I could easily see my parents falling for this. I don't think they deserve to have their money taken.
Although, to be fair, I doubt my parents could set up and use a Paypal account. So they've got that going for them.
Furthermore, it is completely plausible to an inexperienced person that PayPal might enlist FBI to enforce shipment of paid-for goods. It takes some experience in this country to realize that 1) this sort of matter is not referred to FBI unless it's super grave, 2) and not referred to any enforcement entity so fast (less than 30 days), 3) and not referred to any separate enforcement entity without at least several resolution attempts from the original business.
In fact, IMO, it's quite arrogant, on the part of the OP to say this. Unfortunately, this is a typical attitude in the geekdom: if something that's obvious to us isn't obvious to you, you're stupid.
But you're probably right that the use of English and the FBI enforcement letter are obvious only to a subset of people who grew up in a Western, Anglophone culture.
Thus, the promised extra money is actually just a way to both ensure you'll "sell" to them as they made the highest bid, and also perhaps an attempt at triggering just a touch greed which does wonders for putting the blinders on.
We were trained pretty extensively on stopping these checks from being deposited, but it sure broke my heart being the bearer of bad news so often.
I remember one guy who didn't believe me that it was a scam, asked that I at least try to clear the check (we'd put it on hold for about a week). Lo and behold, he came back in a week later to tell me it turned out to be fake.
After about four years of it, you got really good at being able to analyze every deposit in under 30 seconds or so before the customer even knew what was going on.
There's a metaphor about conversions and copy-writing and startups in there somewhere.
These "long con" 419 scams need to rebuff intelligent/savvy people and only attract rubes.
By peppering the letters with bad spelling, punctuation and case mistakes, they eliminate 99.5% of the population who correctly detect it as a scam. Thus, when they do get a response, the person is much more likely to convert.
It applies to startups if signing up the customer requires cost on the part of the startup. If, for whatever reason, you had to sign up a limited number of people and invest time in each of those people, then reducing your response rate by, say, making the signup process complicated, would allow you to pre-qualify your audience by those actually able to navigate their way through it.
It would have real applicability if you wanted to get a limited market for beta testing.
Sometime in the mid '90s, not long after my dad got email, I decided to warn him about Nigerian scams.
Instead, he ended up telling me about how these these kind of scams started popping out of the first fax machine he turned on, back in the early '80s.
As for being suspicious of free money, I think most people generally would be, but relax their misgivings when something appears to be legitimate- that is to say, any escapes they are aware of appear to be covered. The scammer, therefore, takes advantage of the victim's lack of knowledge of the escapes in an electronic age.
WWW has been around for 20 years. But it's only recently that people have always on cable modems and active content.
> without educating themselves about their dangers first.
HN is full of stories of well funded, international businesses, with considerable sums of cash at risk, who do stupid insecure things. If they can't get it right why should Joe Sixpack be expected to do any better?
Email inboxes are full of hoaxes about supposed dangers - most of them are garbage.
I'm interested to see what kind of help there is for people who want to learn how to protect themselves on the Internet.
(http://www.usa.gov/Citizen/Topics/Internet-Fraud.shtml)
That site has comprehensive information. It's lousy. Look how much stuff people have to wade through.
What kind of help is there for people who want to learn to protect themselves in real life? Does the fact that there is no comprehensive resource somehow remove one's burden to learn anyway?
People can imagine what it looks like to be in physical danger, and instinct can help them avoid the situations to some degree. It's hard to imagine what it's like being in an unsafe situation on the internet.
Blaming the victim is bad only if you believe that blame is a zero sum game. Unfortunately, it is not. If you walk down a dark alleyway in New York at night alone and get mugged, the mugger is guilty of mugging you, but you're also guilty of being a silly goose. You don't gain immunity to blame simply because you were the victim.
If I replace my bicycle u-lock with a nice hefty rope and start lashing my bike to whatever object seems solid at the time (this is a concept that actually appeals to me), then I should receive some blame when my bike gets inevitably stolen. However the bicycle thief is no more nor less a thief.
The important thing to remember is that the blame of the victim, while present, has no relation to the blame of the criminal and should never be relevant in, for example, a criminal trial for the criminal. I really feel like I can't emphasis that enough.
You are making your life less convenient for yourself by letting your bike get stolen but you're not doing anything wrong.
In other words, since blame is not zero-sum, placing some blame on the victim is not a defense of the perpetrator.
Not literally, no. But most Internet scams can actually be avoided using common sense, which dictates that if something sounds too good to be true, it probably is.
http://p3n1zp1llz.48djkhcd.com.shadyurl.info/freemoneyz.exe
;)
Edit: Forgot about this site, but perhaps it could be used as a training tool for family members you feel are not quite as savy as they should be: http://www.shadyurl.com/
Make a page that just says "Grandma, don't click links like that!", convert it to a "shady" url with shadyurl.com, then email it to your grandmother.
But [urls are disguised so easily](http://horribleurl.example.com). The A element has split the real URL from the text description since forever.
Victim blaming is wrong, period. If you get mugged, you're not guilty of anything. Stop making excuses for people behaving shitty.
I have Public Information Films on a variety of subjects:
Tables are dangerous (http://www.youtube.com/watch?v=icbYf_aR91o)
A collection of terrifying ads (http://www.youtube.com/watch?v=m0xmSV6aq0g)
There are a variety of crime prevention and community safety websites. There are radio and tv programmes with advice about avoiding scams. There are magazine articles (even a well respected consumer law advice magazine "Which?") about scams and consumer law.
All of this is built up over many years and modified when needed.
How are people expected to learn how to keep themselves safe on the WWW? What search terms are they expected to use? (This is when I need Matt Cutts or some other Googler to give us useful stats about the words people use to find information about scams)
Obviously, first reaction of a non-techy user would be to click on the Amazon link in the email and enter their account details to check their order history.
And that's how they get your Amazon account details. I think this works because the "OMG my account has been hacked!!!" panic overrides you're natural caution about phishing emails.
Maybe there needs to be some sort of Internet-wide PSA about this kind of thing?
So I can see how these emails seem totally real and threatening to the average computer-illiterate who sells something for the first time ever. Remember, good scams are about that initial shock, that initial mental blow you deal on your victim to completely catch them off-guard and disable their logical thinking. Flashing a shiny batch or pretending it is an "emergency" is a very good angle.