Getting Hinky About Nigerian Scams

Nigerian advance-fee fraud scams are alive and well. Ben Rothke looks at a series of emails for clues that should set off any recipient's sense of danger.

By Ben Rothke, CISSP

August 31, 2009 - CSO

The first generation of computer viruses was relatively easy to identify and quarantine. Get infected, run your favorite scanner, the scanner quarantined the virus—end of story. This process worked fine until the virus writers became more sophisticated. In the early 1990's, the world of computer viruses changed radically when polymorphic viruses came on to the scene. While early viruses were easy to indentify by their static signature, polymorphic viruses mutate and rendered the first-generation of virus scanners useless.

Similarly, the first generation of Nigerian advance-fee fraud scams was relatively easy to identify. But the real challenge was getting people not to fall for those scams. As far back as 1997, the Bureau of International Narcotics and Law Enforcement Affairs of the United States Department of State wrote a 33-page document [PDF link] that detailed the Nigerian advance-fee fraud scheme and how to avoid being a victim.

Also see Mind Games: How Social Engineers Win Your Confidence

The classic advance fee-fraud was somewhat limited in its scalability given that there are only so many permutations of murdered/deposed mothers, fathers, uncles, brothers and brother-in-laws, from corrupt governments in Nigeria, Somalia, Senegal and surroundings, and that over time, people would eventually become suspicious.

In response to growing consumer awareness the scammers started to do what the polymorphic viruses did—they mutated. However, while the scams are morphing, the end result is the same; the scammers get their money, and the victim is out, with no recourse.

With the tactics changing, what can you do to protect yourself from these scams? Technology and spam filters generally can't identify these emails. Scammers often compose their emails to not get flagged, and are often written like a prospectus sent from a legitimate firm. The best thing you can do is get a feel for these scams. Use your common sense, and remember the adage that if something sounds too good to be true, it usually is. Finally and perhaps most importantly, develop your own sense of hinky.

What is hinky? In a fascinating article, BT Chief Security Technology Officer Comments (0) | Print | Send | del.icio.us | Digg It! | Linking Blogs | 8 Views