I am a grieving widower. However, I am also an expert in information security. I got my start researching malware, spam, scams, and frauds. Therefore, it follows that I know quite a bit about grief scams.
Since I know about all manner of scams, I know what *I* mean by grief scams. But I should probably clarify the term, since there are all manner of activities which might be of concern.
Many professionals, such as psychological counselors, do charge for supporting people in the process of grief, and, indeed, the entire medical system is, in a sense, profiting from the suffering of individuals who are in difficulty. Generally speaking, medical professionals have gone through years of training, in order to most effectively address the difficulties that people are experiencing. A number of people have, however, decided to set up shop by selling various forms of "support" to those in grief, without having studied. In recent research, I was startled by the number of companies that have created "griefbot" or "restoration" systems, often without any apparent study of grief or counselling at all. I have difficulty justifying griefbot systems or amateur "counsellors" in their attempt at making money off the grief and suffering of others, in any case. After all, I volunteer in a hospice environment, and spend many hours, not being paid, trying to support people who are going through their own process of grief. However, I do draw a line between these enterprises and actual scams.
Grief scams are, specifically, a variation on romance scams. However, they are a particularly vile type of fraud, in that they specifically prey on a population known to be vulnerable and susceptible. However, grief scams are somewhat unique, in the family of fraud overall, in that the community is able, quite aside from educational materials and workshops, to ensure that the community itself is protected against the danger of grief scams. We'll come back to that.
Romance scams and frauds have been going on, basically, forever. The fraudster, or confidence trickster, either by research, or simply by cold reading during conversation, pretends to be first a compatible friend, and then, eventually, a potential, and generally strong, romantic interest. In the age of the Internet, where, famously, nobody knows that you are a dog, the scammer can pick targets of pretty much any gender. This allows for a wider range of targets, since the budding friendship, and then romance, can be conducted online via email, text, or other forms of messaging, without the necessity of meeting face to face. If the target wants a picture of the scammer, the scammer can simply harvest anyone of a number of possible, and generally attractive looking, pictures that are available online, or, these days, simply generate one with generative artificial intelligence.
About fifteen years ago, when Twitter was new, a number of us in the information security field were contacted by young ladies who expressed interest in us and our work. Generally speaking, these young ladies must have lived in relatively warm climates, given the lack of interest in heavy clothing. Eventually, through research, we found out that all of these accounts were being generated from China, and were part of a dedicated and concerted effort to infiltrate the information security field in the West. Not all of the activity, in regard to this mass campaign, was specifically in regard to romance scams. However, by being allowed to become a "friend" of an information security expert, the account would then be accepted, as a "friend" or other "approved" contact, by other information security workers and researchers. Thus this campaign was able to establish accounts within networks of information security experts and practitioners.
However, this is all related to the more general category of romance scams, of which there are many types.
Grief scams target the bereaved. Those who have suffered a loss, particularly of a spouse, or a close friend or family member, are subject to grief. Grief is not a single entity, but a syndrome: a collection of symptoms and characteristics related to our reaction to a significant loss. One of the characteristics, and, overall, the most common in prevalence, is that of sleep disturbance. Those who are bereaved may sleep more than normal, but most often, they suffer from a lack of sleep. This is unfortunate as it leads to cognitive impairment, and bad decision making, just at a time when you are faced with a mass of decisions that, in our society, have to be made right away.
However, one of the other, relatively common, symptoms of grief is that of an extreme loneliness. It is very difficult to describe, to someone who is not in mourning, how strong this feeling of loneliness is. It isn't as if you had lost one relationship (albeit a very important one), but as if you had lost relationship, in general. The loneliness is intense, and pervasive. It affects your behavior, sometimes in extremely odd ways. It has, in fact, become one of our cliches about grief and bereavement: Mum dies, and then Dad, inappropriately quickly, falls in love with some inappropriate bimbo, and gets remarried.
This is, pretty much, what grief scammers are relying upon.
Grief scammers are, of course, targeting the bereaved, and those who have suffered a loss. They are searching social media for appropriate targets. As just noted, they are searching for the bereaved because the bereaved are particularly susceptible to the approach that they are going to make. The bereaved are lonely, and are, very likely, also beset by problems, and are at a point and situation in their lives where cognitive faculties may be somewhat impaired. All of these make the bereaved targets for this particular type of scam.
So, how do grief scammers find their victims? Well, as I have noted, on social media. We, in the information security field, recognize social media as a major danger. As we frequently try to point out to people, if you are concerned about your own privacy, and if you do not want people to know absolutely everything about your private life, stop posting every single detail of your private life on the public Internet. We tend to give away far too much information about ourselves, sometimes not even realizing that we have done so. Sometimes in the postings that we ourselves originate, and sometimes in the responses that we make to other people's postings.
