I’ve worked IT help desk before and have seen lots of phishing emails. If scammers tightened up their spelling and grammar skills a tiny bit they would catch many more victims effortlessly. The bar is insanely low. Most users could spot obvious phishing emails. But emails with even just a little more effort put into spelling and grammar were insanely successful. I worked at a University - I’ve seen professors, students, admin fall for these ones.

Why can’t they spell? Because most scammers are operating from the developing word and don’t have great English. That’s it. There’s no elaborate theories beyond that.

https://en.wikipedia.org/wiki/Just-so_story

They have access to spell checkers. I somewhat agree that current retirees may be very sensitive to spelling mistakes, but spammers often aren't even putting in the minimum amount of effort to produce an error free E-Mail. I think that both theories aren't satisfying.

For instance I once saw one of those sex scam accounts on Facebook where the profile pic was some hot, obviously white woman, but the name was Vietnamese and all the posts were in the Thai alphabet. That to me seemed very deliberately designed to catch men who saw the big boobs and immediately switched off their brains. And obviously no one is incompetent enough to use the wrong alphabet by mistake.

Remember that scammers are lazy. The target is someone who doesn’t notice the punctuation problems. People with mental illnesses, etc, but with access to funds. It might very well be much smaller than the group you mention but they are easier to scam. No need to use technical trickery. They will give you their credit card details over the phone.

Educated, British retiree is one class of audience, who may need a different nuanced tactic (tech/ amazon/ gmail security like email with a professional English call center that can engage them).

The world is a big place. There are also other classes of audiences (where the engagement effort is much lower) and this purposeful spelling mistake does look like a good way to weed out some of them.

You believe they don't have access to fiverr or any of the numerous sites that will copy edit for a couple dollars of the thousands bucks they are scamming?

but in this case it is both.

:-)

Don't help them get better at scamming.

This is especially relevant to your point because facebook could EASILY be flagging people based on known pasta messages, for review or shadowbanning etc. They presumably don't do this because "not my problem".

1.Actually the experience of someone I know who's turned screwing with scammers into a personal hobby, who frequently shares notes on this with me.

They put plenty of investment into scamming me before I called them out, and I don't think their grammatical errors would have served to filter anyone (because it also could have just been someone wanting to buy something who happens to have bad English).

However the paper itself doesn't present any evidence around the scammer's intention. Rather it presents a mathematical model under which it would make sense for a scammer to intentionally exclude a large swathe of victims, and it posited that misspellings is a way to achieve it.

I am not sure smart people are scammed less often than the average person. Perhaps smart people get sucked in by different scams (like buying altcoins, or complex speculation)?

The exception (and a potential attack vector) is when a phone call or other live interaction ends in an email being sent as part of the process. There you have to weigh the risk I suppose; obviously i have replied to such emails. But i would never reply to a bulk email even if it came form my banks domain.

Savvy users who will become wise to the grift somewhere along the way are the ones they want to weed out. Early in the process ideally.

Having totally convincing emails fails to weed out these savvy users - you get to discover who they are a bit further down the line, after you've invested some time.

Since their time they can spend is finite, they want to only spend time on sure bets. This is why it is important to take a few moments to lead on scammers - you're damaging their ROI the more of their time you can take up.

We've been seeing a rise in attacks that are launched from compromised accounts, where the email is a reply to a previous thread. So you have the context, name and address of someone you're presumably already familiar with. The last one I looked at had the body "What do you think of this?", their signature was missing, and the payload was a html file that delivered a passworded zip via a data: blob, and the password was in the html file. "for security".

The attachment was the only real tell. Also noticed the sending server was in the wrong country, but since the thread they were replying to had to come from compromised access, I wouldn't trust that either. If the attachment was an office doc, the payload would have been delivered before I heard anything about it.

It's not quite spear-phishing (you're still a target of opportunity rather than a selected target), but it's effective and convincing. But trainings haven't got much past the nigerian princes yet.

Most of the people who haven't heard of Nigerian prince scams have spam filters which have. I suspect their spam-filter evasion rates are so low they really, really wouldn't want to filter those people out if they knew what they were doing

(I suspect the reverse is actually true: a lot of the people running the scams have heard legends about how much their fellow countrymen made from using certain email templates, but have no idea how much of a running joke they are in Western discourse and how consistently they're filtered out)

https://www.microsoft.com/en-us/research/wp-content/uploads/...

> In GTA, the player received a 'GOURANGA' bonus for running over an entire procession of Hare Krishna. 'GOURANGA' is actually a term that was popularized as use by the Hare Krishna movement during the 1970s. It is often used to describe happiness. This is also a cheat code in the PC version of GTA 2.

There’s no link or request for money, so people probably respond more often.

I imagine like many areas of persuasion (like interrogation), getting someone to start talking is the “foot in the door” that starts to snow ball, even if it’s not about anything relevant.