Advance-fee scam
An advance-fee scam is a form of fraud and is a common scam. The scam works by promising the victim a large sum of money in return for a small upfront payment, which the fraudster claims will be used to obtain the large sum. If a victim makes the payment, the fraudster either invents a series of further fees for the victim to pay or simply disappears.
Overview
An advance-fee scam is a form of fraud and is a common scam. The scam works by promising the victim a large sum of money in return for a small upfront payment, which the fraudster claims will be used to obtain the large sum. If a victim makes the payment, the fraudster either invents a series of further fees for the victim to pay or simply disappears. The Federal Bureau of Investigation (FBI) states that "An advance fee scheme occurs when the victim pays money to someone in anticipation of receiving something of greater value – such as a loan, contract, investment, or gift – and then receives little or nothing in return." There are many variations of this type of scam, including the Nigerian prince scam, also known as a 419 scam. The number "419" refers to the section of the Nigerian Criminal Code dealing with fraud. It is popularly known as "yahoo yahoo" in Nigeria. The scam has been used with fax and traditional mail and is now prevalent in online communications such as emails. Other variations include the Spanish Prisoner scam and the black money scam. Although Nigeria is most often the nation referred to in these scams, they mainly originate in other nations. Other nations known to have a high incidence of advance-fee fraud include Ivory Coast, Togo, South Africa, the Netherlands, Spain, and Jamaica.
History
The modern scam is similar to the Spanish Prisoner scam that dates back to the late 18th century. In that con, businessmen were contacted by an individual allegedly trying to smuggle someone who is connected to a wealthy family out of a prison in Spain. The scammer promised to share money with the victim in exchange for a small amount of money to bribe prison guards. One variant of the scam may date back to the 18th or 19th century, as a very similar letter, entitled "The Letter from Jerusalem". This is illustrated in the memoirs of Eugène François Vidocq, a former French criminal and private investigator. Another variant of the scam, dating back to ca. 1830, appears very similar to emails today: "Sir, you will doubtlessly be astonished to be receiving a letter from a person unknown to you, who is about to ask a favour from you..." and goes on to talk of a casket containing 16,000 francs in gold and the diamonds of a late marchioness. The modern-day transnational scam can be traced back to Germany in 1922 and became popular during the 1980s. There are many variants of the template letter. One of these, sent via postal mail, was addressed to a woman's husband to inquire about his health. It then asked what to do with profits from a $24.6 million investment and ended with a telephone number. Other official-looking letters were sent from a writer who said he was a director of the state-owned Nigerian National Petroleum Corporation. He said he wanted to transfer $20 million to the recipient's bank account—money that was budgeted but was never spent. In exchange for transferring the funds out of Nigeria, the recipient would keep 30% of the total. To get the process started, the scammer asked for a few sheets of the company's letterhead, bank account numbers, and other personal information. Yet other variants have involved mention of a Nigerian prince or other member of a royal family seeking to transfer large sums of money out of the country—thus, these scams are sometimes called "Nigerian Prince emails". The spread of e-mail and email harvesting software significantly lowered the cost of sending scam letters by using the Internet in lieu of international post. Although Nigeria is most often the nation referred to in these scams, they may originate in other nations as well. For example, in 2007, the head of the Economic and Financial Crimes Commission stated that scam emails more frequently originated in African countries or in Eastern Europe. Within the European Union, there is a high incidence of advance-fee fraud in the Netherlands and Spain. The emails sent invariably feature a large number of implausible claims, as well as numerous spelling and grammatical mistakes. According to Cormac Herley, a Microsoft researcher, "By sending an email that repels all but the most gullible, the scammer gets the most promising marks to self-select." Responding to Herley, a director at Nigeria's National Security Adviser said that there are more non-Nigerian scammers claiming to be Nigerian, and suggested that Nigeria's reputation for corruption is part of the allure that makes scams seem more plausible. Nigeria has a reputation for being at the center of email scamming. Modern variations include “sugar daddy/sugar momma” schemes, some of which involve advance-fee scamming, and money flipping, whereby the mark is promised a large amount of money in exchange for sending a small amount of money. A 2018 study of Nigerian hip-hop culture found that glamorization of cyber-fraud is prevalent in such music. Some scammers have accomplices in the United States and abroad who move in to finish the deal once the initial contact has been made.
