How not to win a million

By Jeremy Scott-Joynt
BBC News Online business reporter

Could it be your lucky day? Not likely...

It could happen to you.

That simple belief drives hundreds of millions of people around the world to buy lottery tickets every week.

So if an e-mail arrives announcing that a "European lottery" has selected you as the lucky winner of half a million euros, it is all too easy to believe.

You never bought a ticket? No matter - your e-mail address was selected randomly.

Does the e-mail - usually purporting to come from Spain or the Netherlands - have a few spelling and grammar errors? Well, they're not native English speakers, are they? Everyone makes mistakes.

All this should be ringing alarm bells.

For the lottery e-mails which have dropped into inboxes by the thousands in recent months - they also sometimes take the form of letters or even phone calls - are part of a widespread scam.

ONLINE SCAMS The lottery scam is just one of dozens of frauds perpetrated online. Among other common scams to watch out for: 419: The famous "advance fee fraud" offers victims money for help in getting millions of dollars abroad. In fact, the scam demands money upfront and has even resulted in kidnapping for ransom. Phishing: Fake e-mails - see above - purporting to come from banks direct victims to websites which are very realistic copies of the real thing - but suck up personal details such as PIN numbers and mothers' maiden names. Cheap software: E-mails promise expensive software at knock-down prices. Usually the online store is simply a front for getting personal and bank details.

They come from the same kind of people who invite you to open your bank account to $30m or so supposedly belonging to the family of one dead dictator or another: the now-infamous "419" confidence trick.

With 419 now part of the online world's lexicon, its practitioners - often West Africans living in Europe - are coming up with new ways to separate the unwary from their money.

The lottery e-mail is a prime example. The prize fund does not exist. The firm acting as "agent" does not exist. The bank supposedly holding the winnings on the unwary punter's behalf does not exist.

The only funds which actually change hands are the thousands the punter will be asked to pay for handling charges, tax exemptions, anti-money laundering certificates and a list of other demands.

And in the process, victims will have given the crooks enough personal information to steal their identity, spending huge sums in their name and ruining victims' credit ratings.

The old rule applies: if it sounds too good to be true, it usually is. And just about no-one offers money for nothing.

Expensive mistake

Peter, who lives in the Midlands, has found all this out to his cost.

Earlier this year, he received an email purporting to come from the Lucky Day Lottery in Amsterdam, promising him 500,000 euros.

Peter's son has leukaemia, and the thought of what the money could do for his welfare was irresistible.

An initial contact led to a blizzard of official-looking documents and daily phone calls with an "agent" of the lottery.

The caller, "Peters Morrison", claimed to work for Standard Chartered Securities.

(The real Standard Chartered Securities is part of the massive Standard Chartered banking empire. Morrison is misusing their name, and the group is an innocent party.)

Morrison said he was working to release the money which Peter was owed, held in an offshore account at a offshore bank called Ultimate Finance and Investment (Ultimate FI).

Warning signs: How to avoid getting caught by the lottery fraudsters At-a-glance

There were just a few formalities.

Ultimate FI needed to see identity documents, of course. But it also wanted evidence of payments to the Netherlands' Belastingdienst, or revenue service, as well as high-priced certificates supposedly from the International Monetary Fund.

All in all, the process of clearing the claim cost Peter almost 20,000 euros.

Documenting the fraud

That was the point at which Peter's plight came to the attention of an investigative team at BBC News.

The team proved that all the contact numbers listed for "Standard Chartered" and "Ultimate FI" belonged to mobile phones - and that all the e-mail addresses were from US-based free e-mail providers, not banking institutions.

The real-world addresses were fictitious, including those used for the official-sounding messages apparently from the Belastingdienst and the IMF. Both organisations, needless to say, are innocent of any involvement - as is the real Lucky Day Lottery, run by the Netherlands' national lottery organisation, De Lotto.

And Ultimate FI's impressive-looking website was registered to a man in Amsterdam who had already been connected to other fake banking sites used in online scams.