Now, as I have said, it's probably not a great idea to post, on social media, that you are a grieving widower, and are desperately looking for someone to relieve your loneliness. But this is not the only way that grief scammers can find their targets. As a matter of fact, it is probably not the most important way that scammers will find their targets.
As we, any information security, also frequently say, if you are not paying for the service, then, in fact, *you* are the product. Pretty much all social media platforms are freely available. Most make no charge for using their services. Some may have some associated charges for enhanced functions or services, but, for the most part, general chatter, and connecting with other people, on social media platforms is available to anyone who wants to create an account, at no charge. So, how do the social media companies, such as Meta/Facebook, become some of the largest and most valuable companies in the world? Well, it's by selling information about the people who use those social media platforms.
(Social media companies and platforms began appearing around the time when American intelligence agencies had just faced a scandal where it was revealed that they had been spying on American citizens. There is an information security joke that says that since they were forbidden to do so, a bunch of intelligence staff met in the basement to decide what to do. One suggested that they set up a Website, present it as a social media site, and have everyone in the world type in all their private information and deepest, darkest secrets. The other all said he was crazy: nobody would ever do such a thing. "Trust me," he said. "We'll call it Facebook! It'll work!" And it did.)
Social media allows the companies that run the platforms to collect information about you. They then sell that information to companies, advertisers, political parties, and, indeed, anybody who is willing to pay for the information. And it's not just the text and content that you post on social media that provides information. Every time you look at a posting, every time you "like" a posting, every time you share a posting with your friends, every time you acknowledge someone as a friend or a family member, every entry you make on your profile, identifying your hometown, or the town where you currently reside, or the company that you work for, or the school that you went to, all of these items are information that can be gathered about you, and packaged, and sold. In fact, the information about postings that you look at, or share, or like, is far more valuable to advertisers, and political propagandists, then is anything that you write and post on social media. And, it is also far easier to collect. Reading your postings, and understanding what it says about you requires a person to spend time reading it, and thinking about it. Collecting information about what you like, or what you share, or who your friends are, takes a fraction of a second and can be done by a program. So, if a grief scammer is looking for targets, then it would take quite a long time reading through different people's postings to find the one where I say that I am a grieving widower. However, a program can, in a flash, determine the fact that I "follow" at least a dozen grief accounts (accounts created by people who are providing grief support to the bereaved), and can then know, with pretty good certainty, that I am one of the bereaved. So, it's pretty quick and easy for scammers to determine who the grief scam targets are.
(Grief scam targets are not solely identified through social media. There are some scammers who still do it the old-fashioned way: by reading the obituaries, and noting surviving family members. But social media allows you to do it much faster, and at scale.)
As I have, previously, noted, I have been the target of romance scams in the past and have been able to identify such approaches on Twitter, WhatsApp, and a variety of other platforms. Recently I was subject to a few grief scam approaches on the Facebook platform. It is fairly easy to identify these approaches. For one thing, two of the accounts supposedly originate from the same small town, which seems rather unlikely on the face of it. In the second place, the profile pictures of the supposed women identified by these accounts are somewhat older than the romance scam illustrations have been in the past. The approach was also somewhat unusual: in both cases the initial messages to me were not through the private messaging function on the Facebook system, but rather replies to postings that I had made, or replies to comments that I had made to other postings. When I sent a reply to one of these approaches, asking why this "person" was so interested in my postings and writing (both of the approaches had stated this), the reply said that I posted such "cool and interesting" material. It is always gratifying to hear this type of thing, and pretty much everyone anyone who was not already a professional paranoid would probably accept it. But, you will note, it isn't very specific. And, indeed, the posting went on to say that I post such "heartwarming" stories about my family, and I seem like such a "happy person who is a joy to be around."
This, of course, is full of red flags. In the first place, I do not post heartwarming stories about my family. As a matter of fact, I don't post *any* stories about my family. (I'm a security expert. I respect the privacy of others, particularly those closest to me.) And, as I frequently note to people, not only am I a grieving widower, but I am also a depressive. I'm not a happy person who is a joy to be around. I certainly don't write and post material exclusively in that vein. I may write comic stories about events that happened to me, and I try to make unfortunate events that happen to me sound as funny as I can when I'm writing about them, but there couldn't possibly be sufficient of that material to make people feel that I am a happy person who is a joy to be around. For one thing, I am frequently posting about information security, and the dangers of technology, social media, artificial intelligence, cryptocurrency, and all kinds of other dangers to individuals and, indeed, our society. No, I am not a jolly, happy person who is a joy to be around, and anybody who can make that kind of statement obviously hasn't read the content of my postings.
What they probably *should* have read, is a report that says that I follow an awful lot of comedy accounts. I suppose it would be an easy enough mistake to make.