Motives
Many scammers tend to come from poorer and more-educated backgrounds, where Internet access and better education, along with inability to afford basic necessities, drive people into committing online fraud. They could also have been influenced by social media celebrities and artists who promote scamming as a "cool" trend to quickly gain access to luxury items like sports cars and fashion. In the case of Nigeria, the rise in scamming cases was due to a boom in cybercafes, a series of economic crashes from the 1980s, and the resulting joblessness among young people in Nigeria.
Implementation
This scam usually begins with the perpetrator contacting the victim via email, instant messaging, or social media using a fake email address or a fake social media account. The fraudster then makes an offer that would allegedly result in a large payoff for the victim. An email subject line may say something like "From the desk of barrister [Name]", "Your assistance is needed", "Important", "Dear Sir or Madam" and so on. The details vary, but the usual story is that a person, often a government or bank employee, knows of a large amount of unclaimed money or gold that they cannot access directly, usually because they have no right to it. Such people, who may be real people being impersonated by the scammer or fictitious characters played by the con artist, could include, for example, the wife or son of a deposed African leader who has amassed a stolen fortune, a bank employee who knows of a terminally ill wealthy person with no relatives or a wealthy foreigner who deposited money in the bank just before dying in a traffic accident or a plane crash (leaving no will or known next of kin), a US soldier who has stumbled upon a hidden cache of gold in Iraq, a business being audited by the government, a disgruntled worker or corrupt government official who has embezzled funds, a refugee, and similar characters. The money could be in the form of gold bullion, gold dust, money in a bank account, blood diamonds, a series of cheques or bank drafts, and so on. The sums involved are usually in the millions of dollars, and the investor is promised a large share, typically ten to fifty percent, in return for assisting the fraudster to retrieve or expatriate the money. Although the vast majority of recipients do not respond to these emails, a small percentage do, enough to make the scam worthwhile as many millions of messages can be sent daily. To help persuade the victim to agree to the deal, the scammer often sends one or more false documents that bear official government stamps, and seals. 419 scammers also often utilize fake websites and addresses to present themselves as more legitimate. Multiple "people" may write or be involved in schemes as they continue, but they are often fictitious; in many cases, one person controls all the fictitious personae used in scams. Once the victim's confidence has been gained, the scammer then introduces a delay or monetary hurdle that prevents the deal from occurring as planned, such as "To transmit the money, we need to bribe a bank official. Could you help us with a loan?" or "For you to be a party to the transaction, you must have holdings at a Nigerian bank of $100,000 or more" or similar. This is the money being stolen from the victim; the victim willingly transfers the money, usually through some irreversible channel such as a wire transfer, and the scammer receives and pockets it. Often but not always, delays and additional costs are added by the fraudster, always keeping the promise of an imminent large transfer alive, convincing the victim that the money the victim is currently paying would be covered several times over by the payoff. The implication that these payments will be used for white-collar crime, such as bribery, and even that the money they are being promised is being stolen from a government or royal/wealthy family, often prevents the victim from telling others about the "transaction", as it would involve admitting that they intended to be complicit in an international crime. Sometimes psychological pressure is added by claiming that the scammers' side, to pay certain fees, had to sell belongings and mortgage a house or by comparing the salary scale and living conditions in their country to those in the West. Much of the time, however, the needed psychological pressure is self-applied: once the victims have provided money toward the payoff, they feel they have a vested interest in seeing the "deal" through. Some victims even believe they can cheat the other party, and walk away with all the money instead of just the percentage they were promised. The essential fact in all advance-fee fraud operations is that the promised money transfer to the victim never happens because the money does not exist. The perpetrators rely on the fact that, by the time the victim realizes this (often only after being confronted by a third party who has noticed the transactions or conversation and recognized the scam), the victim may have sent thousands of dollars of their own money, sometimes thousands more that was borrowed or stolen, to the scammer via an untraceable and/or irreversible means such as wire transfer. The scammer disappears, and the victim is left on the hook for the money sent