Coder Legion - Recent posts tagged scam

The Nigerian Prince: A Brief History of the Internet's Most Famous Scam

Tue, 06 Oct 2026 14:52:59 +0000

Originally published on the fuck.it blog

Everyone has had the email. A prince, a general, a dying widow, a bank official with a dead client and no next of kin. Millions of dollars, trapped. You, a complete stranger, are the only person who can help. There will be a small fee.

It is the most mocked email in history. It has its own punchlines, its own Wikipedia article and its own genre of parody. It also has a proper name: advance-fee fraud, a con in which the victim pays something small to unlock something large that doesn't exist.

Here's where it came from, why the stories are so hard to believe, what it turned into and what to do if it already got you.

TL;DR

The con is centuries older than email. It circulated on paper as the
Spanish Prisoner letter.
"419" is a section of the Nigerian criminal code, the one covering
fraud. The name stuck in the 1980s, when economic collapse turned the
scam into an industry.
One proposed explanation for the absurd stories: a 2012 paper argued
that implausible emails can serve scammers well, by weeding out
everyone except the most promising respondents.
The country in the story tells you nothing about who actually sent
the message.
It never went away. A family of related scams grew up around it:
redirected invoices, romance scams and crypto platforms where your
balance only goes up.
Already paid? Stop, contact your bank or payment provider
immediately, keep everything and report it. Some payments can still
be recovered.

The Letter Before the Email

Long before anyone had an email address, there was the Spanish Prisoner.

The setup went like this. A letter arrives from a stranger. A wealthy man of high birth is imprisoned in Spain under a false name. His identity can't be revealed. If you help pay for his release, you'll be rewarded many times over from his hidden fortune. There's also, in many versions, a beautiful daughter.

Variants are documented back to the era of the French Revolution. The New York Times covered it in 1898 under the headline "An Old Swindle Revived" and it was already old news then. The paper described letters written the way educated foreigners speak English, with the occasional misspelling and an odd turn of phrase.

The ingredients were all there and haven't changed since: a fortune you can't verify, a stranger who needs you specifically, a reason for secrecy and a modest payment up front against an enormous payoff later.

Why Nigeria

In the 1970s Nigeria was flush with oil money. In the early 1980s the oil price collapsed and the economy went with it. What followed was mass unemployment among educated young people, a currency in freefall and a government widely described as spectacularly corrupt.

Out of that came the letters. Millions of them, physically mailed around the world, often using counterfeit postage. They arrived with official-looking documents, letterheads from the central bank and occasionally the United Nations. The story was usually the same: money from an overinvoiced government contract or a dead dictator's estate, stuck in an account and needing a foreign partner to move it.

The scam picked up its nickname from Section 419 of the Nigerian criminal code, the part covering obtaining property by false pretences. In Nigeria the practice became known as "yahoo yahoo."

Then came the fax machine, which was cheaper than postage. Then came email, which was cheaper than everything.

Email Changed the Arithmetic

Paper costs money. Every letter is a bet: stamp, envelope, printing. Send a million and you've spent a fortune before anyone replies.

Email took the cost of sending one more message down to almost nothing, which means a very low success rate can still be profitable. The expense moves elsewhere, into the hours spent on people who reply but never pay.

That's the real reason the 1990s and 2000s were flooded with princes. Not because the story got better, but because distribution became almost free.

One thing worth keeping straight: the country named in the story is no guide to who sent it. These messages are routed through compromised machines and services all over the world, and "Nigerian prince" long ago became a template anyone could download. Treat the flag in the letter as part of the costume.

The One That Actually Worked

For all the jokes, the amounts involved were sometimes staggering.

It began with a fax. Between 1995 and 1998, Nelson Sakaguchi, a director at Brazil's Banco Noroeste, sent around $190 million out of the bank's accounts, chasing a promised contract to build a new airport in Abuja. He believed he was greasing the wheels of a Nigerian government deal. Counting interest and costs, the case is usually cited at about $242.5 million.

Nobody noticed until an audit in early 1998, carried out while the bank was being prepared for sale to Santander. It remains one of the largest advance-fee frauds ever recorded.

So: a director at a national bank, over three years, for nine figures. The victims of this con were never only the naive.

Why the Stories Are So Implausible

Here's the part that sounds like a joke and isn't.

In 2012, Microsoft researcher Cormac Herley published a paper with the magnificent title "Why do Nigerian Scammers Say They are from Nigeria?" His argument is an economic model rather than a confession from any scammer: implausibility can work in the sender's favor.

Think of it from the scammer's side. Sending email is nearly free, but replying isn't. Every conversation takes hours of work and most go nowhere. The expensive part of the business is time spent on people who were never going to pay.

On that model, the opening email functions as a filter. It would need to repel everyone who would eventually back out and keep only the people who might go all the way. A story about a Nigerian prince and twenty million dollars would do that job well: anyone who finds it ridiculous never replies, and the few who don't find it ridiculous have identified themselves as promising prospects.

