A few days ago I placed a bid on yahoo! auctions but lost it. The day
after I got several emails from different people (mainly from Italy)
saying that they could offer me the same article I bid for
significantly less money.
I replied to one of them and asked about conditions and security. He
answered the transaction was through yahoo auctions and he has an
account with $5000 and they would be responsible for all negative
consequences (even they would give me a refund if something went
wrong. Also, he claims that the shipment will be made through UPS. He
will put the product with UPS, UPS then will send me a confirmation
saying that the product is ready to be shipped when they get the
approval after my payment.

I gave this person my address and I already got 2 confirmation emails,
one from yahoo another from ups:
Yahoo email came from: aw-confirm@list1.ac.vip.scd.yahoo.com
UPS email came from  aw-confirmation@ups.com 

The UPS email says: This message was sent to you at the request of
Ionut Paunoiu to notify you that information related to the following
shipment will be shipped to you by UPS, but we will not proceed the
order until we get the confirmation from the seller that has been
paid.

Yahoo email says among other things: 3. Seller Marian Enache
(jurtkem@yahoo.com) has been
verified by Yahoo Shopping Auctions and there is no problem in dealing with him.
4.Yahoo Shopping Auctions allows the buyer to pay the seller using
Western Union service as the seller solicited!
5.Has an account ($5000) at us and if something will go wrong. Yahoo
Shopping Auctions will responsible for all negative consequence of
this transaction!

I?ve looked in yahoo and UPS but couldn?t find infor about these
people or this kind of transactions. 

Are these emails valid?
How can I verify this is not a fraudulent person/transaction? 
Is there any information regarding these emails or history of frauds
using this scheme?
How it is possible that I got a ups/yahoo email if this is not for real?
On the other hand, is it possible I just got a good deal?

---

Request for Question Clarification by pafalafa-ga on 01 Jun 2004 07:17 PDT

julio_f-ga,

STOP!!!!!

DO NOT SEND THESE PEOPLE YOUR MONEY.

You are being targeted by an unscrupulous scam.  I am preparing an
answer to your question that will provide some details of the scam,
and some steps that you can take to report it.

But I didn't want to wait with a warning.  Do not reply to these
emails or send any money to these people.  They are out to rob you.

I'll provide more detailed information in a while, as an answer to your question.

pafalafa-ga

Julio,

Thank you for having the foresight to run a check on the emails you
received.  I can assure you that they did not originate from Yahoo or
UPS, but are instead, fraudulent messages designed to look legitimate,
and to part you from your money.

As I said earlier -- do not send these people any money, or any
information.  They are out to rob you.

You received two emails -- one claiming to be from Yahoo, one from UPS
-- assuring you that there are "no problems" in the transaction you
are considering.  Note that both the emails begin similarly, with the
text:  "aw-confirm..."

aw-confirm is a fairly well-known scam that has mostly focused on ebay
customers, but is now apparently expanding its horizons.

A site called Fraud Watch International has a "Fraud Alert" posted on
the aw-confirm scam at:

http://www.fraudwatchinternational.com/fraud_alerts/040103_ebay.htm

=====

FRAUD ALERT 
eBay phishing email - "aw-confirm@ebay.com" 

Date Issued: January 03 2004 

eBay customers are the target of the latest 'phishing' emails.

This message is NOT from eBay.

=====

More recently, messages have begun appearing warning of aw-confirm spoofing Yahoo:

http://lists.sosdg.org/pipermail/sosdg-nanab/2004-March/001110.html

=====

Cgi1-yahoo.com has been Terminated off Hostingbyregister.com
Mar 29, 2004

The domain cgi1-yahoo.com has been terminated off
Hostingbyregister.com for spoofing yahoo.com
(http://cgi1-yahoo.com/secure/) effective today March 29, 2004 at 1
PM...

X-Originating-IP: [194.102.90.39]
From: aw-confirm at yahoo.com 

=====

In both cases, the messages were "phishing" -- attempting to get the
recipient to click on a website link, and enter sensitive information,
such as credit card numbers and passwords.

