My Scammer Girlfriend: Baiting a Romance Fraudster

Nobody likes spam messages, but some of them contain rather fascinating scams. Case in point, [Ben Tasker] recently got a few romance scam emails that made him decide to take a poke at the scam behind these messages. This particular scam tries to draw in marks with an attached photo (pilfered from Facebook) and fake personal details. Naturally, contacting scammers is a bad idea, and you should never provide them with any personal information if you decide to have some ‘fun’.

The games begin once you contact them via the listed email address, as they’re all sent from hacked/spoofed email accounts. After this you have to wait for the scammers to return to the campaign on their monthly cycle, so give it a few weeks. Analyzing image metadata provides some clues (e.g. the FBMD prefix in IPTC tags set by Meta, as well as timezone info). The IP address from the email headers pointed to a VPN being used, so no easy solution here.

After establishing contact, the scammers try to coax the mark into ‘helping’ them move to their country, with Skype out-call numbers received on [Ben]’s burner phone that seem designed to add to the realism. Then ‘disaster’ strikes and the mark is asked to transfer a lot of money to help their new ‘love’. Naturally, [Ben] wasn’t a gullible mark, and set up a few traps, including a custom domain and website that’d log any visitor (i.e. the scammer).

The scammer happily clicked the link and thus the browser language (Russian) was determined while confirming the UTC+3 timezone from the image metadata. Even more devious was inflicting Cloudflare’s much-maligned Turnstile feature that is supposed to protect websites from bots and such. This did however mostly confirm what the more basic Javascript had sussed out previously. Pinning down the location of the scammers was proving to be rather hard.

The breakthrough came when following a similar scam email that came in, with the scammers having seemingly forgotten to turn on their VPN, as this time the email headers pointed to an IP address of a Russian ISP.

Ultimately this sleuthing mostly reveals the depressing truth about these scams, in that the scammers will readily make up sob stories and pilfer people’s images from social media, all to find a few susceptible marks within the probably thousands if not millions who get sent these scam mails. The crude sophistry displayed in [Ben]’s article when it comes to photoshopping visas, passports, etc. tends to be still enough to convince those who want to believe that their soulmate just messaged them out of the blue.

As much as we’d like there to be a technological solution to scams, this is one area where only careful human ‘programming’ can help, and thus why educating everyone on the hazards of the Internet is so essential.