Scambaiter: Understanding Targeted Nigerian Scams on Craigslist

Advance fee fraud scams, also known as Nigerian scams have evolved from simple untargeted email messages to more sophisticated scams targeted at users of classifieds, dating and other websites. Even though such scams are observed frequently, the community’s understanding of targeted Nigerian scam is limited since the scammers operate “underground”. In this paper, we focus on fake payment scams targeting users on Craigslist. To better understand this type of scam and associated scammers, we built an automated data collection system. The system relied on what we term magnetic honeypot advertisements. These are advertisements that are designed to attract scammers but repel legitimate users – similar to how a magnet attracts one side of a magnet but repels the other. Using advertisements of this type, we offered goods for sale on Craigslist, gathered scam emails and interacted with scammers. We use this measurement platform to gather three months of data and perform an in-depth analysis. Our analysis provides us with a better understanding of scammers’ action patterns, automation tools, scammers’ email account usage and distribution of scammers’ geolocation. From our analysis of this dataset, we find that around 10 groups of scammers were responsible for nearly half of the over 13,000 total scam attempts we received. These groups use shipping address and phone numbers in both Nigeria and the U.S. We also identify potential methods of deterring these targeted scams based on patterns in the scammer’s messages and usage of email accounts that might enable improved filter of their initial messages by content and email address.