Index -

Psychology of scams

A scam has two main stages: 1) a scammer provides false information and urges a potential victim to act upon it, and 2) the victim acts on the false information and transfers some benefits to the scammer. The third stage occurs when the victim realizes that he has been cheated, but the best scams are those that go undetected and try to avoid this stage in order to repeat the process. This page will examine the psychological reasons why we fall for these scams and the social engineering manipulations that cause us to divulge confidential information or perform actions that are detrimental to ourselves.

   

In 2010, the Internet Crime Complaint Center (IC3) received 314,587 complaints about cybercrimes that cost the victims more than $617 million dollars.[1]  The greatest number of complaints, 44,562 or 14.16 percent, were about FBI scams. The second largest number of complaints (8.9 percent) was about advance fee frauds which promise money to a victim if he pays an upfront fee; this type of scam is also called a 419 scam after the Nigerian penal code under which it is prosecuted. Other complaints included identification theft, credit card fraud, overpayment fraud, account hacking, and online sales where the merchandise purchased was not delivered. Many of these scams are perpetrated through unsolicited spam e-mails, but they can also be carried out by telemarketing.

Appeal to Fear
Fear can be used to manipulate attitudes. A scary message that includes a recommendation of how to take care of the problem can be crafted into a successful scam. These scams may use letterheads from genuine enforcement agencies to make the threats appear genuine.

Example:
You get a message from the FBI Anti-Terrorist and Monetary Crimes Division threatening to arrest you if you do not reply back. The message explains that your identity was used to perpetrate an online international scam, and you are wanted by the FBI. However, you can make the problem go away by sending money via Western Union to the overseas address specified in the message.

Example:
An e-mail from the Speed Enforcement Division notifies you that a traffic camera caught your car speeding fifteen days ago on the weekend. You can avoid a court summons and avoid accumulating points on your driving record if you pay the speeding ticket within 24 hours by sending the amount of the fine to the following P.O. Box.

Example:
The following note is an appeal to fear designed to make the recipient divulge the user ID and password of an e-mail account. For potential victims who might hesitate to provide the information, the note gives reassurance that it is safe to send the password because it will be encrypted.
The threat: "your email account will be terminated"
The solution: Send back your user name and password within the next 12 hours.

Verizon Inc. bowengary25@yahoo.com
to undisclosed recipients

Dear Verizon Subscriber,
=====================
Virus Notification (The following instruction should be followed within the next 12hrs)

A DGTFX Virus has been detected in your verizon.net folders. Your email account has to be upgraded to our new Secured DGTFX anti-virus 2011 version to prevent damages to our web mail log and to your important files. Click your reply tab, Fill the columns below and send back to us or your email account will be terminated to avoid spread of the virus.

Email:
User name:
Password:
Reconfirm Password:

Note that your password will be encrypted with 1024-bit RSA keys for your password safety.

All verizon.net User Should Reply Now !!!
Failure to do this will immediately render your Web-email address deactivated from our database.
Thank you for your co-operation.

Warning Code :ID67565434
Verizon Inc. Account Support.
Copyright ©2011

Appeal to Greed
Most people would be happy to find an investment that guarantees 11% dividends. Scams that appeal to greed exploit our desire to get reliable high returns on investments, to get something for nothing, or to make an exorbitant profit on a business deal even though the deal may be unscrupulous or illegal. Many advertisements use the word FREE in big letters to advertise a promotion, but then explain in small print the conditions of the "free" offer.

Example:
You get an e-mail or telephone call announcing that you have won a prize of several million dollars. When you respond, you find out that in order to collect your prize you have to pay a transfer fee or taxes. You can become a victim of the scam if you don't ask yourself how you could have won a lottery or prize when you never entered a contest, but greed is so powerful that this thought may not surface into your consciousness. Your losses may escalate as new fees are requested to finalize the receipt of your winnings, which, of course, you will never get. Prize scams are sometimes timed to coincide with promotions by legitimate sweepstakes such as the Publishers Clearing House Sweepstakes. This enables the scam artists to pose as company agents and benefit from all the TV publicity of the real contests.

Example:
Your inbox has an e-mail seeking a discreet and trustworthy partner to help the widow of a deposed African dictator transfer 60 million dollars from a secret foreign account to the U.S. This widow is willing to give you 30% of this money for helping her transfer the money to your account, but you have to be discreet to prevent the authorities from freezing the assets. When you agree to the deal, you will find out that you need to provide a transfer fee to get the process going. This type of scam originated in the Internet cafes of Nigeria, but some new variants come supposedly from the widow of Libyan Leader Colonel Muammar Gahdafi who fled to Algeria.

Appeal to Curiosity
Scams that exploit curiosity provide some tantalizing message that lures the victim into providing confidential information or performing an action that will eventually be harmful. These are some e-mails associated with this scam.

