This is the first of a semi-regular series where I respond to scammers, break down the warning signs, and waste their time! The goal is to get information about these scams out in the world for other people to find and, perhaps, protect themselves.
If you only want to see the signs this is a scam and how you can protect yourself, click [here].
This all began with an email in my work inbox.
It reads:
Subject: [External Email] A unique gift for piano lovers awaits you ๐
From: cfine@optonline.net
To: hello@tupelogoods.com
Message:
Dear Sir/Madam,
I hope this email finds you well. I am writing to express my interest in donating a piano.
The piano is well-kept and in good condition. It has served me over the years, but I feel that it would be better utilized by individuals who can benefit from its presence.
If you have any further questions or would like to schedule a delivery with a reliable moving firm, Kindly reply.
Thank you for considering my donation. I look forward to hearing from you.
Warm regards,
Charlotte Lawson
Development Assistant
This caught my attention in several ways. First, for some Chase lore: my job title is “senior account manager” at an eCommerce website (one you’ve probably never heard of). I get a lot of cold sales emails for SaaS services or, around the holidays, items for corporate gifting. Things that could theoretically interest any business.
But it’s not related at all to musical instruments, and nothing to do with donations. This piece of spam managed to squeak past both Proofpoint’s junk filters and Exchange’s to end up in my main inbox. So the fact it seemed non-suspicious to both systems drew my curiosity.
Second, the “to” line. I am the sole or main recipient of a lot of company emails/lists, to the point that I amassed something like 5 million archived emails in 7 years, which caused IT many headaches when they were migrating to Exchange. None of them are @tupelgoods.com, and my employer has nothing to do with pool furniture. So how did this even end up in my inbox?
[If you’re a member of IT reading this: hi! I can send you the OG message, if you want, but you can probably find it in your logs, too. I actually have no idea what address it hit to get to me! So you might want to check that out]
While I am not musically gifted, I have many friends who are, and also I can surmise the deranged logistics that must occur to physically move a piano from one place to another. I’ve even heard of people needing to pay someone else to take their piano away because they had no takers when it was free. It’s not like a mattress or piece of furniture you can just throw into the bed of a truck and dump in east Oakland, and the risks from damaging it is astronomical (both financially and potential kinetic energy-ally).
So, to me, this reads as an obvious scam; they’re going to have me “only” pay for shipping, and then the piano will never materialize.
But how much work are they going to put into this? Will it hold up under shallow scrutiny? Let’s find out!
Hi Charlotte,
I received your email regarding the piano you wish to donate. Unfortunately, my employer is unlikely to take care of such an item, but I think the members of my rotary club would absolutely love it!
One of our members has had an idea to teach local children music so that they can become more employable in the future, so your piano would be an amazing gift for this program.
Do you have any pictures of the piano? How long have you owned it? I would love to learn more about it.
I hope you have a wonderful and blessed day!
-Chase Star
Additional Chase lore: I am a writer, so I decided to make stuff up about me, such as why I am emailing them from a gmail and not the original address they messaged, and why I would want a free piano so badly.
I also wanted to push the idea that I’m a more tempting mark. I am just a nice older person who wants to help kids stay off the streets and play the piano ๐
I get a reply a few hours later, from a totally new email (charlotte.lawson@geckesongemcare.co.uk). The original email is via an NYC-area ISP, but gecke song em care dot co dot uk drops you to a blank page (who needs SSL/HTTPS, anyways?) that states it was recently registered via Namecheap. Per who.is, the domain registration is going to expire on the 27th, so I better get my piano while I still can!
Hello Chase,
I am writing to inform you that the piano you are interested in is still available to claim. It is in excellent condition and ready for a new owner to enjoy its beautiful sound.
The Piano is a 2000 Yamaha Grand Piano has the following dimensions:
length 5″3 (161 cm), Width 59″ (149 cm), Height 40″ (101 cm), Weight 627 Ibs (285 kg). Picture attached.
The Piano is currently with a Shipping Company (Gocargo Travels). They assisted me in moving my stuff to my current Location. Feel free to reach out to them at your convenience. To arrange delivery with the shippers, contact Gocargologistics@post.com
For reference, use GTR7ITY119CMBest regards,
Charlotte Lawson
Hooray, this is exactly what I wanted! Let’s check out the pics.
The files are all named something like “Yamaha c3 Piano,” so, for my non-piano-expert brain, it’s enough to find the exact model and its specs. But the given length/weight is too low. Maybe it’s a baby grand? I can’t music, so what do I know!
Looking at the image metadata, I can tell it was taken on Aug 18 2023 with a Canon EOS 60D within a few minutes of each other. Considering the slightly-different settings, I think these photos were taken on some sort of “automatic” mode to tweak things based on slightly differently light settings as the photographer moved around the room.
So I’m pretty confident in saying that these are definitely photographs that a real human took with a real camera in real meatspace.
But I’ve watched Catfish. It’s trivial to just steal photos and pretend they’re yours. To Google Image Search!
This is obviously not the same piano, but it is the same corner in the same room! It’s even the same camera shot with the same sorts of settings!
Let’s look up Yamaha C3 on this store….
And there it is! Photos are exactly the same, metadata and all.
This listing may use photos and videos of another comparable piano we’ve recently sold or a stock image.
So we now know that Caruso Piano Gallery had this piano at some point, which they had listed online (and where anyone could steal the images). If you start going down the rabbit hole, you will find a lot of pianos, being listed on all sorts of sites, using images from Caruso. If we want to be charitable, we could assume these sellers were too lazy to take their own photos and “borrowed” them to resell the piano.
But many of them are also very obviously scams.
A $40.99 piano? That’s not even enough for free shipping!
So, now the question is: did Charlotte Lawson “borrow” these photos and actually has a piano to give away? Or is she using them to scam the pianoless?
Unfortunately, the piano is currently with the shippers, so I can’t ask her to take any sort of verification photo. We’ll have to figure out if these are real guys the old fashioned way.
The email gives us two versions of the shipper’s name:
Gocargo Travels‘s wesbsite isn’t up/functional (issues with DNS/name server etc.) and doesn’t have any other sites/services/back links, so it probably doesn’t existGocargo Logistics, which could be one of many companies with a similar-enough name, and they all have their own site as their email’s domain
The contact email we’ve been given is gocargologistics@post.com. Like the cereal? No, actually, but it does forward you to world dot com, which uses a lot of MBA lingo to say “we have domain names everyone wants,” including post.com. They also mention that you can get email service via mail.com for these domains (more on that later).
Regardless, we must say goodbye to Charlotte, as the real nexus of this scam has to be the shippers; they’re the people who will be requesting and–they hope–recieving my money.
Hello,
I have been corresponding with Charlotte Lawson, who wrote to me that she had a piano she was looking to donate. She tells me that you are currently in possession of the piano and that I should contact you to schedule delivery.
She also said that I should use GTR7ITY119CM when writing to you.
What shall I do to get the piano delivered to me? Do you have any pictures of how it is packaged? I am concerned that it might get damaged in transit.
Have a blessed day.
-Chase Star
I apologize for all the extra whitespace. My work keyboard has a funky space bar and I have been too lazy to remedy it (and I’m copy/pasting these emails exactly for this message. I want to preserve all the errors, even my own lol)
Nine minutes later, I get a response.
Hi Chase,
You are welcome to Gocargotravels, We still have the piano in our climate-controlled storage, We appreciate your interest in GoCargo Services, a national provider of household and office supplies for your next move. We are so happy to have you on board.
As your onboarding assistance for the Grand Piano during shipping, my name is Stephen. For reference, use GTR7ITY119CM. Attached is the picture of how the Piano is packaged.
Please respond to me with the information requested below, as our charges are based on the delivery location.
Full Name:
full home address:
Phone number:Kindly get back with the information requested so we could calculate your shipping quote and proceed with shipment.
Regards,
Gocargo Travels.
I understand that not everyone has perfect spelling/grammar/punctuation (lord knows I’ve spliced a comma), but this is the email that really got me itching to pull out my red pen. I think it’s the “As your onboarding assistance” that got me. It’s entirely possible that this was some sort of text-to-speech error…but there’s just so many little things that add up.
