DelphiFAQ Home Search:

Is this Russian girl scamming me? How to recognize scammers

 

comments7349 comments. Current rating: 5 stars (830 votes). Leave comments and/ or rate it.

Are you an American or Western European man exchanging emails with a girl from Russia? I was contacted by a girl who turned out to be a scammer. Reader Derrick put together some great advice how to detect scammers.
I only have one advice (#8) to add: If a Russian girl tells you that she will get a visa to the USA instead of inviting you, that is - under the current immigration law - a SURE sign that SHE LIES.

Here is the process how a Russian woman can come to the USA:

If she is considered a relatively young/ attractive woman (let's say under 40, hope I don't hurt anyone's feelings here), then there is virtually NO CHANCE THAT SHE GETS A TOURIST VISA TO THE USA. First the Russian Federation will not allow her to leave the country. Then, even if she was getting out, the USA will deny her admission. The reasoning is that she is considered a risk. How could she not be a risk? If she had family in Russia (husband, children) or a valuable business or real estate. Most likely the woman who writes you will be considered a risk. The only way for her to get a visa into the USA is this procedure:

  1. the foreign man visits her in her native area in Russia
  2. they get engaged during such a visit - take photos of the 2 of you together
  3. he flies back and applies for a K-1 visa. A K-1 visa is also known as Fiancee visa, used for marriage-based immigration
  4. once the K1 visa is granted, the girl can enter the USA and stay there for 3 months. By the end of these 3 months you HAVE to GET MARRIED or the girl has to go back home.
  5. if you get married, the girl gets a greencard and can work
  6. after 3 years of marriage, the girl can apply for a US citizenship. That's when they interview you to find out if it's a real marriage. She also has to answer some questions about US history, political system, etc etc.


Here are Derrick's tricks (1-7) that he uses immediately from the start:
  1. GOOGLE or websearch the first part of the scammers first emails and/or 'profile'. SEE HOW MANY OTHER SITES their listed on! RECORD THOSE SITES FOR FUTURE REFERENCE. THAT alone can give you a good idea IF your dealing with a scammer OR not.
  2. GOOGLE or websearch the return email address. See how many 'hits' come from that search and also note all the sites. (many times you'll see the email end up on a 'scammers list') IF YOU FIND THE EMAIL ADDRESS LISTED ON A SCAMMER LIST - don't bother further, your only fooling yourself - no matter what excuse they might give you.
  3. FROM THE START - ASK FOR SPECIFIC INFOMATION! A full name, address, phone number - something. OFFER THE SAME in exchange, except make it a P.O. box and a CELL PHONE rental card that will protect your identity. If you see your requests ignored, which you usually will, don't waste your time further.
  4. ALWAYS ASK SPECIFIC QUESTIONS that would REQUIRE A SPECIFIC ANSWER outside the use of FORM LETTERS. IF YOU FIND your questions go unaddress in your reply emails from 'them/her' - YOUR DEALING WITH A SCAMMER. Again, don't bother further.
  5. DON'T WAIT 6 MONTHS to offer to talk with the PROSPECT by phone! WHAT A TOTAL WASTE OF TIME! IF THERE IS CHEMISTRY OR APPEARS 'INTEREST' BETWEEN THE TWO OF YOU - then sieze the opportunity. ARRANGE A PHONE CALL! International rates to Russia and most places are reasonably cheap. IF YOU GET THE REPLY ' I'M SO POOR I DON'T HAVE ACCESS TO A PHONE' - drop the whole thing, your only wasting your time and WILL BE SCAMMED at some point in the future.
  6. PHOTO FLOOD! IF IT/SHE/HIM/THEM - LOOK TOO GOOD TO BE TRUE - THEN IT PROBABLY IS! MOST IF NOT ALL OF THE SCAMMES USE PHOTOS OF MODELS IN THEIR HOME COUNTRIES TO POSE ON THE NET IN THEIR PROFILE(s)! Consider this - IF THEY LOOK like a MODEL then tell you they're so poor they don't have access to a phone - YOUR BEING SCAMMED!

    ASK FOR A SPECIAL PHOTO TO BE TAKEN. IF YOU SENT YOURS, HAVE THEM TAKE A PHOTO SHOWING THEM HOLDING UP YOUR PHOTO IN THE PICTURE! That is a good 'scammer filter' - even the most adept with Photoshop will easily be spoted.

    BETTER STILL - ASK THEM TO TAKE A PHOTO THAT SHOWS THEM HOLDING A CURRENT NEWPAPER OF YOUR CHOICE OR THEIR COUNTRY, WITH A RESOLUTION THAT YOU CAN READ THE DATE! NOT some low grade - grainy photo! FEW WILL EVER DO THAT.