The purpose of these messages is to get the victim to click on a link in the e-mail or open the attached file. Several bad things can happen. Opening an attached file from a spam e-mail can deploy malware on your computer. Clicking on a link may take you to a web site that infects your computer with malware that can steal passwords and e-mail addresses, set up your computer as a spambot, or give fake computer virus warnings that request money to fix the problem. Clicking on a link may also take you to a phishing web site that looks like the web site for your bank, but when you type your logon ID and your password you are actually giving it to the crooks with the fake web site who will promptly empty your bank account.

To avoid this type of scam, NEVER click on a link in an e-mail. If the e-mail claims to be from your bank, go to the address bar of your browser and type the website address of the bank yourself or get it from your saved favorites. Also, never open an attached file in an e-mail without doing a virus scan on it. Even when the e-mail comes from a friend, their computer could have been compromised and a spambot could have sent the infectious attachment to all e-mail addresses on your friend's computer. Keep your antivirus software up to date.

Appeal to Love or Loneliness
This type of scam usually targets men who don't have a wide circle of friends, so when such a man gets a spam e-mail from a Russian woman looking for a meaningful relationship and only asks for a pen pal, the temptation to reply may be too great to resist. What usually happens, is that the beautiful Russian woman is not a woman, but just a scammer who builds up the confidence of the victim little by little and then starts asking for favors. The sting may be something like: "My mother got sick and I need some money for her operation; I don't know what to do." The man may feel that he is doing a good deed to help his girlfriend by sending money, but he has just become the victim of a scam.

Appeal to Piety
The e-mail in your inbox starts out "Beloved in God, my will to you $3,000,000". A Christian lady who is dying of cancer says that the Lord guided her to find your e-mail address in a guest-book that she was examining. She is sure that you are a God fearing person to whom she can entrust the fund that she has designated for several charitable purposes. As compensation for administering the fund according to her wishes, you will receive 30% of the total assets. This is a variation of the Nigerian 419 scam that targets religious believers who would like to help a dying woman fulfill her last wishes. The religious angle of this scam enables the scammer to manipulate the victim's actions by questioning the strength of the victim's faith in God when the victim begins to resist some aspect of the scam. The scammer can use quotations from the Bible that say how to serve the Lord and ensnare the victim further.

Appeal to Compassion
Sometimes a letter or an e-mail has a sad story and asks for any money that you can spare for a charitable purpose or to help a person overcome a serious problem. The only good thing about this scam is that it is straightforward and does not beat around the bush. The persons who send money may never find out if the money is really used for the charity or whether the person who has the problem really exists. The donors may never know that they have been the victims of a scam, but they may then receive follow-up messages thanking them for their support and saying how new problems have come up that require additional funds, or they may become the targets of donation requests for other causes. These scams become more popular after a hurricane, a flood or an earthquake when there is a lot of TV coverage about a disaster.

Many popular appeals for charity run television campaigns that show children with dirty faces, others show pets with matted hair and sad eyes. The advertisements say that the children are poor with no resources or that the pets were the victims of abuse and will be killed in some horrible gas chamber because they are unwanted. Could you please donate to feed and educate these children, or to try to put these pets in a home where they will be loved? Most people don't know that a private charitable foundation is required by law to pay out only 5% of its assets each year; the rest can be used for the operation of the foundation which may include high salaries and fancy cars for the administrators, and more TV ads. A person who donates $100 dollars to a charity would be surprised to discover that only $5 dollars reaches the intended beneficiaries. This may not be a scam, but it feels like one.

Appeal to Shame or Embarrassment
Some of the most pervasive spam e-mails are those for Viagra, Cialis or other male enhancement products. The premise of these offers is that the Internet provides a fairly anonymous way of obtaining a product that would be awkward or embarrassing to discuss with a doctor or pharmacist. One real problem is that any products bought in this way could be counterfeit look-alikes with ineffective or harmful ingredients. You don't know with whom you are dealing when replying to a spam e-mail, and there is no guarantee that you will receive any product if you send money. You basically could be just sending the money to the scammers.

Internet commerce has grown substantially during recent years. Shopping online is a convenient way of buying products from the comfort of your own home, but it is necessary to deal with reputable commercial web sites and not just a random e-mail that appears in your mailbox.

Taking advantage of Ignorance or Inexperience
A person who thinks that someone is trying to pull an old trick may say: "I was not born yesterday" and reject an offer that is too good to be true, but even very smart people have been duped by the Fake Cashier Check scam. The scam goes like this:

The Federal Deposit Insurance Corp. (FDIC) requires banks to make money from certified or cashier's checks available in one to five days, but this may not be long enough for the check to clear the issuing bank. The scam works because the victim's account is credited with the money and he can wire the remainder to the scammer, but in a couple of weeks, the bank tells the victim that the check is fake and removes the money from the victim's account. The scammer never comes to take possession of the property. The counterfeit checks can look very realistic on tamper-proof paper with proper routing numbers and account numbers, so the scam may not be discovered until it is verified by the issuing bank. Avoid getting into a transaction where you have to refund an overage, and always wait until the issuing bank has cleared the check before refunding any money or surrendering possession of what you are selling.

