Forward scams to - remove your name and email address first! TO CONTACT US CLICK HERE INSTEAD

Scam email #255914 - FOLLOW THE INSTRUCTION TO DELIVER YOUR ATM CARD TO YOU.

Email info

The email was sent on 2019-02-02 09:52:52 and appeared to be from howardnadle135@gmail.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to skyebanksplc1247@yahoo.com which was the scammer's actual email address.
It was probably sent from 209.85.160.194 in Unknown, United States

Email header

Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it

Header field	Description	Value
X-Apparently-To:	Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to	[email address removed] Sat, 02 Feb 2019 06:52:51 +0000
Return-Path:	The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path	[email address removed]
X-YahooFilteredBulk:	The IP here was blacklisted by Yahoo for sending spam	209.85.160.194
Received-SPF:	Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info	pass (domain of gmail.com designates 209.85.160.194 as permitted sender)
X-YMailISG:	A unique ID added by the Yahoo Inbound Spam Guard	jWTjzUYWLDvlMNPG8o3eAf2qGAAiVryAn39ruwhz1j_ZOWw5 M4QLqBrOEnzn2_WhzyN9_DIg3JrccPtpOqP8rMr4mHKY1aPVq.4y752bAbOq ZTKI7FeyQt.scUUfb2pSr1XilWZ1pWBq5yMHgap.7eEi9A5_9rX5ZWHbXRGy P7Q58dEn2QcENqRAyYg68.u4PR5HsedQmEjjIRKSUowOS9iBQ71E4M0iJiIK 4WZaPw3Sw364B19wmOce2PKsILw.cQTHK7ZzUBd6pwBqUkja0mjPqAVrAO2I bYYTxGJ9WGqof_BRXKaJ0VUsUtTDhCOgzdG15Zm2rWnEgjX4Yn3.z.gSsrx2 Pmo39iONc912zb97e.I3NZNnRGghkNyq_a0PuMy72wIncWy0EfLJj8M3.dlP 964YN8Cx.cqIjB801qIA8EC.7kxYTMR67UOXraGwhpJTj0n9YxvEhIksFWmj XJhNsihz8JJk633jsxJrYUiHbqK6ZvCsftxuWovAfbCJKSY9k13G_155K4MS oPXgqRhztUoKs0lLv_sXEw5YiyoQ1SrGm0m8Q2PaFfY_aRu58C03eDgbcnY8 x1r1sKmZG6t4ciShAi8BfwgZXKbpk7Fo5kUriCZbOSohFc9Oz.al6Wwosr6D grs4LDojJpLObZ3Qr3VCBa4SsnueiWo_i3Ol.vIImhHMaYAmQiYdLapKpNZt nU8OLDsl._WvvYGGMLjV7.aPHTY3YMh8Nrgt_.thKkt2k9ZnJI56xECyczfh vhegvOBUSlhkvGDWCi1Og_mTY1VbgE1gDI9732L7z7waNjV1hmFMvZcDh8Ku tfz2s9owMKZBZbvuh7yZIC_0RHy4qCQYmnuxCdIUKoN2D._8EqMzcBmQIBLZ e6jPHnbDd6O5.rW9i9gaA8_rVk0tTf.zmUBABzZjObUyzXH6uFEEd.1.daAV AjA8fLUqmei5yKsbiS8nK7SafKogWxxKNtRXGASLhEvspMLuUwxW3qSm9Eor U7Xovm72J4Nr9l1KAJ_qE.wuitBCmjFiA41xqB3ufRT5C.7dm.yZJjf139qS iEWWeM3epp4pQvWe0Q0OY0iVi0Qo4Yele1N.PU5.t2Vj2x_Sr343m3kGg8sm Esf7oaQ1z0R6SbH8p0gnnmdATHkn1ZgcL8wKQ_HYGWIOtCzQDQnVqF4KeSiM lyaPIf4S441yhRbMa4JhqlFlfsLTDUwxGQYF1E2CPAGSc1qlCU3R
X-Originating-IP:	The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from	[209.85.160.194]
Authentication-Results:	Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info	mta4203.mail.gq1.yahoo.com [email address removed] header.s=20161025; dkim=pass (ok)
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from 127.0.0.1 (EHLO mail-qt1-f194.google.com) (209.85.160.194) by mta4203.mail.gq1.yahoo.com with SMTPS; Sat, 02 Feb 2019 06:52:50 +0000
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	by mail-qt1-f194.google.com with SMTP id i7so10329598qtj.10 for [email address removed] Fri, 01 Feb 2019 22:52:50 -0800 (PST)
DKIM-Signature:	Used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:reply-to:from:date:message-id:subject:to; bh=fqilKozldJancZc64GZDjBxqdyRipijSKwLxWz521Qo=; b=qHWmfzzt4H+4T+OFmFEbcXyPZ/ThQ9ubXdkamrxPRd1I2GgDadtOtunqEYj55tTmtp aKYdDB/tumLkIwVQkjyPeCAyIfypdfvaMjNxZPZegmLUmfYaJ84JPwGdQiPFsxlbwGKm W7YVvx2IT93HpKBqHcMJn/VRQBoCI62b2mgoob8aJKbEkzQRz2ZADoNfzK51xGh8VmqP m3X6wJGSDzgpKvgWao0LeHB0nrahMVyvt7Drs4NfbiHvY2fcVzwnagJQ5cbGCZSTFfM8 OoNz1YIty7FdqoqcchyyNQBox/eaIoXSy8RG4wUGW1hYczb6Bwhg2dZ66QqcyJrq1efq hbgg==
X-Google-DKIM-Signature:	Google Mail adds this to all their headers, it is used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:reply-to:from:date:message-id :subject:to; bh=fqilKozldJancZc64GZDjBxqdyRipijSKwLxWz521Qo=; b=W4DMyE5QEpR+dV/r/jErPX4dAiPb6TQuoKWz2QQHgibl5hh6KHgqKfhJCZlAGLCUD+ cWSg/5+6dHFysI0ovbl8dzcaLYZI4f9dui7x30A70xO1MCcO+z0GafXHsowLImopLJT4 s8+dFOrLHT3ILfJJBMRP0v/4919/od1p3T8mY5lgK4jh5FhmoxFmzTZ5xWNhGOFd82fQ yBfmBkjkb4mmaCur9cqdNu8fEqb5qHPbEjFOeFnHzCz25/5i06jkTMD/OyxpXxndMLb/ 3UpbQLTP2GqvLZX1JHatrXPcUM19NiH2N4C9fWlPnO7AgMZJeWlcGTC+XdiSbEW6JA9O HeRA== X-Gm-Message-State: AJcUukfMPlUdt7NCGTjw3WDwqDU7c41hDanWogj+mcNzufgMvsJmPBq0 j8qasGB5y2yzYOInggEtO0atyc0tuNfuFO8tpYA= X-Google-Smtp-Source: ALg8bN6XfyYClKN2J4vMLZNU+xCDjJ/TVK30Vo/D0R0EiVP56M3FCoIJdKEFDRMFxUGiFb5DQSNCRbJoQXO7femD2Ro=
X-Received:	Just like 'Received'. Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	by 2002:a0c:b28e:: with SMTP id r14mr40178700qve.241.1549090368968; Fri, 01 Feb 2019 22:52:48 -0800 (PST)
MIME-Version:	Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)	1.0
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	by 2002:ac8:33db:0:0:0:0:0 with HTTP; Fri, 1 Feb 2019 22:52:47 -0800 (PST)
Reply-To:	This is the email address any reply would be sent to by default	[email address removed]
From:	This is the address the email was apparently sent from	ATM COMPENSATION PAYMENT OFFICE [email address removed]
Date:	The date/time the email was sent	Fri, 1 Feb 2019 22:52:47 -0800
Message-ID:	A unique ID assigned to the ID for reference purposes	[email address removed]
Subject:	The subject of the email	FOLLOW THE INSTRUCTION TO DELIVER YOUR ATM CARD TO YOU.
To:	The email address(es) the email was sent to	undisclosed-recipients:;
Content-Type:	What type of content the email usually is, usually text/html, and what character set is used	multipart/mixed; boundary="0000000000002b6ed30580e3b5de"
Bcc:	Email addresses the email was secretly copied into, this field is usually blanked so even by viewing the email header you can't see who was secretly copied into the email	[email address removed]
Content-Length:	The size of the email, in bytes	212783

