Malicious Life Podcast: The Nigerian Prince

Transcript

When you imagine the kinds of people who fall for scams, who pops into your head? Probably someone elderly, or unintelligent.

Not Weidong Xu. But maybe he should. Or maybe anyone else, too, regardless of their age or intelligence. 

Xu–who looked rather older than his age, with parted black hair, bushy eyebrows, and big glasses–had used the 1990s to develop a respectable career in the field of HIV/AIDS research. In his late twenties, having received a master’s degree in Beijing, he traveled to the States to earn a doctorate in biochemistry. Then he joined an AIDS research lab, and two years later he was recruited to a project at Boston’s Dana-Farber Cancer Institute, investigating antibodies which might lead to an HIV vaccine. By age 38, Xu was a Harvard Medical School professor. So, a smart guy.

On Tuesday, March 30th, 2004, Boston police were called to Dana-Farber to interview a number of its employees. The timing was fortuitous. During one of the interviews, the interviewee pointed out Xu in the building’s cafeteria. Xu was, at that very moment, arguing with a fellow employee who claimed he’d given Xu over $5,000.

For what would one colleague have given another colleague so much money?

Well, for months prior, he’d been raising money for a Chinese research lab investigating a cure for severe acute respiratory syndrome (SARS). It made enough sense: he was Chinese, a medical researcher, and China has historically struggled with SARS far more than any other major country. And his fundraising efforts were remarkable. In all, he’d solicited just over $600,000 from over 30 people. Then, like he’d promised, he sent it all to the Chinese research lab. Which didn’t exist.

“He saw a fax in the Dana-Farber office from some people in Nigeria, and he fell for it,” Xu’s lawyer explained, after his arrest that day in the cafeteria. So Xu wasn’t the scammer–at least intentionally–he was the victim. Swindlers pretending to be from a research lab in China convinced him of a promising, 50-million-dollar research project, if only he could raise enough money upfront to help them along.

Even from the Suffolk County Jail in Boston, he couldn’t admit–or just couldn’t believe–what’d happened. As the Boston detective leading the case recalled, quote, “He wouldn’t acknowledge he’d been scammed. I tried to tell him he’d been scammed, but he never caught on.”

Intro to Nigerian Scams

“[Deborah] Your typical Nigerian email scam will be sent from someone who claims to be from another country. It’s often Nigeria, which is why the name was attached, but I’ve gotten them from all over the world.”

You’re listening to Deborah Schaffer, Professor of English Emerita from Montana State University Billings. Twelve years ago, Schaffer published an academic paper exploring the linguistic hallmarks of a typical Nigerian scam–also known as the 419 or advance-fee scam.

“[Deborah] They’re usually people who claim to be important figures in the country or related to important figures. An email I just got was supposedly sent from the daughter of Muammar Gaddafi, for example, and they all have large amounts of money that they need outside help with to manipulate in some way.”

We’ve all gotten an email like this before–in fact, thousands of them. Far more than we even know about, because most get caught by our email spam filters.

They’re so ubiquitous, even in today’s world of more advanced cybersecurity threats, because they do work. Not on everyone, all of the time, but enough people enough of the time. We have data to back this up, actually, going back hundreds of years.

The French Prisoner Letter

In his memoirs, published in 1827, Eugène François Vidocq–a criminal-turned-father of modern criminology, as well as the French national police force–told of a prison at Le Kremlin-Bicêtre, in southern Paris, which served as a breeding ground for malicious letters.

First, existing prisoners would solicit from newly arrived prisoners the addresses of wealthy individuals from their area. Each new letter might substitute in relevant names and places like Mad Libs but, in general, there was a formula that stayed the same each time. It would open with a line to…

“[Deborah] introduce themselves, and asked to be excused because they’re intruding on the recipients, time and so on.”

Sir.–You will doubtlessly be astonished at receiving a letter from a person unknown to you, who is about to ask a favor from you; but from the sad condition in which I am placed, I am lost if some honorable person will not lend me succor.

After a bit more flattery, a long, dramatic story would begin.

“[Deborah] So it’s a little narrative, to explain the nature of the money and what they need to do with it.”

