Nail the Scammers: Great Effort Across Austin, Philly and London!

Several friends and I worked across multiple continents to find the source of a "Nigerian Prince" phishing scam... bringing some levity to a tragedy.


by flipperpa on Aug. 3, 2010, 1:57 p.m.

Random
Letters to Scammers

Background

I received an email from my good friend Dave. A friend of his from Austin had recently lost his wife, yet was receiving scam texts from "her" in London. Dave asked if I knew anyone in London, and fortunately, I knew some wonderful people who were more than excited to help out. What follows below is the full story, in email form (emails and most last names removed for obvious reasons; I'm sure Tim Allen (me) and Bob Marley are fairly safe).

The Email Thread

Subject: Londoner’s?

————————

From: Dave B

Date: Fri, Jul 23, 2010 at 6:14 PM

To: “Tim Allen”

Hey – know any whitehats in London?

An old friend and recent Austinite like myself could use a little help.

Rob “Judge” Marley (and you think you’re the only guy needin’ a nickname), recent Austin transplant, old time Burning Man friend who founded some epic and still running camps out there needs a hand.

His wife died this past year after a long and gruesome battle with cancer. No lie that. Joan and I were with him and Tiffany “Stormy” Marley until the end – and it didn’t come quietly. Rob has been through the meat grinder.

So today he starts getting insistent messages from he dead wife. Hell, nearly everyone she ever communicated with gets messages. Same old scam. I’m stuck in London. My passport and money are gone. Please wire me money. Its an old and weak scam.

But its coming from a dead woman.

Nothing like a kick in the balls followed by a shit sandwich being rammed down your throat, ay?

Rob has tracked it down to one Blackberry and one specific Internet cafe in London. Yes, he – and other involved – have filed the appropriate complaints with the authorities.

Know anyone who wants to walk over to a cafe, look for dick and kneecap’m for being the bitch-of-week?

Here’s a link to Rob: http://www.facebook.com/profile.php?id=XXXX

BTW – Rob works at XXXX and is often in the control room for YYYY. He’s an exceptional dude. You’d like him.

----------

From: Tim Allen

Date: Sun, Jul 25, 2010 at 12:37 PM

To: Dave B, Justin B, Nick L

The only folks I know in London aren’t exactly White Hat hackers – more like brilliant graphic designers – but might be up for a Sherlock Holmes case like this. I’ve CC’d them.

Justin, Nick – anything you can do with this? I know you guys travel all the time, so feel free to say you’re too busy, but you’re my London contacts. Anything you can do to help out with some recon in this extremely fucked up situation, to earn a shitload of karma?

Regards,

-Tim

----------

From: Nick L

Date: Mon, Jul 26, 2010 at 4:21 AM

To: Tim Allen

Hi Tim

Have been away but just back now – do you know which cafe this is coming from and how often – what absolute twats!!!

If you have any more information let us know and we will see what we can do!

Nick 😉

----------

From: Tim Allen

Date: Mon, Jul 26, 2010 at 10:23 AM

To: Nick L, Dave B

Hey Dave,

Do you have any more information for Nick? I don’t know if we’ll be able to find anything, but perhaps he could at least poke his head in and talk to someone at the cafe in question.

Thanks Nick! I hope you’re doing great.

Regards,

-Tim

----------

From: Dave B

Date: Mon, Jul 26, 2010 at 11:02 AM

To: “Rob Marley”

Cc: “Tim Allen” , Nick L

Mr. Marley,

Care to comment?

Dave Brown

PS – Nick! I was in London 2 months ago. Tim told me that I must meet you but sadly my schedule was overbooked. Next time.

----------

From: Nick L

Date: Mon, Jul 26, 2010 at 11:09 AM

To: Dave B

Cc: “Rob Marley”, “Tim Allen”

sure no probs, let us know that name of the cafe and we will pay a visit. let you know what the score is!

----------

From: Rob Marley

Date: Mon, Jul 26, 2010 at 11:29 AM

To: Dave B

Cc: “Tim Allen”, Nick L

Hey guys,

Thanks for doing a little Sleuthing for me.

I’ve been in contact with “Tiffany” over the weekend. I’ve told “her” that I couldnt get to the bank over the weekend and would have to wait till Monday.

This morning I got another email from her saying “Poor me, I didn’t make it out of here. Sad! I hope your weekend was great.” I told her we would be putting together a fundraiser to help her out.

The address where she wants the money wired to is:

11 Charing Cross Road

London, WC2H 0QU UK

A quick Google search shows this is an Internet cafe (Street View is a beautiful thing)

It would be fun to go in there posing as a courier and see who steps up to receive the package. Maybe let them know that there are people that dont appreciate getting bullshit email scams like this from dead friends.

I’d just love to tell the guy off. Maybe take a few pictures of his face and post it around the net just for fun.

That’s all the information I know so far. I’ll keep trying to string them along through email, but eventually they are going to get tired and move on to someone else.

Thanks for the help!

