E-Mail Scammers Ask Your Friends for Money
Nigeria continues to develop and export the world's most innovative Internet scams. In one bizarre variation that seems to have ramped up in recent months, the scammers are taking a page from Facebook and leveraging the power of social connections.
Context & Ripple Effects
In July 2007, Symantec flagged a scheme in which con artists made friends with charities to borrow institutional trust; the variant reported today extends the same play from organizations to individuals, with hijacked e-mail accounts sending urgent money pleas straight to a victim's contact list.
The timing is pointed. Facebook spent this week unveiling Social Ads and Beacon in New York (November 6–8), and users were already scrambling to block Beacon's automatic sharing of their off-site activity — so at the precise moment the company began monetizing the social graph, criminals demonstrated that the same graph works just as well as an attack surface.
First-order effects
- Owners of compromised webmail accounts suddenly have their contact lists weaponized: friends receive urgent, personal-sounding money requests from a known address, slipping past spam filters built to catch mail from strangers.
- Facebook enters its first advertising week defending trust on two fronts at once — user revolt over Beacon's sharing defaults, and criminals explicitly modeling their lures on Facebook-style social connection.
Second-order effects
- Webmail providers and security vendors are pushed to judge accounts by behavior rather than message content — anomalous logins, sudden blasts to entire address books — because the malicious payload here is a plain-text plea from a 'friend'.
- Every successful friend-list scam erodes the willingness of users to expose their connections, pressing Facebook to treat account security as a visible product feature during the very weeks its ad business depends on users trusting the graph.
Third-order effects
- If scams keep riding social ties, the defensive burden shifts from filtering unknown senders to verifying known ones — out-of-band confirmation and authenticated devices becoming the default expectation for any message that asks for money.
- Fraud follows concentrations of trust: as social lives centralize on platforms whose core asset is the friendship graph, that graph becomes the highest-yield target for social-engineering operations, forcing platforms to internalize abuse costs their advertising models never priced in.
The trend: Online fraud is migrating from anonymous bulk e-mail toward attacks embedded in trusted social graphs, advancing in lockstep with the platforms that monetize those same graphs.