Your content is below the advert

The scam

ATM Director,( SKYE, Africa?s Global Bank)
SKYE BANK PLC NIGERIA.
P.O. Box 1668,
Head Office Address: 23,
Oyin Jolayemi Street, Victoria Island, Lagos, Nigeria

Attn: ATM Beneficiary,

Why are you Ignoring My E-mails? and Why do you refuse to call Mr.
Tokunbo Abiru from Skye Bank with his direct telephone No:
+234-80-2507-8474 immediately today or Drop Short Message Service
(SMS). If you know that you want to receive your ATM CARD DELIVERY
NEXT WEEK. I have done my best for you to put a smile on your face
next week. Open your attachment and fill the form given to you since
last year. Your total fund is loaded into your ATM CARD is the sum of
$25,500.000.00m.

You should stop delaying your ATM CARD DELIVERY till this moment.
Nobody will hitch or delay your ATM CARD DELIVERY to you. The most
importantly you shall be requested to pay the Activate Fees and
Delivery Charges Fees for the process of your ATM CARD with 100%.

Answer my question and You are advised to include the followings below
tell us your plan. We which you going good luck next week.

1, Why are you keeping silent over this issue...?
2, Do you want us to cancel your ATM CARD DELIVERY....?
3, What is holding the payment till this moment...?
4, Final date of the payment..?

