DCO Survey: Focus on Fraud and Phoney

Observations:

In the course of the month, we made some observations regarding our "sample", some of them commonplace, others more unusual. We discovered that email addresses were only in use for a few days: this is a well-known fact, and confirms the impression that scammers know how to protect themselves from getting caught. Further, the same names, particularly in connection with lotteries, are used over and over again, but not so with the email addresses and domain names used to promote these "lotteries" – they change very frequently. The same aspect applies by and large to the Nigerian letters, though scammers operating in this field tend to be more creative in that the contents vary as well. We tried to find out whether it is possible to establish any connection whatsoever between, on the one hand, the use of names, and, on the other hand, the use of domain names and email addresses by tracking IP numbers.

Nigerian letters:

The name Sadaa Lintah popped up a couple of times in email addresses associated with the Nigerian letters. In this connection it would have been interesting to see whether the same group would use the same alias in different versions: however, it proved impossible to trace the IP numbers any further than the Danish ISPs.

Not so with a Nigerian letter featuring "lawyer" James Schambach: although a different email address – with a different domain name - was used in at least two instances, the same Israeli IP number came up. Same fraudster trying to make more people swallow the bait? As for country of origin, the recent sweep day not surprisingly revealed that little correlation exists between where the letter claims to be from and where it actually comes from. While most Nigerian letters obviously claim to be Nigerian or African at least, our results showed that many turned out to have their origin in the US or the Netherlands.

Lotteries:

Lotteries turned out to be the most diverse type of scams as touched upon above. And again the picture proved a little blurry: SmartBall Lottery, a seemingly British scam, is most likely everything but British: three out of six emails showed that it originated from the US – and from different ISPs.

Unfortunately, other notorious lottery scams such as Krasloten, El Gordo de la Primitiva, Dayzers etc. easily outwitted us. With the limited technical means available to us, it simply was not possible to derive anything meaningful from the header information.

Phishing:

Our little survey showed that phishing scammers using Ebay, PayPal, Washington Bank etc. as their cover are still very much in business, and continue to be a nuisance. However, we chose to look at some other phishing schemes.

Citizens Bank: One recipient was particularly annoyed with this scheme, forwarding 6 mails regarding this scam in February. We were unable to identify two of them whereas 2 had Korean IP numbers, one came from Portugal and another from the UK. All used the same email address. Again, it is tempting to see a connection, but should we look for one person/group using a host of IP numbers or rather several groups using the same email address?

Regions Bank: 13 recipients were exposed to phishing attempts under regions.com cover. Far from being able to identify the source of all the scams, some interesting results nevertheless emerged: the nine mails we did "crack" showed that the majority came from Korea, two came from the US and one came from Ghana, Malaysia and Russia, respectively. While confirming the heavy presence of Asian and US scammers in general, the variety of email addresses used also made room for a number of possible interpretations. The address customer@regions.com lead to Korean and US IP numbers whereas the address identdep_op5@regions.com lead to a Ghanaian server, to mention a few examples. Several groups in action or just one organised scam network?

Closing thoughts:

Our limited access to advanced technical equipment makes it hard, if not impossible, to draw any definitive conclusions. We wanted to make the Danish public alert to scam schemes, and that part of the survey succeeded – and succeeded well. Guessing at the nature of the scam methods in use here was tempting, but equally hard to substantiate. Our tentative experiment clearly consolidated the fact that most scammers operate on a global scale, and obviously often in very sophisticated ways. One thing is certain: the more savvy scammers are, the more consumers need to be informed about and educated in how to avoid getting swindled.