I’ve worked IT help desk before and have seen lots of phishing emails. If scammers tightened up their spelling and grammar skills a tiny bit they would catch many more victims effortlessly. The bar is insanely low. Most users could spot obvious phishing emails. But emails with even just a little more effort put into spelling and grammar were insanely successful. I worked at a University - I’ve seen professors, students, admin fall for these ones.
Why can’t they spell? Because most scammers are operating from the developing word and don’t have great English. That’s it. There’s no elaborate theories beyond that.
Got an email shortly afterwards about a login from Russia, however I was able to change my password and kick out all other sessions before any damage was done.
The worst part was that I was doing a favour to a Steam "friend" who asked me to vote for his clan in some kind of competition. I will give him the benefit of the doubt and assume it wasn't really him, but someone who had hacked his account, but either way, Steam support were utterly disinterested in doing anything about it when I reported it. As were Cloudflare. I checked on the site a few days later and the safe browsing list had flagged it, so at least those maintainers still seem to give a shit.
I have a friend that got a message from a "girl" over the summer. It was like "Hello Dear Joseph, I would like to no if you can help me with to practice English. I find you profile today and I have a work visas starting in 90 days to come to your city for work and I am wanting to make new friends and practice my english!! Sorry if this bothered to you. ~~EMOJIS~~~ - Signed Brazilian Model.
So far I think he's 8 grand into helping her. I'm sure it's more now because that was like before Halloween and it's impossible to convince him that it's a scam.
Scams work, because people want to believe in them.
The email was really good (not in junk), the domain was close, pixel perfect UI and is just finished a reformat so entering in my feeds again made sense. Unfortunately for them, they sent the email out prematurely because after pressing the button I got a JS error.
I mean, with Google Translate, spellcheckers, etc, improving all the time, at least some of those messages should have been improving as well, no? If their grammar has not improved at all during the last decade, then there might be a hinge of truth to the theory.
There are often horrible spelling and grammar and composition errors leading to phishing pages which involve zero further input on the spammer's part to collect valuable data too.
Once you start getting into the mindset of investing time for learning and development of skills, then it's just easier, safer and more profitable to go the legit way.
https://www.youtube.com/watch?v=18bovtIlrpI
Skip through the hot parts of the video per the graph and just see how the scam actually works, and I think that for all the social engineering steps required and the sheer amount of time spent on the phone, most people would just give up even if they maybe fell for the initial well designed email.
I don't really want to speculate on the spelling/email of scam emails as I think short of some reporter just finding a spam-house and asking, it will all be senseless speculation. The article theory has plausible theories, but might very well be specious. I don't buy that it's due to poor English skills, as spellchecks are plentiful and I have no doubt that the spam-houses could easily pirate older copies of Word and get a decent looking email.
Similarly, if it was effective, I have to imagine that this is the format they'd pick.
The simplest explanations of the poorly formatted/written emails and chats for me are:
1. The targets that have the highest chance of success don't care about the emails
2. The formatting of the initial emails doesn't impact the scam in a significant way
From a more personal perspective and the people I know who continued with the scam past its initial stages, they didn't pay attention to the formatting, just the general idea behind the message was more their concern. The IRS scams, giftcard scams, etc, put some sort of pressure on the people in a way that they truly stopped thinking about the content and were more worried about the idea behind the message: they would get in trouble if they didn't comply, and the financial concerns were the driving force.
Wait until they discover ChatGPT, problem solved.
They have access to spell checkers. I somewhat agree that current retirees may be very sensitive to spelling mistakes, but spammers often aren't even putting in the minimum amount of effort to produce an error free E-Mail. I think that both theories aren't satisfying.
For instance I once saw one of those sex scam accounts on Facebook where the profile pic was some hot, obviously white woman, but the name was Vietnamese and all the posts were in the Thai alphabet. That to me seemed very deliberately designed to catch men who saw the big boobs and immediately switched off their brains. And obviously no one is incompetent enough to use the wrong alphabet by mistake.
Remember that scammers are lazy. The target is someone who doesn’t notice the punctuation problems. People with mental illnesses, etc, but with access to funds. It might very well be much smaller than the group you mention but they are easier to scam. No need to use technical trickery. They will give you their credit card details over the phone.
Educated, British retiree is one class of audience, who may need a different nuanced tactic (tech/ amazon/ gmail security like email with a professional English call center that can engage them).
The world is a big place. There are also other classes of audiences (where the engagement effort is much lower) and this purposeful spelling mistake does look like a good way to weed out some of them.
You believe they don't have access to fiverr or any of the numerous sites that will copy edit for a couple dollars of the thousands bucks they are scamming?
They don't do that because the promise of the scam is easy money. That means, low investment and high profit.
Imvesting time and money into proficiency level skills kinda defeats the point of working for a scam company.
At that point you'd rather find a legit job with a good salary for local standards
but in this case it is both.
:-)
Don't help them get better at scamming.
> Don't help them get better at scamming.
Yeah. The last thing you want is someone like me getting into scamming, right? /s