Employment scam - Scamalot

Seen a Scammer? Report Them!

Seen a scammer? Been caught out? Let the world know so they don't get burned. Add information if you see one that's already been logged - scammers move quickly and change details often to avoid detection. Details you log here will be in major search engines within an hour or two.

Please Like, Share, Tweet etc. to spread the word.
  Scam type at Advanced Search      
Scam ReporterScam Tips Received
Savannah, GA, United States
2017-07-31 21:20:05
Job Scam
+2 Employment scam   
Name Unknown
Email Address:
Country of Scam:
United States (US)
There will be a counterfeit check sent. The check will not be any good. They will tell you to keep $500 or $600 and send the rest to someone else by money gram,western union or by i-tunes cards or gift cards. If you email him/them the control/MTCN number,they can pick up the transfer even if they live in Africa and you are told to send the transfer to someone in New York or (doesn't matter) - all they need is the MTCN/control number. You must understand how money gram,western union works.

Dear Applicant,

Sorry for the late response.
Please apply for the job at: https://fabplc.wufoo.com/forms/office-assistant-application-form/
If you have any question, reply back my email.

Good luck,
Alex Phillip - Hiring Manager
Follow Ups/Extra Information. Most recent is listed first.
Falconsfan   (Savannah, GA, United States) Added the following extra information on :2017-08-01 12:27:24
Alex Phillip
Email Address:
(201) 701-1367
Hello Good Morning,
This is to inform you that a check payment of $3965 has been delivered to you since yesterday Via USPS here is the tracking number 9405501699320126153812. You can track the transit progress on www.usps.com.
You should have deposited the check by now which should clear in a day or two,When you are through depositing the check,you will send me a report with deposit slip image to know when the funds are available,you are to deduct your weekly salary which is $500 from the payment then the rest will be forward to my shipper account details that i will provide for you once i read back from you the funds is meant for shipping of Fabrics to my client warehouse,you are to handle that after this first trail,hope i can trust you on this and also note that this trial task is to test your efficiency and diligence also to work out your time schedule and fit it to mine.
Get back to me as soon as you see my message also let me know the status of the check.
Looking forward to hearing from you.
Sincerely, Alex Phillip. (201) 701-1367

Scam Email
From: Alex Phillip delivered-to:
received: by with HTTP; Tue, 1 Aug 2017 03:07:16 -0700 (PDT)
arc-seal: i=1; a=rsa-sha256; t=1501582036; cv=none; d=google.com; s=arc-20160816; b=u4bE/WEMNPxaWPPfbhSl2+lguvuyOc7Dnpl5UGf/rN...
arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=to:subject:message-id:date:from:mime-version:dkim-si...
arc-authentication-results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.b=Nze9+3Ub; spf=pass (google.com: domain of alex.phillip001@g...
received-spf: pass (google.com: domain of alex.phillip001@gmail.com designates as permitted sender) client-ip=;
authentication-results: mx.google.com; dkim=pass header.i=@gmail.com header.b=Nze9+3Ub; spf=pass (google.com: domain of alex.phillip001@gmail....
dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; ...
mime-version: 1.0
date: Tue, 1 Aug 2017 03:07:16 -0700
content-type: multipart/alternative; boundary="94eb2c07ca76e15ec60555ae4f9e"

Falconsfan   (Savannah, GA, United States) Added the following extra information on :2017-07-31 21:23:42
Alex Phillip
Email Address:
Hello,How are you doing today? Information reaching me from USPS that the payment inform of check $3965 have been delivered to you today Friday. Kindly confirm the receipt of delivery,take it to your bank and have deposit it to clear bank within 1-2 days,you can as well do mobile or ATM deposit. I will be waiting for the deposit slip image so that I can give you next line of action.
Sincerely, Alex Phillip

Scam Email
Subject: PAYMENT DELIVERED... GET BACK TO ME 9405501699320126153812
From: Alex Phillip delivered-to:
received: from CY4PR18MB1606.namprd18.prod.outlook.com ([]) by CY4PR18MB1606.namprd18.prod.outlook.com ([]) with...
arc-seal: i=1; a=rsa-sha256; t=1501535552; cv=none; d=google.com; s=arc-20160816; b=h5m7x2PmIF/AeS0/qRGZiMbmNR4ZuUtpzWeu9rinHa...
arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:spamdiagnosticmetadata:spamdiagnosticou...
arc-authentication-results: i=1; mx.google.com; dkim=pass header.i=@outlook.com header.b=NEZnvx0f; spf=pass (google.com: domain of alex.phillip01@...
received-spf: pass (google.com: domain of alex.phillip01@outlook.com designates 2a01:111:f400:fe50::80a as permitted sender) client-ip=2a01:11...
authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=outlook.com;
dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=G...
thread-topic: PAYMENT DELIVERED... GET BACK TO ME 9405501699320126153812
thread-index: AQHTCkGuk+uPT6HndEG6sgXxh1AGQQ==
date: Mon, 31 Jul 2017 21:12:15 +0000
accept-language: en-US
content-language: en-US
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
content-type: multipart/alternative; boundary="_000_CY4PR18MB16066AC3EF301014B5E6649C8BB20CY4PR18MB1606namp_"
mime-version: 1.0

 Got more information on this Scam/Scammer?
Add to Report
 Problems with this Report? (Spam/Legal/Abuse etc) ?
Report to Scamalot
Curious what information about you is out there? You may be surprised! | Reverse Email Lookup | Reverse Phone Lookup

Increase ad revenue 50-250% with Ezoic
    [CONTEXT_DOCUMENT_ROOT] => /home2/scamalot/public_html
    [DOCUMENT_ROOT] => /home2/scamalot/public_html
    [HTTPS] => on
    [HTTP_ACCEPT] => text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    [HTTP_ACCEPT_ENCODING] => x-gzip, gzip, deflate
    [HTTP_HOST] => www.scamalot.com
    [HTTP_USER_AGENT] => CCBot/2.0 (http://commoncrawl.org/faq/)
    [HTTP_X_HTTPS] => 1
    [PATH] => /bin:/usr/bin
    [PATH_INFO] => /86660
    [PATH_TRANSLATED] => /home2/scamalot/public_html/ScamTipReports
    [QUERY_STRING] => 
    [REDIRECT_STATUS] => 200
    [REMOTE_ADDR] =>
    [REMOTE_PORT] => 49958
    [REQUEST_SCHEME] => https
    [REQUEST_URI] => /ScamTipReports/86660
    [SCRIPT_FILENAME] => /home2/scamalot/public_html/ScamTipReports
    [SCRIPT_NAME] => /ScamTipReports
    [SCRIPT_URI] => https://www.scamalot.com/ScamTipReports/86660
    [SCRIPT_URL] => /ScamTipReports/86660
    [SERVER_ADDR] =>
    [SERVER_ADMIN] => webmaster@scamalot.com
    [SERVER_NAME] => www.scamalot.com
    [SERVER_PORT] => 443
    [SERVER_SOFTWARE] => Apache
    [SSL_TLS_SNI] => www.scamalot.com
    [TZ] => America/Sacramento
    [PHP_SELF] => /ScamTipReports/86660
    [REQUEST_TIME_FLOAT] => 1508738632.61
    [REQUEST_TIME] => 1508738632
    [argv] => Array

    [argc] => 0