Do not trust the Beneficiary/Inheritance phishing email

Beneficiary/Inheritance email scam removal guide

What is Beneficiary/Inheritance email scam?

As a rule, scammers behind email scams like this one attempt to trick recipients into believing that they are beneficiaries of some will, life insurance policy, etc. Scammers ask recipients to contact them and provide some information. It is common that at some point recipients are asked to pay some processing fee, transfer charge. It is worthwhile to mention that scammers exploit the names of existing, often well-known organizations, companies to make their emails to look legitimate.

There are at least two variants of this email scam. One of them is disguised as a release of funds letter claiming that a recipient is a beneficiary of 3,800,000.000 dollars, Another one is disguised as a letter regarding a will (a testament) of a person who has died of COVID-19 and claiming that a recipient who supposedly has the same surname is named as a beneficiary of 21,300,000.000 dollars. In most cases when recipients contact or reply scammers behind such emails they are asked to provide some personal, sensitive information like credit card details or to transfer some money (as a processing fee, transfer charge, etc.). In other words, scammers attempt to extract money or sensitive information that could be used for malicious purposes (e.g., make fraudulent purchases, transactions, steal identities).

Threat Summary:

Name	Beneficiary/Inheritance Email Scam
Threat Type	Phishing, Scam, Social Engineering, Fraud
Fake Claim	Recipient is a eligible to receive distributions from a will or life insurance policy
Disguise	A letter from Dubai Islamic bank
Symptoms	Unauthorized online purchases, changed online account passwords, identity theft, illegal access of the computer.
Distribution methods	Deceptive emails, rogue online pop-up ads, search engine poisoning techniques, misspelled domains.
Damage	Loss of sensitive private information, monetary loss, identity theft.
Malware Removal (Windows)	To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Malwarebytes. ▼ Download Malwarebytes To use full-featured product, you have to purchase a license for Malwarebytes. 14 days free trial available.

"United Nations Online Lotto Email Scam", "USAA Email Scam", "You Received A Transfer In The Amount Email Scam" - these are the examples of other email scams. It is worthwhile to mention that cyber criminals can use emails not only to extract money and/or sensitive information, but also to distribute various malware (like Agent Tesla, Urnsif, TrickBot, Adwind, etc.).

How do spam campaigns infect computers?

Recipients infect their computers with malicious software via emails (malspam) when they open attached malicious files, or when they open files that were downloaded via links in in them. Some examples of files that cyber criminals use in their malspam campaigns are executable files (like .exe), JavaScript files, PDF, Microsoft Office documents, archive files (like ZIP, RAR). It is worthwhile to mention that malicious Microsoft Office documents infect computers with malware only when recipients enable editing/content (macros commands) in them. However, it applies only to documents that recipients open with MS Office versions that were released after year 2010, older versions install malicious software automatically. It is because the older versions do not include "Protected View" mode.

How to avoid installation of malware?

Received emails that are irrelevant, sent from unknown address and contain some attachment (or website link) should not be trusted. These are the emails that tend to be used to distribute malware. Software, files should be downloaded from official websites and via direct download links. Other sources (like Peer-to-Peer networks, third party downloaders, unofficial websites and so on) can be used as tools to proliferate malicious files that are designed to infect computers with some malware. Installed programs should be updated and activated via implemented functions or tools that are designed by their official developers. Also, it is not legal to use third party tools to activate licensed software, or use installers for pirated software. Additionally, it is advised to scan the operating system for threats regularly and use an up-to-date, and reputable antivirus or anti-spyware suite for that. If you've already opened malicious attachments, we recommend running a scan with Malwarebytes for Windows to automatically eliminate infiltrated malware.

Text presented in the Beneficiary/Inheritance email scam:

Subject: DEAR BENEFICIARY

Dubai Islamic Bank
P.O.Box 1080, Dubai
United Arab Emirates

Dear Beneficiary

We wish to congratulate and inform you that after thorough review of your Inheritance/Contract funds transfer release documents in conjunction with the World Bank and the International Monetary Fund assessment report, your payment file was forwarded to us for immediate transfer of a part-payment of US$3,800,000.00(Three Million Eight Hundred Thousand United States Dollars) to your designated bank account from their offshore account with us.

