Interview With The Scammer

Posted 3/21/2023

I recently found myself in the midsts of an online scam. Because I am absolutely unable to just "let it go", I humored them for a while so I could better understand their modus operandus. I'm posting this here in an effort to help others not fall into this trap. 

I am certain this may seem like an obvious scam to a lot of my colleagues, after all, it has all of the hallmarks of "if it's too good to be true...". That said, this scammer was not particularly clever, articulate, or bright, so it was pretty easy to spot. Naturally, I had to have a little fun with this lowlife, so I'm posting my email exchange below for all to read.

This originated on Facebook, from my responding to an ad for a stupidly low-priced Toyota Tacoma. When I responded to the ad, I was informed by the seller that they "were listing it for someone, and that I needed to contact them at melaniemelton77@gmail.com. I will redact this report if this email address turns out to be stolen or hacked, but as of this writing, it has not been traceable.

Email 1 (from me)

Hi, I’m interested in the Toyota Tacoma.

Can you email me back or call me at 1 (904) XXX-XXX9 to let me know if it’s still available?

Thanks!

Email 2 (From "Melanie")

Hello. My name is Melanie, and I have received your email regarding the 2005 Toyota Tacoma SR5, with a gasoline  engine, automatic transmission and only 71,000 miles. Never had or needed any paint/body work done, garaged keep always, without any mechanical  problems, tires and wheels are in great shape as well, electric is working perfectly. The 4.0L V6 engine runs very well and the automatic transmission shifts perfectly. Has a clean and clear title in my name and there are no liens or loans on it. This Car was used by my husband  who died 2 month ago. The price was reduced at $1,200 because I'm in a hurry to find a buyer. I need to sell it before the 31th of March,when I  will be leaving on military duty with my medical team out of the country for a year and do not want to store my car. Hate to sell it but  it's not worth keeping insurance and paying storage fees for a year. If  you are interested I can send you pics.  

Thank you!

Email 3 (From Me)

Hi Melanie,

I’m sorry to hear about your husband’s passing.

I would like to come by and take a look if that’s possible. If all looks good I can pay you on the spot.

When would be a good time?

Email 4 (From "Melanie")

As I've told you in my first e-mail, I'm in the army with my military medical team and right now I am in a military base. We are training, getting ready to leave the country. Before leaving I had prearranged the deal with eBay services so my presence isn't necessary. The delivery process will be managed by me. I think I can have it there at your home address within 2-3 working days. It will come with a clear title and reg. You will have 5 days to test and inspect the car after making the payment. During that 5 days testing period I will not be getting any money. I need to know if you are interested so I can ask eBay to send you the details on this deal. If interested please include in your next email your contact info for eBay (full name, shipping address (city and zip code) and phone number), so we can get the ball rolling.

P.S: I attached all the pictures with the car .  

Looking forward to hearing from you soon!

Author note: 17 images were included, I'm including the just first one below. It should be obvious that this isn't a $1,200 truck.

Email 5 (From Me)

Hi Melanie,

I am interested. I was also in the military. Where are you currently stationed?

My contact info is:

Dr. M Martin

3XXX GXXXX CXXXXXX PX WXXX

Jacksonville, FL 322XX

My phone number is: 904-XXX-XXXX.

Author note: I provided this number as a Google Voice number. I also wanted to see if I could get them to refer to me as "Doctor", just for fun. I'm not a Doctor.

Email 6 (From "Melanie")

Hi, I just received a copy of the invoice from ebay and a notification from them saying that they already sent you an email with details on our transaction. At this point the vehicle is reserved for you. From my side everything is done, I got ready for all the paperwork that you need to register the vehicle in your name.  Let me know if you received the invoice ok? Please check your spam folder maybe is there because if  I received it , you should too

Thank you and God bless

Email 7 (From Me)

Yep, I received it.

So now what do I do? You said the truck will be here in 2-3 days? Can't wait!

Thanks!

Email 8 (From "Melanie")

Well, let me explain to you how this works.they will hold your funds secured until the 5 days period is over.

First, you have to submit the payment proof for this purchase to eBay with the amount of $1,200 for the vehicle and when they will receive the payment details from you, I will start immediately the shipping process to you. It will take max 1-2 days until you will have the vehicle to your home and from the moment that you receive the vehicle you have 5 days for inspection. In that period I will not get any money, only when you give the confirmation to eBay that you are satisfied by the vehicle and wanna keep it, they will release the funds to me, otherwise, they will refund you the full amount of money without any question, and you can ship the vehicle back at my expense. Those are the eBay rules and I need to know if you are interested in this transaction.... Keep in mind that I didn't made those rules and if you don't to continue, that's fine..I will find a new buyer for my vehicle.... But I will need to know what's your final decision on this.