    AT THE LEAST - ASK THEM FOR A PHOTO of them wearing a specific combination of clothes and/or colors - something different then the usual 'model clothing' - most use to send out. OR AN OBJECT - TOASTER, ELECTRIC CLOCK, BY A COUCH, IN A ROCKING CHAIR something that would be very hard to use PHOTOSHOP to just PUT in another FILE PHOTO.

    *** IF this person is real or sincere, they won't mind doing this for you! ALSO - offer to do the same for their comfort also - that is only fair.
  7. IF THINGS GET SERIOUS - then ASK THEM TO DELETE ALL THEIR OTHER WEB PROFILE POSTS! CHECK ON THE ONES YOU NOTED EARLIER! Again, IF THEIR SINCERE - they will - happily as your their DREAM and future!
  8. If she talks about getting a visa or that she needs money to get a travel visa to the USA, she lies. See the proper course of action described at the top.



Comments:

You are on page 87 of 490, other pages: 1 2 3 84 85 86 [87] 88 89 90 487 488 489 490
2007-08-05, 08:25:47
anonymous from United States  
Broom in Lietuva,

You are in a privileged position to understand Russian culture; You only need to board a bus to Kaliningrad (If this name is offensive to you, make it Konigsburg)

This forum is not about misunderstanding Russian girls in general; It's to separate scammers from respectable ones.

OJAS

P.S. I enjoy games of your chess master Mikenas
2007-08-05, 10:00:44
anonymous from Canada  
And yet again, another scammer picture and letter.

Hello! It is very pleasant for me, that you have written to me the
email the address and I can send you more my photos and tell about
myself. Unfortunately I cannot be for a long time on a site of
acquaintances as I use for this purpose a working computer. But I can
come in the Internet of cafe or to my girlfriend Naste to write to you
the letter if you will want to continue our dialogue. Excuse, if my
letters look a little chaotically, but I have more recently decided to
start to get acquainted with men through the Internet and I still
badly am able to use a computer. I have decided to get acquainted with
the man of their other country because here in Russia men count the
woman simply a labour which should put things in order in the house,
erase and prepare for a meal, but I want that me loved counted the
PERSON, instead of the slave. For me not important the country, a
difference in the age of and presence of children at the man. I simply
want to be HAPPY!!! If you have any questions to me ask them. You can
tell to me more about yourself, the family, customs of your country?
It is very interesting to me to learn about it. I shall wait for your
answer.
Anna from Kozmodemyansk, Russia.




Keywords:
2007-08-05, 13:52:23
'S' from United States  
Anon Canada,Will you at least post the e-mail addy's? A full header would be nice too.Pic's and letter's don't help much!

For future reference the following is the important info to post first;

A photo {preferably labeled with the name and e-mail address.To avoid confusion}
Name {with surname if possible}

E-mail address {IMPORTANT}

Location {country,city,street}

Phone number {if given}

The first and money request letter,with full header.With that the IP can be seen and if an X-mailer {ie;THEBAT- For Russian scammers}is used.

The dating site the scammer contacted you on.


With that available people doing a google search will get answer's.



SNT...
2007-08-05, 13:55:37
'S' from United States  
The 'edit' button doesn't work!!!???

Wanted to add this to the above;

When posting 'her' photo, include in your message itself, any body-piercings, tattoos, moles, dimples, whatever strikes you.



SNT...
2007-08-05, 14:38:08
anonymous from United States  
This one went by Linda Bruce and claimed to be from Texas


Keywords:
2007-08-05, 14:39:08
anonymous from United States  
more Linda


Keywords:
2007-08-05, 14:39:45
anonymous from United States  
another Linda


Keywords:
2007-08-05, 14:40:21
anonymous from United States  
the last Linda I have


Keywords:
2007-08-05, 15:31:05
drod from United States  
Anon USA,

For the future,

More info please.

Name, first and last.
Address
Email address
Phone, if available
First email w/header
Money letter w/header
Photos w/name listed
Site met

Any other info you feel relevant.

This info will be picked up by the web for future searches.

good hunting........drod
2007-08-05, 16:19:24
Eddie from Sweden  
Coldiron711 from United States ....if you have so many pics etc of this Nigerian scammer, you should really think about starting a new thread. You can do it using the 'add new scammer' at the bottom of the page.
2007-08-05, 16:47:12
anonymous from United States  
It is the weekend.I'm sure Peter will have them up by Tues.You should get a notification.
2007-08-05, 18:02:54
drod from United States  
Have a strange one. Received in my junk box, with an attachment.