The audit reports given to us, shows that you have been going through hard times to see to the release of your funds, which has been delayed by some dubious officials.

We therefore advice that you stop further communication with any correspondence outside this office.

Kindly reconfirm your details to enable us credit your account through online or by telegraphic transfer and send copies of the funds transfer release documents to you and your bankers for confirmation.

Should you follow our directives, your funds will be credited and reflect in your bank account within five (5) bank working days.

For further details and assistance on this Remittance Notification, kindly provide us with the below details:

FULL NAME AND AGE:
TELEPHONE AND MOBILE NUMBERS:
FULL CONTACT ADDRESS

Nagaraj Ramakrishnan
Chief Credit Officer,
Dubai Islamic Bank/EIB
Dubai, United Arab Emirates.

Screenshot of the Coronavirus-themed variant:

Text in this variant:

Subject: Dear beneficiary

Dear Friend,
I am pleased to write you this letter for the following reasons:- One
of my clients who died as a result of COVID-19 VIRUS in January, in His Will, left
for someone who bears your surname his entire Cash deposit valued Twenty
One Million Three Hundred Thousand Dollars (US$21,300,000.00). The
truth is that, l do not know if you are the beneficiary or not. l have
tried severally to locate the name on the will without success since l
have contacted you,
Can you please get back to me urgently if you are capable of investing
this fund for any profitable business in your Country, get back to me
for further explanation if you are interested. Please reply to the email below.
Regards
Barr. Tyrone Reid
Private Email: tyronereid@protonmail.com

Another variant of "Beneficiary/Inheritance" scam email:

Text presented within:

Subject: URGENT REPLY IS NEEDED FROM YOU

 

Attn: Beneficiary:

Congratulations!! Your payment has been approved and endorsed, with the instruction and approvals are given from the Authorities Due to the incessant scam activities going around the globe, the Authorities has instructed our Financial Institution to use high Performance in Banking System to set up a Personal Online Banking Account.

The sum of US$15,500,000.00 was deposited in our bank, The Management has resolved to open Personal On-line Banking Account for you with our bank and then give you the on-line access which will enable you to check and make electronics wire transfer out to any part of the world of your choice.

Kindly send the below information to enable us to set the account open for you.

Full Name:..................
Full Address:.........................
Direct Cellphone Number:..........
PASSPORT AND ID CARDS:.................
YOUR OCCUPATION.........
POSITION.........
DATE OF BIRTH..............    

Looking forward to your next letter

Regards

Thanks for banking with us,

Mr.Charles Goodman.
A/C Online Payment Officer,
US Capital Bank Branch North Carolina,
United States of America

Yet another variant of Beneficiary/Inheritance-themed spam email:

Text presented within:

Subject: Memo !

 

Attn: Beneficiary,

With due regards to your overdue contract/inheritance funds as
recovered and under the custody of the United Nations fund recovery
committee, thus, considering  the overdue duration of your inability
to receive the funds.

we write to you in respect of the amount which we have successfully
passed a payment mandate to the paying bank and they are ready to wire
Your payment of (Ten Million Five Hundred Thousand United States
Dollars) USD$10.5M into your receiving bank account.

However, we advise you to forward your full names, Cell phone
number/WhatsApp number,Company name, position and address, banking
information and Copy of your int’l passport OR DRIVERS LICENSE to us.

As soon as we receive all the requested information from you, we will
proceed with the transfer into your account.

Yours faithfully,

Mr Edward Guckin
UN Debt Reconciliation.
Email:m.guckin@aol.com
Email:guckinedward62@gmail.com
Tel:+1 5137177979

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced computer skills. Malwarebytes is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Malwarebytes By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Malwarebytes. 14 days free trial available.

Quick menu:

• What is Beneficiary/Inheritance email scam?
• STEP 1. Manual removal of possible malware infections.
• STEP 2. Check if your computer is clean.

How to remove malware manually?

Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Malwarebytes for Windows. If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:

If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:

Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:

Restart your computer into Safe Mode:

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup. Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings". Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options". In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

Video showing how to start Windows 10 in "Safe Mode with Networking":

 

Extract the downloaded archive and run the Autoruns.exe file.

In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.

Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.

You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".

After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.

Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs. These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software.

To be sure your computer is free of malware infections, we recommend scanning it with Malwarebytes for Windows.

Click to post a comment