How to Troll a Nigerian Prince

Have you ever received an email from a Nigerian prince? Why not answer for a change and see how things unfold.

Inside an Advance Payment Scam

Boy, am I lucky. Steven Richards, a regional director for the UBS bank just informed me that I am entitled to over 16 million pounds. Steven sent me the information in German from a Hotmail account, as he explained that he was doing this without the knowledge of his employer. It turns out that I am the last of kin of a UBS customer who recently died with his entire family. At first, I was devastated. Losing relatives is always hard and I didn’t even know them. After a brief phase of grief, I decided to claim my inheritance and answer to Steven. Of course, we all know that none of what is stated before is true. It is part of an advance payment scam. I decided to play along and see how far I can get in this scam.

I knew at some point I would have to present identification, so I googled pictures of German IDs until I found a picture that might do the job. Around this ID, I created a fake persona: Thomas, a 65 year old retiree that speaks very bad English. I created a new Protonmail account bearing his name and replied to Steven in German. Not even an hour later did I receive the answer, even though he obviously never sent an email to this account. This time the email was in English. As my alter ego Thomas didn’t understand much of what was written, he decided to call Steven (Steven provided a phone number in the initial email). The phone number was a virtual phone number registered in the UK. This was start of many interesting conversations between my fake persona and the scammer known as Steven. For starters, Steven didn’t sound British at all. He had a thick central or western African accent. I gave Thomas a thick German accent and Steven took the bait. Steven explained that I would need to send a letter to UBS making my claim to the 16 million pounds. While we were still on the phone, Steven sent me a pre-drafted letter that I only needed to sign and send to an UBS email-address he provided as well. I found a signature from the person I modeled my fake persona after on Google, “signed” the letter and sent it. Needless to say, the email address wasn’t really one belonging to UBS.

1

Afterwards, I called Steven again just to make sure I was doing things right. He told me that I should forward him all emails coming from the bank, so he could process them and give me further instructions. Immediately after our conversation, I received a reply from UBS. Almost, as if Steven had sent it himself 😉

2.png

I forwarded this document to Steven and he said he would take care of the first three things on the list, while I was to provide him with my banking details and a copy of my ID. I was also asked to pay about 60,000 pounds to Steven and his lawyer, so they could prepare the death certificate, will and affidavit that I obviously didn’t have. I sent him bank account details for an account that is used in another scam (fake invoices) and a copy of the ID I had based my fake persona on.

3.pngBy the way: Google could have warned Steven that something wasn’t right with Thomas…

In the next phone call, I told Steven that the money I had wasn’t on my account since it was dirty money. I had obtained it through tax fraud. Clearly, Steven wasn’t amused about this and we had several phone calls and emails regarding the topic.

4

Eventually, he accepted this money and I told him I could go to the bank and try to transfer the money. For this, he requested a payment receipt as proof that I had sent the money. Steven called multiple times to make sure I was going to the bank. As with the ID card I googled and all the other fake documents I sent Steven, I quickly made a fake payment receipt without putting too much effort into it. To be honest, I was surprised that Steven was still taking me serious after all the obviously fake information I sent him. He didn’t seem to be the smartest person.

5.png

Upon sending the fake payment receipt, I called and told him that I could only transfer 10,000 Euros a day and that I would have to go back the next to transfer another batch. Steven seemed very satisfied and called back the following day, asking if I had already made it to the bank again. Again, he showed no signs of suspicion and was eager to receive the money.

Payback Time

So far, I played along and made the scammer think he was receiving money. During this, I unraveled additional email addresses, the bank account he used and received copies of the documents he created for this scam. Steven was happy as can be, assuming lots of money would soon end up on his bank account. It was time to give Steven a little something to think about.

While my alter ego, Thomas, was supposedly on the way to the bank to transfer the next batch of money, I used Emkei’s Fake Mailer to send Steven a fake email from Interpol.

6

One hour later, I called Steven again. This time posing as a special agent working for Interpol. I told him that Thomas was arrested upon trying to transfer money to a bank account that was linked to African terror groups such as Boko Harram. I could clearly hear the fear in his voice and he demanded to speak to Thomas.

