How to spot fake emails like "Fund Transfer Assistance" scam email

What kind of scam is "Fund Transfer Assistance"?

Our team has reviewed this letter and determined that it is a scam. The goal of this scam email is to deceive recipients into sending money and (or) providing sensitive information to the scammers. It is strongly advised not to respond to this letter (and always ignore emails of this type).

More about the "Fund Transfer Assistance" scam email

This letter appears to be from a woman named Mrs. Janet E George, a widow, who is seeking help with transferring a large sum of money her late husband had deposited in a bank. Her late husband had a personal oil firm in Bentiu Oil zone town and Upper Nile city and had dealt with the Federal Government of Sudan.

However, her life is now in danger due to the civil Ethnic crises in Sudan caused by the President and the rebel leader. She is currently taking refuge in a refugee camp in Côte d'Ivoire. She explains that the rebels are targeting the families of oil businessmen in the country, accusing them of milking the country dry.

Fearing for her safety, Mrs. George is seeking a partnership with the recipient to transfer and invest the sum of £10,500,000, which her late husband deposited. She explains that her life is no longer safe in Sudan, and she needs to transfer the money to a secure place.

She requests the recipient's help in transferring the money to their bank account and offers to provide more information on how to contact the bank where the money is currently deposited.

Typically, such letters are used to extract money or information. For instance, scammers request to pay some fake administration or other fees, or they claim that an advance payment is required to receive the full amount. Either way, people who fall for such scams never receive any money.

Similar scam emails in general

It is common for scam emails to be disguised as important/official/urgent or other kinds of letters from real people or legitimate entities. In most cases, scammers send them to trick recipients into providing credit card details, ID card information, social security numbers, or other details or sending money.

Examples of scam emails are "Thank You For Shopping With Apple", "PayPal Account Has Been Charged", and "Investment Into Building Homes For Orphans". Cybercriminals also use emails to trick recipients into infecting their computers.

How do spam campaigns infect computers?

Threat actors behind emails used to deliver malware attempt to lure recipients into infecting their computers by including malicious links or attachments in emails. Computer infections are caused when recipients download and execute malware by themselves.

Files that cybercriminals use to distribute malware are malicious MS Office documents, PDF files, JavaScript files, ISO files, executables, archive files, and other files. Simply opening a malicious file does not always leads to a computer infection. For instance, malicious MS Office documents infect computers after enabling macros commands.

How to avoid installation of malware?

Avoid opening files and links received from unknown email addresses, especially when emails appear to be irrelevant. Before opening any email content, it is essential to carefully inspect the email. Also, download programs and files from reliable sources such as official pages and stores. Do not click ads on suspicious pages.

Keep all software (including the operating system) updated. Using reputable antivirus software and regularly running system scans is also recommended. If you've already opened malicious attachments, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

Text presented in the "Fund Transfer Assistance" email letter:

Subject: Greetings my dear pls pay attention

--
Greetings my dear

I am writing to you based on trust. My name is Mrs.Janet E George, My
late husband deals in Crude Oil with the Federal Government of Sudan
and we have a personal Oil firm in Bentiu Oil zone town and Upper Nile
city.

What I have experience physically, I don't wish to experience it again
in my life due to the recent civil Ethnic crises caused by our
President Mr. Salva Kiir and the rebel leader Dr. Riek Machar, I'm in
a refugee camp in Côte d'Ivoire to save my life.

I want to solicit for your partnership with trust to transfer and
invest the sum of (Ten million Five Hundred Thousand British Pounds
Sterling) deposited by my late husband to your country, because my
life is no longer safe in our country, since the rebels are looking
for the families of all the oil business men in the country to kill,
saying that they are the people that is milking the country dry.

Let me know if you are willing and capable of assisting us in getting
this fund transferred to your bank account so that I can give you more
information on how to get in contact with the bank where my late
husband deposited this fund when he was alive.

With love from

Mrs.Janet E George

Other examples of emails from "Fund Transfer Assistance" spam campaign:

Sample 1:

Text presented within:

Subject: I will be waiting to hear from you,

 

Dear Friend,

With due respect to your person and much sincerity of purpose, I make
this contact with you as I believe that you can be of great assistance
to me. My name is Mr.Hamzak Wadrago, from Ouagadougou Republic of
BURKINA FASO, West Africa . Presently i work in the African
development Bank as telex manager. I have been searching for your
contact since you left our country some years ago.

I do not know whether this is your correct email address or not
because I only used your name initials to search for your contact .In
case you are not the person I am supposed to contact, please see this
as a confidential message and do not reveal it to another person but
if you are not the intended receiver, do let me know whether you can
be of assistance regarding my proposal below because it is top secret.

I am about to retire from active Bank service to start a new life but
I am aseptically to reveal this particular secret to a stranger. You
must assure me that everything will be handled confidentially because
we are not going to suffer again in life.

It has been 10 years now that most of the greedy African Politicians
used our bank to launder money overseas through the help of their
Political advisers. Most of the funds which they transferred out of
the shores of Africa were gold and oil money that was supposed to have
been used to develop the continent. Their Political advisers always
inflated the amounts before transfer to foreign accounts so I also
used the opportunity to divert part of the funds hence I am aware that
there is no official trace of how much was transferred as all the
accounts used for such transfers were being closed after transfer.

I acted as the Bank Officer to most of the politicians and when I
discovered that they were using me to succeed in their greedy act; I
also cleaned some of their banking records from the Bank files and no
one cared to ask me because the money was too much for them to
control. They laundered over $5b Dollars during the process .As I am
sending this message to you, I was able to divert thirty five million
united state dollars ($35m) to an escrow account belonging to no one
in the bank. The bank is anxious now to know who the beneficiary to
the funds is because they have made a lot of profits with the funds.

It is more than Eight years now and most of the politicians are no
longer using our bank to transfer funds overseas. The ($35) Million
Dollars has been laying waste but I don't want to retire from the bank
without transferring the funds to a foreign account to enable me share
the proceeds with the receiver. The money will be shared 60% for me
and 40% for you..

There is no one coming to ask you about the funds because I secured
everything. I only want you to assist me by providing a bank account
where the funds can be transferred. You are not to face any
difficulties or legal implications as I am going to handle the
transfer personally. If you are capable of receiving the funds, do let
me know immediately to enable me give you a detailed information on
what to do.

For me, I have not stolen the money from anyone because the other
people that took the whole money did not face any problems. This is my
chance also to grab my own but you must keep the details of the funds
secret to avoid any leakages as no one in the bank knows about the
funds.

Please get back to me if you are interested and capable to handle this
project I shall intimate you on what to do when I hear from your
confirmation and acceptance. If you are capable of being my trusted
associate, do declare your consent to me.

Waiting for your urgent response.

Yours Faithfully,

Mr.Hamzak Wadrago

Sample 2:

Text presented within:

Subject: ATTN: Confidant,
 

I am contacting you after making official enquiries at the foreign trade office of the Chambers of Commerce here in Johannesburg, South Africa. I haven’t disclosed the nature of my intention to anyone due to the sensitive and confidential nature of the project involved which is my need for assistance in profiling some investment funds and transfer of said funds to your country.

I must plead for your confidence and confidentiality and if it so happens that you are unable to assist in this projects I would crave your indulgence and ask that you do not divulge this to any other third party and ignore this email. I am constrained to issue more details about this mutually beneficial financial project until I get your positive response by email.

The fund in question $40,000,000.00 (Forty Million USD) accrued from over-inflated contract executed by foreign contractors through our connections and the over invoiced amount is waiting to be remitted from a commercial bank here in South Africa. By virtue of my position as a senior civil servant I cannot acquire this money in my name due to the fact that I am bound by the Civil Service Code of Ethics which bars me from operating bank accounts outside of our shores. On the other hand it is not safe to keep the funds here due to security reasons; hence my need to source for an overseas silent partner to facilitate the transfer of these funds for our mutual benefit.

My proposal is that after you receive the funds, it would be shared as follows: 40% to you as commission for your co-operation and assistance in facilitating the transfer, while the remaining 60% belongs to me. You will be free to take out your commission immediately after the money is credited to your account in your country. Since our objective is to invest the money in a foreign country, it would be appreciated if you could also help us with advice and direction on investing into profitable ventures in your country.

What we need to do is give you an approval from the ministry and you will email the approval to the paying bank to facilitate the processing and transfer of the contract funds into any of your nominated bank accounts. If you are interested and capable, I request you forward your personal details to my private email address (siyabongaakhumalo@gmail.com) to enable me contact you for further discussion. I would also request that you send me your most confidential phone number for further communication too.

Respectfully,

Mr. Siyabonga Khumalo
Program Implementation Committee.

Sample 3:

Text presented within:

Subject: Greetings: From Sandrina Omaru

 

Greetings: From Sandrina Omaru
Abidjan. Cote dIvoire,
West Africa .

Hello Dearest,

I deep it a respect and humble submission, I beg to state the
following few lines for your kind consideration, I hope you will spare
some of your valuable minutes to read the following appeal with
sympathetic mind. I must confess that it is with great hopes, joy and
enthusiasm that I write you this email which I know and believe by
faith that it must surely find you in good condition of health.

My name is Sandrina Omaru; I am the only child of my late parents
Chief. Mr. Williams Omaru. My father was a highly reputable business
magnet who operated in the capital of Ivory Coast during his days.

It is sad to say that he passed away mysteriously in France during one
of his business trips abroad Though his sudden death was linked or
rather suspected to have been masterminded by an uncle of mine who
travelled with him at that time. But God knows the truth! My mother
died when I was just 6yrs old, and since then my father took me so
special.

Before the death of my father, he called me and informed me that he
has the sum of Three Million, Six Hundred thousand
Euro.(€3,600,000.00) he deposited in a private Bank here in Abidjan
Cote D'Ivoire.. He told me that he deposited the money in my name, and
also gave me all the necessary legal documents regarding to this
deposit with the Bank,

I am just 22 years old and a university undergraduate and really don't
know what to do. Now I want an honest and GOD fearing partner overseas
who I can transfer this money with his assistance and after the
transaction I will come and reside permanently in your country till
such a time that it will be convenient for me to return back home if I
so desire. This is because I have suffered a lot of set backs as a
result of incessant political crisis here in Ivory coast.

The death of my father actually brought sorrow to my life. I also want
to invest the fund under your care because I am ignorant of business
world. I am in a sincere desire of your humble assistance in these
regards.Your suggestions and ideas will be highly regarded.

Please, consider this and get back to me as soon as possible.
Immediately I confirm your willingness, I will send to you my Picture
and also inform you more details involved in this matter.

Kind Regards,

Sandrina Omaru.

Sample 4:

Text presented within:

Subject: MY SUBJECT/ INVESTMENT PORTFOLIO

 

Dear Sir/ Madam     

I, got your Email contact from the South Africa Exchange Information On-line Service on my personal programmed search on the internet for a reputable company or individual to assist me sincerely & confident that your information & profiles were very satisfactory and I decided to contact you immediately.        

It is my great pleasure to write you this letter. Within Eskom Holdings Limited where I work as a Director of Audit and Project Implementation, I have in my possession an overdue payment in US currency.        

The said funds represent a certain percentage of the total contract value executed on behalf of my department by a foreign contracting firm, which I the official over-invoiced to the amount of US$350,000, 000.00 (Three hundred and fifty Million United States Dollar only).

Though the actual contract cost has been paid to the original contractor leaving the excess balance unclaimed. Since the present elected Government is determined to pay foreign contractors all debts owed, so as to maintain good relationships with foreign governments and non-government agencies, we included our bills for approvals with the Department of Finance and the South Africa Reserve Bank (SARB).        

I am seeking your assistance to front as beneficiary of the unclaimed funds, since I am not allowed to operate foreign accounts, Details and change of beneficiary information upon application for claim to reflect payment and approvals will be secured on behalf of you/your Company. I have to propose that should you be willing to assist me in this transaction your share as compensation will be (30%), (5%) is for expenses and the balance of (65%) will be for me and my colleagues.

The business is completely safe and secure, provided you treat it with Utmost confidentiality. It does not matter whether you/your Company does contract projects, as a transfer of powers will be secured in favour of you/your Company. Also, your area of specialization is not a hindrance to the successful execution of this transaction.  

I have reposed my confidence in you and hope that you will not disappoint me.        

Thanks for your co-operation.   
    
Regards,    

Thabiso Nzimande     
Eskom Holdings SOC Limited
South Africa.

Sample 5:

Text presented within:

Subject: Please Confirm Now

Dear Friend,
 
It is my pleasure to contact you, having seen your contact from a reliable source. Please this transaction should be kept confidential because of the gravity of the transaction. We all know the past crises of Libya, the stories about late President Muammar Gadaffi and his family. How they looted the Libyans treasury and hid funds in various countries.
 I am an attorney to Moatassem-Billah Gaddafi the late son of Gadaffi.He mandated me to deposit the sum of Thirty Five Million US Dollars ($35,000,000.00) with a Security Company which will be disclosed to you as you indicate interest. The Gold/fund is in cash, packaged and sealed in 2 trunk boxes. Now that the war is over and Moatassem-Billah Gaddafi is dead, there is no member of Gaddafi`s family that knows about the fund.I want to use your contact to move out the fund to your country for investment.
 All I need is your total compliance and I will do my best to make sure that the transaction is done successfully. I am a good international lawyer, I am capable of providing every documentation and defense to back up the fund. Any good lawyer is subject to strict standards of professional responsibility. These standards are set forth in codes of conduct and Privileges, ethics, rules of professional conduct that are established by state bar associations. Although the rules vary from state to state, Nations to Nations. But as a lawyer we will not have any problem.
 
For us to proceed, I will need your full names, address and phone numbers. When I receive it, I will submit your particulars to the security Company where the trunk was deposited. They will then make arrangements to have the trunks delivered to you in the given address. When the trunk arrives, I will give you a code number to open the trunk to have access to the cash. For you to assist me, you will be entitled to 35% of the total money and we will set 5% for the expenses incurred in the course of this transaction while 60% will be for me, I will then come over to meet with you for sharing according to the proposed percentage for you. If you agree with my proposition, you can write to enable  us to proceed.
Thanks.
Awaiting Response.
Barrister Anis Rahman Watts

Sample 6:

Text presented within:

Subject: Payment of $10,200,000.00 USD.

 

Good Day Dear,
 
Compliment of the day. My name is Miss. Anna Chanda. I am 21 years of Age and an Orphan. I got your contact email on the Internet while searching for a trusted personality I can confide in. I am writing to seek your kind assistance to stand as my foreign trustee and retrieve $10,200,000.00 USD ( Ten Million Two Hundred Thousand United States Dollars ) which I inherited from my late parents.
 
Before the Death of My Late Father. He deposited the above stated amount with one of the Leading Bank in South Africa and with my name as the next of kin, but with a clause that I must get to the Age of 30 before the Bank could allow me access to the funds or I provide a foreign trustee who could lead me with the investment of the funds outside Africa.
 
I am therefore soliciting for your kind and matured assistance to receive the transfer of these funds into your account and also help me to secure the necessary documents that will permit me to fly over to your Country and further up my Education, while you manage the investment of the funds under a written agreement.
 
I want you to return this email only if you are really willing to assist me with all your heart, so that I can give you more details.    contact me with this email   (miss-annachanda@naver.com)
 
NOTE: I also would like us to have a video  conversation via whatsapp or Skype only if you are willing to assist me as my foreign trustee, until then I am waiting urgently for your kind response as I hope to rely on you.
 
Regards,
Miss. Anna Chanda.

Sample 7:

Text presented within:

Subject: Investment Assistance

 

Attn: -,

I am Mr. Collins Muzorewa, with due respect, trust and humility, I write you this proposal which I believe will be of great interest to you. It is understandable that you might be a little bit apprehensive because you do not know me; I found your contact while I was doing a private research on the internet for a reliable and capable foreign partner that will assist me and my family to invest my inheritance funds in your country.

After the death of my father Mr. Abel T. Muzorewa, I decided to move out of Zimbabwe, before the death of my father, he deposits the sum of US$18.2M (Eighteen Million Two Hundred Thousand United State Dollars) in one of the private security company, as if he foresaw his death. This money was deposited in a box as gemstones to avoid much demurrage from the Security Company. This amount was meant for the purchase of new machines and chemicals for his farms and the establishment of a new farm in Swaziland.

So if you consider this proposal, I will give you 25% of the total sum for helping us to move this money out of South Africa and 75% will be for me and my family for investment in your country.

Finally, as soon as you have indicated your interest and capability to handle this transaction then I will detail you the modality. Please contact me directly on my email id; collinsmuzorewa@gmail.com or Whatsapp me +27 60 308 7608

Best Regards,

Mr.Collins Muzorewa
Whatsapp me +27 60 308 7608

Sample 8:

Text presented within:

Subject: From: Yao K. CNVT

 

Hello, Good Morning
 
With trust that you are keeping well today !
 
Let me briefly introduce myself for better understanding, I am Yao Kwabena, a financial consultant writing to you from the Republic of Ghana. I am compelled to initiate this communication with you due to the urgency of the matter at hand. A well known minister in one of the African countries who is undergoing financial queries by the Authority over alleged mismanagement of contract funds worth over five billion dollars has contacted me to help him move transit funds amounting to US$ 76 Million
dollars.
 
He has advised that the funds be moved from its present position to a reliable hand and be used for any lucrative investment abroad and therefore I am contacting you based on the information I already gave to him that I have a reliable hand in your country to handle the investment funds but the person I had in mind
unknown to me passed away due to Covid-19 complication as I was reliably informed.
 
Therefore I am contacting you to know if you are able to handle this matter by receiving and investing the funds under a 60/40 sharing ratio of the capital and the investment annual returns. Therefore should you be ready to move on with the said transaction kindly provide me your personal telephone/WhatsApp number for further discussion on the way forward.
 
Regards
Yao Kwabena

Sample 9:

Text presented within:

Subject: PROJECT: From: Dr. Emmanuel Ibe Kachikwu (GMD) Nnpc Towers Garki, Abuja TM 09

 

Nnpc Towers, Central Business District, Herbert Macaulay way, P.m.b. 190, Garki, Abuja.

From: Dr. Emmanuel Ibe Kachikwu (GMD)
Contract Ref No: NNPC/PED/1462/KADREF/92)

Attn: Ceo

I know that this proposal may come to you as a surprise especially having to come from someone you have not meet before I got your information from your country chamber of commerce here in Nigeria.

My name is Dr. Emmanuel Ibe Kachikwu, The Minister of State for Petroleum Resources, National Petroleum Corporation (NNPC). Be informed that my partner Dr. Maikanti Baru and I awarded a contract to a foreign firm (Sheng Yang Contraction Company) with contract Ref No: NNPC/PED/1462/KADREF/92) for the maintenance of the Nigeria petroleum-chemical complex located at Kaduna, Nigeria.

I know that this proposal may come to you as a surprise especially having to come from someone you have not met before, but I would like you to co-operate with me so that this U$D98, 000,000.00 will be released and transferred into your account, it is mine profound intention to contact you for this very important and highly confidential transaction for the transfer of (U$D98, 000,000.00 Ninety-Eight Million United States Dollars Only into your bank account.

The contract has been successfully executed by the contractors and their contract sum have been paid to them, leaving us overestimated balance of (U$D98, 000,000.00 Ninety-Eight Million United States Dollars Only) still pending at the bank. Right now, we are left with this overestimated balance of (U$D98, 000,000.00) which is still floating at the escrow account in the Central Bank of Nigeria (CBN) waiting for final payment to any reliable foreign bank account, you may provide.

We, as government officials, are not permitted to own or operate foreign bank account. therefore, we need reliable person who will provide us with a foreign account where to transfer and deposit this US$98,000,000.00, that is the reason we are soliciting for your sincere assistance to provide us with an account where to transfer this money .all modalities for the easy transfer of this money is now in place, the period of this transaction is only two weeks from the day we receive your bank account details.

Note that 50% of our share will be invested in your country, as we propose to give you 30% of the U$D98, 000,000.00, my partners and I will get 60% of the money.

The balance of 10% will be allocated to cover all expenses incurred by both partners, be informed that this proposal is urgent and confidential, please send to me your bank account details and full address of company name and address, your private phone and fax number for easy communication which will be used in securing all the necessary documents for easy transfer of the fund.

Awaiting your urgent response.

Best regards.

Dr. Emmanuel Ibe Kachikwu.
The Minister of State for Petroleum Resources, Nigerian National Petroleum Corporation (NNPC)

Sample 10:

Text presented within:

Subject: Confirm receipt.

--
Good day.

Let me be brief with my introduction to you.

My name is Elisabeth De Nolf lawyer and solicitor.

My client, a recently overthrown President of Gabon in a Coup d'Etat wishes to partner with you in
helping him to secure and invest a large sum of united states dollars.

You can check for more information here -

I sent you this message today because I will like you to help me in securing some of

This funds is in an off shore account, With these in mind, you can see that contacting you requires absolute care,honesty and confidentiality.
You will be require you to help in the purchase of home in your country for him and further invest 50% of the total sum in a lucrative business.
You will be adiquantly compensated as he is ready to discuss terms for assistance if you are ready.

Please let me know your position as soon as you reveive this message for a further communications.

Yours Faithfully,
Elisabeth De Nolf

Sample 11:

Text presented within:

Subject: Maria

Dear Friend,

My Name is Miss Maria Gomo from Cote d'Ivoire, I'm 16 years old and I originated from Bondoukou, Côte d’Ivoire. I believe that it is better we know each other better because I believe that any good relationship will only last if it is built on trust and mutual understanding.

Please I want you to read this letter very carefully and I must apologize for barging this message into your mailbox without any formal introduction due to the urgency and confidentiality of this
issue. I lost my parents through the crises war last time in Congo RDP, he is a gold miner, my uncle conspired and sold my father's properties and left nothing for me, on a faithful morning I opened my late father's room which I saw a briefcase and I opened it there I found documents in which indicated that my late father deposited amount of money in one of the bank in London in my name as his next of kin.

I have contacted the bank by call and by email to withdraw the money so that I can start a better life and take care of myself.  The branch manager of the bank whom I emailed told me that my father's instruction to the bank was that the money should be released to me only when I am married or if I present a trustee who will help me and invest the money overseas.

I have chosen to contact you and I believe that you will not betray my trust in you, though you may wonder why I so soon revealed myself to you without knowing you well, I am convinced that you are the real person to help me out. I will disclose much to you if you can assist me to relocate to your country because my wicked uncle has threatened to assassinate me. The amount involved is $10.5 Million Dollars with some kilos of Gold Bars and I have confirmed from the bank in London where the Gold BARS were deposited. You will also help me to place the money in a more profitable business venture in your country.

However, you will help me by recommending a nice university in your country so that I can complete my education, it is my intention to compensate you with 30% from the total money for your noble assistance and the balance shall be my capital for establishment after my school.

In receipt of your below information, I will submit a letter of introduction/recommendation to the bank immediately in your name as my trustee. Please read this proposal as urgent and contact me with your information below: here is my private email address. ( gomomaria6@gmail.com )

1. Name In full:.........2. Address:..............3.
Nationality:..........4. Age:.........5. Sex..........6. Occupation:
..........7. Marital Status:.......8. Phone.........

Yours Faithfully,

Miss Maria Gomo.

Sample 12:

Text presented within:

ATTN : CEO.
Compliment of the season.
I am the Deputy Director of finance, foreign
payment approval dept. Philipines . My office oversees all
developmental projects financed by Asian Development Bank.

 With reference to an introduction and recommendation of you by a
friend who works in the Chamber of Commerce and Industry of Manila
, I do hereby; Wish to commence talk with you on a highly
confidential level. After due consultations with my colleagues, We
have decided to contact you in order to arrange for a possible
transfer of the sum of Five million three hundred thousand dollars
(US$5.300.000.00) into your account. This money is a subject of an
over inflated {over - invoiced}sum acquired from contracts awarded by
my Agency in the past years.

 The original contractors have been paid and all projects executed by
them commissioned. This over inflated amount cannot be withdraw
locally from the  paying Bank because the contractors concerned are
foreign Firms. As a matter of trust, honesty and secrecy, we have
decided to contact you as to assist us provide an account for this transaction if you have
accepted to assist and fully participate in this transaction,
The terms of sharing the money after a successful transfer
will be discussed as you indicate your interest in assisting to transfer
this money. Immediately all these information gets to us, we will then
present every document to the paying bank. Be rest assured with our
connections, everything will be through within a short time. After
many years of meticulous services to the government and people of our sub region we would not want our image to
be dented. Therefore we expect you to handle this transaction with utmost maturity by keeping everything secret. I can assure you that if
our instructions are carefully adhered to, there will not be any hitch
Throughout the transaction, there is  no risk on your side, because we
have perfected the  deal very well over years.

After the transfer, we will be coming over to your country for further
sharing and possible investments.
I'm waiting to hear from you urgently through your respond here
roy@feedbackunitroy.info

Instant automatic malware removal:

Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:

By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.

Types of malicious emails:

If you opened an attachment or downloaded a file from a suspicious email, run a full system scan with Combo Cleaner. If you only received the email and didn't engage with it, you don't need to scan anything - just identify the scam and delete it. The full procedure below covers both situations and what to do if you already clicked, replied, or sent money.

Credential theft Phishing emails

Fake login pages disguised as PayPal, Microsoft, Apple, banks, or social networks. The email pushes a link to a near-perfect copy of the real login screen. The moment you type your username and password, the attacker has them.

Common subject lines

• "Action required: confirm your account"
• "Your password expires today"
• "Unusual sign-in attempt detected"
• "Verify your billing information"

Malware delivery Emails with malicious attachments

Trojans hidden inside fake invoices, faxes, shipping confirmations, or Office documents. Opening the attachment runs the payload and infects the system - often with an info-stealer or remote-access trojan.

