I should mention there have been two instances where a little bit of extra effort on my part has gone a long way (but not nearly to the extent of what this requires).
I was selling some gear and had an ad on tdpri.com I got contacted by someone via there with some emails in broken English and such, strange requests that they really wanted the Tele, take if offline for sale, maybe even wire transfer request, can't remember. Anyway, total scam. So I had them email me directly (to my 'bogus' account - a free email account I use for these types of situations). I was then able to check the email headers and find the IP address used to send the original mail - Nigeria, lol! When the person said they were from the Midwest. So, I emailed them back my findings, emailed tdpri.com and also contact an online source (3C or something like that) just to get on record that the "buyers" email address, IP, etc... was being used to try and scam people.
I stupidly paid $300 in full via Paypal/credit card to have someone mod my AC30cc1. He is highly regarded everywhere as THE man for the job and works magic. Anyway, what should have been 2 weeks turned into 4 months. I tried emails, phone calls, etc... and I got to thinking I was screwed even though friends of his assured me he was going to pull through. What worked? Telling him to forget it, he can have my cash and just send back the amp unmodded. Also, I contacted friends/business partners that I know worked with him and THEY helped to set him straight. Took a while, but my amp comes back (modded) on Monday via UPS.
If you have email directly from the "mule" to you I would checked the email headers, find the starting IP address and do a looking to see where it's registered (and possibly the location of his ISP) to see if he lives where he says he does.
Now, if HE has original emails from HIS guys he could do the same... might be interested to find out what part of Russia they are from
