Anatomy of an Internet Scam at QRZ

Discussion in 'Amateur Radio News' started by AA7BQ, Aug 18, 2014.

ad: L-HROutlet
ad: l-rl
ad: Subscribe
ad: L-rfparts
ad: l-gcopper
  1. AA7BQ

    AA7BQ Guest

    Maybe you know someone who's had a bad experience when buying radio gear online from a private party, and maybe you don't. At QRZ, we've been tracking and monitoring our online swapmeet for years now and despite our best efforts, some people are still being taken. The story is always the same, a user answers an ad posted on QRZ and contacts the seller. Usually, the radio is fairly expensive but being offered at a great price. The buyer then sends the money to the seller, and never receives the goods.

    Over the past 10 days, I've been exchanging emails with one of the scammers while negotiating for the purchase of a supposed FTDX-9000. This particular scammer has already taken money from other QRZ members and we know this because his third-party money launderer is the same.

    Just follow along as I include the original ad as well as the emails that we shared with each other.

    Note: all of the email addresses, bank account numbers, and other personal information is the actual data that was given to me by the scammer. We are not hiding anything so that this thief can be completely exposed.

    The amateur AA1AX, who is mentioned several times in this article, has absolutely nothing to do with the deal. His callsign was stolen by the scammer.

    The story starts on August 12 with this ad posted in the QRZ Swapmeet:

    [​IMG] Yaesu-FTDX-9000D-HF-Transceiver
    This is my own personal transceiver, I have owned from brand new and it just 8 month old, it is the PEP model and I believe has less than 24 hours of use, or certainly close to it

    I am supplying the custom made dust cover which has always been on the rig when not in use which is most of the time.

    The rig is perfect in every way, it is complete as supplied direct from Yaesu.
    This is simply the ultimate rig, Period !!

    The Yaesu FTDX9000 series continues in the proud tradition of the FT-1000D.
    Covering HF and 6 meters, this is The 200 watts, large TFT, built-in memory board, main & sub receiver VRF, full dual rx, internal power supply.

    The leading edge TFT display on the FTDX9000D gives you unprecedented information and access to dozens of features and settings.


    Email me for more pictures :
    Aa1ax.aa1ax@gmail.com

    73




    Note that the email address shown above is real and it belongs to the scammer. The scammer identified himself as AA1AX however, looking at the account info at the bottom of the swap listing, it indicated that the user joined QRZ just the day before.

    Note to self: beware of expensive radios being offered by people who just came online.

    To start the scam, the scammer needed a QRZ login account. He found a callsign that was not associated with a QRZ account and went to GMail and created a fresh new account that matched his target callsign. Using the newly minted gmail account, he went back to QRZ and opened an account for AA1AX. Then, once logged in AA1AX, he posted the for-sale ad.

    Note: AA1AX is Paul Batutis, a ham who lives in Massachusetts but is not a QRZ member.

    We monitor all for-sale ads and this one caught our eye immediately. For starters, there were no photographs in the ad, which we do not allow. We immediately removed the ad and banned the AA1AX account. Next, I sent the following email to the scammer:

    (Green text is Fred, AA7BQ, Red text is the scammer)

    Hi there,
    I'm interested in the radio. Can you please send some pictures?


    The scammer responded quickly and sent along some great photos:

    Hello Fred, thank you for your email , here is your requested pictures ,

    kindly view attach pictures below ,

    price :$6200.00 include shipping

    thank you

    best regard
    73

    [​IMG]

    The photo was lifted from another website. It was easy to find using Google Image Search. I looked through a few pages of images before I found the original. It belongs to: http://www.radio-mart.net/Yaesu-FTDX-9000D-HF-Transceiver.html

    Then, I responded with:

    On Tue, Aug 12, 2014 at 12:22 PM, Fred Lloyd <
    flloyd@qrz.com> wrote:
    It looks VERY GOOD!

    How shall I send payment, and what kind of shipping will you use?

    -fred


    He then replied:

    Hello Fred ,

    Payment via bank transfer , kindly write me your full mail address, i will double box it for you and mail it down to your address .

    Thank you
    Best regards
    73


    To which I responded:

    On Tue, Aug 12, 2014 at 6:57 PM, Fred Lloyd <flloyd@qrz.com> wrote:
    Ok,

    My address is: QRZ LLC, 8711 E. Pinnacle Peak Rd. #193, Scottsdale, AZ 85255

    73,

    -fred


    Note how I sent him QRZ's company address. This didn't seem to phase him at all.
    His response was:

    Thanks for your respond, Kindly proceed with the below details to my wife bank account .