In a very short space of time I have had multiple romance/grief scams contacts on Fakebook--all of them (within the first few messages) telling me "I can't send you friend request," and either instructing or implying that I should attempt to "friend" them, or contact them via private messaging.
Interestingly, in one case, despite the fact that my email address was available, the scammer did *not*, in fact, contact me via email.
Facebook/Meta is lousy at protecting its users from such scams. But I assume that, somewhere in the bowels of the "algorithm," there is some awareness of the types of messages that scammers send their "friends," and thus the scammers have learned to avoid "friending" too many marks at a time. I also assume that these attempts are part of an organized scam "farm" operation, given the frequency and consistency of the attempts on Facebook, and the avoidance of email.
So, how does the grief scam proceed?
Having selected a target, the grief scammer will find out any information that they can about the target. Likes, dislikes, political leanings, interests, preferences of all sorts. The scammer will then create a persona, or use a persona that is already established, but, generally, doesn't have any postings or personal information. (This was one of the indications raising a red flag on the Facebook grief scammers whom I have just described. The accounts had been active for a little over half a year, but no postings had been made.)
The scammer will then contact the target. Sometimes personally, sometimes in some kind of group chat situation. The initial approach will indicate some level of mild interest, but probably not too much. Both grief and romance scams tend to be reasonably long-term arrangements. Sometimes they will operate over a period of months, sometimes this may extend over years.
Initially, as I say, there will be a mild level of interest and engagement. This allows the scammer to collect additional information about the target, as well as providing time for the target to get used to the scammers presence, so as to make the eventual approach more believable, and less suspicious. The initial period, extending over some months, allows the scammer to present themselves as a continued and consistent presence, and not someone to be wary of.
As I say, there will be initial research, and additional research conducted during the initial engagement. This allows for the collection of information about likes, preferences, political and religious leanings, and possibly other information that the scammer can use to reference during the subsequent romancing phase. Information about where the target lives, the target's family, additional contacts that the target has, professional and educational level are all valuable for the subsequent romancing, and then fleecing, phases of the scam.
I should also note that frauds and scams, in this day and age (and particularly online scams), are generally highly organized. There are still individuals pursuing individual scams. These, of course, have been the way that confidence tricksters have been presented in literature and movies. However, in the online world, the majority of scams and frauds that you may encounter probably have some form of organized crime behind them. Spammers are organized, social engineers are organized, fraudsters are organized, into different specialty groups. They are not necessarily involved in different types of online fraud, although that may be possible. Very often the organized groups will specialize in a particular type of fraud, and will have well established processes to perpetrate the frauds. Therefore, there may be one group of specialists who are identifying targets for grief scams, who then pass the identities of the targets on to other groups, who may have well established and multiple personae in social media platforms, and who may conduct the initial phases of the engagement. In certain situations, while the target may feel that they are dealing with a single individual, they may be identified by one team, their identity passed to another for the initial engagement, their identity, and the associated information that has been collected, passed to an additional team for the romancing phase, and then the identity passed to a different specialist team for the fleecing phase of the scam. (This also aids the scammers in providing the time and patience for conducting grief and romance scams, since the teams will be working with multiple targets over the same period of time.) It can become even more complicated, in the case of, for example, a "pig butchering" scam, where larger sums of money, and scams, are involved in supposedly cryptocurrency investment scams. (We'll address that in a bit.)
But that is a possible side issue. At this point we are still talking about moving from the initial phase into the romancing phase. The initial phase will probably have identified interests and social and political preferences, and the scammer, and the false persona that the scammer is presenting, will be presented to the target as someone with similar interests and sympathetic to the targets preferences and leanings. At some point the discussion, which has been carried on at a mild level, will move to a more persistent approach, and the scammer persona will express a romantic interest in the target, and work towards a romance type of relationship.
There will be common indications of the scam that will likely be present. There will be reasons why the target cannot meet the scammer persona. This may be separation by distance, and if the target has sufficient money to travel to the scammers location, the scammer will probably indicate business activities that require them to move frequently, and a lack of available time in which to set up a meeting. It may be possible that scammers will agree to meet, briefly, and use well-trained actors to meet with the target, but this is obviously more expensive, and presents additional difficulties in coaching the actors, so this is unlikely unless with high value targets. The scammer will, obviously, avoid any close connections, or identification with locations, businesses, or people that the target may actually know. Sometimes arrangements may be made to meet, and then canceled at the last minute, and there are generally spurious reasons provided for that.
Eventually, of course, there will be some kind of requirement for the target to provide money to the scammer. This may be for the purposes of a business deal, or some temporary cash flow embarrassment that the scammer presents, or some sudden illness, injury, or legal entanglement, on the part of the scammer, that the target may be asked to pay for. (The scammer will, of course, promise to pay the target back, possibly with interest, or an extra gift.) This request isn't going to be presented until the scammer has established a strong relationship with the target. However, it is frequently the case that small requests may be made of the target, often not involving large sums of money, which, psychologically, support the targets willingness to provide the scammer with a larger sum of money. If the scammer can convince the target to forward some of money in the hundreds or low thousands of dollars, then subsequent requests may be made for tens (or hundreds) of thousands. This is a pattern that is frequently seen in advance fee frauds (also known as 419, lottery, or Nigerian scams), as well.
