Is this Russian girl scamming me? How to recognize scammers
7162 comments. Current rating: (816 votes). Leave comments and/ or rate it.
Are you an American or Western European man exchanging emails with a girl from Russia? I was contacted by a girl who turned out to be a scammer. Reader Derrick put together some great advice how to detect scammers.
I only have one advice (#8) to add: If a Russian girl tells you that she will get a visa to the USA instead of inviting you, that is - under the current immigration law - a SURE sign that SHE LIES.
Here is the process how a Russian woman can come to the USA:
If she is considered a relatively young/ attractive woman (let's say under 40, hope I don't hurt anyone's feelings here), then there is virtually NO CHANCE THAT SHE GETS A TOURIST VISA TO THE USA. First the Russian Federation will not allow her to leave the country. Then, even if she was getting out, the USA will deny her admission. The reasoning is that she is considered a risk. How could she not be a risk? If she had family in Russia (husband, children) or a valuable business or real estate. Most likely the woman who writes you will be considered a risk. The only way for her to get a visa into the USA is this procedure:
the foreign man visits her in her native area in Russia
they get engaged during such a visit - take photos of the 2 of you together
he flies back and applies for a K-1 visa. A K-1 visa is also known as Fiancee visa, used for marriage-based immigration
once the K1 visa is granted, the girl can enter the USA and stay there for 3 months. By the end of these 3 months you HAVE to GET MARRIED or the girl has to go back home.
if you get married, the girl gets a greencard and can work
after 3 years of marriage, the girl can apply for a US citizenship. That's when they interview you to find out if it's a real marriage. She also has to answer some questions about US history, political system, etc etc.
Here are Derrick's tricks (1-7) that he uses immediately from the start:
GOOGLE or websearch the first part of the scammers first emails and/or 'profile'. SEE HOW MANY OTHER SITES their listed on! RECORD THOSE SITES FOR FUTURE REFERENCE. THAT alone can give you a good idea IF your dealing with a scammer OR not.
GOOGLE or websearch the return email address. See how many 'hits' come from that search and also note all the sites. (many times you'll see the email end up on a 'scammers list') IF YOU FIND THE EMAIL ADDRESS LISTED ON A SCAMMER LIST - don't bother further, your only fooling yourself - no matter what excuse they might give you.
FROM THE START - ASK FOR SPECIFIC INFOMATION! A full name, address, phone number - something. OFFER THE SAME in exchange, except make it a P.O. box and a CELL PHONE rental card that will protect your identity. If you see your requests ignored, which you usually will, don't waste your time further.
ALWAYS ASK SPECIFIC QUESTIONS that would REQUIRE A SPECIFIC ANSWER outside the use of FORM LETTERS. IF YOU FIND your questions go unaddress in your reply emails from 'them/her' - YOUR DEALING WITH A SCAMMER. Again, don't bother further.
DON'T WAIT 6 MONTHS to offer to talk with the PROSPECT by phone! WHAT A TOTAL WASTE OF TIME! IF THERE IS CHEMISTRY OR APPEARS 'INTEREST' BETWEEN THE TWO OF YOU - then sieze the opportunity. ARRANGE A PHONE CALL! International rates to Russia and most places are reasonably cheap. IF YOU GET THE REPLY ' I'M SO POOR I DON'T HAVE ACCESS TO A PHONE' - drop the whole thing, your only wasting your time and WILL BE SCAMMED at some point in the future.
PHOTO FLOOD! IF IT/SHE/HIM/THEM - LOOK TOO GOOD TO BE TRUE - THEN IT PROBABLY IS! MOST IF NOT ALL OF THE SCAMMES USE PHOTOS OF MODELS IN THEIR HOME COUNTRIES TO POSE ON THE NET IN THEIR PROFILE(s)! Consider this - IF THEY LOOK like a MODEL then tell you they're so poor they don't have access to a phone - YOUR BEING SCAMMED!
ASK FOR A SPECIAL PHOTO TO BE TAKEN. IF YOU SENT YOURS, HAVE THEM TAKE A PHOTO SHOWING THEM HOLDING UP YOUR PHOTO IN THE PICTURE! That is a good 'scammer filter' - even the most adept with Photoshop will easily be spoted.