This was the time of the French Revolution, we should note, when many rich aristocrats were being executed or were fleeing the country, abandoning their property or having it forcibly removed by the government. The letters were aimed at wealthy individuals experienced with and sympathetic to such plights, spinning for them the tall tales of great treasures left behind. Quote:

“As valet-de-chambre to the marquis de _____, I emigrated with my master, and that we might avoid suspicion we traveled on foot and I carried the luggage, consisting of a casket containing 16,000 francs in gold, and the diamonds of the late marchioness. We were on the point of joining the army at _____, when we were marked out and pursued by a detachment of volunteers. The marquis, seeing how closely we were pressed, desired me to throw the casket into a deep ditch near us, so that it might not implicate us in case we were apprehended.”

“[Deborah] They’re not pushy, they’re not aggressive. They try to be enticing and make it sound like this is a great opportunity. And the recipients should at least reply and find out more about it.”

The story goes on, rich in details about the treasure that happened to have been left just nearby the recipient’s home, and his perilous attempts to retrieve it. Eventually, the author does get caught by a “bitter Jacobin,” hence why he’s writing from jail, and needs the recipient’s help.

“[Deborah] And then they are usually not very specific about what they want the recipient, the email recipient to do.”

With only a fraction of the money they could recover together, the old French prisoner explained, he could pay for counsel and get out of his sticky situation. In return, sender and recipient could share in the spoils.

“[Deborah] if the recipient is interested in finding out more about how to handle this situation and what else they feel they have to do, they should respond to the email and often send personal information: certainly name, sometimes it’s the bank account number that the money will be deposited in. But most of these emails are a little more circumspect than that and just say, respond and establish communication. And we’ll get the next steps clarified.”

According to Vidocq, for every 100 such letters, around 20 would receive a reply. A brief correspondence would follow, with the clever prisoner expertly manipulating his mark.

“[Deborah] I like the frog in boiling water analogy. If you put a frog in the boiling water immediately, it’ll hop out, but if you put it in cool water and gradually heat it up, supposedly the frog stays in. And I think that’s the way some people get hooked by these scams. They get drawn in bit by bit, and by the time they start suspecting something’s not kosher, they feel like they’ve had too much invested to back away. They keep hoping against hope that it’ll turn out that they’ll get something from their time from the money they’ve already sent.”

Vidocq recalled, quote:

“Some individuals, thinking to give a profound proof of sagacity, came even from the remotest parts of their provence to Bicetre, where they received the destined plan which was to conduct them to this mysterious forest, which like the fantastic forests of the romances of chivalry, fled eternally before them.”

In one case from this time, for example, a clothes seller was found digging under the city’s bridge, expecting to find a wealthy dutchess’ diamonds.

(And it’s not really the point, but if you’re wondering: Why, if prisoners were scamming rich Parisians, were the prison guards responsible for sending and receiving those letters not doing anything to stop it? The jailers, Vidocq reported, were happy enough to let the prisoners have their little activity, and a little extra money to spend on food and alcohol, so they wouldn’t be thinking as much about escaping.)

Prisoner Letter Reaches America

The scam perpetrated by French prisoners was already well-known throughout the advanced world by the late 1800s. The New York Times noted in a Sunday edition story from March 20th, 1898 how, quote, “One of the oldest and most attractive and probably most successful swindles known to police authorities has again come to the surface.”

By this period, Americans were primed for believing tall tales of fortunes and the people adventuring to retrieve them. In a 2013 interview with NPR, Boston Globe correspondent Finn Brunton tied it to the Spanish-American war–often referred to as the first “media war”–where newspapers covered faroff events almost as soon as they happened, sometimes without as much concern for the truth as the drama of it. From Brunton, quote:

One of the side effects of that was that there was this kind of reservoir of common knowledge, of a day to day near real-time understanding of things that were going on and the fact that there were, you know, mercenaries and adventurers and money and so on and so forth. And that provided a fantastic background, a sort of reality scenario inside which a syndicate of scam artists could create very plausible seeming letters that would build on real world events and create this narrative that someone could then fall for.

This logic could be b.s., frankly, it’s hard to say. But this same kind of combination of ignorance of the world and curiosity for adventure might also help explain why the advance-fee scam ended up thriving in the region with which it’s associated today.

African Cultural Context

Think about it like this: If you had to choose, where would you say you’re more likely to find hidden treasure: New Jersey, or the African rainforest?

In the early 2000s, a professor at UC Berkeley, Jenna Burrell, embedded herself with young people at Internet cafes in Ghana. After seven years, in 2012–the same year Schaffer published her paper on the linguistics of Nigerian scams–Burrell explained where West Africans were getting their creative ideas for emails.

