvWYJwj09V6Ns.bs8Y1n ajsI8osi5YZLecPb0BJqInR5DT2T2PlJUE.ICaqPuuLOdWTAd8sjm8rTPKEs Khw1xvl8KkogDO8dRj8smiT542BAu1Vlq0vcTutTjeUzE9qCRToMJ8VcrC1g tSwtLqD7wxaYmLSTh5Pg6KUwz36d47K89WUZRiDVO27y_p4xpwJeuCVnVOJN pA--
X-Originating-IP:	The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from	[74.6.129.43]
Authentication-Results:	Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info	mta4120.mail.gq1.yahoo.com [email address removed] header.s=s2048; dkim=pass (ok)
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from 127.0.0.1 (EHLO sonic301-4.consmr.mail.bf2.yahoo.com) (74.6.129.43) by mta4120.mail.gq1.yahoo.com with SMTPS; Thu, 24 Jan 2019 16:56:12 +0000
DKIM-Signature:	Used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1548348971; bh=h4h9O1qWwBOYrM16JAVH+Vr6mMzJxPeX5j4MV14nktc=; h=Date:From:Reply-To:Subject:References:From:Subject; b=DkKHGYf+r2TEUXjyjNvdHoAktWQIz/c416QG4BDhKzuvT7Pi7vRe+wq7yOxcwc0dUcnI3uFXiO13WrmxpYrcf+3jJFsBXTz3fRog87IzQRO3xY2LLtn0Fm78NAWKOmuHwmFCNv77sSuXol3ehnzOqpSyCF6W/euwQbLEeENZHoEIakfj8BDHqxlFHG3oRj3tiETz7edA0ueThfw1aSaz6drq+/XFTZAw97PLV9BGhffMDdpG1+biHU/xNFXnuNHc/9d+LRMEbNluJ0YqU88JxqpQU/3iOCpuXpDtbDPMO/EGjxNCJFFB2zvWlfkxJrMUJx8Zgw4FWvCnVB6kRuhtOw==
X-YMail-OSG:	A unique ID added by the Yahoo Outbound Spam Guard	M.ZLsMcVM1lZMhxsWade69.Z3pjp8rsb47_b2KPV.JcH7dFnzt0cmtsIBm5hAc8 _D.4XQeALJks1LwI6BIRo9ouuCPxIJPEmYVhDhrp_uLxp_TpeFxcPK0WPzUjfZcl6eyvSrwrI4EM 6eW5xcXI6Ducv1vOqucX6WGXPPkMZ4LuSG.WYiNbpiVGs8E1GWO3t54bL5jvQqJKiDbJey0UjE3R uxQkX7DNeLuY1hRaXXBBa6TB.sohRJBnSPwdWkFBWXwU5I1jRa_CPWPxaF8gHqGOgl6II39kwyz_ dkXcq0OYbpdgdvPE6DC8swU.Nx.HPT6PPJvMJwD0Z2oY78W9s2xRn4gSHjPMIjJ7GOdLOutWRt5Z 2lS6nKSuS6k1lbKCsRqmyl_jJYfiEYCXiMsHI0beBVo19JWkoECNAX9ALDQJr8koxJ_UpyaxeWlV 5ecIcu7CJI0gND1cWxjv9d_fMeO4Xx9mLPdImdd0oB2avDGbTcNNfHOMfs.bmpJ_6ins79Hlcvuf bA3dbGe6AiZVHeuhkMV3NSMhQriI_JQhQ3R_4Db5kR14HSSW78UXQHGqg1J_k92XLcWTFTQXj3d2 PKL275YBvCpFay6uEI03JsfCbo3WGQObJdMp8f0DYLXCKMQZ_jkrk5dn3y44FvC5HCg.doIX4Jz0 bBWTdlu2HQ.BReiJaYAq2AYyPHvDGdqlG2NYIRpKOZlMEoaWY7vtQjxAlxiwyO3KNgv0Ix9kLmLd A586dTgJkpbpV6rzAQEQddun1QTKESMjsEcgE7DZaOC6pquNtJl901Fw6F.ZC1_i4NcNc.AIpkP3 eToROJUl4PDazyVG3UIezYAMHP_vRs54Lt4zoI17SrvfGFOSO40tiyGyBcBuUIv7AO9B8txhilEb eJhPP_3R7C7ZAK1_SbFseB0iHNn1.QKyP4Vwkflkfijf44wn963ynVL8oGxoTGTuUxYodpKIfvfG pmxoQTh0d5XMkB43GZNRS7qO1oMGqByFHrWZLquWHu_i8rDJBmi.j8XaduiPjUaq1cAxOqdibWQR Q.LbA5EDPDJWWGD9Dt8pUMB6.HlfGVXPM7eVDPIl4_loFBkurur7HzMtmx6TrQeIt6liE2kYae0w xftgSoI9SqDcQrPhtueDcZD.JqA--
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from sonic.gate.mail.ne1.yahoo.com by sonic301.consmr.mail.bf2.yahoo.com with HTTP; Thu, 24 Jan 2019 16:56:11 +0000
Date:	The date/time the email was sent	Thu, 24 Jan 2019 16:56:09 +0000 (UTC)
From:	This is the address the email was apparently sent from	"MR.THOMAS STEVENSON" [email address removed]
Reply-To:	This is the email address any reply would be sent to by default	"MR.THOMAS STEVENSON" [email address removed]
Message-ID:	A unique ID assigned to the ID for reference purposes	[email address removed]
Subject:	The subject of the email	FIDELITY WORLDWIDE INVESTMENT BANK: ATM CARD PAYMENT NOTIFICATION
MIME-Version:	Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)	1.0
Content-Type:	What type of content the email usually is, usually text/html, and what character set is used	text/plain; charset=UTF-8
Content-Transfer-Encoding:	How the email has been encoded to comply with regulations (e.g. maximum characters per line)	7bit
References:	Facilitates the threading of emails; helps the email client piece together which emails belong together in a conversation	[email address removed]
X-Mailer:	The software used to send the email. Spambots, including those used by scammers, often falsify this as a version of Outlook or Outlook Express to get through some spam filters	WebService/1.1.13027 YahooMailBasic Mozilla/5.0 (Windows NT 6.1; rv:64.0) Gecko/20100101 Firefox/64.0
Content-Length:	The size of the email, in bytes	2614

