How not to win a million

Story Here

How not to win a million

By Jeremy Scott-Joynt
BBC News Online business reporter
Tuesday, 5 April, 2005, 14:21 GMT 15:21 UK

It could happen to you.

That simple belief drives hundreds of millions of people around the world to buy lottery tickets every week.

So if an e-mail arrives announcing that a "European lottery" has selected you as the lucky winner of half a million euros, it is all too easy to believe.

You never bought a ticket? No matter - your e-mail address was selected randomly.

Does the e-mail - usually purporting to come from Spain or the Netherlands - have a few spelling and grammar errors? Well, they're not native English speakers, are they? Everyone makes mistakes.

All this should be ringing alarm bells.

For the lottery e-mails which have dropped into inboxes by the thousands in recent months - they also sometimes take the form of letters or even phone calls - are part of a widespread scam.

The lottery scam is just one of dozens of frauds perpetrated online. Among other common scams to watch out for:
419: The famous "advance fee fraud" offers victims money for help in getting millions of dollars abroad. In fact, the scam demands money upfront and has even resulted in kidnapping for ransom.
Phishing: Fake e-mails - see above - purporting to come from banks direct victims to websites which are very realistic copies of the real thing - but suck up personal details such as PIN numbers and mothers' maiden names.
Cheap software: E-mails promise expensive software at knock-down prices. Usually the online store is simply a front for getting personal and bank details.

They come from the same kind of people who invite you to open your bank account to $30m or so supposedly belonging to the family of one dead dictator or another: the now-infamous "419" confidence trick.

With 419 now part of the online world's lexicon, its practitioners - often West Africans living in Europe - are coming up with new ways to separate the unwary from their money.

The lottery e-mail is a prime example. The prize fund does not exist. The firm acting as "agent" does not exist. The bank supposedly holding the winnings on the unwary punter's behalf does not exist.

The only funds which actually change hands are the thousands the punter will be asked to pay for handling charges, tax exemptions, anti-money laundering certificates and a list of other demands.

And in the process, victims will have given the crooks enough personal information to steal their identity, spending huge sums in their name and ruining victims' credit ratings.

The old rule applies: if it sounds too good to be true, it usually is. And just about no-one offers money for nothing.

Expensive mistake

Peter, who lives in the Midlands, has found all this out to his cost.

Earlier this year, he received an email purporting to come from the Lucky Day Lottery in Amsterdam, promising him 500,000 euros.

Peter's son has leukaemia, and the thought of what the money could do for his welfare was irresistible.

An initial contact led to a blizzard of official-looking documents and daily phone calls with an "agent" of the lottery.

The caller, "Peters Morrison", claimed to work for Standard Chartered Securities.

(The real Standard Chartered Securities is part of the massive Standard Chartered banking empire. Morrison is misusing their name, and the group is an innocent party.)

Morrison said he was working to release the money which Peter was owed, held in an offshore account at a offshore bank called Ultimate Finance and Investment (Ultimate FI).

There were just a few formalities.

Ultimate FI needed to see identity documents, of course. But it also wanted evidence of payments to the Netherlands' Belastingdienst, or revenue service, as well as high-priced certificates supposedly from the International Monetary Fund.

All in all, the process of clearing the claim cost Peter almost 20,000 euros.

Documenting the fraud

That was the point at which Peter's plight came to the attention of an investigative team at BBC News.

The team proved that all the contact numbers listed for "Standard Chartered" and "Ultimate FI" belonged to mobile phones - and that all the e-mail addresses were from US-based free e-mail providers, not banking institutions.

The real-world addresses were fictitious, including those used for the official-sounding messages apparently from the Belastingdienst and the IMF. Both organisations, needless to say, are innocent of any involvement - as is the real Lucky Day Lottery, run by the Netherlands' national lottery organisation, De Lotto.

And Ultimate FI's impressive-looking website was registered to a man in Amsterdam who had already been connected to other fake banking sites used in online scams.

Moreover, the investigation revealed links between the fraudsters in Amsterdam and others in South Africa, Canada and Spain - where another fake bank website was found to be registered to an internet cafe in Nigeria's commercial capital, Lagos.

Our scammers, it seemed, were part of what seems to be a con artists' "franchise operation".

LOSING YOUR IDENTITY

• Almost all online scams are designed as much to get victims to reveal personal data as they are to amass money directly.
• Identity theft is growing at a breakneck pace: US law enforcement agencies recorded almost 216,000 complaints in 2003, up 30% on the year before.
• Victims can find themselves with emptied bank accounts, huge credit card bills or loans, and ruined credit ratings.
• Estimates suggest it takes victims up to 300 hours to regain their good name, at huge financial cost.
  The victim must then be on permanent alert about potential misuse of his or her personal details.

Face to face

At last, it was time to take the final step.

BBC News arranged for Peter to confront his tormentors in Amsterdam itself.

They were demanding 20,000 euros as final payment to clear his winnings.

For days, BBC staff worked with him to convince the scammers to meet him.

One day, Morrison would agree. The next, he claimed to be heading off on holiday.

Then, supposedly speaking from his vacation in Portugal, where he claimed to be watching the Euro 2004 football tournament, he said he was prepared to arrange a meeting - but blamed the bank's "protocol officer", Jeffrey Parkinson, for demanding the money by post.

At long last, he agreed to a meeting - at Amsterdam's Schiphol Airport.

The last straw

That, the team judged, was unsafe. There was too much risk of interfering with airport security, while the possibility that Peter might be separated from the BBC's own security and camera teams was too high.

Instead, the team arranged a plausible last-minute change of location to a nearby hotel.

The phone call changing the location - as if Peter had simply missed the sign-bearing protocol officer at the airport - went fine.

Barely minutes after the call, with the hidden cameras only just in place, "Parkinson" turned up - and his voice was eerily familiar. In a final, clinching piece of proof, Parkinson and Morrison were the same man.

After a few minutes of talk, he asked Peter to come out to his car to get a banker's draft.

Peter, wisely, refused - at which point Morrison/Parkinson beat a hasty retreat, realising that his cover was blown.

What next?

Unfortunately, Peter's money is still missing.

He may now need to take action to ensure credit agencies and financial institutions check his identity whenever a transaction takes place.

And Morrison/Parkinson is still at large.

The BBC has offered its evidence to law enforcement both in the UK and the Netherlands.