Company Representative scams, Payment Processing scams and other Employment scams.
#378994 by kim200490 Tue Dec 25, 2018 11:29 am
Mike Wilson wrote:Hello Andrés,
This is a fake offer of employment. The position does not exist and the best thing to do now is to ignore the emails.


Could you please help me to identify is it scam or not?
Recently I got email with text below:

This is to inform you that your application which was submitted has been evaluated kindly go through the attachments for details of the invitation.

Engr. Stephan Minnaar
(Human Resource Relation Officer)

but email is very strange: [email protected]

For me it is seems like a scam mailbox.
Please advise.


#378995 by AlanJones Tue Dec 25, 2018 11:45 am
It's a definite scam. The email address is not a real Exxon Mobil one.

Please do not tell scammers that they are listed here - it will take them seconds to change their fake details and their new details will not be listed for any future victims to find.
#380864 by esam Thu Jan 31, 2019 4:39 am
i received this mail from this mail address :EXXONMOBIL MALAYSIA <[email protected]>

Menara ExxonMobil, Kuala Lumpur City Center
50088 Kuala Lumpur P.O. Box 10857, 50728
Kuala Lumpur, Malaysia
Attention:Mohamed Rashad Mahmoud
We have tried to call but all effort went avail.If you receive this email kindly sign the contract and send it back to us if you are interested in the role.After screening and verification process of details contained in your resume and evaluation of our Employment Data Sheet.You have been selected as one of the candidate that will work with us here at ExxonMobil Malaysia.Our Attached Contract offer shall help you know what to expect after reading the terms and conditions of the contract offer.If the terms of contract are acceptable by you, indicate your acceptance by filling in your details on the CONTRACT ACCEPTANCE FORM signed send a copy back to us via email,You are requested to also send a signed copy of your contract letter to the Immigration Consultant along side with other Necessary Requirements Which Include A scanned copy of your International Passport recent photograph.
The below email and phone number belongs to the immigration consultant who will be in charge of your Malaysia visa and Residence Work Permit, once you agree to the terms and condition of this offer by signing your signature on the space provided,you are to immediately contact the below email address and let the immigration consultant know that you have accepted the job so he can start your Residence Work Permit Papers and Visa Application.
Chan Immigration Services Malaysia
Address Jalan Sultan,Persekutuan, 59100 Kuala Lumpur, Malaysia
Mr Chan Abdukareem
Email: [email protected]
Please contact the Immigration Consultant once you signed the contract because you shall be required to furnish us with your valid Malaysia residence and work permits papers before the 25th of Feb 2019 as a proof of readiness to join ExxonMobil Malaysia Family and also to enable you receive your first monthly salary including your due entitlements/emoluments prior to your departure for services with the ExxonMobil Malaysia.All Malaysian based employees' are to report personally to our office with identification materials for signing and collection of hard copy of their contract documents.
This is in line with the expatriate statuary law of Malaysia in compliance with the U.N.Terrorism Act. Find attached a company of the contract.Congratulations on your appointment for Joining ExxonMobil Malaysia we wish you every success in your new duties and We hope that your professional association with us will be a rewarding and fulfilling experience.Note because of the time difference and in case you didn't get me on the phone please send all your queries via email i will deal with it once i get back to the office.Sign the contract and send it back to me also dont forget to contact our company immigration consultant to start your travel documents.
Best Regards
Ms Kim Anderson
#380867 by AlanJones Thu Jan 31, 2019 5:09 am
Thanks for posting, is another fake domain that was registered by someone using fake details at the start of this month.

There is no job, the scammer just wants to charge you fees for non-existent documentation.

Please do not tell scammers that they are listed here - it will take them seconds to change their fake details and their new details will not be listed for any future victims to find.
#381689 by Pontello45 Fri Feb 15, 2019 5:24 pm
Hello, this what I got:

FROM: EXXONMOBIL ([email protected]) <[email protected]>

Thanks for your interest in the Exxon Mobil UK Family, please note that your resume has been evaluated and you have been shortlisted for Job interview. Please go through the attachments for important details of the invitation.

We look forward to seeing you soon.

Engr. Stephan Minnaar
(Human Resource Relation Officer)

3 PDF files attached
#381698 by Tim Atem Sat Feb 16, 2019 7:28 am is an email-only domain being used in this scam and is not a legitimate Exxon-Mobil email address. Is it possible for you to post the header of the email you received?

How to extract email headers: ... eaders.php

Make sure to remove your email address from the header before posting.

Domain name:

Data validation:
Nominet was not able to match the registrant's name and/or address against a 3rd party source on 20-Nov-2015

PDR Ltd. d/b/a [Tag = PDR-IN]

Relevant dates:
Registered on: 20-Nov-2015
Expiry date: 20-Nov-2019
Last updated: 08-Dec-2018

Registration status:
Registered until expiry date.

