Slashdot Mirror
Nigerian Email Scammers Are More Effective Than Ever (wired.com)
You would think that after decades of analyzing and fighting email spam, there'd be a fix by now for the internet's oldest hustle -- the Nigerian Prince scam. But the problem, a new report suggests, has only grown to become more widespread and sophisticated. From the report: There's generally more awareness that a West African noble demanding $1,000 in order to send you millions is a scam, but the underlying logic of these "pay a little, get a lot" schemes, also known as 419 fraud, still ensnares a ton of people. In fact, groups of fraudsters in Nigeria continue to make millions off of these classic cons. And they haven't just refined the techniques and expanded their targets -- they've gained minor celebrity status for doing it.
On Thursday, the security firm Crowdstrike published detailed findings on Nigerian confraternities, cultish gangs that engage in various criminal activities and have steadily evolved email fraud into a reliable cash cow. The groups, like the notorious Black Axe syndicate, have mastered the creation of compelling and credible-looking fraud emails. Crowdstrike notes that the groups aren't very regimented or technically sophisticated, but flexibility and camaraderie still allow them to develop powerful scams.
On Thursday, the security firm Crowdstrike published detailed findings on Nigerian confraternities, cultish gangs that engage in various criminal activities and have steadily evolved email fraud into a reliable cash cow. The groups, like the notorious Black Axe syndicate, have mastered the creation of compelling and credible-looking fraud emails. Crowdstrike notes that the groups aren't very regimented or technically sophisticated, but flexibility and camaraderie still allow them to develop powerful scams.
According to TFA, these guys are stepping up their game though. They use phishing techniques, get company servers infected with some commodity malware that lets them snoop around, then they can spear-phish using intraoffice email. If you have access to someone's inbox and a rough idea about the company's inner workings, it's not at all hard to impersonate that person convincingly. Perhaps enough to re-route some cash or get some account numbers changed. Or - especially in smaller companies - they simply intercept emails with payment details and change the data.
Scams like those might be prevented with proper security and procedures, but they are way outside the realm of simple idiocy.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...