wellsfargobnk07@gmail.com

[Wayne]

Urgent response


Wells Fargo <wellsfargobnk07@gmail.com>
Bcc:

Tue, 22 Feb at 13:00

Attention: Fund Beneficiary.

A prime bank with branch California Wells Fargo Bank is currently
holding over unclaimed payments originating from various banks in
Africa The payments includes unclaimed customer deposits and over
payments,Unclaimed Contract Funds, certificates of deposit, credit
balances, refunds, un-cashed death benefits, and the contents of
safety deposit boxes.If you have received this notification,
beneficiaries, legal heir or nominees and you are entitled to an
unclaimed payment currently under the bank’s custody.If you wish to
claim this deposit and prevent the bank from transferring the funds to
government as abandonment, please contact us with your complete name,
address, telephone, receiving banking coordinates.Payment would be
made automatically by direct debit to the with holding bank account
which has been adequately funded for this purpose.
IF A RESPONSE IS NOT RECEIVED WITHIN SEVEN (7) DAYS FROM THE DATE OF
THIS NOTICE, THE FUNDS WILL BE TRANSFERRED BACK TO
GOVERNMENT TREASURER AS UNCLAIMED PAYMENT.

Please you can contact us on my official Email : info@wellsfargousa.org.

Sincerely,
Mr George Makris
Wells Fargo Bank California(USA)

[Big Al]

Dear

Sir,

Thanks for your response,

we can pay you through a debit ATM Card or a telegraphic bank transfer but you have answer our questions.

1,how much are you expecting to receive from our bank?

2,which category of fund did your payment fall in.

is it Loan?,or inheritance, contract fund,which one name it.

send your complete postal address and your direct telephone number

Regards,

George Makris

Wells Fargo bank California(US

Header:

Delivered-To:
Received: by 2002:a05:7300:7984:b0:56:f1a3:acdf with SMTP id a4csp641708dyi;
Mon, 28 Feb 2022 13:41:20 -0800 (PST)
X-Google-Smtp-Source: ABdhPJxHhHreBq8/wdGFpVkXdA0Q8JFhPU6AbJSlmGIHB/ox/vcs4IZhyg618dNgH56SPI63nTPY
X-Received: by 2002:aca:5a8b:0:b0:2d7:8337:eb3e with SMTP id o133-20020aca5a8b000000b002d78337eb3emr6106650oib.83.1646084480736;
Mon, 28 Feb 2022 13:41:20 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1646084480; cv=none;
d=google.com; s=arc-20160816;
b=Qa8zzrKDmJCJuqG4jLL5XVbs9XpzRrCUMhWZrgPBGEb5RzGGqsxSdUB0T//dsUxsuJ
tpgybSpTTYaZ958VOBO7kJclPYYFgmQJW/P25386Vd2Prf9wRYrHN3fFk8orIbeV5gkW
25TJGlsrwRZZLh+lqtvK7et54rKlYLeNnLXyQgafNfKxsA56R/08w61b7ighpySLNMUw
A94sIzUkPVYWRao85zZ/6gZd3apulnCyuoI8lavFcZMbxS+x+sKNyYSZWXsMZp3p6OA4
aQV8Mz3pjhfpt1myhtYdQ6JVH5opUTJJJJ7VPT89jaXEI/1BBO+16H+XaKgbQIr3QBBj
U7xg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=message-id:user-agent:references:in-reply-to:subject:to:from:date
:mime-version:dkim-signature;
bh=N64wLORkZCkm1IW5rjtY90nbcgy89j8PZIj8Aj1EuSQ=;
b=op6shx7tRIWl1g83kip3o0avGH2pAO5wkK3U7YcvTcKS2NOL8jcDxtGvs9F7t9gapF
KjAO4l/ervUCnfM+yrlBUd06n3xBkJ8yv/v0iBpWdvTCskcCkqw+ycQPnV8/f+iD/k2K
4B2xkp4dBwmXp3/xReVYeo6m1NCeYp9F3MP8vZOk8ra0wAigK7dO6jqlItdSDI5Qoh+k
obfcIcj23FaIZ7TVFyV5zNrsN7GIwlx7blHJhFqXapuuB4fKg+bod9paN5eLJauWUya6
iGiBLTe3siyFye6meVv282OkmtXk5XxAemPi6tbHooKL2HKm3ICmrRFj973clNTpval6
JW2g==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@wellsfargousa.org header.s=20201026 header.b=IlbShwUu;
spf=pass (google.com: domain of info@wellsfargousa.org designates 208.91.198.156 as permitted sender) smtp.mailfrom=info@wellsfargousa.org
Return-Path: <info@wellsfargousa.org>
Received: from us2-ob4-1.mailhostbox.com (us2-ob4-1.mailhostbox.com. [208.91.198.156])
by mx.google.com with ESMTPS id v10-20020a9d5a0a000000b005af7886ef1fsi6557557oth.264.2022.02.28.13.41.20
for < >
(version=TLS1 cipher=AES128-SHA bits=128/128);
Mon, 28 Feb 2022 13:41:20 -0800 (PST)
Received-SPF: pass (google.com: domain of info@wellsfargousa.org designates 208.91.198.156 as permitted sender) client-ip=208.91.198.156;
Authentication-Results: mx.google.com;
dkim=pass header.i=@wellsfargousa.org header.s=20201026 header.b=IlbShwUu;
spf=pass (google.com: domain of info@wellsfargousa.org designates 208.91.198.156 as permitted sender) smtp.mailfrom=info@wellsfargousa.org
Received: from localhost (unknown [10.86.224.106]) (Authenticated sender: info@wellsfargousa.org) by us2.outbound.mailhostbox.com (Postfix) with ESMTPA id C4E472C6429 for < >; Mon, 28 Feb 2022 21:41:19 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wellsfargousa.org; s=20201026; t=1646084479; bh=N64wLORkZCkm1IW5rjtY90nbcgy89j8PZIj8Aj1EuSQ=; h=Date:From:To:Subject:In-Reply-To:References; b=IlbShwUugcqY9ucdGgEEol007Ycwk7TIFN84mpQtpGPxzxxppR14Mg00WbvhJT7Sb
khnBl6L0ES3Hc3S5Ew/putNqyQQXMvi1FM7rOwAERLxWrQuwFEVG7LpmbCwedTNwf0
S7mItgJrnDqsfrg99ngmMEJEXwRA+D3X0R7KULrQ=
MIME-Version: 1.0
Date: Mon, 28 Feb 2022 13:41:19 -0800
From: info@wellsfargousa.org
To:
Subject: Urgent response
In-Reply-To: <CAG7vLpxmAAEtP_dBbMTWA8rAACozoA0FCyw2WHp8LRUhEdv=_w@mail.gmail.com>
References: <CAG7vLpxmAAEtP_dBbMTWA8rAACozoA0FCyw2WHp8LRUhEdv=_w@mail.gmail.com>
User-Agent: Roundcube Webmail/1.4.8
Message-ID: <d84419323b0254320f0d68b9503554c8@wellsfargousa.org>
X-Sender: info@wellsfargousa.org
Content-Type: multipart/alternative; boundary="=_15aaf9ad0688ed054dc3a6a234422ef7"
X-CMAE-Score: 0
X-CMAE-Analysis: v=2.4 cv=dOXFJMVb c=1 sm=1 tr=0 ts=621d417f a=JlfWCKdc9h/rx7LPK1XxAg==:117 a=fmD_JHji_u0A:10 a=kvW2oCXAGiUA:10 a=LmV7pkAbXYUA:10 a=TZmrJTXDgRUA:10 a=L5SlO2SrAAAA:8 a=J8tx_fnvj9VBTn8yEXUA:9 a=CjuIK1q_8ugA:10 a=Cqlz-GBvC7oA:10 a=aTitaG8enIwK-lcjvRcA:9 a=NJuTFDpo15ebfBNJ:21 a=_W_S_7VecoQA:10 a=QEXdDO2ut3YA:10 a=oI3M2HKYBD-T6MFCy5LG:22 a=HH7FIXwXL_sUf1zzYxQd:22 a=a74rbJCgoavrjza3kfOd:22 a=37s0gm3O6Ik5_rHIWVV_:22

