I think I may have been scammed...And I'm worried about it. If it is a phishing scam, someone went to a whole lot of trouble. I'm still not sure either way, but I thought I'd provide the details here and hope that some wiser and more experienced folks might provide some insight.

Here's the story. On March 16, I received an email from someone named "Robert Porshke," who claimed to be working on a master's exam project at the academy of fine arts in Umea, Sweden. He said that he'd read some of my works on Armchair Arcade, specifically this piece on game audio. Here's a quote from the email:

Along with the exhibition we will release a catalog as usual. But it's going to be more like an anthology with text about subjects we are interested in, instead of the usual description of our works and self promotion. This will hopefully increase it's lifespan and audience, since you won't need to see the exhibition to enjoy the catalog. We also plan to distribute it together with a culure/art-magazine.

The short of it is, he was willing to pay $130 for a 1000 words on interactive audio that he could use in this catalog. I followed up, and we exchanged several longish emails about interactive audio, swapping lots of links and so forth. I ended up drafting the piece, which he said he liked.

Finally, on March 22nd, Robert emails back and says,

Sorry about the delay. I'm not very good with too many balls in the air. The school needs your bank account info, especially your IBAN.

Something didn't seem right this time, so I emailed him back asking about the IBAN. He replied, "Yeah, I think they want to transfer the money directly into your bank account. IBAN is an International Bank Account Number, which you can get from your bank.."

So, the obvious question is, why can't they just send a check? I got an email from one Susanne Andregas, apparently the accountant at Umea. She insisted that I send her my bank account information (what amounted to my bank code and router number). I was highly suspicious, but after looking over the site several times, I just found it impossible to believe that all this could be a scam. Why go to this much trouble? So, against Charlie Lowe's advice, I ended up sending the invoice via snail mail (to the address on the website), and hoping for the best. I'm really strapped for cash, and, believe it or not, $130 is a real boon.

Well, the next day Susanne writes back and says they can do the money order after all. Apparently someone named Britt-Marie Sandstrom has "found a way" for me to get paid by money order. However, "To do that we need your, date, month, year of birth." Uh...Well, isn't that nice? I told them I had already sent the invoice. But, on later reflection, I figured--it's not as though the info they are asking for is confidential. Heck, anyone with basic googling skills could find my birthday in a matter of minutes. So, I sent it. At this point, my scam alert was up to say, high orange.

What finally triggered the red response was the email I got today from Britt-Marie Sandstrom:

Dear Matt Barton,

I thought we got all the information that is needed to pay you - but no. I need to know the following:

Citizenship:
Country of residence:
Country code:
Foreign tax identification number: I believe this is the number you have at the TAX authorities.
AND A COPY OF YOUR PASSPORT you can fax it to +46- 90 - 786 66 87.

Sorry for this, but rules are rules....

Uh, no. In so many words, I told them that I wouldn't provide this much information to anyone, and that I suspected the whole thing was a scam. I'm still waiting to hear back from them on this, but it's starting to sound like a really large and really nefarious scheme. At any rate, I'm done providing them with private information. They already have enough to really cause me some damage, so I'm keeping a careful eye on my bank account and will notify the bank the moment I see anything remotely suspicious.

Or, they could be perfectly innocent, simply trodding along in their university's bureacratic procedures...

Any thoughts? Did I act rashly by refusing to provide this extra info? Or did I act rashly by sending them my IBAN and BIC in the first place? Advice is appreciated.