I have mentioned "pig butchering." This, rather unlovely, phrase describes a new form of fraud, which is basically just a combination of multiple old forms of fraud.
Pig butchering combines romance scams with investment scams, with the additional twist of the new cryptocurrency technology. A target that has been groomed through a romance or grief scam is not asked for money for a medical emergency or legal problem, but is encouraged to invest in a new, and supposedly both safe and lucrative, investment scheme. The scammer will state that he or she makes an income from a cryptocurrency investment scheme. This is, theoretically, and indeed actually, possibly a legitimate investment. Cryptocurrency, and the associated decentralized finance, allows for a great many forms of financial activity. These kinds of financial activities can, again theoretically, provide for many business opportunities that would otherwise be difficult in a standard banking situation with its associated fees. Cryptocurrencies are not as restricted by the same types of banking fees as ordinary financial instruments. They are also conducted by computer, and computer communications, and therefore can take advantage of rapid transactions, quickly changing financial circumstances, and many and frequent transactions conducted at high speed allowing for the rapid accumulation of tiny amounts of profit. The idea is that these many, and only marginally profitable, transactions can, in the right circumstances, provide a livable income.
The thing is, the banking fees are there to cover the fact that there are regulations, restrictions, and limitations, on existing financial instruments. The *regulations* are there to provide some security that the transactions, and the financial instruments, are legitimate. Cryptocurrencies, while not all of them are actual fraud, have relatively few guarantees of value, and, with the rapid dissolution of existing restrictions and enforcement in the United States in recent times, are becoming even more dangerous in terms of investment.
Many of the new financial instruments that are based on cryptocurrency technologies, and decentralized finance, rely on a concept known as smart contracts. Smart contracts ensure that certain conditions are met before a transaction is completed. Unfortunately, in order to ensure that you understand the risks and guarantees of the smart contracts, you have to understand the technology at a very detailed level. Very few people who are involved in cryptocurrency transactions actually understand the details of the technology that is at play. Where the scam comes in in this particular case is that, after the scammer has convinced me to invest in the situation, someone who is setting up my account will have installed, in my account, a smart contract which, either after a given amount of time, or at some particular date in the future, reverts all of the income that I have made, and indeed my original investment as well, to somebody else. Because so many smart contracts, and so many transactions, are involved in establishing these types of investments, it is extremely unlikely that I will have examined, and understood, all of them. When my money suddenly disappears, the cryptocurrency exchange cannot be held legally at fault, because I am deemed to have agreed to the way my account was set up, and to all the smart contracts that were associated with it, and with every transaction that I was involved with. The original scammer, who got me into the investment scheme, and the person who set up my account with the rogue smart contracts, of course disappears. With my money.
While pig butchering may seem to be a minor variation, it has seen an explosion of growth in the past few years. Therefore I include its details in order to alert people to look for these specifics, of investments in cryptocurrency schemes, as yet another set of indicators of fraud.
I mentioned, earlier, that grief scams are the one type of fraud where the community can protect both itself, and the individual members of the community, from this type of scam.
Grief scams are perpetrated on the grieving, mourning, and bereaved because they are vulnerable and susceptible. The loneliness leads to a kind of desperation which makes people less inclined to examine closely offers of friendship and or romance. The type of protection that *I* offer, that of education and awareness of the scams, is one way to protect against pretty much any scams. However, even warnings of possible scams, plus querying of your friends and relatives who may be entering into questionable relationships, will likely elicit negative pushback. If you ask the bereaved person how much they knew know about this new acquaintance, friendship, or romance, the answer will probably be a very stiff "enough." The strength of the loneliness, as I have mentioned before, leads to a level of desperation which is going to make people very resistant to probing or challenge, even if it is intended to protect them.
The answer to protecting against the grief scam lies in another direction. I may have mentioned that I was involved in a pilot project with the Vancouver area health region, examining and trying to address the issue of loneliness and isolation in seniors. The answer to the grief scam, as well as a number of other issues, both social and medical, is to ensure that people who are isolated are *not* lonely. To bring them, sometimes even to force them, out of isolation and into community. You need to take care of your friends and possibly relatives, who are bereaved and lonely. Ensure that they are not lonely. Ensure that they are not isolated. Check up on them. Make sure that you understand their state of mind, and their state of isolation, community, and companionship. Make sure that those in your community are not isolated, and therefore are not subject to grief scams.
No comments:
Post a Comment