Did not open the mail, let alone the attachment, just 'viewed source' and searched header.

Open to comments, if any.

Header search is long, sorry.

.............
.............


X-Message-Delivery: Vj0zLjQuMDt1cz0wO2k9MDtsPTA7YT0w
X-Message-Status: n:0
X-SID-PRA: =?windows-1251?B?RG9uYWxk?= <donaldanderson_jr@hotmail.com>
X-SID-Result: SoftFail
X-Message-Inf6sSXyD95QpVZgSQljgjvY7gdTLZnDrPj3CYChl1hz+ mJL7rqsQluViYYXzehlehlL9riq3ZumvzqARLjITo6NLHZA==
Received: from viefep20-int.chello.at ([213.46.255.22]) by bay0-mc12-f2.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
    Sun, 5 Aug 2007 11:44:22 -0700
Received: from chello089079021054.chello.pl ([89.79.21.54])
by viefep20-int.chello.at
(InterMail vM.7.08.02.00 201-2186-121-20061213) with SMTP
id <20070805184405.RXGQ1832.viefep20-int.chello.at@chello089079021054.chello.pl>
for <drodxxxxxxxxxxx>; Sun, 5 Aug 2007 20:44:05 +0200
Reply-To: '=?windows-1251?B?RG9uYWxk?=' <donaldanderson_jr@hotmail.com>
From: '=?windows-1251?B?RG9uYWxk?=' <donaldanderson_jr@hotmail.com>
To: <drodxxxxxxxxxxx>
Subject: =?windows-1251?B?SGkgaXQgaXMgRG9uLiBJIGhhdmUgYmFkIG5ld3MgZm9yIHlvdS4=?=
Date: Sun, 5 Aug 2007 22:42:44 +0400
MIME-Version: 1.0
Content-Type: multipart/mixed;
    boundary='----=_NextPart_000_00F7_01C2A9A6.5B9F3DFC'
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20070805184405.RXGQ1832.viefep20-int.chello.at@chello089079021054.chello.pl>
Return-Path: donaldanderson_jr@hotmail.com
X-OriginalArrivalTime: 05 Aug 2007 18:44:23.0159 (UTC) FILETIME=[A4172070:01C7D790]

This is a multi-part message in MIME format.

------=_NextPart_000_00F7_01C2A9A6.5B9F3DFC
Content-Type: text/plain;
    charset='windows-1251'
Content-Transfer-Encoding: 7bit

Hello my angel. How are you? sorry for long time responding. I try find all money but i can't find it.
Sorry my love but now i send to you first part of all money. I hope you receive it soon. I love you my baby and want
to be with you together. I wanting your mail. Please don't write to me to it e-mail because i use it at work
write to my home e-mail after then you take money. I use money gram for it. You can see all information about money
transfer at attachment. My darling i hope you not drop me and you are real.

With love Don.


------=_NextPart_000_00F7_01C2A9A6.5B9F3DFC
Content-Type: application/octet-stream;
    name='MG information (38963824) for my angel.com'
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
    filename='MG information (38963824) for my angel.com'

.........
.........

WHOIS - 7.08.02.00
Generated by www.DNSstuff.com
Location: United States [City: Columbus, Ohio]

[Note: Using 7.0.0.0 instead of 7.08.02.00, to save time and bandwidth]
Using 8 day old cached answer (or, you can get fresh results).
Hiding E-mail address (you can get results with the E-mail address).


OrgName: DoD Network Information Center
OrgID: DNIC
Address: 3990 E. Broad Street
City: Columbus
StateProv: OH
PostalCode: 43218
Country: US

NetRange: 7.0.0.0 - 7.255.255.255
CIDR: 7.0.0.0/8
NetName: DISANET7
NetHandle: NET-7-0-0-0-1
Parent:
NetType: Direct Allocation
Comment:
RegDate: 1997-11-24
Updated: 2006-04-28

OrgTechHandle: MIL-HSTMST-ARIN
OrgTechName: Network DoD
OrgTechPhone: +1-800-365-3642
OrgTechEmail: **********@nic.mil

# ARIN WHOIS database, last updated 2007-07-27 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.


……
WHOIS - 89.79.21.54
Generated by www.DNSstuff.com
Location: Austria [City: Vienna, Wien]

% This is the RIPE Whois query server #1.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net..ight.html