Author note: So I'm starting to see how the scam works, but I need details. So I check my email and I have received an email from "ebaymotors@invoices-buyer.online".

Email 9 (From Me)

Ok, I see. So if I submit a payment for the invoice to the totally legit email address of eBaymotors@invoices-buyer.online, eBay will HOLD my funds until I receive the truck.


Then I have 5 days to inspect it before the funds are released to you.


Makes sense. Do I need to pay taxes or shipping, or just $1200? Can I use a credit card? I'm not really used to doing transactions this way.


Thanks for your help!


Author note: I thought they might pick up on the sarcasm with "totally legit", but nah. Probably not American.

Email 10 (From "Melanie")

Shipping is free, you have all the details in the invoice that you received from eBay, you will have to buy 2 American Express of $500 and one 200$ or 6 eBay gift cards of 200$  from any Walgreens, Target, HomeDepot, Dollar General, Rite Aid, Radioshack, Kroger, Dollar Tree, K Mart, CVS, 7-Eleven, Best Buy,SAFEWAY, Albertsons, Winn Dixie, Lowe's, Fred Meyer, Pavillions, Ralph's, A & P, HEB, Pathmark or you can buy from Local Post Office. and once you have the cards you have to confirm your payment with the eBay cards following info: Card Number (Digits Number from the front of your Cards) ,Expiration Date,Security Code (Digits Numbers from the front of the Cards) by replying to the invoice that you received from them and as soon as they will contact me with the payment confirmation I will start the shipping. Thank you

Author note: AHA! Now I see what they want. Prepaid Amex or eBay cards.

Email 11 (From Me)

Aha, ok, I see.

I have a CVS right down the road, so let me head that way and get the completely untraceable Amex cards.

I’ll be back in a few minutes!

Email 12 (From "Melanie")

Perfect! I will notify eBay and for now, I will start all the arrangements for the shipment. At this point the vehicle is reserved for you and the estimated delivery from eBay is 72 hours. Please let me know once everything on your part is completed so I can get everything ready. Once eBay receives your payment details, I will be instructed to start the delivery process to your location. Keep me posted, I will do the same!

Author note: See the eBay spoof emails at the end of this article.

Email 13 (From "Melanie")

Did you make the payment?because I didn't received the payment confirmation from eBay yet.Please get back to me asap and let me know the status of our transaction.

Email 14 (From Me)

No, not yet, I’m just now getting home from CVS with the Amex cards. I decided to stop and say hello to my sick mother, she’s in a nursing home that is close to the CVS. 


Give me a few and I’ll take care of it.


Thanks!


Author's note: My mother is just fine. I wanted to see what playing a sympathy card would do. Spoiler alert...nothing.

Email 15 (From "Melanie")

Ok, thanks for the update. 

Email 16 (From Me)

I just got an invoice addressed to “Reynaldo” from eBay. Who is that?

Author's note: I did receive an invoice for "Reynaldo", some other poor guy they were scamming, most likely. Then immediately after, I received an invoice to "Martin".

Email 17 (From "Melanie")

eBay agent says it was a mistake,please reply to the eBay invoice with pictures of the cards front and back and the receipt once it receives the payment information the delivery process will begin.

Email 18 (From Me)

Thank you, I will do that. They're like scratch-off tickets kinda.

Email 19 & 20 (From "Melanie")

Email 21 (From Me)

I’m working on it. You’re being very pushy.

Also my name isn’t Martin, it’s Matthew. I prefer to be called Doctor.

Author note: I was actually out having dinner. My second attempt to see if they would call me "Doc Martin".

Email 22, 23, 24, & 25 (From "Melanie")

Author note: Ok, now I'm kind of over this. I could be clever and bait them some more, but I think it's time the jig was up. I reported their domain to the registrar, email to Google, spoof emails to eBay, and reported the user(s) to Facebook. Time to come clean.

Email 26 (From Me)

Ok, sorry, I was a little busy doing some stuff. 


If you're disappointed now, this just gets worse for you!


I wanted to check a few things, so here's what I did.


First, I contacted www.namesilo.com. They are the American registrar for your fake eBay site, "invoices-buyer.online", and the fake email "eBaymotors@invoices-buyer.online". That site will be shut down shortly, so you will probably need to secure a new domain to run your lousy online scams from. I also reported it to eBay (spoof@ebay.com). 


Second, I reported your email address to Google. You probably just compromised someone's account, and I feel bad for them since you are just a giant douche. I'm pretty sure Google will do the right thing though and block your email account.


Third, I reported our entire exchange to Facebook, including your "friend" Eryn Brase, who is also probably a compromised account. I also contacted the real Melonie Melton. Boy will she be surprised!