To be clear, though, the majority of Africans weren’t scamming people. Even many of those who were, let’s say, “stretching boundaries” were doing so in a relatively inoffensive manner. Many wrote emails to, for instance, ask money from their family living in wealthier parts of the world, and those family members abroad were the first to suspect that these emails were fabricating the truth.

As “Samuel,” a Ghanaian abroad told Burrell, quote, “the concern has always been like every other family… they always think that you are making too much money, you’re here, so you have to send them money.” To convince their family abroad, Africans started making stuff up. Samuel recalled how, quote, “They will even tell you stories about ‘well I’m not feeling well, the doctor says it’s medical, so you send money to them. Then they just go and spend the money . . .”

The key here, Burrell noticed, was that the stories weren’t just randomly manufactured to elicit sympathy. Quote:

“[S]trategies of self representation online among Ghanaians were shaped in relation to perceptions of an audience living outside of the country, whether Westerners or family living abroad. Even in ordinary non-criminal social interactions, the presented self was flexibly formed to reflect this audience, rather than serving to simply report current conditions.”

In other words, self-aware Africans played on how people in the rest of the world imagined their lives being. Quote:

“[T]hey were aware of the way the foreign media typically represent Africa as homogeneously war-torn, poverty stricken, and chaotic. [. . .] They believed that their desire for the funds needed to start a legitimate business, or to go to an IT school, were not persuasive enough to grab the attention of a foreign contact. [. . .] In response, scammers created alternate identities that catered to the perceived prejudices of their foreign chat partners. They performed as a needy African orphan, as an attractive African woman seeking rescue, as a participant in or victim of a corrupt African government regime[.] [. . .] Young Internet scammers believed these foreign perceptions of Africa could be usefully manipulated, perhaps in a way that even served as subversive justice.”

So Africa–in particular Nigeria, Africa’s most populous country–became the world’s hub for the advance-fee email scam not just because its people were, on average, rather in need of the money, but also because they were misunderstood. A Westerner might have a hard time believing that a prince had buried his family fortune under a bridge in New Jersey, but in Nigeria? Who knows? That place is wild.

Another of Burrell’s interviewees–“Yaw,” a member of an Internet cafe that acted as a de facto Nigerian email scam factory–boasted about using rich Westerners’ ignorance against them. Quote:

“Yaw noted that his friends didn’t feel bad about scamming because, as he ambiguously noted, “they say the white man is the biggest thief.” This rationalization made scamming activities an expression of vigilante justice rather than truly a crime. [. . .] He added that Westerners perceive Africans as not clever and capable enough to carry out a scam. In a satisfying sense of revenge against this racism, it is precisely by this prejudice that Westerners are taken advantage of in the ideal scam. Scammers and their sympathizers imagine the moment when racist scam victims realize they have been outwitted by individuals they had thought to be inferior.”

The scheme worked: as recently as 2019, according to a report by ADT, Nigerian scam emails were estimated to have cost Americans alone around $700,000. In 2020, the FBI’s Internet Crime Complaint Center tallied almost 2.5 billion dollars in lost funds to Nigerian cybercrime on the whole, including advance-fee scams.

Through the years, more and more African internet cafes became scamming epicenters, sometimes with clever young men pulling up in nice, new cars, wearing fancy jewelry and high-end clothes.

Consequence to Nigerians

And yet, in the grander scheme, Nigerian emails have hurt Nigerians as much as Americans, or any other country.

It was as the fraudulent activity started to ramp up in the 2000s and early 2010s that their victims got truly fed up. Online, you can find remnants of the early decision-making process we as a society ultimately, collectively, seem to have landed on. The blogger Ethan Zuckerman collected a few, like one online forum user who wrote how, quote, “I am so fed up with these darn African fraudsters, is it possible to block African traffic by IP.” From a Unix security discussion group, quote, “Maybe we could just disconnect those countries from the Internet until they get their scam artists under control.”

Soon entire companies–lots of them–adopted the same tactic. According to Wired, brand name organizations like PayPal, Binance, and more began blocklisting users from Nigeria, and–consciously or not–training machine learning algorithms with data biased against Nigerians.

You can understand why companies would take a hard line, too. For a payments platform or a cryptocurrency marketplace, preventing money laundering is of utmost importance. Any profits lost by excluding Nigerian users–a large, but relatively poor market–is vastly counterbalanced by the incentive of not enabling cybercrime, and all the undue law enforcement attention that doing so might bring.