% Information related to '89.64.0.0 - 89.79.255.255'

inetnum: 89.64.0.0 - 89.79.255.255
org: ORG-UTKS1-RIPE
netname: PL-UPC-20060222
descr: UPC Telewizja Kablowa Sp. z o.o.
country: PL
admin-c: UP94-RIPE
tech-c: UP94-RIPE
status: ALLOCATED PA
notify: **********@upc.com.pl
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: UPC-PL-MNT
mnt-routes: UPC-PL-MNT
mnt-domains: UPC-PL-MNT
changed: **********@ripe.net 20060222
source: RIPE

organisation: ORG-UTKS1-RIPE
org-name: UPC Telewizja Kablowa Sp. z o.o.
org-type: LIR
address: ul. Szturmowa 2a
address: 02-678
address: Warszawa
address: Poland
phone: +48 22 7010 900
fax-no: +48 22 7010 901
e-mail: ***@upc.com.pl
admin-c: MK17510-RIPE
admin-c: TK627-RIPE
admin-c: JJ2128-RIPE
admin-c: RM695-RIPE
admin-c: SB666-RIPE
admin-c: MS2509-RIPE
mnt-ref: UPC-PL-MNT
mnt-ref: RIPE-NCC-HM-MNT
mnt-by: RIPE-NCC-HM-MNT
changed: **********@ripe.net 20040415
changed: *********@ripe.net 20050421
changed: *********@ripe.net 20050511
changed: *********@ripe.net 20050511
changed: *********@ripe.net 20050516
changed: *********@ripe.net 20050617
changed: *********@ripe.net 20050621
changed: *********@ripe.net 20050621
changed: *********@ripe.net 20050707
changed: *********@ripe.net 20050711
changed: *********@ripe.net 20050711
changed: *********@ripe.net 20050711
changed: *********@ripe.net 20050802
changed: *********@ripe.net 20050815
changed: *********@ripe.net 20060213
changed: *********@ripe.net 20060213
changed: *********@ripe.net 20060314
source: RIPE

role: UPC Poland
address: UPC Telewizja Kablowa
address: ul. Szturmowa 2a
address: 02-678 Warszawa
address: POLAND
phone: +48 22 7010 900
fax-no: +48 22 7010 901
e-mail: ****************@upc.com.pl
admin-c: MK17510-RIPE
admin-c: TK627-RIPE
admin-c: SK1870-RIPE
admin-c: SB666-RIPE
tech-c: TK627-RIPE
tech-c: JJ2128-RIPE
tech-c: RM695-RIPE
nic-hdl: UP94-RIPE
remarks: = ==================================================================
remarks:
remarks: Any abuse activities including, but not limited to spamming,
remarks: hacking and intrusion attempts coming from chello.pl address
remarks: space shall be reported ONLY to:
remarks:
remarks: _ *****@chello.pl
remarks:
remarks: Any reports sent to any other e-mail addresses may be treated
remarks: as SPAM itself and followed by legal actions against originator.
remarks:
remarks: = ==================================================================
mnt-by: UPC-PL-MNT
changed: ****************@upc.com.pl 20040222
source: RIPE

% Information related to '89.72.0.0/13AS9141'

route: 89.72.0.0/13
descr: UPC.pl
origin: AS9141
remarks: Any abuse activities including, but not limited to spamming,
remarks: hacking and intrusion attempts coming from chello.pl address
remarks: space shall be reported ONLY to:
remarks:
remarks: *****@chello.pl
remarks:
remarks: Any reports sent to any other e-mail addresses may be treated
remarks: as SPAM itself and followed by legal actions
remarks: against originator
mnt-by: AS6830-MNT
changed: **********@chello.at 20060313
changed: **********@chello.at 20070131
source: RIPE

% Information related to '89.64.0.0/12AS9141'

route: 89.64.0.0/12
descr: UPC.pl
origin: AS9141
remarks: Any abuse activities including, but not limited to spamming,
remarks: hacking and intrusion attempts coming from chello.pl address
remarks: space shall be reported ONLY to:
remarks:
remarks: *****@chello.pl
remarks:
remarks: Any reports sent to any other e-mail addresses may be treated
remarks: as SPAM itself and followed by legal actions
remarks: against originator
mnt-by: AS6830-MNT
changed: **********@chello.at 20060313
changed: **********@chello.at 20070131
source: RIPE

% Information related to '89.79.0.0/16AS9141'

route: 89.79.0.0/16
descr: UPC.pl
origin: AS9141
remarks: Any abuse activities including, but not limited to spamming,
remarks: hacking and intrusion attempts coming from chello.pl address
remarks: space shall be reported ONLY to:
remarks:
remarks: *****@chello.pl
remarks:
remarks: Any reports sent to any other e-mail addresses may be treated
remarks: as SPAM itself and followed by legal actions
remarks: against originator
mnt-by: AS6830-MNT
changed: **********@chello.at 20060313
changed: **********@chello.at 20070131
source: RIPE


[The following lines added by www.dnsstuff.com per requirement by RIPE]
This service is subject to the terms and conditions stated in the RIPE NCC Database Copyright Notice.
Contact dnsstuff.com's 'info2@' address to report problems regarding the functionality of the service.