I am here to inform you that your ATM Card package requested long ago
has finally been released for your claim. My meeting with the
government officials at the Annual Meeting held early 30 January 2019
revealed that your name was among those whose packages were seized by
the government authority. I told you earlier-stage that once we
receive the payment fees confirmation from you as we instructed you,
your total compensation sum of $25,500.000.00M USD successful delivery
to you. We will send you your ATM CARD which you will use to withdraw
your money in any ATM machine in any part of the world, Your ATM CARD
has been approved and upgraded in your favor. You are advised that a
maximum withdrawal value of $7,000.00usd is permitted daily. And we
are duly inter-switched and you can make withdrawal in any location of
the ATM Center of your choice/nearest to you in your country. Your
total amount is $25,500.000.00m USD only.

For your own good, you are advised to stop any further communication
outside this office. All you need to do now is come down here in
person for the collection of your ATM CARD once again your advise to
go to any bank of your choice to cash out your fund. You are
requested to get back to me for more direction and instruction on how
you want your ATM CARD to receive by you. I will like you to come down
here in person as you are not complying with me. So that you can
collect your ATM CARD in person but you want us to deliver the ATM
CARD to you over there in your country. It's going to cost you money
for the Activate Fees and Delivery Charges Fees and that is the only
money you are going to pay is for your Activate Fees and Delivery
Charges Fees only and other necessary things has been taking care of
by the Skye Bank authority as instructed,

You should contact Ceo. Tokunbo Abiru,
Executive Director. ATM Product/ Foreign Operations (SKYE BANK)
Call me with my direct telephone No: +234-80-2507-8474 immediately
today or Drop Short Message Service (SMS)
Email: skyebanksplc1247@yahoo.com

Thanks for Your Co-operation.

ATM CONTROL DEPARTMENT,

Attachment content - SKYE BANK FORM,.jpg:

Image text:

ClamAV for Windows - Antivirus report:

Known viruses: 6626722 Engine version: 0.99.4 Scanned directories: 0 Scanned files: 1 Infected files: 0 Data scanned: 0.15 MB Data read: 0.14 MB (ratio 1.03:1) Time: 23.047 sec (0 m 23 s) LibClamAV Warning: ************************************************** LibClamAV Warning: *** The virus database is older than 7 days! *** LibClamAV Warning: *** Please update it as soon as possible. *** LibClamAV Warning: **************************************************

SpamAssassin Report (spam score: 6.1)

 pts rule                       description                                       
---- ----------------------     --------------------------------------------------
 0.0 TVD_RCVD_IP                Message was received from an IP address           
 0.0 TVD_RCVD_IP4               Message was received from an IPv4 address         
 1.6 SUBJ_ALL_CAPS              Subject is all capitals                           
-0.0 SPF_PASS                   SPF: sender matches SPF record                    
 0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit          
                                (skyebanksplc1247[at]yahoo.com)                   
 0.0 FREEMAIL_FROM              Sender email is commonly abused enduser mail      
                                provider (howardnadle135[at]gmail.com)            
 0.0 DKIM_ADSP_CUSTOM_MED       No valid author signature, adsp_override is       
                                CUSTOM_MED                                        
 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit     
                                (howardnadle135[at]gmail.com)                     
 0.0 T_DEAR_BENEFICIARY         BODY: Dear Beneficiary:                           
 0.0 URIBL_BLOCKED              ADMINISTRATOR NOTICE: The query to URIBL was      
                                blocked. See                                      
                                http://wiki.apache.org/spamassassin/DnsBlocklists…
                                #dnsbl-block for more information. [URIs:         
                                scammed.by]                                       
 0.0 RCVD_IN_MSPIKE_H3          RBL: Good reputation (+3) [209.85.160.194 listed  
                                in wl.mailspike.net]                              
-0.0 RCVD_IN_DNSWL_NONE         RBL: Sender listed at http://www.dnswl.org/, no   
                                trust [209.85.160.194 listed in list.dnswl.org]   
 0.0 PP_MIME_FAKE_ASCII_TEXT    BODY: MIME text/plain claims to be ASCII but isn't
 0.1 DKIM_SIGNED                Message has a DKIM or DK signature, not           
                                necessarily valid                                 
 0.0 LOTS_OF_MONEY              Huge... sums of money                             
 0.0 RCVD_IN_MSPIKE_WL          Mailspike good senders                            
 0.1 DKIM_INVALID               DKIM or DK signature exists, but is not valid     
 1.0 FREEMAIL_REPLYTO           Reply-To/From or Reply-To/body contain different  
                                freemails                                         
 1.2 NML_ADSP_CUSTOM_MED        ADSP custom_med hit, and not from a mailing list  
 1.6 MONEY_FRAUD_8              Lots of money and very many fraud phrases

Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)