It's a theory about incentives, not a proven account of how any particular scam was written. But it's the most convincing explanation anyone has offered for why the most mocked emails on earth never got better.

The People Who Fought Back by Wasting Their Time

In 2003, a British man named Michael Berry launched 419eater.com, and a sport was born: scambaiting.

The idea was to answer the emails and keep the sender busy as long as humanly possible. Baiters invented elaborate characters, fake charities and absurd conditions. The site's famous "trophy room" collected photographs that baiters had persuaded scammers to take as proof of good faith, often holding ridiculous signs. One celebrated bait, later featured on This American Life, ran for about 100 days and involved persuading a scammer to travel across Africa for money that did not exist.

It's funny. It was also always a bit uncomfortable. Plenty of baiting slid into humiliation of poor people in West Africa by comfortable people in Europe and North America. Sending someone into a conflict zone for a laugh is also hard to defend, whatever they did for a living.

In 2005, the Ig Nobel Prize for Literature went to the internet entrepreneurs of Nigeria, for enriching world literature with short stories full of rich characters, dramatic plots and money that never arrives.

What It Turned Into

The prince still circulates, but the money has mostly moved to quieter formats. These aren't all the same con. They're relatives, built on the same raw material: a trusted-looking story, time pressure and a payment that's hard to claw back.

Business email compromise. No prince. An invoice from a supplier you
actually use, with changed bank details, arriving when you expected
it. The goal isn't to promise you a fortune, it's to redirect a
payment you were already going to make. It's one of the costliest
forms of email fraud there is.
Romance scams. Months of real conversation, then a crisis. Sometimes
there's a promised payoff, often there's just an emergency and
someone you believe you know.
Investment and crypto scams. Closest to the original. The fortune
sits in an account you can watch grow and withdrawing it requires a
fee. Then a tax. Then another fee.
Recovery scams. The cruelest branch. Someone contacts a victim
offering to recover the money they lost, for a fee paid up front.
Lists of people who have already paid once are valuable precisely
because they've already paid once.

How to Spot the Shape

The stories change. Several signals don't.

An unexpected windfall from someone you didn't know, for reasons you
can't independently check.
A payment to a stranger to release it. Legitimate inheritances really
can involve taxes and legal costs, but those are handled by an
executor or an institution whose identity you verified yourself. A
prize or a lottery win is different: being asked to pay anything to
claim one is a scam, every time.
Secrecy. Don't tell the bank. Don't tell your family. Every version
of this works by keeping you away from anyone who would say "that's a
scam."
Payment methods that are hard to reverse. Wire transfers, gift cards,
crypto. That's not a coincidence.
Urgency. A deadline exists so you don't have time to check anything.
Changed bank details. Any invoice with new account numbers gets a
phone call first, to a number you already had, never the one in the
email.

If You've Already Paid

This matters more than any of the history above and speed matters.

Stop paying. There is never a final fee. The next request will have a
new and excellent reason.
Contact your bank or payment provider immediately, whatever you paid
with. Some payments can be stopped, recalled or disputed and the odds
fall with time.
Keep everything. Emails, headers, account numbers, chat logs,
receipts. Don't delete the correspondence out of embarrassment.
Report it to your national fraud or consumer protection body and to
the police. Reports are how patterns get traced, even when individual
money doesn't come back.
Expect a second approach. Someone may offer to recover your money for
a fee. That's the same con, wearing a rescue uniform.

And for what it's worth: people who fall for this are not stupid. A bank director lost nine figures to it. The con is old because it works on normal human reasoning under time pressure.

Why It Keeps Going

Email filtering has become very good and the crude versions mostly die before you see them. That didn't end the con, because the con was never really about email.

It's about a person believing a story. The Spanish Prisoner worked by post, by telegram, by fax and by email, and it works now over messaging apps and dating sites. Every time a new channel opens, the same letter walks through the door in new clothes.

The same offer, for centuries. There is a fortune. It is nearly yours. It needs just one small payment first.

Where [@fuck.it] Lands

Our filtering kills the obvious material before it reaches you, along with phishing, fake invoices and the rest of the daily sewage. That reduces your exposure. It doesn't reduce it to zero and anyone promising otherwise is selling something.

The hard version has no links, no attachments and no malware. It's a plain message from a real address, properly authenticated, asking a reasonable question. Modern filters look at more than malware: impersonation patterns, unusual correspondents, display names that don't match their addresses. Those signals catch a lot. They don't catch everything and passing SPF, DKIM and DMARC only proves a message came from the domain it claims, not that the request inside it is honest.

So when money and urgency show up in the same message, slow down and verify through a channel you chose yourself.

Disclosure: We run fuck.it, an email service, so we see a lot of this in the filters. Make of that what you will.

Hackers and scammers target blockchain developers and founders. How to protect yourself?

Mon, 24 Mar 2025 21:14:03 +0000

The new scam is gaining momentum in March 2025, and blockchain developers and project founders are especially at risk. With social engineering tactics becoming increasingly sophisticated, it's important to stay ahead of potential threats. This article outlines some of the most advanced and deceptive scams, particularly those targeting job seekers in Web3, and provides actionable steps to protect yourself.

