Scambaiter: Understanding Targeted Nigerian Scams on Craigslist

Abstract

Abstract-Advance fee fraud scams, also known as Nigerian scams have evolved from simple untargeted email messages to more sophisticated scams targeted at users of classifieds, dating and other websites. Even though such scams are observed frequently, the community's understanding of targeted Nigerian scam is limited since the scammers operate "underground". In this paper, we focus on fake payment scams targeting users on Craigslist. To better understand this type of scam and associated scammers, we built an automated data collection system. The system relied on what we term magnetic honeypot advertisements. These are advertisements that are designed to attract scammers but repel legitimate users -similar to how a magnet attracts one side of a magnet but repels the other. Using advertisements of this type, we offered goods for sale on Craigslist, gathered scam emails and interacted with scammers. We use this measurement platform to gather three months of data and perform an in-depth analysis. Our analysis provides us with a better understanding of scammers' action patterns, automation tools, scammers' email account usage and distribution of scammers' geolocation. From our analysis of this dataset, we find that around 10 groups of scammers were responsible for nearly half of the over 13,000 total scam attempts we received. These groups use shipping address and phone numbers in both Nigeria and the U.S. We also identify potential methods of deterring these targeted scams based on patterns in the scammer's messages and usage of email accounts that might enable improved filter of their initial messages by content and email address.

The check is in the mail: Monetization of Craigslist buyer scams

“…Our analysis corroborated similar results to previous studies [4] regarding a small number of organizations being responsible for over 50% of the fake payments and groups using multiple initial email accounts filtering down to a smaller number of reply-to email accounts. Of interest though was the analysis result that the majority of fake Paypal payments scams resulted in direct shipment requests to Nigeria while all fake check payment scams led to addresses within the United States.…”

“…We used a technique similar to a previous methodology in attracting scammers to our Craigslist postings [4]. However, instead of an automated collection methodology, we chose to use manual data collection in order to enhance our ability to personalize and extend our online interactions with targeted scammers.…”

“…Previous studies have focused on understanding the basics of Nigerian scams targeting Craigslist and how the scammer groups are organized [4]. Some studies have looked at the cultural issues faced by the youth in Nigeria that have given rise to the scammer culture prevalent there [5], [6].…”

“…Since our previous research collected and analyzed all IP addresses observed, for this research we focused solely on the IP geolocation for those 22 email threads for which we were able to collect both IP information and payment was attempted, either via check or Paypal, rather than the entire body of IP addresses. 4 We referenced the website whatismyipaddress.com/iplookup for geolocating the IP addresses and Table IV shows that 77.2% (17 of 22) of IP addresses associated with any type of scam payments were from Nigeria with only 4.5% (1 of 22) originating from within the United States. Additionally, all of the IP addresses associated with fake check payments (12 of 12) were located within Nigeria.…”

“…However, the majority of these safeguards are focused on preventing scammers from posting fraudulent information on the site, little effort has been made to protect legitimate users receiving responses from fraudulent buyers. In 2013, a research measurement study was conducted focusing on the fake payment scams targeting users on Craigslist [4]. One result of the study was the identification of two primary payment methods, fake checks and fake Paypal payments being utilized by scammer groups in furtherance of their scam attempts.…”