Tuesday, January 4, 2011

Foreign Banker Fraud Phishing example - pggymrk@gmail.com

Have any of you received the following phishing email? If you are reading this post, that is a good sign. See my commentary below

-----Original Message-----

From: webmaster@redcross.org.rs [mailto:admin@taiyuan-sz.com]

Sent: Tuesday, January 04, 2011 1:26 PM

Subject: FOR YOUR INFORMATION. ACT QUICKLY

Dear Friend,

In accordance to my religious persuasion,I felt expedient to write and inform you on the wicked conspiracy hatched by the duo of Mr David the Accounting Audit and Mr. William Anderson. Head of foreign remittances,Nat West Bank London - England BRANCH: Putney, 153 Putney High Street.LONDON SWI5 IRX UNITED KINGDOM to divert your money to their designated account in Europe.

As a junior staff,I discovered that they moved the Funds from our London Branch to a corespondent bank in Asia and from Asia; Today I found out through the Central computer database that they are about to reroute your fund to AIR COURIER SECURITY COMPANY in China. With this,I felt that it is important for me to alert you on this development, i have try calling but your number has not been going through.

They are still using your name and contract/inheritance identification number as the beneficiary but they have changed the account co-ordinate,that is why they are frustrating you by asking for money every time in order for them to go behind and contact you. I have the reference number of the transaction and also I have the number of the official who is directly in charge at the AIR COURIER SECURITY COMPANY.

Your Consignment is supposed to go through the London credit control financial clearinghouse before finally Lodge in AIR COURIER SECURITY COMPANY in London Uk .All the data about your claim profile are within my reach. I do not need gratification from you either in cash or kind; I can never be a part of evil because the bible said YE SHALL KNOW THE TRUTH AND THE TRUTH SHALL SET YOU FREE.

Please respect my discretion in this matter, you can send an email to me so that I can give you the reference number and the name and contact information of the officials of the AIR COURIER SECURITY COMPANY in Asia. I repeat, please do not expose my person, it is not easy to get jobs around here and I cannot contend with these powerful individuals because they can eliminate me just like that all i will do for you is to give a secret guidance on how you would contact the security department of my office and made a report to them concerning your approved fund.

But you must not expose me, all am assuring you was that once this report is made your fund will be recover immediately and release to you and them will be made to face the crime they have committed.

You can reach me through my email. (pggymrk@gmail.com)

Thanks and God bless.

Rev. Mrs.Peggy Mark


First sign of trouble in paradise is the non consistent email addresses (webmaster@redcross.org.rs,admin@taiyuan-sz.com pggymrk@gmail.com). The use of the Red Cross in the name of the from email address is no doubt used to instill a feeling of trust from a worldwide recognizable brand synonymous with goodwill.

When you read the e-mail, the tone of the e-mail is one of empathy, where the author claims to be trying to help recipient and save them from being defrauded from funds that are rightfully theirs and reside in another country in (London in this phishing example being move to somewhere in Asia then ultimately, China) and those funds are purported to be mishandled by senior executives in the company that the e-mail sender claims to work. Interesting that I did not even know that I had this money?!?

The author urges the recipient to take action to protect themselves by responding back to the provided gmail account. The author explains that they wish to help because of their religious convictions actually cite a passage from the Bible to demonstrate religious convictions. When an unsuspecting recipient responds, I assume that is when the ruse begins.

This seems like it would never work. Are there really people that gullible? Well, frankly its a numbers game. If these criminals send out 10,000 of these e-mails and they get a .1% response rate (1 out of 1000 email sent, one responds to pggymrk@gmail.com, that means that 10 people respond and if the phishing criminals and they came engage with one or more of the respondents to the phishing scam, they can get a pretty good return on their investment. This of course takes the approach to prequalify victims by sending mass emails to see which ones can be further engaged to give up their personal information, and eventually their identities.

These numbers are provided for illustrative purposed are made-up numbers. I'm not sure what the real ratios are. This particular email is particularly despicable to use the Red Cross and Bible citations as trust builders.

To protect their pggymrk@gmail.com gmail account prior to getting a response from an unspecting victim, they also attempt to appeal to the reader's good nature asking them not to expose them as they claim that their job is at risk and that if you expose them, then it will be difficult for them to find work, etc. Even as I right this blog post, I feel terrible for what's about to happen to the wholesome and honorable Rev. Mrs.Peggy Mark. Can anyone say religious appeal? Pretty slick. Burn in Hell I say you evil send of Phishing SPAM!


This phishing attempt is typical where the sender will appeal to a recipient’s sense of morality, conscious and also greed. Greed is probably the overriding appeal in this phishing scam because the recipient obviously doesn't know about any money they have in Europe, but yet they feel compelled to respond to this e-mail. For those that do have money in accounts in Europe, they know better than to fall victim to Rev. Mrs.Peggy Mark.

It will be interesting to see if there is a lot of searches for Rev. Mrs.Peggy Mark or the email address pggymrk@gmail.com. Hopefully recipients will turn to Google before respond and find this blog post.

Until next time, be safe read your e-mail carefully!