    BANK NAME : Rock land trust
    ACCOUNT NUMBER : 1473008686
    ROUTING NUMBER ; 011304478
    ACCOUNT NAME ; Annette Swartz
    BANK ADDRESS : moody st waltham Massachusetts for 02453
    COUNTRY : United State
    CITY : Waltham Massachusetts
    Zips code : 02453
    BENEFICIARY ADDRESS: 500 Main St. Waltham, Massachusetts 02452

    Kindly get back with a scan copy of payment slip and necessary transaction details.

    Hope to read from you soon.

    Thank you
    best regards
    73

    A couple of things to note about this. First, we had a complaint last month from a QRZ member who actually sent money to this same bank account, and Annette Swartz. When he reported it to us we explained to him that he had been scammed, and that he should have known better than to send a wire transfer of funds to a third party having a different name than the seller. He had a difficult time accepting this and he called the police on the ham whose callsign was used as a cover. It took a while for us to convince him that the person he thought he was dealing with wasn't a ham at all and that the callsign had been stolen.

    Note also the poor spelling and punctuation. There is a strong indication that the perpetrator is from overseas. The IP address he used to register for the fake AA1AX account originated from Australia, however this cannot be confirmed.

    Next, I decided to string him along, so I sent him the following:


    On Wed, Aug 13, 2014 at 8:27 AM, Fred Lloyd <flloyd@qrz.com> wrote:
    Paul,

    Thank you for the banking info. I am preparing the transfer now. Before I send such a large sum
    of money, I'm sure that you will understand that I will need you to send me a copy of your driver's
    license or passport, and that of your wife since she will be receiving the funds. You can scan or
    photograph the documents and email them directly to me.

    thanks and 73,

    -fred

    To which he responded:

    Hello Fred ,



    How you doing today ? have been at the hospital since for my surgery, came for my chest treatment ,
    Am an cancel Patient that why, will i cant do anything here , and my wife she is the one running around now , but i will ask here to get you her id sir ,


    thank you
    best regards
    73


    Here, he pulls the cancer card, or as he calls himself, a "cancel Patient", as if this is supposed to endear me to his plight. Normally I would care deeply about anyone with cancer, but in this case, I know that the only illness is his sick mind.

    His next email floored me. He sent me a passport photo!

    ​Hello Fred ,


    Here is my passport , i think this should stand the trust sir,


    thank you
    best regards

    73

    [​IMG]

    The passport is quite obviously faked. When you look at the image up close, or even at a distance, it's easy to see that the picture was photoshopped and the name written in. It's the most cheezy attempt at a falsifying document that I've seen in quite some time.

    Here is a closeup that makes it even more apparent:

    [​IMG]

    Next, I wrote him the following, asking for some ID for his wife:


    On Wed, Aug 13, 2014 at 5:59 PM, Fred Lloyd
    <flloyd@qrz.com> wrote:
    Thanks for your ID. I'm still waiting on your wife's ID since she has a different last name, and since she is on the bank account.

    73

    -fred


    He then responded with:

    Hello Fred ,


    How you doing Sir, am sick i would have don everything in time but never mind, my wife has already help me out with your requested ID, She was also Able to take it to the DHL EXPRESS MAIL today so is ready to be mail to your following address ,

    ADDRESS ; QRZ LLC, 8711 E. Pinnacle Peak Rd. #193, Scottsdale, AZ 85255



    Kindly view attach pictures .


    thank you

    best regards
    73


    This time, he sent me a DHL Waybill for the radio (addressed to me) and a quite obviously doctored Mass Drivers License:

    [​IMG]
    Fake DHL Waybill

    [​IMG]

    The "Face" of Annette Swartz. This forgery is so bad as to be laughable.


    I waited about 24 hours and on Aug 15th, He said:

    Hello Fred ,



    Are you still buying the FTDX-9000 ? i need to know from you Sir .


    thanks
    73



    By the next day, he was getting more anxious and sent me this email:

    Hello Fred ,



    What is going on now because am not hearing from you , you requested for my passport and my wife ID card am still not hearing anything from you sir, if you know you are not buying the FTDX-9000 , you should have not requested for my passport and also for my wife ID card she has been waiting for you and you know am not feeling fine, am still at the hospital the DR say i need a surgery on my feet to make me walk again, so that why i needed the money not just that i really want to sale it if not for the help of founds for my health, it very unfair sir, if you cant send the money true the bank , i think there's another way of send the money true :USPS poster money order .,that should be better to my address : Annette Swartz 500 Main St. Waltham, Massachusetts 02452.


    thank you

    best regards
    73



    To which I responded:

    Hi,

    I'm prepared to pick up the radio in person. Please give me your address and I'll show up with cash in hand.

