Wiz's Computer and Website Security Blog

December 4, 2022

For the last few months I have seen and reported many comments that have been posted on the timelines of female Facebook members. These comments are usually in response to some sad event mentioned by those members in posts they make on their timelines. This event might be a death notice about a relative, friend, workmate, or even a pet. Or, somebody may have posted about being sad, or brokenhearted because of a breakup, or some form of loss. If the post was made by a female Facebook user, in addition to replies from their friends, they may also receive a comment similar to the following, which I copied from a friend's post about pets crossing the Rainbow Bridge.

"Glen VanHerck
Honestly, I love your posts and shares, you seem kind and worth talking to. I hope you don't mind if we are friends? I tried sending you a friend request but it won't let me. I would love you to send me a friend request for a friendly chat, if you don't mind.."

This wording and slight variations of it are from a template used by romance scammers that are often based in Nigeria. This come-on has been used over and over to lure unsuspecting women into replying to the scammers behind it. Anybody who becomes Facebook or Instagram friends with these people will be sweet talked out of a lot of money.

If you went to that person's page you would find photos of a distinguished looking US Air Force General who works at the US Northern Command. This entire profile is faked and uses photos downloaded from publicly available military news publications. The scammer, or multiple scammers running this Facebook page created the profile as a lure to rope lonely women into a romance scam where they will build trust with the victim, then begin asking for money for various reasons. I have a Facebook friend who has lost thousands of dollars to a similar scammer, who it turned out lives in Lagos, Nigeria.

If you are a female Facebook user and see a similarly worded comment under something you posted on your timeline, block that user and report the comment as Fraud or a Scam. Then delete that comment so your friends don't get curious and reply to the scammer.

Photos can be downloaded from the web and uploaded to a new Facebook profile. The details about the person being cloned are often publicly available. The scammers are professional confidence men. Once they get the confidence of a victim they will drain that person's bank account asking for payments by prepaid gift cards, MoneyGram, or Western Union, which are untraceable and unrecoverable once sent and claimed by the scammers.

You can learn more about Nigerian Romance Scams on this Wikipedia page. If you know somebody who may have fallen for a romance scam, point them to this Wikipedia article.

Posted by Wiz at 11:13 PM | Permalink

back to top ^

November 28, 2022

On Monday, November 28, 2022, I fetched my mail and one letter caught my attention. It was a plain white envelope addressed to me by my name. The sender was simply the words "IBT ELECTION." It had a prepaid postmark from Canada Post, which is strange because I am in the USA. The enclosed letter was obviously printed from a scan on a black and white copy machine. The message it contained is what is known in the spam and scam trade as a Nigerian 419 scam. I will outline the gist of the letter below.

The upper left contained a black and white copy of a TD logo, followed by Canada Trust. It was dated November 22, 2022 and addressed me as "Dear (my name redacted)." The first paragraph was worded much like a typical Nigerian 419 scam going back to the early 2000s. It started off with this: "I am aware that this letter has come to you as a surprise as we have not met before or handled any business deal in the past. Nevertheless, I have contacted you with genuine intentions and I hope I can trust you with this inheritance opportunity which I explain below."

The second paragraph reads as follows:
"My name is MR. MATHIAS EDISON, an account manager with TD Canada Trust Bank, Ontario, Canada. I retrieved your contact address in my search for the next of kin to a deceased customer of our bank MR. GEO (redacted), a citizen of your country, who lived and died in London from Cardiac Arrest in the year 2012. Unfortunately, this customer died intestate leaving his bank account with an open beneficiary status." snip minutia

It ends the paragraph with the hook:
"I would like to present you to our bank as his next of kin to claim this dormant account worth $9.2 Million USD (Nine Million Two Hundred Thousand US Dollars)." the rest of his story is octopus ink meant to further rope in the reader and get them to respond to the email address at the end of the letter where professional followup scammers go to work getting the victim to pay advance fees to cover imaginary fees and bribes in the hopes of splitting this huge amount of money with the scammers.

The signature at the bottom is:
Sincerely
Mr. Mathias Edison
chicken scratch signature.
Email: [email protected]

Inheritance and investment scams are favorites with the lads from Lagos. They've been scamming people in other countries for centuries going back to the French Revolution with the Spanish Prisoner letter scam, and in modern times with the Nigerian Prince scam. You can read up on the details and history of these Nigerian 419 advance fee fraud scams on this Wikipedia page. The number 419 refers to Nigerian Penal Code 419, which deals with financial and advance fee fraud..

In conclusion, there is no such dormant account. You are not the beneficiary. You are a mark which the Nigerians sometimes refer to as Mugus (fools). If you're reading this you probably got a similar letter, or perhaps a similar email. Don't fall for it. Keep tabs on your elderly friends and relatives and mention this to them so they don't get scammed..

Posted by Wiz at 1:23 AM | Permalink

back to top ^