Ron Sturgeon entered into an agreement to purchase 4 vehicles from Johan Lundberg for $290,000 euros. Johan Lundberg defrauded Sturgeon (or worked with others, including but not limited to the seller, whom Joahn represented) by creating a fake email and banking info.
Sturgeon has lost over $150,000 due to this fraud. Sturgeon has assembled a file with over 300 emails and documents to prove that Johan committed this fraud. That file can be furnished on request, but also I have a summary of the details.
- After months of negotiation, including an inspection trip from TX to Budapest, terms were agreed to, and Sturgeon agreed to send $135,000(dollars) as a deposit.
- All emails to and from Johan were from johan.lundberg@petrolheadclassics.com or his personal gmail account until April 28, 2023.
- March 15, 2023 – Test wire of $100 sent to bank in Hungary for Petrolhead Classics KFT (#507)
- There was a problem and the wire couldn’t go thru. It was corrected and wire was successful.
Wiring instructions and banks start to change
- #350 email with bank information in Hungary
- Recipient- Petrolhead Classics Kft, Szent Istvan utca 50, HU-2161 Csomad
- Bank details: Granit Bank Zrt, Lechner Odon fasor 8, HU-1095 Budapest. IBAN: HU78 1210 0011 1016 1508 0000 0000. SWIFT: GNBAHUHB
- April 17, 2023 at 6:09am Johan sent email (#70) with details of doing two wire transfers for the balance. Johan states that Ron already made one successful test transfer so shouldn’t be any issues.
- The bank info in this email is Petrolhead Classics Kft, IBAN HU78 1210 0011 1016 1508 0000 0000 SWIFT: GNBAHUHB
- April 17, 2023 at 7:02am (#71) Johan sends another email but changes the bank. All other info such as VIN are the same as the other email.
- Petrolhead Classics Kft, IBAN: GB33 BUKB 2027 2866 4200 99, Account 66420099, BIC/SWIFT: BUKBGB22XX, Address: Leicester, LE87 2BB, GTB
- April 17, 2023 at 10:22 am (73) Johan changes bank again.
- Recipient: Petrolhead Classics Kft. Unit A6, Rosehill Industrial Estate, Market Drayton TF9 2UJ, United Kingdom.
- Bank details: Account Holder Name: Petrolhead Classics Kft., Bank Name: BARCLAYS BANK, IBAN: GB33 BUKB 2027 2866 4200 99, ACCOUNT: 66420099, BIC/SWIFT: BUKBGB22XXX, Bank Address: Leicester, LE87 2BB, GB
- April 20th email #79 Johan sent wire instructions for US bank. Address of recipient is a single family home owned by KIMBERLY OLEJNICZAK.
- Acc Name: Pure Contracting LLC, Acct #: 1100026312874, Beneficiary address: 6220 SW 6th ST, Margate FL 33068
- Truist Bank 57000 Coconut Creek Pkwy, Margate FL 33063
- April 30 email #95 & May 1 #112 another bank change.
- Name and address of recipient: Petrolhead Classics Kft., Unit A6, Rosehill Industrial Estate, , Market Drayton TF9 2UJ, United Kingdom
- Name and address of bank: Account Holder Name: Petrolhead Classics Kft., Bank Name: BARCLAYS BANK, IBAN: GB93 BUKB 2026 8647 851577, ACCOUNT NO: 47851577, SORT CODE: 202686, BIC/SWIFT: BUKBGB22XXX, Bank Address: Leicester, LE87 2BB, GB
Barclay’s Accounts Belong to A Different Company
- Wire transfers were sent to Petrolhead Classics Kft
- (#514) Classic Petrolheads LTD is owner of account at Barclays and received the wire transfers. Their address is the same as the Barclay accounts.
- All the money had been withdrawn from Barclays except a little less than $400. Barclays returned what was left to Ron.
Email Address Changes
- April 28 at 7:52am email #95 sent from johan.lundberg@petrolheadclassic.com.
- Both email at petrolheadclassic and petrolheadclassics were sent sometimes using IP addresses known for blacklist activity and abusive behavior.
- Petrolheadclassic was registered April 28, 2023 and dropped and removed name servers June 30, 2023.
- From April 28 at 7:52am until morning of May 3 all emails came from johan.lundberg@petrolheadclassic.com.
- May 2, 2023 morning Johan sent email #332 from his personal gmail account to Jennifer. She then forwarded the email to Ron and copied Johan at the petrolheadclassics email address. Ron replied to this email Johan’s email at his classicS account (#124) using same subject listed in Johan’s private email. Ron also email (#128) tp ClassiC address.
Johan Claims His Email Was Hacked
- There is nothing to prove Johan’s emails were sent by a hacker. Go Daddy never said his account was hacked. A hacker will attempt to send out thousands of emails from your account. They do not target just one person.
- (#81) April 20 Johan states his email was hacked and claims fraud emails between April 15-May 3, 2023. He told attorney that he was hacked between April 7 and May 8.
- (#162) Johan waits till May 11 to send report from Go Daddy showing his account was blocked. The report says nothing about hacking, only that he had wrong settings and inbox wasn’t his default box. Instead he had his RSS subscription box set to receive his email.
- (#328 pg5-6) May 11 Johan sent email showing email traces for two emails. The dates show he received the emails May 1 and the other May 3. First one (#328 pg 5 & #510 pg1) with subject, I’m only trying to avoid problem for you was previously only used with the classiC email, yet his trace is showing this subject and his classicS email. It said he received the email at classicS but in the rss subscription folder. Proving he received emails at both classic and classicS addresses. The unique message ID on the trace is the same unique message ID on the email Ron sent.
Conclusion
- They wouldn’t spend so much time reading all past emails to get small little details to include.
- Why did Johan wait so long to report issue to Go Daddy and so long to contact Ron saying he was hacked?
- Johan has said only he and Ron were sent fake emails.
- How did Barclays Bank accept a wire for a company that didn’t match the account holder?
- The fraudster had to be involved with the company that owned the Barclays Bank account. They withdrew the money and saw it came in as a wire to someone else.