    -fred


    And then a few minutes later, I wrote:

    Hi,
    The reason I've been slow to respond is that I'm currently traveling in a motorhome.

    As I stated in the last email, I have the cash in hand and will pick the unit up in person.

    -fred

    Now he's really flapping in the breeze. He thinks that I'm still interested and can't decide whether I'm still on the hook.
    I've offered to purchase the radio for cash, and since I'm in a motorhome, I'll drive by and pick it up. Here's what he had to say:

    Hi,



    You should have explain that to me, I would have ask my wife to live for work she has been at the house and go around for me ,
    remember i need it for my surgery Fred that why am writing you, on Monday i must do it that what the DR say , so please help me , and if you can pay 50% out of the money,if you not sure of coming down here, and when you receive it you send me the rest found. i will be very happy to get my health back on track sir. bless you sir


    thank you
    best regards
    73


    Translation: he's saying that if I send him half the money as a deposit the deal can be done, and his health will benefit.

    To which, I responded:

    On Sun, Aug 17, 2014 at 6:06 PM, Fred Lloyd
    <flloyd@qrz.com> wrote:
    Paul,

    Send me your phone number and I'll call you right away. I'm sure we can work something out.
    The 50% deal sounds OK.

    -fred



    Then, the next day, he says:

    someone is picking it up tomorrow morning, have wait for you sir but i think you not ready to take it .


    thanks 73

    So this marks the end of this deal. My final response below:

    Well, I guess that means I'm the lucky one.

    Here is what I know:

    1. You are not Paul Batutis, AA1AX. I know Paul and just spoke to him on the telephone last week.

    2. You do not have an FTDX-9000 in your possession, and, you stole the pictures from another
    website. The pictures you used came from:
    http://www.radio-mart.net/Yaesu-FTDX-9000D-HF-Transceiver.html

    3. We know of other cases where hams have sent money to Annette Swartz and been defrauded.

    4. The passport image that you sent me was a forgery.

    5. The drivers license for Annette Swartz was a forgery.

    6. You are not located in the United States.

    7. You do not speak or write English very well.

    8. You were pretty stupid to think that you could deal with me, the owner of the website, and
    not be caught.

    You, sir, are a common thief. You have stolen money from elderly hams, and you have forged emails
    and other documents to steal from people.

    We have contacted the authorities, who were very interested when I showed them the forged passport.

    Very soon, every person on the QRZ website will know you.

    Sincerely,

    Fred Lloyd, AA7BQ



    Lessons Learned in How to Avoid Getting Ripped Off


    • The scammer is thought to be located overseas and is using a USA-based bank account to launder the funds.
    • The scammer usually creates an email address that looks like the callsign, such as aa1ax.aa1ax@gmail.com, and there is usually a dot (.) in the mailbox name. If he were going to impersonate me, he would probably create a new email address such as aa7bq.fred@yahoo.com or maybe aa7bq.aa7bq@gmail.com
    • The name Annette Swartz is a huge red flag. Never, NEVER send money to a bank account, and never send money to a recipient having a different name than the callsign holder.
    • Beware of any seller who will not talk to you on the phone.
    • Beware of sellers with English or Anglo-saxon sounding names who, over the phone, have a thick foreign accent.
    • Pay attention to GRAMMAR in the email communications. Our scammer has poor english skills. The original ad copy may have been written by someone else and subsequently pilfered by the scammer.
    • Beware of any seller who has just joined QRZ and shortly thereafter offers a late model, expensive radio for sale.
    • Do your homework! Search the internet for images of the radio model you are considering. See if you can find the exact same photo used in the ad somewhere else.
    • Carefully scrutinize photos, and blow them up to see if any identifying information has been "photoshopped" to alter the image. This can include the callsign in the photo, or, names, etc., on passports and drivers licenses.
    • Ask for references, i.e. the names of other hams who the seller knows, an then CONTACT the references. You can lookup a great many names and phone numbers (including the seller's), on http://www.whitepages.com
    • Ask for a fresh photograph of the item being offered, with an identifying background, possibly a current newspaper headline.
    • NEVER SEND MONEY VIA BANK OR WIRE TRANSFER. These types of transactions are one-way. There is absolutely no way to get your money back if something goes wrong.
    • NEVER SEND MONEY VIA WESTERN UNION. Same reason as above, zero buyer protection, not traceable.
    • PayPal is usually the best option for sending money. PayPal will refund your money in many cases, provided that you did not send money using a "gift payment". NEVER SEND A "GIFT" PAYMENT BY PAYPAL. Gift payments explicitly have no buyer protection from PayPal.
    • Don't count on any help from law enforcement in the event you are vicitimized. Even the FBI can't help you when you've sent money to someone living overseas. Local law enforcement won't have any interest in the case either. You'll likely be on your own.