Rob

----------

From: Tim Allen

Date: Mon, Jul 26, 2010 at 11:35 AM

To: Rob Marley

Cc: Dave B, Nick L

Maybe sic Michael Palin on them? This is a good read:

http://www.419eater.com/html/booked.htm

Regards,

-Tim

----------

From: Nick L

Date: Thu, Jul 29, 2010 at 12:55 PM

To: Rob Marley

Cc: Dave B, Tim Allen , Louise J

Hi guys

Sorry to have dropped off the radar but we have had a terribly busy week.

Louise and I are due to be in the West End tomorrow afternoon and we were going to pay a visit to the store with a package to deliver as you suggest and see what we could find out. Louise is going to be armed with a camera (she’s wanted to stake out the place for days but realized she would have to park illegally on Charing Cross Road – she has gone all Nancy Drew on me!)

We will report back with our findings and hope that this has not been too awful for you.

It’s a pleasure to help

Nick and Lou

----------

From: Tim Allen

Date: Thu, Jul 29, 2010 at 1:20 PM

To: Nick L

Cc: Rob Marley, Dave B, Louise J

Thank you both so much. As you can see, this is a pretty messed up situation, so we really appreciate you guys going above and beyond. If there’s ever anything we can do to help out state-side, let us know! We’ve got Austin (South by Southwest) and Philly covered!

Regards,

-Tim

----------

From: Dave B

Date: Thu, Jul 29, 2010 at 1:26 PM

To: Tim Allen

Cc: Nick L, Rob Marley, Louise J

Yes, please consider us your Austin/SXSW resource. Please let me know if you are coming to town.

DB

----------

From: Louise J

Date: Fri, Jul 30, 2010 at 5:17 PM

To: Dave B

Cc: Tim Allen , Nick L, Rob Marley

Hi Dave & Tim

So… we went down at appointed time but unfortunately “Tiffany” was no show

I’ve filmed our exploits and Nick will send the ftp link to over the weekend to show you what happened

Downstairs was an internet cafe and they sent us to the office above which turned out to be some really grubby recruitment place

No one had heard of “Tiffany” so we think we might need to try and set up one more meeting

Anyway Nick is out this evening and I’m sure he’ll fill you in on more of the detail – but I just wanted to let you know how we’d got on to date

Also I’ve enclosed a pic of the message that Nick enclosed in Tiffany’s package – so please feel free to add / amend anything for our next attempt…

Catch up soon and have a lovely weekend

x Lou

----------

From: Dave B

Date: Fri, Jul 30, 2010 at 5:31 PM

To: Louise J

Cc: Tim Allen , Nick L, Rob Marley

You people are exceptional. No really. You’ve just earned free drinks and BBQ all through Austin.

So come to Austin some time. We will go out of our way to show you a true “Keep Austin Weird” good time.

DB

----------

From: Nick Laurence <nick@riversrunred.com>

Date: Tue, Aug 3, 2010 at 5:38 AM

To: Dave B

Cc: Louise Jorden <louise@riversrunred.com>, Tim Allen , Vitiare <vitiare@gmail.com>

Hi guys

Here the link to the movie file – sorry but our trail has run cold or the recruitment agency on the first floor is a cleverly constructed front to obscure some trafficking / laundering / porn ring. We think that someone has been using that cafe and would have perhaps given the owners another of their hard luck stories so that they would permit them to use it as a mail location which couldn’t be traced back to their home address.

If there’s anything else we can do or if you hear from them again don’t hesitate.

Thank you

Nick

----------

From: Tim Allen

Date: Tue, Aug 3, 2010 at 9:39 AM

To: Nick Laurence <nick@riversrunred.com>

Cc: Dave B, Louise Jorden <louise@riversrunred.com>, Vitiare <vitiare@gmail.com>

Thanks so much for your efforts. It definitely sounds like a shady operation. We really appreciate you going way above and beyond, and hope we can repay the favor some day!

Regards,

-Tim

----------

From: Rob Marley

Date: Tue, Aug 3, 2010 at 9:47 AM

To: Tim Allen

Cc: Nick L, Dave B, Louise J

I had told “Tiffany” that we had a fundraiser in her honor and that instead of wiring the money to her, I would deliver it personally. I told “her” I was getting on a plane and needed to know where she was. Unfortunately, I haven’t heard from them since last week, so its safe to say they probably thought something was up and just moved on to the next email address they’ve hacked.

Apparently the phone number they used as a contact number has been talked about on the net. Its definitely not the first time they’ve scammed people for money.

This was a beautiful attempt, everyone. Thank you all for trying to catch this person on camera. I'm sure this is the last we will hear about Tiffany in London.

-Rob

----------

From: Dave B

Date: Tue, Aug 3, 2010 at 9:59 AM

To: Rob Marley

Cc: Tim Allen, Nick L, Louise J

Holy hell y’all are special people. No wonder Tim was insisted that I connect with you two when I was in London. Wish I could have then but business did not allow it.

Nevertheless please do come and visit us in Austin. We’ll take care of you.

DB

Video of the Scammers

Conclusion

So, no, we didn’t catch Tiffany red handed. However, the mysterious texts have stopped, as I think “Tiffany” got wind that she was about to get pwned. So mission accomplished, and a testament to how having friends across the planet can really help out a messed up situation. So, here’s the video grand finale: