Advance Fee Fraud: British Lottery International

"You've won a lottery without ever buying a ticket" is a recent theme in 419 advance fee fraud. Try to collect these winnings, and you'll discover there are certain "expenses" that you have to meet before you get to taste any of your winnings. And, to cut a long story short, there are no "winnings", only expenses, and expenses, and expenses. Here's a sample I received from 217.76.130.103 (llga582.servidoresdns.net) on Tue, 15 Mar 2005 00:11:08 -0000. Note that exactly the same message arrived at four different addresses, each belonging to different (but fictitious) identities. A lot of people "win" this lottery. Please note that the horrible line-breaks (often in the middle of a word) are part of the original text.

Date: Tue, 15 Mar 2005 01:06:01 +0100
From: britishnatioanllotto
To:
Subject: WINNING NOTIFICATION:

British Lottery Headquarters:
Customer Service
28 TANFIELD ROAD,
CROYDON.LONDON

Ref: BTL/491OXI/04
Batch: 12/25/0304
Date: 15/03/2005

WINNING NOTIFICATION:

We happily announce to you the draw of the British Lottery International programs held on the 1st of March 2005 in London.Your e-mail address attached to ticket number: 56
4 75600545 188 with Serial number 5388/02 drew the lucky numbers:31-6-26-13-35-7,which subsequently won you the lottery in the 2nd category.You are therefore, been approve
d to claim a total sum of US$2,500,000.00 (Two million, five hundred thousand, United StatesDollars) in cash credited to file KPC/9080118308/02.This is from a total cash p
rize of US $125 Million dollars, shared amongst the first Fifty (50) lucky winners in this category.

This year Lottery Program Jackpot is the largest ever for British Lottery.The estimated $125 million jackpot would be the sixth-biggest in U.K. history. The biggest was th
e $363 million jackpot that went to two winners in a May 2000 drawing of The Big Game, Mega Millions'predecessor.

Please note that your lucky winning number falls within our European booklet representative office in Europe as indicated in our play coupon.In view of this, your US$2,500
,000.00 (Two million, five hundred thousand,United States Dollars) would be released to you by our affiliate bank in London.
Our agent will immediately commence the process to facilitate the release of your funds to you as soon as you make contact with her .

All participants were selected randomly from World Wide Web site through computer draw system and extracted from over 100,000 companies.This promotion takes place annually
. For security reasons, you are advised to keep your winning information confidential till your claims is processed and your money remitted to you in whatever manner you d
eem fit to
claim your prize. This is a part of our precautionary measure to avoid double claiming and unwarranted abuse of this program by some unscrupulous elements.

Please be warned.To file for your claim, please contact our fiduciary agent with the below details for processing of your claims.

AGENT: Mrs Victoria Pebbles.
Email: victoriapebbles@privateemail.com

To avoid unnecessary delays and complications, please quote your
Reference/Batch Numbers
Full names
Residential address
Sex
Age
Nationality

Congratulations once more from all members and staffs of this program.Thank you for being part of our promotional lottery program.
Sincerely,
Michael Ronin.
AFRO-ASIAN Zonal Coordinator



___________________________________________________________________________
Mail sent from WebMail service at PHP-Nuke Powered Site
- http://www.area51.es

Note a couple of things about the tactics of this 419er which are, in my experience, quite typical of the breed. First up, the source of the addresses: these were mailed to addresses located on a web page. I put those email addresses on the web page precisely to act as spam-bait. The addresses don't usually get much spam (yet), and they aren't visible unless you look at the source-text of the page, but I've seen clear links between hosts spidering that web page and then spamming to those addresses. A significant portion of the incoming spam is 419 material like this.

The other thing to note is the footer on the message, claiming that it came through a web-mail system. This also quite typical for 419ers: exploiting web-mail systems as their mail distribution vector is their most common M.O.