Your content is below the advert

The scam

FROM THE DESK OF MR.THOMAS STEVENSON,
DIRECTOR ATM DEPARTMENT FIDELITY WORLDWIDE INVESTMENT BANK:
E-MAIL ADDRESS: mr.thomasstevenson599@yahoo.com
TELEPHONE NUMBER:+1941-677-1008 (FOR CALL AND TEXT MESSAGE)

FIDELITY WORLDWIDE INVESTMENT BANK: ATM CARD PAYMENT NOTIFICATION

ATTN: PLEASE,

I AM MR.THOMAS STEVENSON,THE DIRECTOR ATM DEPARTMENT FIDELITY WORLDWIDE INVESTMENT BANK FLORIDA U.S.A BRANCH OFFICE, THIS IS TO LET YOU KNOW THAT WE RECEIVED A PAYMENT NOTIFICATION/INSTRUCTION FROM THE WORLD BANK ORGANIZATION AND UNITED NATIONS (UN, WE THE FIDELITY WORLDWIDE INVESTMENT BANK FLORIDA U.S.A BRANCH OFFICE REACHED OUT AN AGREEMENT WITH THE WORLD BANK ORGANIZATION AND UNITED NATIONS (UN) RESERVE ACCOUNT TO SETTLE ALL OUT ALL OUR STANDING PAYMENT TO ALL OUR FOREIGN DEBTORS.

FOR THOSE THAT HAVE NOT RECEIVED THEIR CONTRACT/INHERITANCE PAYMENT
FUND FROM THE NIGERIA GOVERNMENT FOR MANY YEARS NOW BECAUSE OF THE BAD BANK OFFICERS.

RIGHT NOW WE HAVE ARRANGED YOUR PAYMENT OF US$32.5M (THIRTY TWO MILLION FIVE HUNDRED THOUSAND UNITED STATES DOLLARS) THROUGH OUR SWIFT CARD PAYMENT CENTER ASIA PACIFIC, THAT IS THE LATEST INSTRUCTION FROM THE PAYMENT PANEL COMMITTEE WORLD BANK ORGANIZATION AND UNITED NATIONS (UN). THIS CARD CENTER WILL SEND YOU AN ATM CARD WHICH YOU WILL USE TO WITHDRAW YOUR MONEY IN ANY ATM MACHINE IN ANY PART OF THE WORLD,SO IF YOU LIKE TO RECEIVE YOUR FUND IN THIS WAY, PLEASE GET BACK TO US WITH THE REQUIRED INFORMATION BELOW.