Name servers:


Learn what a scam is and how to protect yourself
#384201 by safakakat Mon Apr 15, 2019 7:05 am

I have just received an e-mail from "[email protected]" for an job interview.
You can see the details in the e-mail below.

There are also 2 pdf files in the attachment;
One of them is "Letter of Interview" and the other one is "Interview Details".

Is it a fake mail, what do you think?
Thanks for your replies.

We are pleased to inform you that your job application has been accepted by the ExxonMobil corporation.
ExxonMobil has made an excellent choice based on the expertise, experience and talent found on your resume. We congratulate you on your employment and new role. Therefore, we invite you to have an interview with us in our London Office.
Please find attached herewith, relevant document containing the prototype of your contract package for detailed understanding.
Should you require more information, please contact us immediately through email below.

Warm Regards,
Nathaniel Edward | Head of Recruitment

Email: [email protected]
Address: ExxonMobil House, Ermyn Way, Leatherhead,
Surrey, KT22 8UX.London, United Kingdom.
Tel: +44 (0) 753-718-4370
+44 (0) 753-718-0215
#384202 by AlanJones Mon Apr 15, 2019 7:37 am
It's a scam, is a fake domain registered by someone claiming to be in the USA a few weeks ago.

Creation Date: 2018-03-21T06:39:27Z
Registrar Registration Expiration Date: 2020-03-21T06:39:27Z

Registrant Name: aktamus williams
Registrant Organization:
Registrant Street: 255 Old Usquepaugh Rd
Registrant City: West Kingston
Registrant State/Province: RI
Registrant Postal Code: 02892
Registrant Country: US
Registrant Phone: +1.6175430022
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: [email protected]

Please do not tell scammers that they are listed here - it will take them seconds to change their fake details and their new details will not be listed for any future victims to find.
#384203 by safakakat Mon Apr 15, 2019 7:44 am
Thanks a lot for your prompt reply.
I also sent an e-mail to real Exxonmobil for checking.

So, should I do anything now?
Or just ignore related e-mial?
#384204 by AlanJones Mon Apr 15, 2019 7:47 am
Just delete the email and don't respond to them.

Please do not tell scammers that they are listed here - it will take them seconds to change their fake details and their new details will not be listed for any future victims to find.
#385850 by RinM18 Wed May 15, 2019 12:19 am
Hi Guys! I've just received an email from [email protected]:
Offer Letter ( Job Ref:EMCL/ID2187/19) 1 файл (Посмотреть)

От:ExxonMobil Cepu Limited <[email protected]>Подробнее&14 Мая 2019, 09:20&

TELEPHONE:+(62)856 9572 3074
FAX NUMBER: +(62)858 9098 0900
EMAIL: [email protected]

Job Ref:EMCL/ID2187/19

Attn: Rinat ________,

Consequent to your request herewith is an attachment of the advance offer letter and you have been offered employment with us here at ExxonMobil Cepu Limited.

Your employment offer comes standard with provisions for accommodation, feeding, flight ticket, medical care, professional training, transportation, security, holiday/travel packages, etc.

Refer to the attached letter for further details and instructions. Upon review and acceptance of the terms of employment, you are required to sign and return a signed copy to us via email, also contact and forward a copy to the Official Immigration Attorney to commence the application for your Work Permit with the contact details below;

South Jakarta, Indonesia
Barrister/Solicitor: Arnold Espinoza
P: +6285772238797
P/E: [email protected] 

You are expected to conclude all immigration matters with the official Immigration Attorney within two weeks. As soon as we receive confirmation of the approval of your Workers Permit, we will make available your Flight Ticket.

NOTE: Your consistency is needed to ensure speedy processing of your Work Permit. Please do not hesitate to call or send us an email if you have any question regarding this employment offer.

Best Regards,
Jon G. Marshal
Hiring Manager, ExxonMobil Cepu Ltd



Email: [email protected]

This e-mail is confidential and may also contain privileged information. If you are not the intended recipient you are not authorised to read, print, save, process or disclose this message. If you have received this message by mistake, please inform the sender immediately and delete this e-mail, its attachments and any copies.
Any use, distribution, reproduction or disclosure by any person other than the intended recipient is strictly prohibited and the person responsible may incur penalties.
Thank you!

Fake email account???
#385853 by Terminator5 Wed May 15, 2019 12:37 am
It's a scam . It's an email domain registered in Lagos Nigeria.

And have no fellowship with the unfruitful works of darkness, but rather expose them. But all things that are exposed are made manifest by the light, for whatever makes manifest is light.
#403487 by N.MANIN Mon Jan 20, 2020 6:25 pm
The same for me, I noticed the scam so I'm coming here, you'll probably be better than me at reporting it, especially unlike all what I've read till now, I got bank details and name of the guy I was supposed to pay to obtain life insurance certificate...

