Forward scams to - remove your name and email address first! TO CONTACT US CLICK HERE INSTEAD

Scam email #255959 - Attn:Hon Beneficiary

Email info

The email was sent on 2019-02-07 12:48:51 and appeared to be from infodirimfdptoffice@yahoo.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to www.usbtxorderingcustomer@outlook.com which was the scammer's actual email address.
It was probably sent from 74.6.131.123 in Unknown, United States

Email header

Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it

Header field	Description	Value
X-Apparently-To:	Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to	[email address removed] Thu, 07 Feb 2019 09:48:51 +0000
Return-Path:	The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path	[email address removed]
X-YahooFilteredBulk:	The IP here was blacklisted by Yahoo for sending spam	74.6.131.123
Received-SPF:	Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info	pass (domain of yahoo.com designates 74.6.131.123 as permitted sender)
X-YMailISG:	A unique ID added by the Yahoo Inbound Spam Guard	WqWFhCcWLDvflz31gTul8nfdlkIR632jbanPyprcwJyotGbD CCi2bF_9IC7z5GLP9WRAWl9hH.TLCiX2eb5xmdV9920ficmL7R5jMlQnitXl jOTDNHzkd42A4Cf3K31qgB.RCcKP2CQEbg0OEydh3SF3vMxgY9vSozFeTUpS 4fCJBD_zb_XSTGbSojt2JuPfYSjySbOc06TrsMNn4HbRHzZl.IjBOkbwhScY K6JSDBgXtoMvNMTBzrt51wsbD9o_XkTLDeuLBqj3AeKpi.Pi3JrGHALba0Vn S_KcYU5gOq_O57_mf4H3vK4KO1NXVvwQc7IbWPAv.NqgqB74wLjUEqyQf7mb cW0gbkBUh4iRqgIX4IZ9Vlrh1MGM6CXqc8pKwMzujM3qGs10fG5n766Cv0Yl slHNx9dwIgDX5jNKSOd5LtvQKuOHvQbKo_ETHCEjfunNaYD8M68F7Q9gRxz6 3MkZu_QxmLw_Nwfr11z9.UuISrItydUZsll.OkEQ5LqOYT.CqM8W52tAq6qf 91.Y_eOX4HDL4sxizf268GmSBk2p0tWDS8eyxkssKt_bQaqakO2B5nWcKT2O 31ikLPcnP8JaPZFhSWxUQISsiENgB01FdhGTwBhDklkpGD6ESwVYkg52SIja 9XWt25Sum7egyJ7q8vmzWW9PNiR2Slb64hSr3.fK46NX.ZyhMW76rPqC8YQQ Gj3GNTZFv90urHCwOIknm3e5.f2uQG4ZgHmM_Dv7N1EoeVN1T65cW7TNukuB 27oHpnBQa7KFCvlaWrAQdi8k12U_8.FalQD95ih9IpDSHA0qABpUMlsI5vWI efpyhxfmSiET.jJ_AjNpV4dfIWWc_pEgKC0eR81C8meI8YAuKAxFFtjEOHiF 3G9bGL7FiPXpAhcLy9Oy2nyqDZT_smaKjv6qMrS8tAOcwSgXpCY0TIo9pW98 odAiV1w47d_s5eHWMJu9VUaIfaRjM2TK11xWuK2Bo8aiPVSx_C3wQwflIbDM IkzF3R9KrwQtR8i0Qztl8Yuw8BHoevHvLgUutwiAUG0gul9RcF6j5YA2TykV DfmHSkD_9DWi77eq1mlToDmeH4LKJrZ3fWPaeGT4qCzlBELfsTYO.DcrJiHd V2slPrSrkZsCpI6oDSa0YdhUNNHffxePt2YzZcJmy5DNal6BDWqnr8EPbFE_ 08Iiy.Y-
X-Originating-IP:	The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from	[74.6.131.123]
Authentication-Results:	Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info	mta4030.mail.ne1.yahoo.com [email address removed] header.s=s2048; dkim=pass (ok)
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from 127.0.0.1 (EHLO sonic311-13.consmr.mail.bf2.yahoo.com) (74.6.131.123) by mta4030.mail.ne1.yahoo.com with SMTPS; Thu, 07 Feb 2019 09:48:50 +0000
