khaledalmutawa23@gmail.com

[Wayne]

Barclays Bank Consultant Agent

khaled almutawa <khaledalmutawa23@gmail.com>
Bcc:

10 Feb at 16:10

Attn: Mr.



My names is Mr. Khaled Almutawa Barclays Bank Consultant Agent .Sometime ago, in Barclays bank New York Branch, your contract/ Inheritance funds was brought to Barclays Bank from Economic Community of West African Foreign Contractor/ Inheritance Payment Panel made off with the following countries: Nigeria, Ghana, Togo, Rep.Benin, Senegal, Ivory-coast, Gambia, Mali, etc. (Ecowas), AND AFTER SOME PERIOD, They call the fund bank to their treasury in World Bank.

For the period of time this money was in Barclays bank New York branch, it has generated an interest of US$2.8 Million, which bank considered your long suffering as one of the African Countries contractor/ Inheritance consignee that have not received his/her payment and we decide to pay you this interest fund via Swift Transfer into your account.

What we need from you now is any form of your identification for example; your international passport number or you’re driving license number, then your telephone and fax number for easy communication.

In view of this you are hereby instructed to contact Barclays bank New York branch foreign remittance department on info@barc-ny.us immediately you receive this fax message and reconfirm your bank particulars.

Truly

Mr. Khaled Almutawa

Consultant Agent

Barclays New York

Branch

[firefly]

Email received:

Attn: Mr.xxx,

Dear Customer,

Interest of US$2.8M approve transfer to be credited into your nominated
account OK.

Sir,

Attachment here is the International processing transfer form from
Barclays bank New York Branch, go through it, feel the form and return
it back to the bank.

Yours Sincerely
Barclays bank
Management
New York Branch

Header:

Delivered-To:
X-Google-Smtp-Source: APXvYqzsHwISJK/JEO2JMCvHClQ9fh5pexH8Am9Dw7Cj6s78vzyR6eqxN4/b8LMvC8PeFP7G/QXX
ARC-Seal: i=1; a=rsa-sha256; t=1581530339; cv=none;
d=google.com; s=arc-20160816;
b=oge78xEgg2mtgkTfyqobvQG4YRwGWX4zA11beDiy82uLxyPsL9npzTpqfgKG6kUQu/
WGGkI5kCoSi8a7KLwHYTdBZJw/2BJZmRDfV0FCg0OxYv/HmjDZj/ZmrSnd37eDgXfN0M
Sl7gtifruk8Od8tbWnB/1gjLM4kaEz28VkY9idxBhmKDmw3JG5fJCXjrW3BbQSqqkxdA
IwfgHkZNYlzWWEmyDHFMZqX+g6rb+fXUM+1czJ/HBpnlftVkjc3xqwgDXMgQNqYEBiu+
BRrpBmrrZRo/I8tbbzBl1p77db4OvHeejZUG+pOi81+BPmjrjRIAGKL4GRdr1z747ErM
ugAA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=user-agent:message-id:references:in-reply-to:subject:to:from:date
:mime-version:dkim-signature;
bh=2AN24fS2DKgL/6/BKafB/+Vog3NmTqwIbMBw6pgrb9M=;
b=GIneVzO2m6UMufP79aNPvWjale6XXoMwjwr5nT4REuQF5tCcKJhV3532/wozu6x7Ja
3U+OOmy+8fOD2PdioInYaAUvc4/oMKdhaMNyvG8vUxV7LkKt3OGvFGvebphk3irZHzqE
w+q7g+XIMAHWapA2T2CbpeErfgi+QOB4YQlfK1XdxSeIFPS3AtWNAbwthjsbRRHSC/1e
UZi34y2NmcP3C//FTsmxv2BwceUHIt+WctkFDl6+IzdwMf76sBd6xpjrsZbxYZAbkInN
RNJjQal1bPUKZIxgOpsu7pkMWqXI+GoFyoQV0M4OAy2oXY0QMjTkCDbaR4oxKJoJs+b0
RElQ==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@barc-ny.us header.s=default header.b=rAwzENFu;
spf=pass (google.com: domain of info@barc-ny.us designates 68.65.122.147 as permitted sender) smtp.mailfrom=info@barc-ny.us
Return-Path: <info@barc-ny.us>
Received: from server168-4.web-hosting.com (server168-4.web-hosting.com. [68.65.122.147])
Received-SPF: pass (google.com: domain of info@barc-ny.us designates 68.65.122.147 as permitted sender) client-ip=68.65.122.147;
Authentication-Results: mx.google.com;
dkim=pass header.i=@barc-ny.us header.s=default header.b=rAwzENFu;
spf=pass (google.com: domain of info@barc-ny.us designates 68.65.122.147 as permitted sender) smtp.mailfrom=info@barc-ny.us
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=barc-ny.us;
s=default; h=Message-ID:References:In-Reply-To:Subject:To:From:Date: Content-Type:MIME-Version:Sender:Reply-To:Cc:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=2AN24fS2DKgL/6/BKafB/+Vog3NmTqwIbMBw6pgrb9M=; b=rAwzENFuVcDEakqXzodcj0dVoO Pmi6/tcHvmeR1V1Q5o9ncYhbi/dSL9CHAL/rDnS6oWDiCJT5+erGGufnmN7HxdTIwVJUzZhZDLMpE XL2OGOXuiNXaUPNjRANxWeC4RAXhw+kB210TG2ogwN8VgzsxvXUf1eggNJojfUydXaVyaRJXStzZU IOg5t2zR74Nk1Xe9loyyzzLzVeS8LXG+Uziu+PKHxPCbkW381rJeHvyKNg99XgYZDichG1trvDFBS 5KYV13SZ5cM+7jc58TdScbkpr+6w2gT2+akA4dv6ALCn+VSN2SHEa8LAjzKkm6gN7xzxB+aIsRGew q3+JMw+w==;
Received: from [::1] (port=59422 helo=server168.web-hosting.com) by server168.web-hosting.com with esmtpa (Exim 4.92) (envelope-from <info@barc-ny.us>) id 1j1wHp-003mGM-6s for xxx; Wed, 12 Feb 2020 12:58:57
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="=_b24d0a65060f4db3ea248c5f35a9223a"
Date: Wed, 12 Feb 2020 12:58:57
From: "Barclays Bank, N.A. -
New York, U.S.A" <info@barc-ny.us>
To:
Subject: Re: About your email
In-Reply-To: <CAGhQ5kt3Kg0yAvW-vZa2Hbg_qJ1Vzb_D2P3qhcdV8japHXU7JA@mail.gmail.com>
References: <CAGhQ5kt3Kg0yAvW-vZa2Hbg_qJ1Vzb_D2P3qhcdV8japHXU7JA@mail.gmail.com>
Message-ID: <3b5f5aa4c4134d641f2ebf1d6cc28d6d@barc-ny.us>
X-Sender: info@barc-ny.us
User-Agent: Roundcube Webmail/1.3.7
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server168.web-hosting.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - barc-ny.us
X-Get-Message-Sender-Via: server168.web-hosting.com: authenticated_id: info@barc-ny.us
X-Authenticated-Sender: server168.web-hosting.com: info@barc-ny.us