# 1st I've been contacted by a fake agency:

Address: 30th Floor WISMA GKBI, Jl. Jenderal Sudirman 28
Jakarta 10210 Indonesia
Email: [email protected]

All responses must be sent to this email:
[email protected]

Attn: Sir/Madam,

Subject: ExxonMobil Cepu Recruitment

The Human Resources department of ExxonMobil Cepu Corporation has found your experience and qualifications suitable for our requirements.

Send your most recent resume and certificates for screening and verification.

Please indicate your present salary and your preferred salary.
Total Years of Experience:-
Years of experience in Oil & Gas companies:-
Current Salary per Month USD:-
Preferred salary USD:-
Nationality / Dual Nationality:-

Yours Sincerely,
Jack Smith
Recruitment Coordinator

==> with below detailed header:
Return-Path: [email protected]
Received: from lpn-prd-vrin015.laposte (LHLO lpn-prd-vrin015) (
by lpn-prd-mstr222 with LMTP; Mon, 6 Jan 2020 20:30:55 +0100 (CET)
Received: from lpn-prd-vrin015 (localhost [])
by lpn-prd-vrin015 (Postfix) with ESMTP id 81C5266001F
for <my address hidden>; Mon, 6 Jan 2020 20:30:55 +0100 (CET)
Received: from ( [])
(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
(No client certificate requested)
by lpn-prd-vrin015 (Postfix) with ESMTPS id 06B94660142
for <my address hidden>; Mon, 6 Jan 2020 20:30:54 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;;
s=dbd5af2cbaf7; t=1578338991;
X-UI-Sender-Class: 214d933f-fd2f-45c7-a636-f5d79ae31a79
Received: from [] ([]) by
(3c-app-mailcom-lxa01.server.lan []) (via HTTP); Mon, 6 Jan 2020
20:29:51 +0100
MIME-Version: 1.0
Message-ID: <[email protected]p-mailcom-lxa01>
From: "Cornerstone Consultant" <[email protected]>
Subject: ExxonMobil Cepu Recruitment
Content-Type: text/html; charset=UTF-8
Date: Mon, 6 Jan 2020 20:29:51 +0100
Importance: normal
Sensitivity: Normal
X-Priority: 3

# 2nd I've had several exchange with a pseudo HR manager from Exxon with the below details:

Return-Path: [email protected]
Received: from (LHLO lpn-prd-vrin015) ( by
lpn-prd-mstr222 with LMTP; Wed, 8 Jan 2020 10:28:32 +0100 (CET)
Received: from lpn-prd-vrin015 (localhost [])
by lpn-prd-vrin015 (Postfix) with ESMTP id 4157466E18E
for <[email protected]>; Wed, 8 Jan 2020 10:27:10 +0100 (CET)
Received: from ( [])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by lpn-prd-vrin015 (Postfix) with ESMTPS id A518C66F6AB
for <my address hidden>; Wed, 8 Jan 2020 10:15:20 +0100 (CET)
Received: from ( [])
(Authenticated sender: [email protected])
by (Postfix) with ESMTPA id 9A3612400B3
for <my address hidden>; Wed, 8 Jan 2020 09:14:51 +0000 (UTC)
MIME-Version: 1.0

# 3rd I was in contact with a pseudo Attorney using the name of a real attorney office in Jakarta with the below details:

Return-Path: [email protected]
Received: from lpn-prd-vrin018.laposte (LHLO lpn-prd-vrin018) (
by lpn-prd-mstr222 with LMTP; Fri, 17 Jan 2020 08:57:19 +0100 (CET)
Received: from lpn-prd-vrin018 (localhost [])
by lpn-prd-vrin018 (Postfix) with ESMTP id E41191466F3E
for <my address hidden>; Fri, 17 Jan 2020 08:57:18 +0100 (CET)
Received: from ( [])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by lpn-prd-vrin018 (Postfix) with ESMTPS id 4D94D145F236
for <my address hidden>; Fri, 17 Jan 2020 08:57:16 +0100 (CET)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901;; cv=none;

# 4th and last I was in contact with a pseudo insurance company who finally ask me to send some money to pre-pay an expatriate work insurance... with the following details (on this one I put the full email detailed because you will see the bank details of Erwin Hermawan who is the scamer who supposed to get the money...):