Look at the block asking for my PII for the shipping quote. Each one has different capitalizations. So we can safely assume that ChatGPT didn’t write this, this is free-range, hand harvested spam!
Also we have a third name: GoCargo Services. What even is the name of this company? Surely, I will have an answer once I get a PDF of the quote.
Unfortunately, I couldn’t glean anything useful from the image they sent. There’s no metadata and I couldn’t find it elsewhere online. It’s also quite small (264 x 300 px) so I can’t look for clues in the background.
I responded with a fake address and a Google Voice number (which I promptly set to do not disturb, because I don’t want anyone calling me lol). This started a new email chain:
Hi Chase,
We appreciate your interest in GoCargo Services, a national provider of household and office supplies, for your next move. We are so happy to have you on board.
The 2000 Yamaha Grand Piano has the following dimensions.
length 5″3 (161 cm), Width 59″ (149 cm), Height 40″ (101 cm), Weight 627 Ibs (285 kg).Below are the shipping options to [REDACTED] in [REDACTED], [REDACTED].
FEES FOR DELIVERY
Please see the list of delivery prices below for a variety of options.
Option 1: Ground Shipping; Delivery in 10 Days Delivery Fee: $550.00Option 2: Express Shipping; Delivery in 5 Days Delivery Fee: $1,050.00
Option 3: Freight Shipping; Delivery in 2 Days Delivery Fee:$1,795.00
We offer many convenient and safe ways for you to pay your bill with payment apps like (Venmo, Zelle) and PayPal.
kindly request further details.
Regards,
Gocargo Travels.
This is the part where I got really excited. Yes! PayPal! We’re almost at the end! But let’s put up a normal amount of hesitancy and see what happens.
Hello,
Would it be possible for you to send me an invoice? I would not be
able to get the charge approved on my end if I don’t have it on any
sort of official letterhead.Have a blessed day.
Chase Star
To which they respond (within 20 minutes):
Hi Chase,
Thank you for your response.
I will like to know which of the shipping options you would like amongst the listed below so that i can make an invoice of it.
Option 1: Ground Shipping; Delivery in 10 Days Delivery Fee: $550.00
Option 2: Express Shipping; Delivery in 5 Days Delivery Fee: $1,050.00
Option 3: Freight Shipping; Delivery in 2 Days Delivery Fee:$1,795.00.Also, which Payment means?
I await your response.
Thanks
I can’t wait to see the totally legit invoice! I said option 1 and PayPal, please.
Two hours later, I get exactly what I want:
PayPal Payment Instructions:
Here’s how you’ll need to make a payment with PayPal… Once you have proceeded please return to me with the attached screenshot confirmation receipt so that our accounting department can validate your payment and begin the shipment process as soon as possible.PayPal Information: Our firm is linked to this PayPal account.
PayPal user: Lehlandcheong61
Name: Lehland Cheong
Reference/Memo: GTR7ITY119CM
Fees: $550.00Notes: Please send as family and friends only.
In order to facilitate the processing of your payment through the system, please send through friends and family only. This will also ensure that the payment process proceeds quickly and without difficulty.
Regards,Director Of Account Management
GoCargo Services
Guys, you’re gonna love the invoice.
I censored the totally-fake address, but it was just as bad as the rest of it. Here is a close-up:
The PNG they sent me is clearly something else that they’re just drawing a white box on top of a field to type in the new info. This is not something generated with any sort of official software.
PayPal has an “invoice” feature, where you get a very nice email from PayPal that says what you’re being billed for, how much, etc. There are definitely scams out there that send you PayPal invoices for things you didn’t actually order in hopes you pay them without thinking, but since they are “business” payments, you can request your money back if you never get the thing you ordered (such as a scam).
Friends and family payments, meanwhile, are supposed to only be for people you know (e.g. your roommate for rent, your friend splitting the bar tab, etc.). There’s no fees, but there’s also no way to get your money back, which is why scammers say it’s the “only” way to send money.
At this point, I report the PayPal user to PayPal so the account can get shut down, as well as to world dot com. I have all the evidence that I need to say, hey, this is really suspicious and is probably a scam! You should maybe stop it!