Originating IP: 68.65.122.147
Originating ISP: Namecheap-net
City: Centre Hall
Country of Origin: United States

Fake document received with the message:

[firefly]

The real Barclays was founded in 1690.

The fake one, used here, was registered in January.

The domain name shows no content and is used only for the email address, as in info@barc-ny.us.

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=142099.

From the domain name registration:

Domain Name: barc-ny.us
Updated Date: 2020-01-27
Creation Date: 2020-01-22
Registry Expiry Date: 2021-01-22
Registrar: NameCheap, Inc.

Registry Registrant ID: C1F476DDD86DB4D86AA67969F968D20C9-NSR
Registrant Name: shawn envy
Registrant Street: 333 O'Farrell St
Registrant City: San Francisco
Registrant State/Province: CA
Registrant Postal Code: 94102
Registrant Country: US
Registrant Phone: +1.4157711400
Registrant Email: shawnenvy1@gmx.com
Registrant Application Purpose: P1
Registrant Nexus Category: C11

The registrant location is stolen from Hilton San Francisco Union Square Hotel.

[Big Al]

Recovery Scam:

Attn: Beneficiary,

Re: Your US$18M Transfer.

According to the approval order to release an inheritance fund to you from the IMF resettlement account with this institution Barclays Bank Accra-Ghana for transparency and accurate record. We deem it necessary to let you know that we are to start moving your funds in bits into Bitcoin Wallet Account and you are advised to open Bitcoin account and forward the details with a copy of your identification to enable us start paying your funds till the entire US$18,000,000.00 ( Eighteen Million United States Dollars) will be paid but not at once but in bits of US$1,000,000.00 on each transaction.

This is the only easy way out to avoid International Payment Requirements as this is PAYMENTS MADE EASY.

We look forward to your compliance

Thanks for your patience and time

Yours Sincerely
Victor Adams
Director of Operations
Barclays Bank Accra-Ghana

Header:

Received: from 127.0.0.1
Return-Path: <khaledalmutawa23@gmail.com>
X-Originating-Ip: [209.85.161.66]
From: khaled almutawa <khaledalmutawa23@gmail.com>
Date: Sat, 23 Dec 2023 15:25:33 +0000
Message-ID: <CAEQUno1rr9wt_vNM=wruRQVKotS5Aqbth2xsn11rpF6W=ur8OQ@mail.gmail.com>
Subject: Re: Your US$18M Transfer.
To: undisclosed-recipients:;