Babs AjayiSaturday, September 5, 2015
Gatineau, Quebec, Canada




have noticed that every time I receive an email from First Bank other emails will follow - only that the subsequent emails are from Yahoo! Yahoo! scam artists with close link and contacts right inside First Bank Customer Service Unit. This has been going on for months and each time I will carefully check the source(s) of the emails before clicking on them. In this new age, you have to separate the wheat from the chaff otherwise you will yield control of your bank account to thieves and Yahoo! Yahoo! scammers and rogues, most of them heartless, hopeless and yet relentless in their zeal to rob you and I. After more than a year since I last wrote about the menace of the Yahoo! Yahoo! boys and girls operating at home and abroad, I felt it was time to write about this latest approach they have resorted to. I felt duty bound to inform the unwary about the trap so that when a customer receives an email from First Bank he or she should not think the next two or three emails that appeared in his/her inbox displaying FirstOnline are from First Bank of Nigeria as well.

I decided to spend some time to look into the source(s) of the fraudulent email. Here is my finding:

The email will claim to be from FirstOnline but when I placed my cursor on FirstOnline it revealed the true source as iudoye@cosharisgroup.net. The subject line reads 'Suspicious Login Alert,' but when I opened the email I received a frightening message: "Dear User, You successfully logged into your Firstonline profile on 22 July, 2015 in CHINA"!

The message was to immediately shock the customer and make him/her very anxious to want to get to the bottom of the problem because he/she never logged into the account in China; has never been anywhere near China and will likely never be. The scam artist's next sentence then provides an immediate solution: "If you did not initiate this login, follow our site here immediately https://www.ibank.firstbanknigeria.com/. The problem is that the scammer will succeed in taking you to an entirely different website. Place your cursor on the link and you will see the real link the scammers plan to take you to: Sunexpress.bit.tr/wp-content/set/info.php. in a second fraudulent email the scammers would have taken me to http://excelldrywall.com/-includes/SimplePie/indexx/.php rather than https:ibank.firstbanknigeria.com/FBN and https:ibank.firstbanknigeria.com/FBN/account/Review. The two emails were complete with First Bank logo as shown in the caption below:

I went a step further to verify the sources of the emails I found that they came from the IP Address and the host name was dedivps-101.aklwebhosting.com. The hosting company was Fasthosts Internet Ltd, UK. I do not think Fasthosts Internet Ltd is aware their hosting service was being used to scam people. I gathered information about the emails from Yahoo! Full Headers. The first scammers' email actually came from the email account of J.Udoye (this may be a fake name!) and the email account address ended with the name of the Nigerian company Cosharis Group. Is Cosharis Group aware of this scam? What have they done to stop and prevent these miscreants from using their company email account to dupe people and damage their own corporate image?

The second crooked email came from admin@westafricabioethics.net but the IP Address remained the same: West Africa Bioethics must work as quickly as possible to regain their email address from these criminals and the Nigeria Police has to do more to fight the scourge of Internet scams.