Common subject lines

• "Invoice INV-2026-XXXX attached"
• "Fax received - 3 pages"
• "Your shipping document is ready"
• "Voicemail from +1-XXX-XXX-XXXX"

Extortion Sextortion emails

Fake claims of webcam recordings demanding cryptocurrency. Almost always a bluff: the attacker pulls a real password from an old data breach to make the threat look credible, then claims to have video of you. They have no recording and no access.

Common subject lines

• "I know your password is XXXX"
• "Your account has been hacked"
• "I have recorded you - 48 hours to pay"
• "You have been compromised"

Callback fraud Refund & callback scams

"Your subscription was renewed for $499 - call to cancel." Norton, McAfee, Geek Squad, PayPal, and Wells Fargo variants are all common. There's no real subscription. The phone number in the email connects directly to the scammer, who walks you through "refunding" yourself - which is actually them stealing money from your bank.

Common subject lines

• "Norton subscription auto-renewed - $499.99"
• "McAfee Total Protection invoice"
• "Geek Squad order confirmation"
• "Your PayPal payment is being processed"

Credential theft Account suspension & verification scams

"Your account will be deleted in 24 hours - verify now." The artificial deadline is the whole point: it pressures you to click before checking details. The "verify" link goes to a phishing page styled to look like the real provider.

Common subject lines

• "Your account will be deleted in 24 hours"
• "Suspicious activity detected - verify now"
• "Final warning: account closure"
• "Action required to keep your account active"

Mixed payload Delivery & package scams

Fake DHL, USPS, UPS, or FedEx tracking, customs fees, or "package undeliverable" notices. Targets anyone expecting a parcel - the timing alone catches many people. The link hides either phishing (asking for card details to "release" the package) or a malware download.

Common subject lines

• "Your DHL package is held at customs"
• "USPS - delivery attempt failed"
• "FedEx tracking update - action required"
• "Pay $2.99 redelivery fee to release your parcel"

Remote access Tech support scams

Fake Microsoft, Apple, or "Windows Defender" security alerts pushing a phone number. Real Microsoft and Apple never email a phone number to call. The number connects you to a scammer who asks for remote access to "fix" the imaginary problem and then demands payment.

Common subject lines

• "Microsoft Defender expired - renew now"
• "Apple ID security alert"
• "Critical: virus detected on your PC"
• "Windows license expired - call now"

Wire fraud Advance-fee scams

Inheritance, lottery wins, romance, or business deals that ask for a small fee to release a much larger sum. The classic "Nigerian prince" 419 family of frauds. Once you pay the first fee, more fees appear (taxes, lawyer, transfer charges) until you stop paying. The promised money never exists.

Common subject lines

• "Inheritance from a relative you didn't know about"
• "You won the international lottery"
• "URGENT - business proposal worth $XX million"
• "Compensation fund release for fraud victims"

Wire fraud Business email compromise (BEC)

CEO impersonation asking employees to wire money or buy gift cards, or fake supplier invoices with newly "updated" bank details for payment redirection. The email often spoofs a real internal executive's display name and uses an external lookalike domain.

Common subject lines

• "Quick task - need you to buy gift cards"
• "Updated banking details for invoice payment"
• "Wire transfer request - urgent"
• "Are you available?" (CEO impersonation opener)

How to spot a malicious email?

Phase 1~ 2 min

Spot - identify the red flags

---

1

Check the sender's actual address, not the display name

30 sec

The display name (the human-readable part) is trivial to fake. Always check the full address that comes after it. Common red flags:

• Domain mismatch - service@paypa1.com, support@micros0ft-help.com, look-alike domains using digits or extra hyphens
• Free-email impersonation - any "official" message from a bank, courier, or platform sent from a @gmail.com, @outlook.com, or @yahoo.com address
• Reply-To mismatch - the From address looks legitimate but Reply-To points somewhere completely different

Why this matters

Real companies own their domains and send mail from them. A "DHL" message from a Gmail address is never legitimate, regardless of how convincing the body looks.

2

Watch for urgency, threats, and generic greetings

30 sec

Scams almost always rush you. The point is to make you act before you think. Treat any of the following as a strong signal:

• "Your account will be deleted in 24 hours"
• "Final notice" / "Immediate action required"
• "Dear Customer" or "Dear User" instead of your real name
• Threats of fines, account closure, legal action, or arrest
• Promises of refunds, prizes, or money you didn't earn
• Spelling and grammar mistakes in messages claiming to come from a major brand

3

Hover over every link before clicking

30 sec

On a desktop, hover the mouse over the link without clicking. The real destination shows in the bottom-left status bar of your browser or email client. On a phone, long-press the link to preview the URL.

• Real Microsoft, PayPal, or bank links go to those exact domains, not redirects through unrelated sites
• Shortened URLs (bit.ly, tinyurl, t.co) hide the real destination - never click them in unsolicited mail
• The visible link text and the actual URL must match - mismatches are the single biggest phishing red flag

Pro tip

When in doubt, don't click the link. Open a new browser tab and type the company's address yourself, then log in normally. If there really is an issue with your account, you'll see it there.