Fake Cashier check
Fake Cashier's Check

Sneaky Withdrawals
You are likely to suffer some financial losses when you provide account numbers or personal information to a scammer. Prepaid card services like the Green Dot MoneyPak are popular because they can be bought at thousands of pharmacies and convenience stores nationwide and the funds are instantly available without transaction fees after you buy the card. People use MoneyPak to pay for telecommunication services, credit card bills or to transfer money to PayPal accounts to buy merchandise on the Internet. MoneyPak works like a debit card without the need for a bank account. To pay for a service, you only need to logon to the merchant that you want to pay and provide the MoneyPak number, but if you give your MoneyPak number to a scammer, he can buy whatever he wants with your money, and your account will be empty when you try to use it. Too bad!

By this time, you know that you should not provide personal or financial information to someone you don't trust. However, some offers don't ask you for this information, they only request that you call to find out about the details of the prize that you have won or the great business deal that they offer. Beware! The area codes 284, 809 or 876 correspond to Jamaica, the Dominican Republic or the British Virgin Islands. These calls may cost you from $1.49 to $3.99 dollars per minute because they function like the American "premium rate" lines that use the 900 area code without the need of dialing 011 for international calls. Calls from the USA to Canada also look like regular long distance calls, but the rates are higher. The high rates are split between the phone companies and the people who operate the lines. The purpose of these scams is to keep you on the phone as long as possible to maximize the amount that you will pay. The operator may chit-chat or put you on hold for a long time. You will find the charges when you get your phone bill, and the phone company is not likely to cancel the charges because you dialed the foreign number willingly. Before calling an unfamiliar area code, make sure that it is not a foreign country code.

Bait and Switch
A bait and switch scam consists of presenting an expensive item at a bargain price. When a customer tries to buy it, he is told that the item is no longer available, but an equivalent item can be bought for a slightly higher price. A customer who has spent time and money getting to the store has a choice to make: accept the item at a higher price or return home empty handed. Sometimes, a lower quality item is wrapped up without any notification; the customer may not discover the switch until he comes home and opens the package. This happens more frequently when ordering merchandise from mail order catalogs and the shipper substitutes an item. The cost and hassle of mailing something back may be more expensive than accepting an unwanted item.

Bait and switch scams are successful when customers are not able to verify a claim that justifies a higher price, e.g., this ground beef is made from top sirloin and not chuck; this camera lens has internal components made of metal and not plastic; this light bulb will last 15 times longer than a regular bulb; this organic lettuce is more nutritious than regular lettuce. Who is going to check? How are they going to check?

Ponzi Scheme
Early in the 20th century, Charles Ponzi set up a fraudulent investment operation where he paid dividends to investors from their own funds or from money paid by subsequent investors, rather than from any actual profits from any investment. People were lured to invest in the scheme with promises of high return rates and reliable payments. The scheme collapsed in 1920 from lack of new investors, depletion of the investment capital, and withdrawal of funds by the promoter. The high notoriety of this crime established the name of "Ponzi scheme" for this type of fraud.

Infamous Scammers
Charles Ponzi
Charles Ponzi
  Bernard Madoff
Bernard Madoff

Bernard Madoff perpetrated the largest financial fraud in the history of the United States. Madoff was a stockbroker and investment advisor who started a Ponzi scheme in the early 1990s. Since Madoff was Jewish, many Jewish organizations wanted to invest in his funds, but he cheated all his investors equally. Madoff kept the scheme going by having a fund that consistently reported a gain of 11% every year for 15 years, but all the actual losses were hidden by co-conspirators who falsified financial records to deceive auditors. By the time that the scheme was discovered, Madoff had defrauded thousands of people and organizations of almost $65 billion dollars. Very little money was recovered. In 2009, at age 71, Madoff started serving a sentence of 150 years in prison.

List of suspicious transactions
If your transaction fits one of the descriptions below it could be a scam.

What is wrong with receiving a work-from-home offer? The prospective employer will ask for your name, address, picture ID, social security number, date of birth, and bank account numbers to send your paychecks and fill out tax forms. But if it is a scam, that information can be used to steal your identity and empty your bank account.

Medicare and Medicaid scams
Medicare and Medicaid are federal medical programs that serve millions of retired Americans and low-income individuals requiring medical assistance. In February 2012, Jacques Roy, a Texas doctor was charged with fraudulently billing Medicare and Medicaid $375 million dollars. The doctor sent recruiters to homeless shelters and paid $50 dollars to applicants that signed up as homebound patients requiring special care. The doctor then billed Medicare for unnecessary services. The scam was discovered after an audit found that Dr. Roy had certified more than 5000 patients in 2010 whereas the average for most physicians was only 104 such cases. You can help fight this type of scam by not signing any blank medical care forms and by reporting charges for services that you did not receive to the appropriate agencies.

-
References:
  1. National White Collar Crime Center (NW3C), Annual Report 2010.
  2. US-CERT, Recognizing and Avoiding Email Scams, 2008. pdf PDF
  3. The FBI,
    Common Fraud Schemes, [link]
    New E-Scams and Warnings [link]


© Copyright  - Antonio Zamora