……….

Generated by www.DNSstuff.com
Location: Netherlands [City: Rotterdam, Zuid-Holland]

ARIN says that this IP belongs to RIPE; I'm looking it up there.

Using 1 day old cached answer (or, you can get fresh results).
Hiding E-mail address (you can get results with the E-mail address).

% This is the RIPE Whois query server #2.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net..ight.html

% Information related to '213.46.255.0 - 213.46.255.255'

inetnum: 213.46.255.0 - 213.46.255.255
netname: CHELLO-MAILSYSTEM-CENTRAL-EUROPE
descr: chello Mailsystem for Central Europe
descr: Statically Allocated
country: AT
admin-c: HMCB1-RIPE
tech-c: HMCB1-RIPE
status: ASSIGNED PA
remarks: INFRA-AW
remarks: Contact *****@chello.at concerning criminal
remarks: activities like spam, hacks, portscans
notify: **********@chello.at
mnt-by: CHELLO-MNT
changed: **********@chello.at 20050917
source: RIPE

role: Hostmaster Chello Broadband
address: UPC Broadband
address: Internet Services
address: Erlachgasse 116
address: A-1100 Vienna
address: Austria
phone: +43 1 96068 5000
fax-no: +43 1 96068 5666
e-mail: **********@chello.at
admin-c: AK991-RIPE
tech-c: SB666-RIPE
tech-c: MG111
tech-c: MS2509-RIPE
tech-c: AK991-RIPE
nic-hdl: HMCB1-RIPE
notify: **********@chello.at
mnt-by: CHELLO-MNT
changed: **********@chello.at 20060324
source: RIPE

% Information related to '213.46.0.0/15AS6830'

route: 213.46.0.0/15
descr: AT-TELEKABEL-19991230
descr: NL-CHELLO-991108
origin: AS6830
mnt-by: AS6830-MNT
changed: **********@chello.at 20001207
changed: **********@chello.at 20070131
source: RIPE

% Information related to '213.46.224.0/19AS6830'

route: 213.46.224.0/19
descr: UPC Technology
origin: AS6830
mnt-by: AS6830-MNT
changed: **********@chello.at 20020603
changed: **********@chello.at 20070131
source: RIPE

% Information related to '213.46.255.0/24AS6830'

route: 213.46.255.0/24
descr: UPC Technology
origin: AS6830
mnt-by: AS6830-MNT
changed: **********@chello.at 20020716
changed: **********@chello.at 20070131
source: RIPE


[The following lines added by www.dnsstuff.com per requirement by RIPE]
This service is subject to the terms and conditions stated in the RIPE NCC Database Copyright Notice.
Contact dnsstuff.com's 'info2@' address to report problems regarding the functionality of the service.

...............
...............

drod
2007-08-05, 19:45:34
[hidden] from Toledo, United States  
Finally found a picture on here of Anastacia.
This image was also posted here:
Dating scammer Anastacia Andreevna



Keywords:
2007-08-06, 05:42:12
Eddie from Sweden  
drod...very strange indeed. could it be that a scammer has accidentally forwarded a mail to you? or it could be a virus, did it have a suspicious attachment? I guess not.
2007-08-06, 13:41:06
drod from United States  
Eddie and All,

Regarding my post '2007-08-05, 18:02:54'

From one of Dirks 'friends' with trojan attachment.

drod
You are on page 87 of 490, other pages: 1 2 3 84 85 86 [87] 88 89 90 487 488 489 490

 

 

Are you being scammed and this is your first visit here?
Read the welcome page/ primer for newbies.
Thanks to Eddie for writing it up.

Please also read Miss Marple's article about recognizing male dating scammers.

NEW: Optional: Register   Login
Email address (not necessary):

Rate as
Hide my email when showing my comment.
Please notify me once a day about new comments on this topic.
Please provide a valid email address if you select this option, or post under a registered account.
 

Show city and country
Show country only
Hide my location
You can mark text as 'quoted' by putting [quote] .. [/quote] around it.
Please type in the code:

Please do not post inappropriate pictures. Inappropriate pictures include pictures of minors and nudity.
The owner of this web site reserves the right to delete such material.

photo Add a picture:
Picture Search

You have received photos and wonder if these photos has been posted here before? Because you suspect this could be a dating scammer, but you do not want to post this picture? Try the Picture Search