“Hello sir/ma’am, I am a member of royal [sic] family and I am in grave danger in my country. If you send me money to get out safely, I will share my great riches with you as reward.”
Recognize this plea as a scam? These blatant attempts by cybercriminals to milk you out of your money are commonly found in emails today. You might believe people are too aware to fall victim to such obvious deceit. Think again; these scams keep reappearing because they succeed.
Understanding Advance-Fee Fraud
The scam known as advance-fee fraud has been used by grifters for centuries. In the 18th and 19th centuries, advance-fee fraud letters were sent to victims requesting a small amount of money with the promise of a large reward in return. An example from history is the “Spanish Prisoner” scam. The missive claimed that the writer was trying to smuggle a wealthy captive from a prison in Spain and needed money to bribe the guards.
Famed French criminal turned criminologist Eugene Francois Vidocq—whose story inspired writers such as Hugo, Poe, and Balzac—cited an account of such a letter in his memoirs. Similar transnational scams have been documented since at least 1922.
Perhaps the most notorious example of modern-day advance-fee fraud is the “Nigerian Prince” scam. Purportedly, an African royal seeking to escape danger requests assistance in transferring his great wealth—with a significant cut allotted, naturally, to the person who assists him.
Once people began using the Internet, these scams became more prevalent. No longer were grifters constrained by “snail mail” postal costs. The number of email messages sourced from scammers was virtually unlimited.
Why Are These Scams So Sloppy?
The prevalence of these scams is scorned by savvy Internet users worldwide. The mere mention of “Nigeria” in an email title is an instant red flag for most people. So why is this scam still used?
In 2012, Microsoft researcher Cormac Herley began investigating the tactics of cybercriminals who launch these seemingly transparent advance-fee fraud scams. His research revealed a beguilingly simple underlying cause: these scams are in essence a hacker’s litmus test for identifying unsuspecting dupes.
The point? False positives—in other words, an incorrect assumption that a scammer’s ploy succeeds—influence all kinds of tests and analyses. To a scammer, a “false positive” is a target who ultimately doesn’t take the bait. Since cyberattacks require an investment of time and effort from the perpetrator, the greater number of false positives they target, the lower their return on investment (ROI).
By using sophisticated algorithms and analyzing various cybercrime statistics, Herley found that by mentioning “Nigeria” at the very beginning of a scam, it was possible for cybercriminals to attract only the most gullible from the outset. This meant that the investment necessary for the rest of the scam was more likely to pay off.
By optimizing their target pool through outlandish stories and obvious spelling and grammar errors, scammers are simply maximizing their options.
For complete details and Herley’s equations, see his research article here.
Protecting Your Business
However, this doesn’t mean that all scams are so obvious. Thus, you and your team need to be aware of the telltale signs of a cyberscam. The FBI offers some suggestions that will help your organization identify advance-fee scams:
• If something sounds too good to be true, assume that it probably is.
• Should you receive correspondence from someone asking for money or information, take steps to confirm the message’s legitimacy.
• Consult a professional to review any agreement you’re considering so you completely understand its terms.
As for your practice, your team must be able to identify the warning signs that a message isn’t all that it claims to be. This activity is known as “phishing” and comes in many forms.
To learn more about phishing and other cyber threats (and how to keep from being victimized by them), contact us! DHS is always happy to discuss your practice’s cybersecurity needs. Call us at 800-777-8089.