Return-Path: [email protected]
Received: from (LHLO lpn-prd-vrin012) ( by
lpn-prd-mstr222 with LMTP; Mon, 20 Jan 2020 09:30:48 +0100 (CET)
Received: from lpn-prd-vrin012 (localhost [])
by lpn-prd-vrin012 (Postfix) with ESMTP id F1D6E120813
for <my address hidden>; Mon, 20 Jan 2020 09:30:47 +0100 (CET)
Received: from ( [])
(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
(No client certificate requested)
by lpn-prd-vrin012 (Postfix) with ESMTPS id B54AA120873
for <my address hidden>; Mon, 20 Jan 2020 09:30:47 +0100 (CET)
Received: by with SMTP id w1so32909999ljh.5
for <my address hidden>; Mon, 20 Jan 2020 00:30:47 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025;
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025;
X-Gm-Message-State: APjAAAXw8uAu6nBt8NxlW3o/s7NSmyqRAp7twFgOk7q8mKyvDIxbM5i6
X-Google-Smtp-Source: APXvYqxxFQq7Hjlrre6aWQ/a9s06JFX5xm9xHPjUw9pAp3troZY5N8zpq5oh4aTQ2QhiKMhBIEOmg1ahLBmHYxew+zY=
X-Received: by 2002:a05:651c:111a:: with SMTP id d26mr12957479ljo.153.1579509046876;
Mon, 20 Jan 2020 00:30:46 -0800 (PST)
MIME-Version: 1.0
References: <[email protected]>
<[email protected]>
<[email protected]om> <[email protected]>
In-Reply-To: <[email protected]>
From: PTMNC Assurance <[email protected]>
Date: Mon, 20 Jan 2020 09:30:36 +0100
Message-ID: <[email protected]om>
Subject: Re: I-ewtip application - my name hidden
To: my address hidden
Content-Type: multipart/alternative; boundary="000000000000a89e12059c8e1baa"
Lpn-Authentication-Results:; spf=pass [email protected]; dkim=pass; dmarc=pass alignspf=pass aligndkim=pass
X-VR-FullState: 0
X-VR-Score: 0
X-VR-Cause-1: gggruggvucftvghtrhhoucdtuddrgedugedrudeggdduudelucetufdoteggodetrfdotffvucfrrhho
X-VR-Cause-2: fhhilhgvmecunfetrffquffvgfdpggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecuhedt
X-VR-Cause-3: tdenucenucfjughrpeggfhgjhfffkffuvfgtsegrtderredttdejnecuhfhrohhmpefrvffopfevucet
X-VR-Cause-4: shhsuhhrrghntggvuceophhtmhhntggrshhsuhhrrghntggvsehgmhgrihhlrdgtohhmqeenucfkphep
X-VR-Cause-5: vddtledrkeehrddvtdekrddujeejnecurfgrrhgrmhepmhhouggvpehsmhhtphdpihhnvghtpedvtdel
X-VR-Cause-6: rdekhedrvddtkedrudejjedphhgvlhhopehmrghilhdqlhhjuddqfhdujeejrdhgohhoghhlvgdrtgho
X-VR-Cause-7: mhdpmhgrihhlfhhrohhmpehpthhmnhgtrghsshhurhgrnhgtvgesghhmrghilhdrtghomhdprhgtphht
X-VR-Cause-8: thhopehnihgtohhlrghsrdhmrghnihhnfeeksehlrghpohhsthgvrdhnvghtnecuvehluhhsthgvrhfu
X-VR-Cause-9: ihiivgeptd
X-VR-AvState: No
X-VR-State: 0

Content-Type: text/plain; charset="UTF-8"

PT MNC LIFE ASSURANCE(Global Work/Travel Protection)
Jalan M.H. Thamrin No.10
Jakarta 10230, Indonesia
Tele: +6285771475441
Email: [email protected]

Attention: My name,

I received your email. The Insurance Certificate covers for a whole year.
I do not require anything from you other than the deposit of the Insurance
fee after which I will email your Certificate immediately on confirmation
of deposit.

Below is the bank information for the deposit;

Name: Erwin Hermawan
Account Number: 411-602-1736
Bank: Permata Bank
Swift Code: BBBAIDJA
Bank Address: Jl. Astana anyar no.22 ,Cibadak ,Astana anyar ,Bandung ,Jawa
barat 40241
Beneficiary Address : Jl. industri Barat Rt. 004/004, Husen Sastra
Negara,Cicendo,Bandung ,
Jawa Barat 40171

Do not forget to send a copy of the deposit slip once you have made the

Best Regards,
Mrs Natalia Angeline Wenur
Issuing Officer, PT MNC Life Assurance
#405687 by engki Mon Mar 02, 2020 7:39 am
Could you share the mobile numbers used by the 'hr manager' and the 'lawyer'? I think we have the same scammers here.
#405691 by AlanJones Mon Mar 02, 2020 9:04 am
Why don't you share the information you have, rather than inconveniencing other forum members.

Please do not tell scammers that they are listed here - it will take them seconds to change their fake details and their new details will not be listed for any future victims to find.

Who is online

Users browsing this forum: Google [Bot] and 24 guests