Nigeria and other countries in its blast zone are keenly aware of the bad attention they’ve incurred. In Ghana, Jenna Burrell observed widespread condemnation and alarm over the prevalence of Ghanaian scammers. The phenomenon even earned a name–“sakawa”–with news headlines decrying “The Sakawa Menace” and movies made with titles like “The Dons of Sakawa.” Yet African scammers continued to proliferate, motivated by stunted economic conditions, enabled by weak policing and judicial systems, and advanced nations penalized all Nigerians in turn, good and bad.

Maybe that’s helped a lot of people not get scammed over the years. But maybe, by excluding Nigerians from important parts of the web, we’re forcing even more young men into its darker corners. Because unlike the malicious hackers we typically think of, Burrell found that many scam artists in Ghana only did it as a means towards better lives. Quote:

Some scammers consequently described their efforts as a launching pad to a legitimate, non-deviant lifestyle. They planned to use the proceeds of their scams, for example, to pay for IT training courses, to start a business importing Western goods for resale, or to pay for a trip abroad. Scamming was never described in interviews as a permanent arrangement or a way to avoid a conventional career.

The person sending you Nigerian prince emails isn’t a Nigerian prince, to be sure, nor are they anything else they might say they are–an orphan, a refugee, sick, whatever. They’re probably just some young person who wishes they had a real job.

Influence of AI

A last thought before we go. 

Criminals had hundreds of years to perfect the story, the tone, wording, and every other aspect of that letter faxed to the Dana-Farber Institute in 2004, which fooled a Harvard professor so thoroughly that he couldn’t see he was fooled even after it was revealed to him.

Now, for the first time in a very long time, the Nigerian Prince scam might actually be changing.

At the turn of 2023, a new kind of cyber threat tool began to spread on the web: black market chatbots, built on the open-source software published by companies like OpenAI. WormGPT, FraudGPT–most of these were fake and useless, but a few weren’t. To circumvent the restrictions in platforms like ChatGPT, dark web developers had remodeled open-source models to help their fellow hackers write better malicious emails (for a price).

Thanks to AI, many in the cybersecurity community worry that scam emails across the board–including the Nigerian prince–are going to be greatly improved. AI will help remove any imperfections in spelling and grammar, and improve their flow so that they sound more professional and legitimate. The resulting emails will be better, and more convincing than ever before.

For what it’s worth, though, I think the experts might be wrong on this one.

Cormac’s Paper

In the same year Deborah released her paper, and Burrell published her book, a Microsoft researcher named Cormac Herley voiced his own take on the Nigerian prince scam. His paper–“Why do Nigerian Scammers Say They are from Nigeria?”–is the most interesting and controversial ever published on the subject.

It opens with a novel idea which throws the whole matter of Nigerian prince scams into new light. “False positives cause many promising detection technologies to be unworkable in practice,” he writes. “Attackers, we show, face this problem too.”

For a moment, put yourself in the shoes of a scammer. You want to steal as much money as possible. How do you do it? By writing the most convincing scam possible, of course, that’s going to trick the highest percentage of recipients as possible into responding to you.

Wrong. Quote:

“Far-fetched tales of West African riches strike most as comical. Our analysis suggests that is an advantage to the attacker, not a disadvantage. Since his attack has a low density of victims the Nigerian scammer has an overriding need to reduce false positives. By sending an email that repels all but the most gullible, the scammer gets the most promising marks to self-select, and tilts the true to false positive ratio in his favor.”

This suggestion is even more significant today than in Herley’s time. If he’s right, it would suggest that the very things which make artificial intelligence a benefit to cyberattacks–error reduction, clean prose, general credibility–would work counter to the operational requirements of a Nigerian prince scammer. It would increase their reply rate, but not necessarily their rate of payment, creating more work to sort through without a commensurate return.

It’s worth mentioning that Herley’s logic–which, in direct contrast to Burrell’s methods, is based entirely in mathematics rather than lived experience–is controversial. It hasn’t really caught on in years since, and many just don’t buy it. Schaffer, for her part, leaves the matter open.

“[Deborah] Well, let’s face it, it’s a big enough umbrella to cover everybody. So I think some of these emailers are really seriously trying to hoodwink people. I would not be surprised if other of these emailers are following that strategy, trying to just see who’s gullible enough to respond because they’ll, in the end, be the bigger fish to catch.”

Only one thing is for sure: with just a little bit of help, I could finally solve the problem of Nigerian scams for everyone, and we can publish a book about it that’ll make ten times your investment in return. All you have to do is send me  $10,000.