1.FULL NAME
2.ADDRESS WERE YOU WANT US TO SEND THE ATM CARD
3 MOBILE,HOME, OFFICE TELEPHONES AND FAX NUMBER
4.YOUR AGE AND CURRENT OCCUPATION
5.ATTACH COPY OF YOUR IDENTIFICATION

PLEASE DO PROVIDE THE ABOVE INFORMATION ACCURATELY, BECAUSE THIS OFFICE CANNOT AFFORD TO BE HELD LIABLE FOR ANY WRONG TRANSFER OF FUNDS.

THANKS FOR BANKING WITH FIDELITY WORLDWIDE INVESTMENT BANK, WHILE WE
LOOKING FORWARD TO SERVING YOU WITH THE BEST OF OUR SERVICE.

GET BACK TO US AS SOON AS YOU RECEIVE THIS MASSAGE THROUGH THIS E-MAIL ADDRESS (mr.thomasstevenson599@yahoo.com) AND FEEL FREE TO CALL ME ON THIS TELEPHONE FOR MORE DETAILS. IF YOU CALL ME AND I DID NOT ANSWER YOUR CALL OR IT ENTER VOICE MASSAGE, YOUR SHOULD DROP A VOICE MASSAGE WITH YOUR TELEPHONE NUMBER AND SEND US E-MAIL, SO THAT WE CAN RESPONDS YOU FAST.

LOOKING FORWARD TO SERVINFIDELITY WORLDWIDE INVESTMENT BANK: ATM CARD PAYMENT NOTIFICATIONG YOU BETTER.

THANKS AND GOD BLESS.

YOURS TRULY

MR.THOMAS STEVENSON
DIRECTOR ATM PAYMENT DEPARTMENT FIDELITY WORLDWIDE INVESTMENT BANK
FLORIDA U.S.A
TELEPHONE NUMBER:+1941-677-1008 (FOR CALL AND TEXT MESSAGE)
E-MAIL ADDRESS:mr.thomasstevenson599@yahoo.com

SpamAssassin Report (spam score: 9.3)

 pts rule                   description                                       
---- ---------------------- --------------------------------------------------
-0.0 BAYES_20               BODY: Bayes spam probability is 5 to 20% [score:  
                            0.0724]                                           
 0.0 TVD_RCVD_IP4           Message was received from an IPv4 address         
 0.0 TVD_RCVD_IP            Message was received from an IP address           
 0.0 DKIM_ADSP_CUSTOM_MED   No valid author signature, adsp_override is       
                            CUSTOM_MED                                        
-0.0 SPF_PASS               SPF: sender matches SPF record                    
 1.5 SUBJ_ALL_CAPS          Subject is all capitals                           
 1.0 MISSING_HEADERS        Missing To: header                                
 1.6 FORGED_YAHOO_RCVD      'From' yahoo.com does not match 'Received' headers
 0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail      
                            provider (email.offic[at]yahoo.com)               
-0.0 RCVD_IN_DNSWL_NONE     RBL: Sender listed at http://www.dnswl.org/, no   
                            trust [74.6.129.43 listed in list.dnswl.org]      
 0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not           
                            necessarily valid                                 
 0.0 T_HK_NAME_FM_MR_MRS    No description available.                         
 0.0 LOTS_OF_MONEY          Huge... sums of money                             
 0.0 UPPERCASE_75_100       message body is 75-100% uppercase                 
 0.1 DKIM_INVALID           DKIM or DK signature exists, but is not valid     
 1.6 REPLYTO_WITHOUT_TO_CC  No description available.                         
 0.6 REPTO_QUOTE_YAHOO      Yahoo! doesn't do quoting like this               
 1.0 FREEMAIL_REPLYTO       Reply-To/From or Reply-To/body contain different  
                            freemails                                         
 0.9 NML_ADSP_CUSTOM_MED    ADSP custom_med hit, and not from a mailing list  
 0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information    
 0.8 MONEY_FRAUD_8          Lots of money and very many fraud phrases

Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)