In the next phone call, I switched between fake personas (special agent John and Thomas) and made Steven believe that Thomas had been arrested while visiting the bank a second time. To make things more believable, I used various different background sounds (thanks to Youtube) during all these conversations. Thomas was also crying on the phone when speaking to Steven. All of this really freaked Steven out and he denied having anything to do with this. Eventually he stopped answering phone calls, but he did still answer to emails sent to him. I was having so much fun, I pushed it a little bit to far. However, I finally got to use a phrase I’ve been waiting to use for a long time.

7

Aftermath

After a while, Steven wouldn’t reply to emails any more. Two days later, I wanted to log on to the Protonmail account I used in the case to go through the mails again before writing this blog article. It turns out my account had been suspended for apperently being part of an advance-fee scam. According to the Protonmail team, someone reported my account and provided them with messages as evidence (since Protonmail can’t see the content of emails).

8

To be honest, I find this hard to believe. The person that was so stupid and was fooled with cheap photoshopped images, an outrageous story and multiple fake personas (that all sounded alike), then reported my account to Protonmail and provided evidence? To me, it looks like something else triggered this…are we really sure Protonmail can’t read the content?

In any case, I sure did have fun trolling a scammer and while doing so, I did many others a great favor. Spending time interacting with me left less time for Steven to interact with people that might have actually fallen for this scam. And, it sure is a nice story to tell!

Matthias Wilson / 26.01.2020

5 thoughts on “How to Troll a Nigerian Prince

  1. Congratulations on the article.
    I’ve been trying to do some research on virtual phones in Britain. Is there a website to look at?

    Like

  2. Love this – and will have to try some of these next time I troll an advance fee scammer. It is great fun – but does take time, and wastes their time too. From an intelligence perspective it’s also a good exercise in using human intelligence and more – to find the data to scam the scammers.

    I’ve had two length interactions with these scammers. The first one involved me setting up a fake phone number that the scammer could call. I was an elderly man but my son in law had a business trip to South Africa with a few days off afterwards. He wanted to visit Ghana and would be bringing the money with him. Could my scammer meet him and host him and show him around…. Of course the answer was yes. I sent the “flight details” – for Jo’burg to Accra and also an 5* Accra hotel he was staying at.

    About an hour after the plane was supposed to have landed – deliberately chose to be around 2.00am – I got a message. (Actually next morning). “Where is he – I’ve been waiting for hours and he is not here”. I replied back that my son-in-law was really annoyed as I told him somebody would be meeting him but the person in the photo I’d given (which had been sent to me by my scammer showing an obviously affluent African American model – easily identified as fake using reverse image searching on Google) wasn’t at the airport and so my son-in-law had to get a taxi at 4.00am which had cheated him on the way to the hotel. So scammer goes to hotel to apologise and get the money. I then get a message asking if he’d booked in his company name as nobody of that surname was in the hotel….. i said he may have misspelled it. Then get a desperate phone call that the hotel is threatening to call the police as he’s refusing to leave and insisting that the person IS a guest…. So more stories – that it is the wrong hotel…. before scammer gives up.

    The second one was more disturbing as it shows how the police really don’t care. I made the excuse that I could only do bank-to-bank transfer and so he gave me bank details. He claimed to be based in the USA and was a pastor at a church there. I asked him the church – and he gave a name of a Nigerian church in the USA. The bank details were for people in the USA. I traced one – via Facebook. An old lady but the phone I found for her was never answered. So I reported it to her bank – for money laundering. Never heard from the bank again. I did send “proof of payments” however showing I’d made the transfer. Eventually he suggested another way. To purchase an Apple Laptop and courier it to an address in Bristol, UK. I invented a friend who worked near there who would take it. And arranged a pick-up time. I also showed proof that I’d made the purchase and a photo of the box with the laptop in it. (Thank you google). I phoned to say my friend was on the way. And then “where are you” – he’s been waiting for ages and you weren’t in so he’s left and come back. This went on for a while and I reported the address to the police who were not interested as no crime had yet been done! (And probably too small).

    Meanwhile I had problems…. I’d broken my leg in a car accident…. that got gangrenous. Then my widow wrote to him asking what the issue was and what she needed to do. I think he realised around then that I’d been scamming him for 6 months.

    Like

  3. That’s the problem with services like Protonmail.
    Seems like your private.key resides on their servers also.
    I don’t trust them that much.
    But I do not trust different services like tutanota or others.
    Though world! 😀

    Like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s