1. Job Offer Scams and Fake Recruiters

Scammers impersonate recruiters or employees of well-known Web3 companies. They approach blockchain developers on LinkedIn or Telegram with flattering messages and high-paying job offers.
The victim is invited to an "interview," but the scammers claim they use a "secure, in-house video conferencing tool" instead of Zoom or Google Meet.
Once the victim installs the software and joins the interview, their system is compromised, leading to the theft of wallet funds. The attack works by detecting and sweeping funds from hot wallets like MetaMask or Phantom.

How to Protect Yourself:

Never install software from an unknown source, even if it appears to come from a reputable company.

Verify recruiters by checking mutual connections, their work history, and whether they have genuine endorsements.

Use a separate, clean device for work-related communications, especially if you're dealing with crypto assets.

Keep your development machine air-gapped from any wallets holding significant funds.

2. Fake GitHub Repositories and UI Scams

A scammer contacts you with a request to audit or test a GitHub repository. They send a Bitbucket or GitHub link, claiming it's a work-related test or a proof of concept. Sounds legit, and many will not notice anything suspicious. And that would be a fatal mistake.
The repository contains malicious code designed to extract private keys, inject malware, or execute wallet-draining scripts.
The victim runs the provided script or opens a compromised user interface (UI) that requests private key access.

How to Protect Yourself:

Always inspect repositories thoroughly before running any code, especially scripts requiring execution privileges.

Use a sandboxed virtual machine or an isolated environment (e.g., Tails OS) when testing unverified code.

Check commit history and contributors — if a repo has no meaningful history or appears AI-generated, it's a red flag.

Never enter your private key or seed phrase into any website or application outside of a trusted wallet provider.

3. Overpaid Job Offers with Unrealistic Salaries

Scammers offer extremely high salaries (e.g., $150+ per hour or $250K+ yearly) for simple blockchain-related work. Bu there is a “small nuance”. They ask for personal information, including GitHub, CV, and even direct access to test repositories.
Eventually, they request that you install their software, test a smart contract, or deploy a script — one that compromises your system.

How to Protect Yourself:
Be skeptical of job offers with excessive salaries that seem too good to be true.

Validate companies by researching them on official sites, checking real employees, and cross-referencing with known Web3 security experts.

Avoid sending personal data or connecting wallets to unknown platforms before verifying legitimacy.

4. Fake Zoom, Google Meet, and Chat Applications

Scammers claim that for "security reasons," they use a proprietary meeting tool instead of known platforms. They send a link that looks like Zoom, Google Meet, or Telegram but is actually a phishing site.
When opened, the malicious site installs a script that either extracts browser-stored private keys or deploys clipboard hijackers.

How to Protect Yourself:

Always check URLs carefully — phishing domains often contain small typos or extra characters.

Use browser security extensions that detect fake domains.

Run crypto-related communications in a separate, hardened browser profile (e.g., Brave with strict security settings).

Never download standalone meeting software unless it’s from a verified, official source.

Attackers build "legit-looking" LinkedIn profiles with fake endorsements and AI-generated backgrounds. They engage in friendly, long-term social engineering before making their move.
If a victim refuses one scam, they may attempt a different angle — fake token sales, job offers, or investment opportunities.

How to Protect Yourself:

Cross-check profiles using multiple sources. If someone’s work history lacks depth, it's likely fake.

Be cautious of unsolicited offers and overly eager recruiters.

Never let social pressure rush you into downloading files or clicking on unknown links.

Final Thoughts: Stay Vigilant, Stay Secure

As blockchain developers and founders, you're a prime target for scammers due to the nature of your work and access to valuable assets. Implementing strict security measures — such as hardware wallets, separate work environments, and in-depth verification processes — will drastically reduce your risk of falling victim to these scams.

Key Takeaways:
Always verify recruiters and job offers before engaging.
Use sandboxed environments for testing third-party code.
Never install unknown meeting software or click suspicious links.
Keep personal and professional crypto wallets separate.
Treat unsolicited, high-paying offers with extreme skepticism.

If you come across new scams or need further insights, share your experiences — awareness is our best defense.

Coder Legion - Recent posts tagged scam

The Nigerian Prince: A Brief History of the Internet's Most Famous Scam

TL;DR

The Letter Before the Email

Why Nigeria

Email Changed the Arithmetic

The One That Actually Worked

Why the Stories Are So Implausible

The People Who Fought Back by Wasting Their Time

What It Turned Into

How to Spot the Shape

If You've Already Paid

Why It Keeps Going

Where [@fuck.it] Lands

Hackers and scammers target blockchain developers and founders. How to protect yourself?

1. Job Offer Scams and Fake Recruiters

2. Fake GitHub Repositories and UI Scams

3. Overpaid Job Offers with Unrealistic Salaries

4. Fake Zoom, Google Meet, and Chat Applications

5. Social Engineering and Psychological Manipulation

Final Thoughts: Stay Vigilant, Stay Secure