BETTER STILL - ASK THEM TO TAKE A PHOTO THAT SHOWS THEM HOLDING A CURRENT NEWPAPER OF YOUR CHOICE OR THEIR COUNTRY, WITH A RESOLUTION THAT YOU CAN READ THE DATE! NOT some low grade - grainy photo! FEW WILL EVER DO THAT.
AT THE LEAST - ASK THEM FOR A PHOTO of them wearing a specific combination of clothes and/or colors - something different then the usual 'model clothing' - most use to send out. OR AN OBJECT - TOASTER, ELECTRIC CLOCK, BY A COUCH, IN A ROCKING CHAIR something that would be very hard to use PHOTOSHOP to just PUT in another FILE PHOTO.
*** IF this person is real or sincere, they won't mind doing this for you! ALSO - offer to do the same for their comfort also - that is only fair.
IF THINGS GET SERIOUS - then ASK THEM TO DELETE ALL THEIR OTHER WEB PROFILE POSTS! CHECK ON THE ONES YOU NOTED EARLIER! Again, IF THEIR SINCERE - they will - happily as your their DREAM and future!
If she talks about getting a visa or that she needs money to get a travel visa to the USA, she lies. See the proper course of action described at the top.
I think that is not the same girl.
I continue to correspond with her for the moment.
I try to obtain another information, address, phone number and I inform you when is done.
Excusez-moi pour mon mauvais anglais oupss.
The photo originates from New York (188.8.131.52). The writer's letters originate from this IP address: 184.108.40.206 which is located in Yoshkar-Ola, Mari-el, Russia. The writer of the letters claims to be from Morki, about 75 miles away. The writer claims to use an internet cafe in Morki. How is it possible that the IP address doesn't support what the writer claims? Is it having to do with a proxy server? Thx :)
Here's the writer's latest letter and photo. (My name is ********) I've intentionally *'d out the email addresses as I want to see where this goes. Like I said, this is entertainment for me: )
****** I do not know, that with me happen. I, seem..... I do not know
how to tell it. I yesterday have come home and thought of us with
you., how you. That with you. Than you are engaged? What did you eat?
Tell to me, ********* at you all is good?
What for you need to know a surname of my girlfriend? I have not
********* I wish to tell to you that was at night. I have left on a balcony
and looked at stars. Thought of us. Also has laid down to sleep. When
I slept to me the dream, in which we with you together has dreamed.
You represent? Also has dreamed morning about which I have told to
you. You remember? And all was as I to you told. And still we then
have together gone to a bath and enjoyed love.
AS IT WAS FINE!!!!!!!!!!!
******** I do not know how to tell to you, that I feel, but with me that
that occurs. In my heart, inside of me. I have got used to
you. I never such had also I never felt so well as when I read your
letters. I shall not approve, but it seems to me, that I am
already enamoured in you. At all I do not know, how it to transfer words.
******** mine mum (NATALYA), the grandmother, girlfriends (TATYANA), everyone speak, that I have changed, became quieter, harmonous and even began
to look better, but I can not explain, why and as. And only I know.
It happens because in my life there was you.
******** it seems to me, that I am enamoured in you. I do not know, that
else it can be. But I am not assured. But I think, that soon I shall
precisely the nobility.
I send you a photo.
I hope, that it is pleasant to you.
Yours and only your loving and gentle girl ' END OF TODAY'S LETTE
From ************************ Fri Apr 17 09:40:05 2009
Authentication-Results: mta161.mail.ac4.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=neutral (no sig)
Received: from 220.127.116.11 (HELO n10.bullet.re3.yahoo.com) (18.104.22.168)
by mta161.mail.ac4.yahoo.com with SMTP; Fri, 17 Apr 2009 10:09:41 -0700
Received: from [22.214.171.124] by n10.bullet.re3.yahoo.com with NNFMP; 17 Apr 2009 17:09:40 -0000
Received: from [126.96.36.199] by t3.bullet.re3.yahoo.com with NNFMP; 17 Apr 2009 17:09:40 -0000
Received: from [127.0.0.1] by omp102.mail.re3.yahoo.com with NNFMP; 17 Apr 2009 17:09:40 -0000
Received: (qmail 89340 invoked from network); 17 Apr 2009 17:09:39 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
h= Received:X-YMail-OSG:X-Yahoo-Newman-Property:Date:From:X-Mailer: Reply-To:X-Priority:Message-ID:To:MIME-Version:Content-nt-Type;
b= 0S/qDy9pAQUu52Kb8h96loFGO5MH/FREoYKioDxukri+k7hbP6z72HACCjvv6WWGZWYgaG6p5ycoPcooHPwKfKIkt 47A9fEs73RBtDFdC43EUX40ekLZPRsPRszmX0j4dlGOH/aO6JmTQFbbv2Pla4mUU0SX3VHZIouqx1lftoG2Io= ;
Received: from unknown (HELO roman) (188.8.131.52 with plain)
by smtp112.plus.mail.re1.yahoo.com with SMTP; 17 Apr 2009 17:09:36 -0000
Date: Fri, 17 Apr 2009 20:40:05 +0400
To: ***********@yahoo.com (This is my email account)
The Project Honey Pot system has detected behavior from the IP address consistent with that of a mail server, dictionary attacker and comment spammer. Below we've reported some other data associated with this IP. This interrelated data helps map spammers' networks and aids in law enforcement efforts. If you know something about this IP, please leave a comment.