DKIM-Signature:	Used to verify message integrity and ensure the header is not spoofed	v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1549532930; bh=VC1cTsUC8bGlWQU+uz38QvLf4Zeqxhxt8he4vdW0lYw=; h=Date:From:Reply-To:Subject:References:From:Subject; b=Zy+cW0GZnm/B0rRdbbGGPbVA1Df1txK+L/JhjKGCS3eLwpHqosY/qwF+qYo2YllwBAoAOpVVNAgJN0vzVtalPHxkjP5b8j3sSBZs5okXCLU3CHhMdmjqc83yRhmgT2GLgI0BvRToGneCGHaBNGbMpvZ7KmAGzO3OYLd2QLFBw74YOTg6C0d0qJInU3XjW6IRy0Bv3fVOogukyqILOays83ljoJ/pWvWwiQpb/uiYVsN+AcBisbzON7U5o0K1QZfGxsbJZTTjWZzo540vmMt2W+O3P8puTmsUdT8BC444xMnk697erHgb7tcMYxfXtBIJJs0LeWhSzsS+gGudygRRUg==
X-YMail-OSG:	A unique ID added by the Yahoo Outbound Spam Guard	ZEv2uO8VM1neMtx7C8bSKGQD1BdV9K1rKL46ZANh4K0DK8O6oyv6Sy5P8dVxenC xOboDlw.qWRM2Bz1rtNDXyqKLy8xbDaCzDsOPltLDBAAjsjO4eA9hTWNqhexZ9BSD.bSpx1ZJ1mA l9CW93HK0VioSOe9H6168eJLwr6i8PPMn8jcY7zZP7fgbDiISN6bhLg3ARKO79Z2RrxXV94oPU2h CmcApzIYeCKeCJvKwuQ5D82.ceUp86WVUKDcYCKeWKBp2.XMnUd5KbkWGOxvpYDg6jc9G6AH67Ku ERmsiDbO_PQT3_f5CxTwMNsrnu_Qd1jCv7xPA1xQ_fQdIV0oS1CEeUzEK6FJFADCQkaVvkgP5j8A bgzz7XVO39bGpMy8MY735vY.3cbimq6JQrjDhTOx1y68pCJeJHbZFz8.4OHZnQFfSB2ktbDhSG3Z 57jiUYk3X5YGEDIbAkFNKnjIRUyKr_TX10avPz9oaLLKkTGQxzZFNxuifqJclft2KAohkPx9SBS3 5.1ajP3T2BQzfIWWG_9KA43LR_X1qbIDn5yS3UZwDYJQOJhpO_jjoy071pyRtYcvBgsjikD7WJbg cM3Vfs7Rk_Jqsbbech78WuZS4cw_YoAXH8VU.1czdVLz3b7imSblpAYVntia4aLZ5ry7JmCXvmk6 _fijkKKNUJg3kuzz99Oq054ACi_i2KkVJMEJjIPaz8BTDtTwbYlWBpN2gaUUHpXYfIFi67dhoTM6 qRrgHZNywtIRRMqxBTAbqMl9_UUwSaacYVS15prl0gY11_vdPCm8xpaRdUPDXgobc0ZeYVK8vajc fcYc1HXptMR2qaYnEA6bsj9S_sz_qwksTOHFdWTEZAhQ6E7G8ucD82nR6NT16i0Q1xOQ7.FRlgJH O9B3zHWoYk33bJBlrZSApq4BCS21Yrviu49P5qYQc7hLxDmF5.6ELghmWuz65knXmQwHLGTwwzIg LCKOyIkJhk4Fajlya0zBJVTkmZyRwc6.zSWichWIkpcLji8dy9eq8zJc2BQmi1YQ3VH4oJOwJZtC QWfQuGMd9vj7ywoxQHISahUMzqB294iG96st_eR.jUnuUCM6B.p6pG1ZBsSJH68jSYYG5H7wxuKk -
Received:	Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took	from sonic.gate.mail.ne1.yahoo.com by sonic311.consmr.mail.bf2.yahoo.com with HTTP; Thu, 7 Feb 2019 09:48:49 +0000
Date:	The date/time the email was sent	Thu, 7 Feb 2019 09:48:48 +0000 (UTC)
From:	This is the address the email was apparently sent from	Elizabeth Truss MP [email address removed]
Reply-To:	This is the email address any reply would be sent to by default	Elizabeth Truss MP [email address removed]
Message-ID:	A unique ID assigned to the ID for reference purposes	[email address removed]
Subject:	The subject of the email	Attn:Hon Beneficiary
MIME-Version:	Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)	1.0
Content-Type:	What type of content the email usually is, usually text/html, and what character set is used	text/plain; charset=UTF-8
Content-Transfer-Encoding:	How the email has been encoded to comply with regulations (e.g. maximum characters per line)	7bit
References:	Facilitates the threading of emails; helps the email client piece together which emails belong together in a conversation	[email address removed]
X-Mailer:	The software used to send the email. Spambots, including those used by scammers, often falsify this as a version of Outlook or Outlook Express to get through some spam filters	WebService/1.1.13027 YahooMailBasic Mozilla/5.0 (Windows NT 6.1; rv:64.0) Gecko/20100101 Firefox/64.0
Content-Length:	The size of the email, in bytes	2387

