Archive for category Scams

Warning: Correspondence from “Harcourt Management LLP”

If you have received any faxed correspondence from “Harcourt Management LLP”, in relation to a supposedly unclaimed inheritance, Bin it. It is a scam.

I see loads of people online asking questions as to the legitimacy of this fax. It is a fake. Key words to check:

  • Edward Baach JD
  • Harcourt Management LLP
  • Harclaw
  • HarclawLLP
  • Gilmoora house
  • Fax +44 207 806 8315
  • Edward@harclawllp.com
  • Ph +44 742 403 1888
  • edbaach2020@gmail.com
  • www.harclawllp.com
  • info@harclawllp.com
  • charituiti@mail.com
  • Mark Dewing of 89 Nile Road, Bunbury, Western Australia as the registrant of www.harclawllp.com

Don’t communicate as per the directions on the fax. They will ask you to fly over to London to sign paperwork and from there, who knows but it will end badly.

Scams are getting more and more sophisticated. They are getting tricker to detect and look more convincing.

I have personally received such a scam this week and after research online,  I can see that this scam is just starting to occur and is more widespread than I thought.
It is for this reason, I am bringing this to your attention and am going to tell you how I confirmed it is a scam.

Always remember,

If it is too good to be true, it’s likely not true!

That should be your first test. Is what you have received bordering on the unlikely, unbelievable and unfathomable?

At our office,  we have received a fax. (Not an email, a fax). It is directed at me and refers to very real family heritage in the UK.
It promises big rewards and no risk (First test fail!).

It is a directed attack. They have the correct name, correct fax number and correct family lineage.
They have done some research.

Please refer to this image (A copy of the fax). See if it fails your first test.

I am on a number of historical websites, my name is on our Business website and so is the business fax number. This could still be a real fax offer.
So why do I suspect it is not real? Lessons for you to use in any scam that comes your way!

I will mark items on this list which can be checked by an IT person. Not all of this will easily be reviewed by a non IT person.

Firstly, Why did I get this fax? Why not my Father, Cousins, Uncle’s? Surely someone else other than myself would be in line to receive any money before me?

  • Locating the website on the paperwork (harclawllp.com), emailing the email addresses on the website, many of the emails bounce (mailbox unknown). A real company would not let their info@ email address bounce.
  • Looking at the registration for the website, it was registered 28 days ago. The website has stamps on it from 2011 (IT Help required)
  • Looking at the web html code in their website, I can clearly see that the website has been ripped from someone else website and had the text changed. (IT Help required)(From the source code, it seems the design was a template taken from www.18carltoncrescent.co.uk/areas_of_work)
  • The lady justice logo on the fax looks grainy, not at all professional.
  • The fax changes through a few fonts on the fax. Not professional.
  • No mention of where the deceased person concerned actually worked or what the Top insurance agency was.
  • The fax comes from the UK and the stamp on the fax confirms this however, the fax report printed at the printer showed an Australian number.
  • The website was registered by someone in Western Australia. (IT Help required)
  • The western Australian registrant comes up in Google as hosting other scam sites
  • Looking up the law society in the UK (in Google), Harcourt Management LLP does not exist. ( https://www.hg.org/firms-united-kingdom.html )
  • Googling Edward Baach JD, he does not exist (At least not as a barrister or solicitor)
  • Reputable business rarely communicate via a gmail account. Especially when they have business addresses @harclawllp.com
  • Mixing Gmail and harclawllp.com email addresses on the same fax looks bad
  • Gmail account with “2020” in the email address looks wrong for a business.
  • Overuse of exciting logos barcodes, rubber stamps and watermarks.
  • There are two different contact phone numbers on the fax. Googling brings up neither. Law firms would advertise their numbers.
  • The website is very sparse. It was very recently registered https://domain-status.com/archives/2018-4-10/com/registered/108
    https://www.whois.com/whois/harclawllp.com  (IT Help required)
  • There is no online mention or obituary for Arthur Jenkin. Being such a wealthy person, surely there would be something in a newspaper.
  • There is no reference to a person of this name, in London or working for any energy company. (In Google)
  • My family name in the fax is in bold, it has an unusual amount of spaces after it (looks like a mailmerge).
  • LinkedIn found the company name https://www.linkedin.com/company/harcourt-management-limited/?originalSubdomain=au – they are in real estate, not law
  • Searching more for the company https://beta.companieshouse.gov.uk/search?q=harcourt+management+LLP, https://beta.companieshouse.gov.uk/company/06682592 , the address that comes up does not match
  • Emailed Golmoora house (Address on the Fax), they say there is no tenant of that name
  • Googled and found others online trying to establish of this guy was a scammer
  • I Emailed the staff listed on the website staff page (using secondary contact information I found from google). Each one said they did not work there and their images and credentials are being fraudulently used.
  • Clicking Edward Baach JD on the website goes to a William Baach ?
  • This fax was Highly confidential yet faxed to a business with 12 people to read it before it got to my desk … how could he expect a fax to be a secret?
  • The servers for the website are in Russia https://db.aa419.org/fakebanksview.php?key=129289  (IT Help required)

Harclawllp.com is a 28 days old domain, situated in Russian Federation. The domain is linked to the IP address 77.222.62.67.
Registration details show that it was registered on 10 Apr 2018 through pdr ltd. d/b/a publicdomainregistry.com and will expire on 10 Apr 2019.
The site returns a status code of 404. The site is being served through nginx/1.9.12.