4

Treat unexpected attachments as hostile

30 sec

If you didn't ask for the file, don't open it - even if it appears to come from someone you know. Categories that should never be opened from email without verification through another channel:

• .exe, .scr, .iso, .img, .vbs, .bat - executables, never legitimate attachments
• .docx, .xlsx, .pptx with "Enable macros" prompts - the macros run the malware
• .pdf with "Click here to view" buttons - usually a phishing redirect, not a real document
• .zip, .rar, .7z archives, especially password-protected ones - the password defeats the email scanner

Phase 2~ 2 min

Report and delete - if you haven't engaged

---

If you only received the email and didn't reply, click, or open anything, the steps below are all you need. Your computer is not infected.

5

Don't reply, don't click "unsubscribe"

30 sec

Replying confirms your address is real and monitored, which gets you added to higher-value scam lists. The "unsubscribe" link in a scam message is rarely a real opt-out - it usually leads to a phishing page or downloads a tracking pixel.

Instead, mark the message as junk or phishing inside your email client (this trains the spam filter), then block the sender.

6

Report the scam to your email provider and authorities

1 min

Inside your email client:

• Gmail: open the message → ⋮ menu → Report phishing
• Outlook / Outlook.com: ⋯ menu → Report → Report phishing
• Apple Mail / iCloud: Move to Junk, then forward to reportphishing@apple.com

Forward or report to authorities:

• International: forward to reportphishing@apwg.org
• United States: ic3.gov (FBI)
• United Kingdom: forward phishing emails to report@phishing.gov.uk (NCSC SERS); for financial loss report at reportfraud.police.uk (Report Fraud, the successor to Action Fraud; 0300 123 2040)
• Canada: antifraudcentre.ca
• Australia: scamwatch.gov.au
• EU: your national CERT - find yours via the ENISA CSIRT map

After reporting, delete the email and empty the Trash folder so you don't accidentally open it later.

Phase 3~ 10–60 min

Recover - if you already engaged with the scam

---

Pick the step below that matches what you did. If multiple apply, work through them in the order they appear - the steps are arranged from lowest to highest risk.

7

You only clicked a link (didn't enter anything or download anything)

Scenario: clicked link only10 min

Close the page right away. Don't enter any information, even if the page looks legitimate.

• Clear your browser cache and cookies for the last hour - Chrome/Edge: Ctrl+Shift+Del → Last hour → check Cookies and Cached files
• Run a quick scan with Combo Cleaner in case the page tried to drop a file silently (drive-by download)
• Update your browser to the latest version - most drive-by exploits target outdated browsers
• Watch for new browser pop-ups, redirects, or unfamiliar notifications over the next few days

Why this matters

Modern browsers block most drive-by attacks, but a single click on a phishing page can still be enough on an outdated browser or unpatched plugin. A quick scan catches anything that landed silently.

8

You opened an attachment or downloaded a file - run a full malware scan

Scenario: opened attachment⚠ Highest risk60–90 min

Opening an attachment is the most common path to actual infection. Treat the system as compromised until the scans below come back clean. Work through these sub-steps in order:

8.1Disconnect from the network

Unplug Ethernet and turn off Wi-Fi. If the attachment was an info-stealer or remote-access trojan, this stops it from sending data out or receiving commands. Keep the network off until you've booted into Safe Mode (next step) - you'll reconnect there briefly to download the scanners.

8.2Boot into Safe Mode with Networking, then download the scanners

Windows 11: Settings → System → Recovery → Advanced startup → Restart now → Troubleshoot → Advanced options → Startup Settings → Restart → press 5 or F5.

Windows 10: hold Shift, click Power → Restart → Troubleshoot → Advanced options → Startup Settings → Restart → press F5.

Once Safe Mode has loaded, turn Wi-Fi back on and download Combo Cleaner (used in 8.4) and Microsoft Safety Scanner (used in 8.5). Safe Mode loads only minimal drivers, so most malware can't auto-run while you're getting the tools. Save both installers to your Desktop.

8.3Run Microsoft Defender Offline

Reboot to normal Windows. Open Windows Security → Virus & threat protection → Scan options. Select Microsoft Defender Antivirus (offline scan) and click Scan now. The PC restarts into a stripped-down environment and scans the disk before Windows fully loads - this is what catches rootkits and bootkits.

Recommended antivirus

Combo Cleaner

VB100 certified. Includes anti-trojan, registry/persistence scanning, and anti-spyware in one pass. The 7-day free trial is available.

Download Combo Cleaner

8.4Run a full Combo Cleaner scan

Install Combo Cleaner and run a full system scan (not the quick scan). Let it complete fully, review what it found, and apply the recommended actions. Combo Cleaner will quarantine known trojans and remove their persistence in the registry.

8.5Run Microsoft Safety Scanner as a second-opinion scan

Download Microsoft Safety Scanner (MSERT.exe). The binary expires every 10 days, which means every download has the latest signatures. Run a full scan after Combo Cleaner to catch anything one engine alone might miss.

8.6Reset browsers and clear notification permissions

Many email-borne trojans drop adware that hijacks browsers. Reset each browser you use:

Chrome: chrome://settings/reset → Restore settings to their original defaults. Then chrome://settings/content/notifications - remove unfamiliar sites.

Edge: edge://settings/reset. Then edge://settings/content/notifications.