Your content is below the advert

The scam

Ministry of Finance (United Kingdom)
130 Dufferin Avenue, Suite 400
London ON N6A 6G8
+44 797 832 969

Attn:Hon Beneficiary,

By means of this message, I wish to inform you that your hour of compensation and actualization has come after our meeting with the United Nations, Bank of America, South African Reserve Bank and the Federal Reserve Bank officials, it has been agreed that your approved payment valued US$10,500,000.00 with the compensation of US$2,300,000.00 (Total US$12,800,000.00) will now be process and released to you through Wire Transfer by U.S. Bank - San Angelo, Texas.

However,it may interest you to know that after the meeting, with the Bank of America, South African Reserve Bank and Office of the Director On-line Account Department have entered into full partnership with the U.S.Bank and your US$12,800,000.00 will now be credited to you by the Wire Transfer Department of the U.S.Bank as soon as you make contact to U.S.Bank Texas, To this effect, you are to contact the U.S. Bank - San Angelo, Texas with the details below for immediate release of your $12,800,000.00 to you.

Full Name:-----------------------
Address:-----------------------
Country:-----------------------
Telephone:-----------------------
Mobile:-----------------------
Alternative Email:-----------------------
Your ID or international passport:-----------------------

Kindly forward your information to U.S. Bank - San Angelo, Texas e-mail: www.usbtxorderingcustomer@outlook.com, Phone: +1 800-872-2657, and get your $12,800,000.00 United State Dollars release to you.

All modalities has been put in place for the successful wire transfer of your $12,800,000.00 United State Dollars to your Account. This process is 100% Genuine and risk free, as all international rules and regulations concerning Funds Transfer has been adhere to for safe transfer of your $12,800,000.00 into your Nominated Bank account.

Our mission with the instruction is to keep a clean slate of all debts that has been owned to beneficiary's because of some Government officials and individual who are not honest.

Acknowledge the receipt of this message for your Certificate of Fund Origin which you will forward to U.S. Bank - San Angelo, Texas for their re-confirmation to be attach to you.

Best Regards.

The Rt Hon
Elizabeth Truss MP
Chief Secretary to the Treasury
Ministry of Finance (United Kingdom)

SpamAssassin Report (spam score: 8.2)

 pts rule                   description                                       
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE     RBL: Sender listed at http://www.dnswl.org/, no   
                            trust [74.6.131.123 listed in list.dnswl.org]     
 0.0 TVD_RCVD_IP4           Message was received from an IPv4 address         
 0.0 TVD_RCVD_IP            Message was received from an IP address           
 0.6 HK_RANDOM_ENVFROM      Envelope sender username looks random             
 0.0 DKIM_ADSP_CUSTOM_MED   No valid author signature, adsp_override is       
                            CUSTOM_MED                                        
 0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail      
                            provider (infodirimfdptoffice[at]yahoo.com)       
 1.2 MISSING_HEADERS        Missing To: header                                
-0.0 SPF_PASS               SPF: sender matches SPF record                    
 1.0 FORGED_YAHOO_RCVD      'From' yahoo.com does not match 'Received' headers
 0.0 DEAR_BENEFICIARY       BODY: Dear Beneficiary:                           
 0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not           
                            necessarily valid                                 
 0.0 LOTS_OF_MONEY          Huge... sums of money                             
 0.1 DKIM_INVALID           DKIM or DK signature exists, but is not valid     
 1.9 REPLYTO_WITHOUT_TO_CC  No description available.                         
 1.0 FREEMAIL_REPLYTO       Reply-To/From or Reply-To/body contain different  
                            freemails                                         
 1.0 XFER_LOTSA_MONEY       Transfer a lot of money                           
 1.2 NML_ADSP_CUSTOM_MED    ADSP custom_med hit, and not from a mailing list  
 0.0 MONEY_FRAUD_8          Lots of money and very many fraud phrases

Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)