By Yuriko Kako-Batt, Malware Analyst, Symantec Hosted Services
Dating scams are a common spam email problem. Spam relating to sex or dating currently accounts for approximately 4 percent of global spam. In a typical scam, a recipient (male or female) would receive an email from a stranger and the email might say something along the lines of: “I found your information on a website. I think you are my true love…write back to me soon”. If the recipient replies to the email, the scammer would begin to write to them with stories about their family, their background and how much they love the recipient; any number of subjects are discussed, and flattering/suggestive comments are made, until at some point the attacker feels that the potential victim has been socially engineered to the point that they trust the attacker.
Some typical dating scam emails
At that point, the victim is usually asked by the attacker to send money to them for a supposed flight to visit the victim, or money for an ill family member’s treatment. It’s all complete fabrication on behalf of the attacker, but much like a traditional 419-style advance fee fraud, it’s all about the attacker building up the victim’s trust and using that trust to get the victim’s money.
However, unlike a 419 scam, these are much more personal, and could end not only in financial loss, but in extreme cases a bad case of a broken heart. Will the recipient’s “true love” visit them or ever return the money “lent”? Never! The victim never meets anyone, and no money is ever returned. However, the attacker might continue asking for more and more money, as long as the unfortunate victim keeps paying. It’s a popular form of attack for scammers who rely on recipients who may be lonely and vulnerable to an attack disguised as an email that offers flattery and attention.
Dating scams, much like other forms of spam, vary greatly in their origin and style. Sometimes dating scams include a picture of “the sender”, and of course usually the picture shows someone young and attractive. Whether or not the scammers are of that standard is uncertain, or even of the same sex (!) but we seriously doubt it. They will be aiming to maximize the chances of a response and so include a nice picture.
It might sound ridiculous to many that someone can be cheated by such a suspicious email from a complete stranger, but it happens all over the world every day. It is possible to protect yourself from this type of scam by taking just a few moments to consider why the sender is emailing you. Does it seem too good to be true? Don’t reply to ‘suggestive’ emails from strangers, even if the person in the picture is your type! The actual sender of the email is quite the opposite of the pretty innocent-looking girl smiling in the picture. Of course, at the very least these emails are annoying and time-wasting for those who are aware that they are scam.
A major step to avoid dating scams altogether is to have decent anti-spam protection, meaning that you would never encounter the scam in the first place.
These scams don’t just begin in spam emails though. Recently, MessageLabs Intelligence was interested to see a detailed report of a fairly elaborate dating scam that began on the web.
I had an alert email about a dating scam from the Japanese Embassy in the UK last month. According to the email, the Japanese Embassies in the UK and Malaysia have received many complaints from Japanese dating scam victims, and interestingly on closer inspection the experiences of the victims were very similar, suggesting that they were probably victims of a single gang.
In this case most of the victims were females living in Japan (the news source is from Japanese Embassy, so it’s possible that females living in other regions have been affected by the same scam). In the case of these scams, the victims made initial contact with the scammers on dating websites. They claimed to be British men who were living in Malaysia.
Following the initial contact, over a period of time the victims built up a relationship with the attacker to the point of becoming engaged. This alone is quite surprising and for this to happen some serious social engineering would be needed, and the attacker would need a very well thought and consistent backstory, including false details about themselves, their family, their friends and a life history. The attacker would also need to be very careful to study all previous conversations to save contradicting something that they said to the victim earlier.
Once engaged, some of the victims embarked on a relationship lasting more than one year, without actually meeting their supposed partner.
During this time, the scammers made repeated requests for the victims to send money, on the basis of a great variety of different stories and reasons, including:
1. Money for an ill family member
2. Money towards a future marital home
3. Money to help with release from a supposed arrest by the Malaysian Police (the money was to hire a lawyer to prove the scammer’s innocence)
Number 1 is likely to be a very common approach in dating scams. Number 2 is probably less common as it depends on the scammer establishing a long-term relationship with the victim before the subject of marital home is broached. But how about number 3? I wouldn’t imagine this is particularly common, although it does have similarities to Number 1. It pulls on the victim’s heart strings and makes the victim feel sorry for the scammer.
But in this case, the scammer employed quite elaborate tactics to add legitimacy to their story. For number 3, the victim first received a phone call from their supposed British partner, who was joined on the call by people posing as the Malaysian police, and a lawyer. The information provided by the scammer and their two accomplices was convincing enough for the victims to believe the situation was real, and send the requested money. In most cases dating scammers would communicate with victims on a one-to-one basis; but this case is interesting as the scammer communicated with the victims as part of a team that were well rehearsed in their roles, and painted a convincing picture.
I don’t think this team-scamming is as common as one-to-one scamming, but it shows that scams come in a variety of flavors and show varying levels of sophistication. Being aware of one type of scam often offers no protection against another scam that is lurking just around the corner.
However having a good level of awareness is certainly a great help. In cases where first contact is made on a dating website, it may not be the case that the dating website itself is a scam. Most legitimate dating websites work hard to supply opportunities for people meeting and trying to start new relationships. There are hundreds of these sites globally and many people are lucky enough to find their true love on them. However, it is often difficult to police registrations on those sites, and scammers often register not with the intention of finding their perfect soul mate, but with the intention of finding their perfect victim.