So the scam is a bit different than the one you received, but the
scammers look pretty familiar, either because they are the same
individuals responsbile for the earlier aw-confirm scams, or because
they are mimicing those scams.



You should report the fraudulent email to Yahoo, as they may very well
take action against the perpetrators.


A form for reporting Impersonations (emails masquarading as if they
came from Yahoo) can be found here:

=====

http://add.yahoo.com/fast/help/us/mail/cgi_abuse

Please use this form to report suspected issues of harassment or
impersonation to the Yahoo! Mail Abuse Team.

=====

Be sure to provide them the full details of the message you received
that appeared to come from Yahoo, including the email message headers
(the Yahoo page includes instructions for copying the full headers).

=====

UPS also has a page warning customers about fraudulent use of the UPS name:

=====

http://www.ups.com/content/cy/en/about/news/fraud_use.html

Fraudulent Usage of UPS Name and Brand 
 
Service Update
 
UPS has become aware of increasing fraudulent activity through the
misappropriation of the UPS name and brand.
 
=====


UPS asks that you contact them through the contact information
provided for the country you live in.  For the US, the contact
information page is here:

http://www.ups.com/content/us/en/contact/index.html 


I hope this provides you enough information to convince you of the
fraudulent nature of these emails, and to take steps to report them.

If you find you need additional information, please let me know how I
can help you further.  Just post a Request for Clarification, and I'm
at your service.

All the best,

pafalafa-ga



search strategy:  Google searches on:


aw-confirm
aw-confirmation
email (scam OR fraud OR impersonation OR hoax)

I hope you didn't go ahead with transaction!
Part of my job is to track fraudulent transaction for a company that
does e-commerce, therefore I do have experience with this kind of
issues.

First at all you must understand that anybody can send a email and
FAKE the sender's email, it's trivial for someone with SMTP(the
protocol used for email) knowledge.

Secondly, the names you just provided, are from Romania, a country (I
meant the people..) notorious for its fraudulent transactions over the
net.

Thirdly, UPS does not operate in such a way that you've described. The
only time you'll ever receive an email from UPS is when the item
actually is in the hands of UPS, or when a verified business customers
(i.e. AMAZON.COM) sends stuff to you. In this particular case, the
shipper has an account with UPS, and this allows them to pre-notify
UPS of the UPCOMING shipment, therefore you will RECEIVE an email with
a VALID tracking number.


Fourthly, YAHOO! Auctions would NEVER disclose any info regarding the
amount of money in its users accounts! IF there is a fraudulent
Auction, Yahoo covers up to $1000, IF certain conditions apply:
http://help.yahoo.com/help/us/auct/abid/insure/insure-01.html


This is a known type of fraud, and usually implies sophisticated fake
emails, even phone calls.

Your example is so typical, and I'm glad you posted here, so other
ones can learn from this.

STAY AWAY from this kind of transactions!!!

Wow!

What a GREAT Comment, Wandering.

Bryan

Hello,
Just a thought. I was on the receiving end of a few scams myself. It
is difficult sometimes to validate where an email is coming from so a
general rule that I use is to contact the company myself. If yahoo
sent you an email then surely they have records of it and a company
support person can validate that it is real. To get over on you this
way they would have to reroute your calls:) That doesn't happen too
often.

I encountered s somewhat similar situation. I replied to an ad on
AdPost.com for a Laptop and the seller is not giving me enough
information to complete the deal.

When I asked for clarification of warranty and original bills for the
laptop he is mum. I got two replies and both of them said only one
thing. ?I will send you the scanned copy of UPS shipping. You verify
and pay the price. I will release the item for shipping thereafter?. I
notified the AdPost.com support group and asked for a credibility
check on that person. He calls himself muianol and claims to be from
Romania.

The deal is so tempting that I can?t let it go so I just gave this guy
option of LC (Letter of Credit) or Cash on Delivery to complete the
deal.

I am yet to hear from him. 

I will post on any updates that I receive from this guy. 

Let?s see how far we can track him. The major job is with AdPost.com
since I don?t get to see this guy?s Email but he did give me a phone
number

Hey suryap I've encountered this guy muianol too but have no idea
about how to figure out if he's legit...

Any result from your last post?

Neji