Anon US 2009-04-18, 11:50:02, I understand you meant to ask if her pix were used by scammers. In most instances, scammers are men, the girls are unaware that their pix have been stolen. Out of over 3K threads you see at left top, there are only about 10 confirmed girl scammers, (mostly gold diggers) who use their own identity. Post additional info, Wanwan suggests. Also try http://www.delphifa..=55#141063
AtomCrochu from France
Hi mes amis,
The same girl send to me another mail, now it appears that the source of this e-mail is based in Poland, strange, you will find below the header of this mail. This beautiful girl ask me some money now, woww, It was necessary to suspect it, i'm going to say to her that I cannot send her any money and I would see the reaction.
At present, I am in contact with 3 russian girls.
the first, ask me money,
the second, ask me money
The third, not still, but it should come.
I looked for the source with the software EmailTrackerPro.
What do you think of this software?
see you soon,
u snel zien,
Au revoir et merci
Below the header of mail of the second girl......
Received: from mwinf8218.laposte.net (mwinf8218.laposte.net)
by mwinb8601 (SMTP Server) with LMTP; Sat, 18 Apr 2009 14:07:36 +0200
X-Sieve: Server Sieve 2.2
Received: from meplus.info (localhost [127.0.0.1])
by mwinf8218.laposte.net (SMTP Server) with ESMTP id A857A900008C
for <firstname.lastname@example.org>; Sat, 18 Apr 2009 14:07:36 +0200 (CEST)
Received: from forwards6.yandex.ru (forwards6.yandex.ru [184.108.40.206])
by mwinf8218.laposte.net (SMTP Server) with ESMTP id 6BBCE900008B
for <email@example.com>; Sat, 18 Apr 2009 14:07:36 +0200 (CEST)
Received: from smtp18.yandex.ru (smtp18.yandex.ru [220.127.116.11])
by forwards6.yandex.ru (Yandex) with ESMTP id E756EA8D009
for <firstname.lastname@example.org>; Sat, 18 Apr 2009 16:07:35 +0400 (MSD)
Received: from 161.85-237-190.tkchopin.pl ([18.104.22.168]:47632 'EHLO
161.85-237-190.tkchopin.pl' smtp-auth: 'dmit-anzhelika' TLS-CIPHER:
<none> TLS-PEER-CN1: <none>) by mail.yandex.ru with ESMTP
id S10436848AbZDRMH0 convert rfc822-to-8bit (ORCPT
<rfc822;email@example.com>); Sat, 18 Apr 2009 16:07:26 +0400
X-Comment: RFC 2476 MSA function at smtp18.yandex.ru logged sender identity as: dmit-anzhelika
Date: Sat, 18 Apr 2009 16:07:01 +0400
X-Mailer: The Bat! (v4.0.14) Professional
X-Priority: 3 (Normal)
To: xxxxxxxxx <firstname.lastname@example.org>
Subject: Salut mon amour l'homme, mien tendre xxxxxxxx!!!
Content-Type: text/plain; charset=utf-8
X-me-spamcause: O( 0)(0000)gggruggvucftvghtrhhoucdtuddrvdekuddrheehucetggdotefuuucfrrhhofhhilhgvmecuoehnohhnv eqnecuuegrihhlohhuthemuceftddtddtnecu