In Depth

Getting Hinky About Nigerian Scams

Nigerian advance-fee fraud scams are alive and well. Ben Rothke looks at a series of emails for clues that should set off any recipient's sense of danger.

By Ben Rothke, CISSP

August 31, 2009 — CSO —

The first generation of computer viruses was relatively easy to identify and quarantine. Get infected, run your favorite scanner, the scanner quarantined the virus—end of story. This process worked fine until the virus writers became more sophisticated. In the early 1990's, the world of computer viruses changed radically when polymorphic viruses came on to the scene. While early viruses were easy to indentify by their static signature, polymorphic viruses mutate and rendered the first-generation of virus scanners useless.

Similarly, the first generation of Nigerian advance-fee fraud scams was relatively easy to identify. But the real challenge was getting people not to fall for those scams. As far back as 1997, the Bureau of International Narcotics and Law Enforcement Affairs of the United States Department of State wrote a 33-page document [PDF link] that detailed the Nigerian advance-fee fraud scheme and how to avoid being a victim.

Also see Mind Games: How Social Engineers Win Your Confidence

The classic advance fee-fraud was somewhat limited in its scalability given that there are only so many permutations of murdered/deposed mothers, fathers, uncles, brothers and brother-in-laws, from corrupt governments in Nigeria, Somalia, Senegal and surroundings, and that over time, people would eventually become suspicious.

In response to growing consumer awareness the scammers started to do what the polymorphic viruses did—they mutated. However, while the scams are morphing, the end result is the same; the scammers get their money, and the victim is out, with no recourse.

With the tactics changing, what can you do to protect yourself from these scams? Technology and spam filters generally can't identify these emails. Scammers often compose their emails to not get flagged, and are often written like a prospectus sent from a legitimate firm. The best thing you can do is get a feel for these scams. Use your common sense, and remember the adage that if something sounds too good to be true, it usually is. Finally and perhaps most importantly, develop your own sense of hinky.

What is hinky? In a fascinating article, BT Chief Security Technology Officer Bruce Schneier writes how terrorist Ahmed Ressam tried to enter the US from Canada with a suitcase bomb. Ressam was approached by U.S. Customs Agent Diana Dean, who asked him some routine questions and then decided he looked suspicious. Ressam was fidgeting, sweaty, jittery and avoided eye contact. In Dean's own words, he was acting hinky. Ressam's car was eventually searched, and he was finally discovered and detained.

Agent Dean did not use any fancy scanning technology; she used her experience and inner feelings to determine the hinky. And the rest is history.