to the scammer. During the course of many schemes, scammers ask victims to supply bank account information. Usually this is a "test" devised by the scammer to gauge the victim's gullibility; the bank account information is not used directly by the scammer, because a fraudulent withdrawal from the account is more easily detected, reversed, and traced. Scammers instead usually request that payments be made using a wire transfer service like Western Union and MoneyGram. The reason given by the scammer usually relates to the speed at which the payment can be received and processed, allowing quick release of the supposed payoff. The real reason for using such money-sending services is that such wire transfers are irreversible and often untraceable. Further, these services are ideal because identification beyond knowledge of the details of the transaction is often not required, making receipt of such funds almost or entirely anonymous. However, bank account information obtained by scammers is sometimes sold in bulk to other fraudsters who wait a few months for the victim to repair the damage caused by the initial scam before raiding any accounts that the victim did not close. Telephone numbers used by scammers tend to come from burner phones. In Ivory Coast, a scammer may purchase an inexpensive mobile phone and a pre-paid SIM card without submitting any identifying information. If the scammers believe they are being traced, they discard their mobile phones and purchase new ones. The spam emails used in these scams are often sent from Internet cafés equipped with satellite internet connection. Recipient addresses and email content are copied and pasted into a webmail interface using a stand-alone storage medium, such as a memory card. Certain areas of Lagos, such as Festac Town, contain many cyber cafés that serve scammers; cyber cafés often lock their doors during certain times, e.g., between 10:30 p.m. and 7:00 a.m., so that scammers inside may work without fear of discovery. Nigeria also contains many businesses that provide false documents used in scams. After a scam involving a forged signature of Nigerian President Olusegun Obasanjo in summer 2005, Nigerian authorities raided a market in the Oluwole section of Lagos. There, police seized thousands of Nigerian and non-Nigerian passports, 10,000 blank British Airways boarding passes, 10,000 United States Postal money orders, customs documents, false university certificates, 500 printing plates, and 500 computers. The "success rate" of the scammers is also hard to gauge, since they operate illegally and do not keep track of specific numbers. One individual estimated that he sent 500 emails per day and received about seven replies, citing that when he received a reply, he was 70 percent certain he would get the money. If tens of thousands of emails are sent every day by thousands of individuals, it does not take a very high success rate to be worthwhile. The success of advance fee crimes is based on the initial persuading of the victim. In its annual report for 2025, the FBI's Internet Crime Complaint Center recorded 7,762 complaints of advance-fee fraud, with reported losses of $155,910,852.
Countermeasures
In recent years, efforts have been made by governments, internet companies, and individuals to combat scammers involved in advance-fee fraud and 419 scams. In 2004, the Nigerian government formed the Economic and Financial Crimes Commission (EFCC) to combat economic and financial crimes, such as advanced-fee fraud. In 2009, Nigeria's EFCC announced that they had adopted smart technology developed by Microsoft to track down fraudulent emails. They hoped to have the service, dubbed "Eagle Claw", running at full capacity to warn a quarter of a million potential victims. Some individuals participate in a practice known as scam baiting, in which they pose as potential targets and engage the scammers in lengthy dialogue so as to waste the scammer's time and decrease the time they have available for actual victims. Likewise, the website Artists Against 419, set up by volunteers, offers a public database with information on scam websites. They work closely together with APWG to share their data with financial institutions and cybersecurity companies.
Irreversible money transfers
A central element of advance-fee fraud is that the transaction from the victim to the scammer must be untraceable and irreversible. Otherwise, the victim, once they become aware of the scam, could successfully retrieve their money and alert officials who could track the accounts used by the scammer. Cryptocurrencies or wire transfers via Western Union and MoneyGram are ideal for this purpose. International wire transfers cannot be cancelled or reversed, and the person receiving the money cannot be tracked. Other non-cancellable forms of payment include postal money orders and cashier's cheques, but wire transfer via Western Union or MoneyGram is more common.
Anonymous communication
Since the scammer's operations must be untraceable to avoid identification, and because the scammer is often impersonating someone else, any communication between the scammer and his victim must be done through channels that hide the scammer's true identity. The following options in particular are widely used.