    So, that's our story. Please bring this to the attention of everyone you know because the more people that know about Annette Swartz, the less likely folks will get ripped off.

    73, -fred AA7BQ
     
    Last edited by a moderator: Aug 20, 2014
    KD0HKD, N2SUB, VA3BLL and 9 others like this.
  2. N2OBS

    N2OBS Ham Member QRZ Page

    Fred,
    Shame people have to be so dishonest. Another of my dislike is people threaten by competition mentioned and hide it the old fashion way by deleting. Competition keeps those companies who want only your money and provide lip services which when someone does this tactic it they take it personally. So many businesses are easy to open up on the web and they are a dime a dozen looking for their pockets to be lined. That's another shame on these who have no honor or morality. Have a good day.
     
    KF5WFG and WA0YAS like this.
  3. AG2AA

    AG2AA Ham Member QRZ Page

    Cool. you should be on dateline Chris Hansen or 20/20 or something. Nicely done.
     
    KF5WFG likes this.
  4. K1ZJH

    K1ZJH Ham Member QRZ Page

    KF5WFG likes this.
  5. KC1MAC

    KC1MAC Ham Member QRZ Page

    Bravo! Well Played..
     
  6. KA9PHZ

    KA9PHZ Ham Member QRZ Page

    Hi Fred.

    I found this very interesting. I think you maybe you shouldn't have sent him the final email. Now he is alerted and may fade away. There is probably very little that can be done to stop these people who operate from other countries. Thanks for alerting everyone on here.
    AL
    KA9PHZ
     
    KF5WFG likes this.
  7. VE6NS

    VE6NS Premium Subscriber QRZ Page

    So what about his surgury now? Ya kind of left him hanging don't ya think?
     
    VE7JBX and KJ4RWH like this.
  8. W6KM

    W6KM Subscriber QRZ Page

    Thank you for taking the time to detail the scam. I am amazed as to how much effort this person put into trying to make it seem legit. QRZ is a good source for information and also for finding good used Ham related items. Thanks and 73.............. Dick, W6KM
     
  9. N0SAP

    N0SAP Ham Member QRZ Page

    Radio-Mart was a big seller on eBay for years. Currently he has not sold on eBay since 7-2-13. Fred you may want to contact eBay for further information about Radio-Mart, it might be in everyone's best interest. Thank you from everyone on the good job QRZ is doing with the site and protecting us. "SAP" NØSAP
     
  10. K5GHS

    K5GHS Ham Member QRZ Page

    I'm betting he will change his ID, names hes using on the account, etc, and try again. Maybe on another ham site.

    People often ask why such scams continue to happen on the internet. This right here demonstrates why-that unless you pay attention and realize something is too good to be true, they still get suckers all the time.

    I've read articles on the internet and have noticed signs at establishments that provide western union type services, especially in California for those who do not speak English, that scream in bold lettering to BE SURE you know who you are wiring money to, because you cannot get it back.

    That tells me that people are still falling for these types of scams hook, line and sinker.

    This guy will try again. He figures he is untouchable because he is not in this country. And depending on where he is, he may very well be that. Some places just don't really care about this kind of stuff, honestly.

    I think the best thing you can get out of this is not only to be suspect if something seems too good to be true, but to investigate it like happened here, and if you have any doubts, seek the advice of your fellow hams as well. I know I prevented a friend a few years ago in falling for one of those scams where you get a check in the mail for much more than the amount of the item being sold...and they want you to send the item plus the change back.

    Its really a shame its come to this, but its been happening even before the internet got traction. I remember the days of being on AOL. Having an IM window which, on the bottom of each one, said, in BOLD LETTERING: "AOL EMPLOYEES WILL NEVER ASK YOU FOR YOUR PASSWORD OR PERSONAL INFORMATION" and windows opening up from random users saying they were AOL Tech Support and the first thing they wanted was your password. And people would give it to them.

    It has just got worse from there, and its not going away.
     

Share This Page