Scamming the Scammer: A Fun Way to Respond to a 419 Scam
by The Piano Guy
I had an experience today that may be instructive on how to deal with scammers.
Someone tried to make me the victim of a Nigeria 419 scam. I didn't fall for it, and instead got to scam the scammer. As a student in IT security and information assurance, this felt good to do.
As you would expect, all names have been changed to protect the privacy of everyone involved. My friend's name isn't Matt, my folks weren't prescient enough to name me Piano Guy, and the scammer wasn't named "[Scammer Replaced Name]." Prosecutions are underway through Homeland Security (no joke), so privacy is required.
A few days ago, I was asked by a friend to re-friend him on Facebook. I figured that he had a problem with his account, so I did. The next day, I saw a post from him wondering why he had been getting questions from people about him re-requesting to be Facebook friends. Now, I like this guy, but it isn't like we talk every day, so I didn't make the connection. In reality, I should have questioned the re-friend request.
The lesson I learned from this is that if someone you think you are friends with on Facebook re-requests your friendship, look them up and see if you're currently in their friends list. If you are, that second request is from someone else who has cloned their account.
Today, while sitting home looking for more computer clients, I got a chat from the scammer:
At this point, I knew for sure someone was trying to scam me.
This friend in no way, shape, or form would be in a position to do this. I looked up his number so I could call him and confirm he was home.
I reached the friend on the phone. He told me about having had his profile stolen on Facebook, and that they could do nothing about it. He was fuming.
I decided to see if I could roll with it, and eventually turn it around on the scammer. Now, this is a dangerous game I chose to play, because the scammer could decide to target me and my friends next, but I use real passwords so I feel somewhat safer than maybe is justified.
No one is getting from Nigeria to the U.S. for $600, let alone sorting out hotel bills as well.
Further, my friend is a grammatical purist, and I would never see an 'i' from him in any correspondence. I'm still playing along...
I wanted to see if I could get his contact information.
I'm stalling for time and trying to get more information.
My friend calls back, and tells me that if I look at the profile I will see that it is really https://www.facebook.com/Scammer.ReplacedName.5, which has nothing at all to do with my friend's name.
I realized that I could see this myself if I clicked on the link on his name that was in the chat window, so I checked and, sure enough, that was the URL.
I should have waited here for him to give me the information, but I jumped the gun a bit.
I had the information I wanted, so it was time to lower the boom.
No response for four minutes... it was a long four minutes for both of us.
That was an understatement.
Now that he had the nerve to come back, it was time to scam the scammer.
It is okay to lie to a liar...
Shortly after that, I went to put in a fraud complaint (which can be done with the gear in the chat message). I couldn't. He had already deleted the page.
Problem solved. But, we're not done yet.
I decided to look up that name. [Scammer Replaced Name] isn't exactly John Smith. It turns out that there is a person from Jackson, Mississippi that has that name, and no one else in Facebook or Google does.
This led me to call the detective bureau there, which led me to the Attorney General's office. They have directed me to the Department of Homeland Security (DHS), who is processing this. I do understand that this person could either be a perpetrator or a victim of identity theft but, either way, the matter should be investigated. All they have to do is look at this person's computer logs, and we may have taken a scammer out of the Internet pool (if they are the scammer), or may lead to logs that will help DHS find the real scammer.
Lessons to Learn
- Don't re-friend someone on social media sites that you are already friends with unless you check it out carefully.
- It is okay to get information from the scammer to try to figure out what is going on, but do not give them more information about you, no matter what. And, if your own systems aren't secure, expect to be attacked back by someone like this, so don't play in that arena.
- Realize that there are people out in the world like me who will see this as an extra credit school project or others who will see you as a person to target back. Knowing how to hack, understanding how things work, and the like is very cool.
Using these skills for bad purposes can get you hurt and can land DHS on your doorstep.
Just as Spidey's uncle said, "With great power comes great responsibility."
Play safe and legal out there.