Firefox: about:support → Refresh Firefox.

8.7Re-enable Defender, Tamper Protection, and update everything

Open Windows Security → Virus & threat protection → Manage settings and confirm Real-time protection, Cloud-delivered protection, and Tamper Protection are all on. Then run Settings → Windows Update → Check for updates and update browsers and applications.

Important

If the scans keep finding new threats on each run, or files reappear after deletion, you may have a deeper compromise that needs a clean Windows reinstall. See pcrisk's full manual malware removal guide for the extended procedure (Process Explorer, Autoruns, hosts file inspection).

9

You entered credentials on a fake login page

Scenario: shared password⚠ Act fast20 min

Assume the attacker has your password and is using it right now. Speed matters.

1. Change the password from a different, known-clean device (your phone is fine if it's not infected). Don't reuse the old password anywhere else.
2. Enable two-factor authentication if you haven't already. Prefer an authenticator app or hardware key over SMS.
3. Sign out of all sessions - most platforms have a "sign out everywhere" option in security settings, which kicks the attacker out.
4. Review recent activity - look for unfamiliar logins, new devices, forwarding rules, or app permissions. Remove anything you don't recognize.
5. Check your other accounts - if you reused that password anywhere else, change it there too. Check your exposure at haveibeenpwned.com.
6. Update security questions - the attacker may have seen the answers in your account profile.

Why email comes first

If you only have time to change one password, change your primary email password - it's the recovery hub for every other account. An attacker who controls your email can reset everything else.

10

You sent money or shared bank, card, or ID details

Scenario: financial loss⚠ Contact bank now30 min

Time is the single biggest factor in recovering money. Banks can sometimes recall a wire or reverse a card transaction within the first few hours.

1. Call your bank or card issuer immediately. Use the number on the back of the card, not any number from the scam email. Ask them to freeze the card, reverse the transaction if possible, and flag the account for fraud monitoring.
2. If you sent a wire transfer or used a money-transfer service (Western Union, MoneyGram, Zelle, Wise), call them directly and request a recall. Some can be reversed within minutes if reported fast.
3. If you sent cryptocurrency or gift cards, recovery is unlikely - but report it anyway, since law enforcement tracks these patterns.
4. File a police report. You'll need the report number for any insurance, bank, or credit-bureau claim. Save the report number.
5. File with the right authority for your country:
   • US: ic3.gov + reportfraud.ftc.gov
   • UK: reportfraud.police.uk (Report Fraud, the successor to Action Fraud; 0300 123 2040)
   • Canada: antifraudcentre.ca
   • Australia: scamwatch.gov.au
   • EU: your national CERT or police cybercrime unit
6. Set fraud alerts on all major credit bureaus if you shared any ID details. US: Equifax, Experian, TransUnion. UK: Experian, Equifax, TransUnion (Cifas Protective Registration is a stronger option).
7. Save all evidence - the original email (with full headers), screenshots of the fake site, transaction records, any phone numbers or chat logs.

Phase 4~ 15 min + 30 days

Verify & monitor

---

11

Final scan and startup-app check

15 min

Reconnect to the network and run one final full scan with Combo Cleaner, followed by a Windows Defender quick scan. Then open Task Manager (Ctrl + Shift + Esc) and switch to Startup apps - disable anything unfamiliar.

Make sure Windows, browsers, and any applications you use are fully up to date. The infection vector that worked on you once usually involves outdated software.

12

Monitor accounts and credit for 30 days

5 min/day · 30 days

Most fraud follow-ups land in the first month. Until that window closes, keep watching:

• Bank and card statements - daily for the first week, then weekly
• Email - watch for password-reset confirmations or login alerts you didn't trigger
• Credit report - US: free at annualcreditreport.com; UK: Experian, Equifax, TransUnion all have free tiers
• Breach alerts - sign up at haveibeenpwned.com to be notified when your email appears in new leaks

If anything new appears in any of those, treat it as a continuing compromise: change passwords again, contact the bank again, and update the police report.

Important: If you didn't click anything, didn't reply, and didn't open any attachment, your computer is not infected - just delete the email and move on. If you opened an attachment or downloaded a file, run an automated scan with Combo Cleaner and Windows Defender and stop there. That path catches the vast majority of email-borne malware without the risk of breaking Windows by deleting the wrong file.

Frequently Asked Questions (FAQ)

Why did I receive this email?

There are probably hundreds of other people who received the same letter. Such letters are not personal.

I have provided my personal information when tricked by this email, what should I do?

If scammers have obtained personal information such as credit card details, ID card information, social security numbers, or other details, contact corresponding authorities as soon as possible.

I have downloaded and opened a malicious file attached to an email, is my computer infected?

It is not guaranteed that your computer is infected just because you opened a malicious file. For instance, malicious MS Office documents do not infect computers until users enable macros commands. However, most executables inject malware immediately after opening them.

I have read the email but didn't open the attachment, is my computer infected?

If you have only opened an email and have not clicked on any links or opened any attachments, then your computer is not infected.

Will Combo Cleaner remove malware infections that were present in email attachment?

Combo Cleaner can detect and remove a wide range of malware infections. It is important to note that some advanced malware may be difficult to detect. Thus, it is required to run a complete system scan to ensure that all threats are detected and eliminated.