Finally, I have saved this entire exchange and will be posting it on my security website in the next day or so, to help warn people about idiots like you who try to take advantage of people. You are the lowest of all scum - a thief who pretends to be an Army veteran and a widower. You are nothing more than a lowlife criminal, and I can only hope you find yourself behind bars soon with some time to think about the life you have chosen.


I know I can't stop your criminal operation, but I can at least try to educate people on how your scam works. Fortunately, I have all of the information I need to publish it, because you just laid it all out for me.


Oh, and P.S. Name Silo is being very helpful in investigating where you registered this domain from. Once I know more, I'll be letting your local police know.


All the best!


Also:


Oh last thing, go ahead and give me a call if you want to chat. Maybe we can clear all this up!


Email 27 (From "Melanie")

I can't believe that you are calling me a thief.Who do you think I am ?I just can't believe this.

Look here, let's suppose that i will scam you, and i will take your money, you will have my name and address and you can send the FBI directly to my door,and they will trow me in jail.I have family,and i don't want to let my kids without a mother,i will not put my freedom in danger for any amount of money.If you even think that I am after your money I don't want to sell you my item anymore.I would rather close this deal with other person than to know that you'll be very stressed hoping that I am a honest person, until you receive it.Your peace of mind is a lot more important than this deal!!! I didn't ask you to send me the money,I wanted you to to send the money to eBay and they will hold the money.I am a woman with trust in GOD, and i will not scam anyone because i will be punished ,and i don't want to happened something to my kids because of me.

Let me know your final decision

Thank you!

Author note: Wow, they are still hanging in there! I have their fake name, no address. Once you send those cards over email, they are GONE folks.

Email 28 (From Me)

I have already reported you and your scam to everyone I can think of.


I'm in the process of writing my article now. I'll be sure to let you know when it's up.

Fake eBay Emails

I'm going to include the eBay spoof emails I received for the "invoice". They were all sent from "ebaymotors@invoices-buyer.online". They are not particularly clever or well written.

307 Jucunda St, Pittsburgh, PA

This is where they claim to live. Not sure here, but that looks a little...condemned. But what do I know? Maybe they just are in between yard service people. And the window is just open for...the breeze. Seems legit, but where's the truck parked?

WHOIS Information for "invoices-buyer.online"

Domain Name: INVOICES-BUYER.ONLINE

Registry Domain ID: D349630218-CNIC

Registrar WHOIS Server: whois.namesilo.com

Registrar URL: https://www.namesilo.com

Updated Date: 2023-02-24T21:30:03.0Z

Creation Date: 2023-02-19T21:15:52.0Z

Registry Expiry Date: 2024-02-19T23:59:59.0Z

Registrar: NameSilo, LLC

Registrar IANA ID: 1479

Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited

Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited

Registrant Organization: PrivacyGuardian.org llc

Registrant State/Province: AZ

Registrant Country: US

Registrant Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name.

Admin Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name.

Tech Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name.

Name Server: NS3.DNSOWL.COM

Name Server: NS1.DNSOWL.COM

Name Server: NS2.DNSOWL.COM

DNSSEC: unsigned

Billing Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name.

Registrar Abuse Contact Email: abuse@namesilo.com

Registrar Abuse Contact Phone: +1.4805240066

URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/

>>> Last update of WHOIS database: 2023-03-22T00:29:15.0Z <<<

For more information on Whois status codes, please visit https://icann.org/epp

>>> IMPORTANT INFORMATION ABOUT THE DEPLOYMENT OF RDAP: please visit

https://www.centralnic.com/support/rdap <<<

The Whois and RDAP services are provided by CentralNic, and contain

information pertaining to Internet domain names registered by our

our customers. By using this service you are agreeing (1) not to use any

information presented here for any purpose other than determining

ownership of domain names, (2) not to store or reproduce this data in

any way, (3) not to use any high-volume, automated, electronic processes

to obtain data from this service. Abuse of this service is monitored and

actions in contravention of these terms will result in being permanently

blacklisted. All data is (c) CentralNic Ltd (https://www.centralnic.com)

Access to the Whois and RDAP services is rate limited. For more

information, visit https://registrar-console.centralnic.com/pub/whois_guidance.

Resolution

As of 3/21/2023 at 10pm EST, nothing yet. I did receive correspondence back from a domain broker (I offered to buy the domain so I could shut it down), but nothing yet from the registrar. I will update this as I find out more.

Update: 3/22 at 6:14pm EST:

From: Domain Broker

Matt,

I got the domain and some others shut down. Namesilo does not want to be included in any press surrounding this and neither do I. God knows who is part of that scam. 

Happy to work with you on another article someday. Good luck! 

Best,

Jxxxxxx M. Gxxxxxx

I just confirmed http://www.invoices-buyer.online is DEAD.