Web-based email
Because many free email services do not require valid identifying information and also allow communication with many victims in a short span of time, they are the preferred method of communication for scammers. Some services go so far as to mask the sender's source IP address (Gmail being a common choice), making the scammer's country of origin more difficult to trace. While Gmail does indeed strip headers from emails, it is possible to trace an IP address from such an email. Scammers can create as many accounts as they wish and often have several at a time. In addition, if email providers are alerted to the scammer's activities and suspend the account, it is a trivial matter for the scammer to simply create a new account to resume scamming.
Email hijacking/friend scams
Some fraudsters hijack existing email accounts and use them for advance-fee fraud purposes. For instance, with social engineering, the fraudster impersonates associates, friends, or family members of the legitimate account owner in an attempt to defraud them. A variety of techniques such as phishing, keyloggers, and computer viruses are used to gain login information for the email address.
Fax transmissions
Facsimile machines are commonly used tools of business whenever a client requires a hard copy of a document. They can also be simulated using web services and made untraceable by the use of prepaid phones connected to mobile fax machines or by use of a public fax machine such as one owned by a document processing business like FedEx Office/Kinko's. Thus, scammers posing as business entities often use fax transmissions as an anonymous form of communication. This is more expensive, as the prepaid phone and fax equipment cost more than email, but to a skeptical victim, it can be more believable.
SMS messages
Abusing SMS bulk senders such as WASPs, scammers subscribe to these services using fraudulent registration details and paying either via cash or with stolen credit card details. They then send out masses of unsolicited SMS messages to victims stating they have won a competition, lottery, reward, or an event and that they have to contact somebody to claim their prize. Typically, the details of the party to be contacted will be an equally untraceable email address or a virtual telephone number. These messages may be sent over a weekend when the staff at the service providers are not working, enabling the scammer to be able to abuse the services for a whole weekend. Even when traceable, they give out long and winding procedures for procuring the reward (real or unreal) and that too with the impending huge cost of transportation and tax or duty charges. The origin of such SMS messages is often from fake websites/addresses. Mid-2011 saw the innovation of scammers employing premium rate callback numbers for potential victims to reply to (rather than providing a website or email address). On calling the number, the victim is first reassured that 'they are a winner' and then subjected to a long series of instructions on how to collect their 'winnings'. During the message, there will be frequent instructions to 'ring back in the event of problems'. The call is always 'cut off' just before the victim has the chance to note all the details. Some victims call back multiple times in an effort to collect all the details. The scammer thus makes their money out of the fees charged for the calls.
Telecommunications relay services
Many scams use telephone calls to convince the victim that the person on the other end of the deal is a real, truthful person. The scammer, possibly impersonating a person of a nationality or gender other than their own, would arouse suspicion by telephoning the victim. In these cases, scammers use TRS, a US federally funded relay service where an operator or a text/speech translation program acts as an intermediary between someone using an ordinary telephone and a deaf caller using TDD or other teleprinter device. The scammer may claim they are deaf, and that they must use a relay service. The victim, possibly drawn in by sympathy for a disabled caller, might be more susceptible to the fraud. FCC regulations and confidentiality laws require operators to relay calls verbatim and adhere to a strict code of confidentiality and ethics. Thus, no relay operator may judge the legality and legitimacy of a relay call and must relay it without interference. This means the relay operator may not warn victims, even when they suspect the call is a scam. MCI said about one percent of their IP Relay calls in 2004 were scams. Tracking phone-based relay services is relatively easy, so scammers tend to prefer Internet Protocol–based relay services such as IP Relay. In a common strategy, they bind their overseas IP address to a router or server located on US soil, allowing them to use US-based relay service providers without interference. TRS is sometimes used to relay credit card information to make a fraudulent purchase with a stolen credit card. In many cases however, it is simply a means for the con artist to further lure the victim into the scam.
Wikipedia contributors · Advance-fee scam · revision 1380774478 · CC BY-SA 4.0 · Plain text extracted and formatting adapted; tags derived from linked topics.