--=_15aaf9ad0688ed054dc3a6a234422ef7
Content-Transfer-Encoding: 7bit

Orig IP: 208.91.198.156 | Orig ISP: Public-domain-registry | City: n/a | Country: United States

[firefly]

The fraudulent domain name used in scam is a spoof of Wells Fargo.

There is no content, the domain name being used only for the email address, as in info@wellsfargousa.org.

Entry in the aa419 database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=155360

From the domain name registration:

Domain Name: WELLSFARGOUSA.ORG
Updated Date: 2021-11-20
Creation Date: 2020-10-26
Registrar Registration Expiration Date: 2022-10-26
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registry Registrant ID: Not Available From Registry
Registrant Name: Frank Moss
Registrant Street: 3rd Avenue I close house 23
Registrant City: Festac Town
Registrant State/Province: Lagos
Registrant Postal Code: 102312
Registrant Country: NG
Registrant Phone: +234.7056071350
Registrant Email: frankmos99@gmail.com

[Big Al]

Dear

Sir,

Good Afternoon , this is to remind you once again that your Certified Bank Draft /ATM CARD is ready to be delivered to you via your postal address.

you are required to $500 dollars to us for courier services and handling charge to enable us dispatch the ATM CARD

to you.

Send your postal address and the money to enable us deliver them to you.

Regards,

Mr George Makris

Wellsfargo bank USA

[Big Al]

Dear

sir,

My dear, l refer you sending this money directly to the person in charge of the delivery.

He said he prefer you sending it to his bitcoin wallet.

Send it through this bitcoin wallet address below

3PgvALF9Z57FFL5VqEAJcLxEN43iF2aucF

As you know what we are talking about is millions of dollars in draft/ATM Card is not an ordinary

paper so we must guide and secure it properly in other not to miss on transit.

That $500 covers everything until its gets to you. once the payment is done send me the copy of

the payment receipt to enable me forward it to him immediately.

Regards,

George Makris

[Big Al]

Dear
Sir,
sir,
Thanks for your reply, use this account below to send the money

Send the $500 dollars through this account ,
Wells Fargo bank
B. B. W.
Address sea Tac WA 98168.
Account 970707XXXX
Routing 125008547

Once the payment is made forward the payment receipt to enable me forward it to him immediately.

Regards,
George Makris
Wells Fargo Bank USA

[Big Al]

Dear

Sir,

Thanks for the information,once the payment is done forward the payment slip

to me immediately to enable me hand it over to them for confirmation.

Regards


George Makris
Wells Fargo Bank USA

[Big Al]

Dear

Sir,

I gave you a bitcoin wallet address to send the money, you said you prefer an account. now l gave you an account for the transfer and your requesting for another account.

Sorry, There is no other account, please try and use either the bitcoin wallet or the account l gave you to send the money .

Once your done with transfer you let me know.

Regards,

George Makris
Wells Fargo Bank USA

[Big Al]

Dear

Sir,

I trust my bitcoin wallet especially the one l gave you, send it to that bitcoin wallet l gave you if anything goes wrong l will be held responsible .

send it and forward the payment receipt to me to enable finalize your payment.

Regards,

Mr George Makris

[Big Al]

Dear

sir,

I have not yet received your payment of $500 dollars concerning the release of your fund.

please try and send the money today like you promised.

Expecting your urgent reply,

George Makris
Wells Fargo Bank USA