My sister was looking for a place to stay in Oslo because she's doing an Erasmus there and due to some miscommunications, the school hadn't provided housing for her. We almost fell victim to a sophisticated scam where our correspondent placed an attractive offer online and impersonated TripAdvisor in order to collect a "booking fee".
After contacting the "owner", we got this response:
On 21 Jul 2017, at 15:58, Rosado Gomez <email@example.com> wrote: Hello, The apartment at Jess Carlsens gate 3, 0179 Oslo, Norge is still available. Everything is just like in the pictures fully equipped with all the appliances you need, very clean and well kept. The apartment can be rented furnished or if you want you can use your furniture and deposit mine in the storage unit. I work as civil engineer and the company I work for has developed projects all around the world. They moved me to the Mexico (Cabo San Lucas) department because they have a new project there. The apartment is vacant so you can move-in anytime you want. The rent of 9500 NOK/month is for the whole apartment and includes all the utilities: heat, water, electricity, parking, laundry in-suite, washer and dryer also included, cable and internet. You will have full access to all building amenities. Just in case repairs are needed there I will cover the costs no worries. The price I'm asking is below the market because I want to find a responsible tenant to take good care of the place. I would like to know how many people will live in the apartment and also which rental contract do you prefer to start with - 6 months or 1 year with option of renewal. The monthly payments can be wired to my Bank Account or we can setup a payment method that is suitable for both of us. I'm the owner of the apartment, it's already paid in full and no mortgage on it. Schools and groceries near-by. You have everything you need near-by because it's one of the best neighborhood. Pets are allowed. You'll love it for sure! I need to know if you are really interested in the place so we can discuss further. Thank you and look forward hearing from you!
On 21 Jul 2017, at 16:59, Rosado Gomez <firstname.lastname@example.org> wrote: Hi again, First of all, I want to start this email saying that this is not an face to face transaction, this being the whole purpose for using TripAdvisor Property Management, to protect the both of us 100%. Now for security and for your peace of mind I had attached an copy of my PASSPORT to build up some confidence. Regarding the process, you will only have to deposit to TripAdvisor the first tow months rent, an total of 19000 NOK so they can proceed with the shipping, and you can receive the rental package (keys and documents). I will pay for a 2 days delivery so you will receive the keys and the contract signed by me right away. Below I will explain you step by step how the transaction with TripAdvisor Property Management works, to avoid any misunderstanding please READ CAREFULLY THE FOLLOWING STEPS: 1 - To start the process all I need are your contact details: full name,email address, mailing address (street, number, city and postal code), cell phone number, move-in date and lease agreement preferred (e.g. 6 months or 1 year rental contract with option of renewal). The lease agreement will be a standard one from the government. 2 - I will go to the TripAdvisor Property Management office to start the transaction and I will give them the apartment keys and necessary documents. 3 - TripAdvisor Property Management will check the ownership documents and lease agreement. They will also confirm with the building management that I'm the legal owner of the apartment I'm renting to you. 4 - TripAdvisor will send you a notification(via email) with the transaction details to inform you that they have the keys and the documents in their custody. 5 - At this point you need to send the amount of 19000 NOK (tow months rent from the rental contract + damage deposit-refundable in the last month of rent from contract) to the the TripAdvisor Property Management payment representative (lawyer escrow account) provided to you in the notification. THE PAYMENT NEEDS TO BE SENT WITHIN 24 BUSINESS HOURS AFTER YOU WILL RECEIVE THE TRANSACTION DETAILS OR ELSE THEY WILL CHARGE ME AN ADDITIONAL FEE. 6 - As soon as the payment is completed you need to send the payment details to TripAdvisor. 7 - TripAdvisor will verify the payment and if everything is in order they will start the shipping procedures using UPS Next Day Shipping Service. 8 - You will receive the package (keys and lease agreement) and you will have 5 business days (inspection time) to check the place. 9 - If you decide to keep the apartment you just need to sign the lease agreement and TripAdvisor Property Management will release the funds to me. If you don`t want to keep the apartment you will receive a full payment refund including any payment fee. PLEASE NOTE that TripAdvisor Property Management can NOT release the funds without your approval. You will have 5 days to inspect the apartment and decide if you want to rent it or not, in this time you will have full control of the payment. They can release the payment to me as a landlord just after they will receive the lease agreement with your signature. ALSO THEY WILL SEND YOU OFFICIAL DOCUMENTS (LEASE AGREEMENT AND INVOICE) BEFORE MAKING THE DEPOSIT TO THEM. I ALSO NEED TO BE SURE THAT EVERYTHING IS CLEAR FOR YOU SO PLEASE READ CAREFULLY ALL THE STEPS OF THE TRANSACTION BECAUSE I CAN NOT CHANGE THEIR TERMS AND CONDITIONS. ALSO I WILL PAY FOR THE TRANSACTION AND DELIVERY FEES AND JUST IN CASE YOU CHANGE YOUR MIND I WILL NOT RECEIVE A REFUND FROM THEM! Let me know if you have the funds available (19000 NOK) so we can move forward and e-mail me your full information I requested. Any further questions regarding the transaction you can e-mail me. Thanks
The passport was not attached.
We got two mails:
Our good buddy Rosado Gomez
Hi again, I want to inform you that I already started the transaction and I went to the TripAdvisor office here in Mexico (Cabo San Lucas) , I gave them the keys, and all legal papers. They verified everything and they started this process. From my part the transaction has been started as we agreed and I have done my part of the process (now it is your turn). Can you please tell me if: # Did you received the email from TripAdvisor? IF NOT PLEASE VERIFY ALSO YOUR SPAM FOLDER # Do you understand the process? Also, please feel free to phone or email me if you have any questions regarding the process! Thanks
What's wrong with this header? You get 3 tries ;)
From: TripAdvisor Rentals <email@example.com> Date: 22 July 2017 at 11:57:40 GMT+2 To: My Sister <email stripped for privacy> Subject: TripAdvisor - Booking Request-Booking number: BR23699210
Answer Key: The sender address is not from TripAdvisor at all, instead it originates from a domain that doesn't even exist.
The content is a modified mail from TripAdvisor, with a "Pay Now" link to http://review-invoice.com/TripAdvisor%20-%20Booking%20Request%20BR23778879.pdf. The guys at TripAdvisor might be able to use this tracking link to the Rental Inbox to find where that email originates from.
The download is on
review-invoice.com, a domain with the following WHOIS info:
review-invoice.com Registered to Perez Ana Email firstname.lastname@example.org Last Updated May 30, 2017 Expires On May 30, 2018 Registrar Cronon AG Name Servers docks14.rzone.de shades11.rzone.de
I don't know of any other files hosted there, the home page is empty and Google hasn't indexed anything.
The PDF contains this information:
Bank Transfer Details
Account Name: Gerson Daniel Rosado Gomez
Bank Name: Banamex
Account Number: 4654341
Bank address: SUC.7012 -PLAZA HOLLYWOOD
It was created on a browser, I'm thinking Chrome (from the PDF metadata) on May the 18th, 2017; then modified right before it got sent to us, presumably to add the date info.