So, without a doubt this is a scam. I played along. I emailed the Harclawllp.com address only to be told, please use gmail.
I reviewed the email header (IT Help required) and noted that they are using an email platform called Zoho, it is hosted email in UK. It is often used for spam attacks.

I then made contact via google Gmail. I reviewed the email header (IT Help required) and noted that google lists the email being from a Russian address and also that webmail was used to send it.

This just further adds evidence to this being a huge scam.

The person replying was doing so in broken English. I would suspect that this is not how a lawyer would respond.
In the Communication with the remote person, they tried to put the pressure on to allow them to sign documents in my name, documents unseen.
They also wanted my banking details. They then want me to fly to the UK next week to meet with him. (All designed to put pressure on me and stop me thinking clearly).

I asked the person if family living in London can meet with him as my proxy, he said no, although the fax stated he only came to me due to my last name. Weird. Surely a local “Jenkin” would be better.
He has now tried to convince me to setup my own Gmail as it is more confidential.

I am still in communication and gathering as much detail as I can for a Police case.

I have taken this a lot further than the average person however, this has become the classic example of what to look out for.

Hopefully this will help you all be careful with scams and be able to detect them early, else after further research, determine that they are a scam.

Always remember,

If it is too good to be true, it’s likely not true!

 

 

 

Should I tell someone about eCrime ??? YES !!!!

I know that I am in Australia and my experience might not reflect other countries, but I say yes. If you have had an eCrime committed against you (not your general virus or malware) then REPORT IT!!!

The more you report, the more the problem is taken notice of, the more investigation happens.

My post today to Facebook

A win for the good guys.

We had a business client scammed out of a large amount of money through an email.
We pursued it. We recommended and assisted in filling in the eCrime report.
We pushed it along. The police told the client, nothing will come of this. The client also felt that they were banging their head against a wall.
Well, today they receive notification that the money is about to be transferred back.
We helped chase the criminal through the Czech republic and into Spain.
Now, the person is cornered and my client has been offered a chance to be there in court and be a part of the process.

Reporting eCrime is the smart choice ! Things can happen !!!

Tags: ,

AiPol is reputable, for the others: Watch out Australian Businesses!

My business is happy to sponsor well-meaning community efforts. We were legitimately listed in the AiPol (Australasian Policing) magazine last year.
We can’t throw money away and only advertise when we can.

 Imagine our surprise when we had an Ad in the “Crime Alert” publication, but never placed it.

 The Ad is a form of sponsorship and we never signed up for it. We never had a hand in designing the Ad and never got to see it before it was “Published”.
We had our Credit card debited and have since successfully had the money refunded.

We new we had been scammed somehow and moved on.

Then we started getting more phone calls about more magazines we apparently sponsored and now owed the money for.

The list so far includes

  • Crime Alert
  • Volunteer Rescue Forum
  • Sun smart Kids
  • Neighbourhood Support Guide
  • Street Watch

 

All of these are around the $440 Ex Gst price (AUS) and all the Ad’s appear to be lifted from company websites.
The content of the publications also appears to be lifted from Websites.
The email contact addresses are @Hotmail.com or @Bigpond.com.au and bounce back.
They all have answering services on 1800 or 1300 numbers. Their addresses all seem to be in QLD.
When you have them on the phone, all deny knowing about the other publications.

All have the same stamp “Proof of Publication” in the rear of the publication.
All have laser printed ads in them that texturally feel different to the rest of the magazine.

None of them have a presence online and the phone numbers do not appear to be in Google.

This scam is known as a Charitable publication scam or Directories and advertising (false billing) scam

Charitable publication scams happen when a telesales agent calls a business selling advertising space in a bogus publication for a seemingly good cause.
The caller will give the impression that the publisher is partnered with local charities, emergency services, crime prevention or community health initiatives.
Sometimes the caller will say that a business has placed an order previously, or even that someone else in the business has agreed to take out the advertising space.
They will either ask for payment details upfront for a 10% discount or already have your credit card details.

All offer to send out a proof of publication with the Invoice. This does arrive but looks suspect.
In general the fraudsters may also send the business invoices whether or not the victim has agreed to take out the advertising space. They may follow up the invoices with threats of legal action.

So if you get a call like this from a publication you have no connection with, write down their number, name and the publication name and contact the ACCC and Scamwatch.