In the meantime, I respond with some concerns:
Hi Lehland,
I am hesitant to use the friends and family option. Since I do work
for a non-profit, there are tax implications if I lie about who I am
sending the money to.Would you be able to generate an invoice via PayPal? That way, I can
get a formal invoice from PayPal, which would make my boss happy, and
then I can pay you, which would keep the IRS from auditing my company.I hope you understand!
-Chase Star
To which I get:
Hi Chase,
Thanks for the reply, But unfortunately, the freinds and family is the only option we have for PayPal payment at the moment. i’m afraid you may have to choose other means of payment accepted by us.
Example: Venmo, Zelle or Cashapp
Let me know if you are still interested.
Thanks.
Sadly, I don’t think they’re going to be hearing back from me anytime soon.
Dear Chase Anderson,
We have forwarded your request to block this account to our security department and it was determined that the account in question will be blocked.
Please understand that we can not provide further information for security reasons.
We apologize for the inconvenience and thank you for your help in making our servers much safer.
Thank you!
Kind Regards,
Yourย mail.comย Support Team
Obviously, there is nothing stopping these scammer(s) from making another account or using another email service, but it should put this email company on alert to these specific guys, and any current conversations they were having with potential victims should be interrupted.
Signs of a Scam:
There are a lot of common features shared among scams, but here are the ones especially prevalent in this one:
- An offer that’s too good to be true, like a very expensive item where you only have to pay the shipping
- Google reverse image search shows the photos belonging to someone else
- Details don’t line up or keep changing (e.g. the name of the company)
- Companies that should have websites don’t, or any other sort of online presence (Yelp reviews, Facebook pages, etc.)
- Company wants to use person-to-person payment methods (Cashapp, Venmo, Zelle) or “friends and family” PayPal transfers
#5 is the big one. No reputable company is going to state they can only use PayPal friends and family. You might use Venmo or Cashapp for someone at a craft fair or your barber, but those would be very small businesses, and it would be for someone right in front of you, and you have the item in hand (or already received the service). They wouldn’t be able to scam you, you already got your hair cut! If anything, you can scam them by saying “oh yeah I totally sent you the money on Venmo!” and don’t. (please don’t do that)
You can read more about PayPal Friends and Family and how it’s used by scammers [here]. You can learn more about common Venmo scams [here] (link is to section about buying from strangers).
Do keep in mind that searching for an image may not always work, especially in the future. With the rise of generative AI, scammers can create as many images of a piano (or anything else) as they like, giving each potential victim a unique image. But genAI images are still at the point where they look not quite right if you study them closely.
I know that it’s common to cite things like spelling/grammar/punctuation errors as a sign of a scammer, but it shouldn’t be the only red flag to look for. Plenty of legitimate folx can’t spell too well, and plenty of scammers can have impeccable messages. Not only could they use tools like ChatGPT to write something “good,” they can use tools like Grammarly or the spell check built into their web browser to fix common mistakes.
But AI can’t make the situation (a “free” item) non-suspicious, and it can’t “fix” the method the scammers use to get what they want (money from you in a manner where you can’t get it back). Unfortunately, we live in a world of quickly-eroding trust. Any legitimate seller (or donor) won’t be mad if you ask for proof of the item or request funds be sent in a way that protects you.
If you’re ever in doubt, do a Google search or ask a friend! Scams succeed because they take advantage of things victims don’t know. The more knowledge is shared, the harder it is for scammers to succeed. This is why you don’t see the “Nigerian prince” scam much anymore, because it’s so widely-known, its chances of success are too low to be worth the effort.
If you’re a writer, you can follow [Writer Beware] to stay on top of the latest scams in publishing. If you want to learn more about emerging social engineering, [Bleeping Computer] has a tag you can follow. If you’re a member of a specific community or hobby, there’s probably hyper-specific scams that would be hard for outsiders to know. For example, there are a lot of [free piano scams] out there, though I couldn’t find one that operated exactly like this one.
Be cautious, always verify, don’t be afraid to ask for help, and let others know about the scams you find! If we all work together, we can make stuff safer for everyone!
-Chase
