(Guest post from Yaacov Apelbaum)
Nigerian scammer networks are a widespread phenomena in the US that affect thousands of victims with billions of dollars in losses. Surprisingly, the Nigerian and Ghanan scammer networks operate domestically in the US!
The Nigerian scammer networks are a major contributor to financial and violent crime in the US. Law enforcement is mostly ineffective in solving this problem and it requires legislative and intelligence agency solutions (like the creation of an international scammer database). These scams require payment industry and money transfer reforms. In addition, rampant immigration fraud is related to the Somali, Nigerians and Ghanas in the US.
Military Romantic Scams – The Theory and Practice
Since 2015 Military Romantic Scams have become a $1 billion industry in the US alone. The life cycle of this scam is well documented and understood, but little is known about their operations, networks, organizational structure, payment collection,and their relationship with their domestic financial institutions, law enforcement, and politicians. The public’s perception of cyber scammers is that of modern day pirates; an amorphous buccaneer entity shrouded in mystery that operates from somewhere overseas with what appears to be complete impunity from prosecution and justice.
Two victims of military romance scams (L-R) Kate Roberts and Esther Ortiz-Rodeghero.
The impact of military romantic scams on the victims who are typically older women living on a fixed income is devastating. Some end up going into debt to pay the scammers; others lose their entire life savings. To add insult to injury, many of the victims continue to be blackmailed long after they discover that they have been defrauded. This can happen even if they try to terminate their communications with the scammer. Due to the international nature of these scams and the social stigma they carry, most victims have no legal recourse nor chance of ever recovering their losses.
Military Romantic Scams 101
At its bare bones, the military romance scam has several variants, all of which revolve around re-purposing images of some serviceman or woman and using them to create a fake profile on a social media or a dating site, then reaching out to a victim and defrauding them. As can be seen from the image below, a single set of stolen images can become a source of dozens of fake identities and over 900 concurrently running scams.
(L-R) The 49 personalities of Richard Canon and 12 other stolen identities used in concurrent romantic scams.
Once the fake on-line profile is created, the scammer will then pursue certain victim demographics and concentrate their efforts on a previously proven cross-section of susceptible individuals—for example, a divorced or widowed woman over 50.
After the initial contact is established with a victim, the scammer will then engage in a trust-building campaign that can take weeks or months. As part of this process, the scammers will transmit to the victim a wide range of collateral that can include a fake military ID, service photographs, additional social network images, and even address and property information about their fake residence.
The emails, text messages, and step-by-step logic used in these exploits are all based on hundreds of previously tested and successful scams. This makes their decision trees robust and the playbooks plausible and effective. Also, because the operator doesn’t have to waste any time on trial and error approaches, improvisation, or real-time content creation, they can effectively run dozens of concurrent scams by just picking up some template-based material, such as handwritten love letters, and minimally customize them to the specific victim.
An example of template based collateral ready for customization
Any compromising information such as sexually explicit images, family, legal, or medical information the victim shares about themselves will be used subsequently by the scammer to continue to exercise leverage on the victim through blackmail.
The Scam Life-cycle
Regardless of what the specific instance details, all scams are formulaic and follow a predefined life-cycle. Every successful romantic scam has these five sequential phases:
1. Establish an online profile and make contact with a vulnerable victim
2. Develop a trust relationship with the victim, by exploiting some of their weakness, isolate them, and groom them
3. Learn as much as possible about the victim’s family, background, desires, and assets
4. Gain access to the victim’s money or resources
5. Use the victim as a money mole or contraband mover to support other scams
The Analysis
The ultimate goal of Apelbaum’s research wasn’t to locate specific individuals but rather to discover the patterns of life of the land in this mysterious Kingdom of Scam-Land. He had no interest in the individuals identified but thought that the information and analytics framework he used would be useful in educating the general public and Western LEA in trying to develop automated and effective real-time scam fighting strategies and programs. Apelbaum used the same artificial intelligence technology on another project titled the Mechanics of Deception which examined the sources of the Steele Dossier.
He started by training the Machine Learning engine to detect known scammer characteristics such as certain car makes, fashion brands, accessories, and hand signs. The training of the model included the extraction of known objects as well as seeding the engine with new insight matches that were confirmed to be related to some relevant search topics. So, for example, the results from a search of a person wearing a Gucci belt buckle yields new insight that these individuals also carried certain pattered style bags. So moving forward, new searches incorporated the patterned bags into the query criteria, etc.