Moreover, the investigation revealed links between the fraudsters in Amsterdam and others in South Africa, Canada and Spain - where another fake bank website was found to be registered to an internet cafe in Nigeria's commercial capital, Lagos.

Our scammers, it seemed, were part of what seems to be a con artists' "franchise operation".

Face to face

At last, it was time to take the final step.

LOSING YOUR IDENTITY Almost all online scams are designed as much to get victims to reveal personal data as they are to amass money directly. Identity theft is growing at a breakneck pace: US law enforcement agencies recorded almost 216,000 complaints in 2003, up 30% on the year before. Victims can find themselves with emptied bank accounts, huge credit card bills or loans, and ruined credit ratings. Estimates suggest it takes victims up to 300 hours to regain their good name, at huge financial cost. The victim must then be on permanent alert about potential misuse of his or her personal details.

BBC News arranged for Peter to confront his tormentors in Amsterdam itself.

They were demanding 20,000 euros as final payment to clear his winnings.

For days, BBC staff worked with him to convince the scammers to meet him.

One day, Morrison would agree. The next, he claimed to be heading off on holiday.

Then, supposedly speaking from his vacation in Portugal, where he claimed to be watching the Euro 2004 football tournament, he said he was prepared to arrange a meeting - but blamed the bank's "protocol officer", Jeffrey Parkinson, for demanding the money by post.

At long last, he agreed to a meeting - at Amsterdam's Schiphol Airport.

The last straw

That, the team judged, was unsafe. There was too much risk of interfering with airport security, while the possibility that Peter might be separated from the BBC's own security and camera teams was too high.

Instead, the team arranged a plausible last-minute change of location to a nearby hotel.

The phone call changing the location - as if Peter had simply missed the sign-bearing protocol officer at the airport - went fine.

Barely minutes after the call, with the hidden cameras only just in place, "Parkinson" turned up - and his voice was eerily familiar. In a final, clinching piece of proof, Parkinson and Morrison were the same man.

After a few minutes of talk, he asked Peter to come out to his car to get a banker's draft.

Peter, wisely, refused - at which point Morrison/Parkinson beat a hasty retreat, realising that his cover was blown.

What next?

Unfortunately, Peter's money is still missing.

He may now need to take action to ensure credit agencies and financial institutions check his identity whenever a transaction takes place.

And Morrison/Parkinson is still at large.

The BBC has offered its evidence to law enforcement both in the UK and the Netherlands.

---

Your comments:

Banks should randomly supply their customers with false bank account details which they can (voluntarily) give to scammers. The false account/s to be monitored by the banks or police agencies to trap the scammers. Much like the false addresses used by some ISPs to trap spam.
Terry Sterling, Birkenhead, UK

Only the truly stupid and greedy can still be falling for these transparent scams, how can people be daft enough to think that money from an organisation they have never heard of/dealt with is suddenly falling into their laps - for a price of course! By the way, if you send me a few grand I'll tell you the only true way of avoiding getting caught by these schemes, honest!
Nick, Potters Bar UK

I have no sympathy for the 'victims' of these scams because:
1. If you haven't bought a ticket you haven't won anything. Do these people believe in Father Christmas?
2. In the case of the 419 scam, by parting with money to the scammer, you have begun to participate in a criminal conspiracy to defraud the rightful owner of their money. The fact that the cash does not exist has no bearing on the guilt of the participant.
Eddie Earl, London, UK

I get many of these scam e-mails daily - the solution is, buy an antispam software like Norton Antispam - which is very effective at filtering out e-mails from Nigeria.
M Tint, Reading

It only attracts those who often make day-dreams.
QQ, Bristol

I get loads of these scam e-mails from banks I don't have accounts with.
I did used to report them to the bank or building society involved. My e-mail was either ignored or I was sent a stuffy letter a few weeks later saying it was not their concern.
I used just to have to delete them manually, but thankfully my ISP seems now to be on the ball, especially as I now get 300 of the blighters a day.
William Cater, London, UK

Click here to return