Related topics
  • ,
  • ,
  • ,

Nigerian scams are hyper-efficient idiot finders

The bigger the lie, the bigger the pile of cash scammers scoop, says MSFT boffin

Nigerian 419 plus Unix Terrorism shirts montage

A Microsoft researcher, Cormac Herley, has penned a paper titled “Why do Nigerian Scammers Say They are from Nigeria?” (PDF), and concludes the whoppers the scam includes are actually a very efficient way of finding likely targets.

Herley's analysis suggests the scam works because it quickly passes BS-detection thresholds in most readers, but those stupid enough to fall for the scam self-select by responding. Scammers end up with a list of hot prospects who have self-selected, leaving them with less work to cash in than would be required with a more plausible tale.

“An email with tales of fabulous amounts of money and West African corruption will strike all but the most gullible as bizarre,” he writes. “It will be recognized and ignored by anyone who has been using the Internet long enough to have seen it several times. It will be figured out by anyone savvy enough to use a search engine [and] won’t be pursued by anyone who consults sensible family or fiends [that's Microsoft's typo], or who reads any of the advice banks and money transfer agencies make available.”

“Those who remain are the scammers ideal targets,” the paper proclaims, as “A less outlandish wording that did not mention Nigeria would almost certainly gather more total responses and more viable responses, but would yield lower overall profit.”

There's a serious side to all this, as the main thrust of Herley's research is how false positives are used by folks with more evil intent than Nigerian scammers to design other forms of attack. He therefore suggests “thinking like an attacker does not end when a hole is found, but must continue (as an attacker would continue) in determining how the hole can be monetized.” ®

Sponsored: Today’s most dangerous security threats