A sample of graphic objects used to train the ML-based search engine used to identify fashion and other accessories with known scammer associations.
An example trend detection involving “distressed Jeans”
An example of a trend detection involving “visible toes” footwear.
Usage of Face Recognition to identify an individual in a large collection of images and reconstruct their social and professional network. Featured in the image is “Play Bowy” and his “KVNG DD” team.
Now that Apelbaum had his scammer catalog done, it was time to get scammed. His first step was to create a fictitious person named Olga Schmatova and use her as bait. He didn’t want to use stock photographs because of their easy tractability or utilize a real person for obvious reasons, so, he resorted to creating her images synthetically. Apelbaum generated several photograph versions of Olga that accounted for age and weight variation. He then created the background information that supported her cover, such as a resume, biography, diplomas, online shopping profiles, employment history, as well as several other artifacts that would ensure that even an in-depth background search would yield valid results.
AI generated images of Olga Schmatova
Next, he created several social media, email, and dating site profiles and waited for the search engines to index her content. As soon as Olga started showing up in general internet searches, he was ready to go.
One of Olga’s dating site profiles
Olga’s Dating Profile
My name is Olga. I am friendly, fun-loving, easy-going, and kind. My friends say that I bring a smile to the people around me. I consider myself to be balanced and a calm person at the same time I am very energetic, active and purposeful. I am full of positive energy and I project it to others.
I work as an emergency room nurse, I am family oriented and soft spoken, and at the same time I am a passionate and sensual woman, with oceans of love in my heart where we can swim together.
I like handmade art, visiting museums, cooking, and music is a big relief in my life.
Ideal Match Description
I want to find a man who is ready to accept my love and love me in return. I need stable and firm relations, I do not want to play with feelings or any drama. I would like to find a mature and wise man who is a doctor or a dentist who knows what he wants and can share with me some of his wisdom.
Apelbaum didn’t have to wait long, within a several days I got the following hit:
Subject: Hello My 110% Match
Message:
Wow was the first thing I said when I went through your pictures/ profile and I wonder why a woman like you is still single. Perhaps, all the men around you are blind (lol)…
We can hook up and hopefully, be wonderful soul mates… A little about myself. Hmmm, I am easy going and kind. When people meet me, they sense it before long. I am a military doctor with the US Army, I love epic movies cos I love adventure, stories from ancient history and anything related to real life. I love the great outdoors, hiking, swimming, and travel.
I love family a lot! My favorite saying is “never look back”. Well, the only thing lagging in my life now is that lovely woman that will follow me to my dream land. I believe ‘ONLY THOSE WHO SEEK, FIND’, and that is why I want to get to know you. I prefer direct email contact because of my deployment I don’t have access to this site at all times. Kindly email me on my gmail at the account at [email protected] or leave your email address. Sometimes, we are dumbfounded answering love related matters cos love is beyond human comprehension. I Hope to hear from u soon. Cheers!
Brandon
Brandon’s fake military ID with scraped Internet image of the Russian actor Oskar Ruchera.
Apelbaum’s romance lasted for about two weeks and included many steamy exchanges of emails, voice, and text messages. The skinny of it was that Brandon loved Olga and wanted to spend the rest of his life with her. They were going to get married in Indonesia and spend the honeymoon in Nusa Penida! All of this, of course, depended on him completing his “contract” combat deployment in Afghanistan in two years, where he served as a doctor.
Then came the con. Brandon said he could leave earlier and meet me in Indonesia, but he would have to pay the US Army an administration fee of about $20,000, which he didn’t have because all of his money was tied up in some high tech investment in Google. He promised that if Olga helped him with this payment, he would repay me the money with interest in no time. Olga then received an email from [email protected] who claimed to be one Colonel William Daniels of the US Army HR team requesting that I transfer these administrative fees to him via Western Union.
Olga didn’t have $20,000 on hand, so in order to keep the conversation going, she decided to give in to Brandon’s insistent requests for some intimate pictures of her. Following Ursula’s advice to the Little Mermaid that one should “…never underestimate the power of body language!” she sent Brandon several glamor shots of herself. She also added some ‘extra’ loving payload to the images to help take their relationship to the next level.
Apelbaum mapped Brandon’s network and devices and started monitoring his internet traffic and messaging activity. Interestingly, Brandon and his team were somewhat security conscious as they were using dedicated machines for scamming and separate computers for banking and business operations andlogistics. They were also careful to use burner phones for business communications and other phones for voice and internet browsing.
One surprising find was that the scammer operations used specialists. This makes sense because If one scammer had to carry out all of the work individually, it would take him years to develop the necessary cross-domain expertise. The substantial resource expenditurerequired to obtain the logistic and operational proficiency needed to support a massive scam campaign such as this would also be time consuming and intellectually prohibitive. In the scammer community, members specialize according to their interests and talents;this allows them to more rapidly reach higher levels of productivity. The person’s roles and responsibilities in the layered scammer enterprise depend on their ranking within the organizational structure. At the lowest level, there are the ‘factory workers’ who conduct their operations in teams of 5-15 individuals in internet cafes located in the suburbs and villages surrounding Lagos and Accra. Most don’t own their equipment and pay a fee for computing resources and internet access. At the next level are thehome-based operator ‘managers’ who own their equipment and manage several low-level teams. These managers are responsible for training, recruitment, mentoring, and operational support for the lower tiers.
The next level above them are the ‘supervisors’ who are responsible for maintaining proper ‘sales’ quotas, conversation rate, and logistics and the development of new scam products.
At the top of this pyramid are the kingpins who control several territories. They liaise the with senior command of law enforcement, military, media, and politicians and are consideredto be the pillars of the community. They engage in wide-scale philanthropic activity such as sponsoring public works and charity.
An interesting anomaly that the AI flagged as a wide scale trend was the frequent appearance of President Obama’s picture in many of the scammer workspace images. Seventeen outof forty workspace images exhibited this trend. It turns out that BHO is considered to be the patron saint of the scammer industry in Nigeria and Ghana and is viewed as the ultimate scamming success story that everyone is trying to emulate.
(L-R) Tier 3 scammers “KingKash” hard at work in the office and “Baron Osty” in a live session with a mark. Many scammers keep images of President Obama in their workspace and view him as the patron saint of the craft of the scam.
Based on the large volume of case data retrieved from the computers on Brandon’s network and the postmortem on these cases, it appears that many operators run hundreds of concurrent scams. In one example from January 2017- February 2018, a mid-level manager/supervisor named Asuaden Rich AKA “Goal Digger” operated over 105 simultaneous scams in the US alone with 40 of these scams paying over $630K USD. For these, “Goal Digger” assembled and used a library of over 300 stolen identities from Facebook and LinkedIn. Between June 2018 and August 2018, Goal Digger spent on average 7 hours a day working 7 days a week, splitting his time between boarding new victims and maintaining active accounts.
Since most victims are too embarrassed to report their ordeals, it is difficult to calculate the exact amount of money lost each year as a result of these scams. In 2013 the estimated figure was about $12.7 billion. Adjusting for a modest 10% growth per year could bring it to 20 billion dollars. So, this industry makes more than the GDP of counties like Albania, Jamaica, and Afghanistan.
Just like in any other form of illegally generated revenue, the vast amounts of money that is collected from these scams must be laundered before the money can be used. In the case of the Nigerian and Ghanan networks, most of the placement, layering, and integration activity associated with money laundering took place locally via cash purchases of luxury goods, investment in large commercial and residential real estate developments, and the purchase of drugs, arms, and human trafficking. Additionally, in at least several instances, the scams were also financing Jihadi operations in Africa and overseas.
Nana Kwadwo picking up the cash transferred via Western Union at the Ecobank branch near Medina Estate Gbagada Lagos. Camera field of view inside the teller does not capture the customer’s face. Cameras mounted on the branch ceiling only provide a rough view of customers.
Over a million dollars transported to Nigeria from Ghana via charted flight by a tier 1 scammer.
Summary of Findings
When Apelbaum started the search, he only expected to identify a handful of enterprising individuals that ran these types of scams from an Internet cafe or its basement. But he was taken aback by the sheer scale and sophistication of these operations and the amount of revenue they generate. It also became clear that these scams are not private operations that are run by some enterprising individuals but rather a national industry that involves banking, law enforcement, the media, some UN bodies (mostly local),politicians, and local and international corporations across multiple jurisdictions.
(There’s much much more on this. See the following link to Apelbaum’s post here.)
