Monkey see, monkey do.

We often talk about how we can tell where a scammer is from simply by format the scam takes.  For example, if a scammer uses a photo of a modelesque female and asks for money to pay the translation agency they’ve been using to help them communicate then we can assume with a great degree of certainty that the scammer is in Ukraine.  If a sextortion scammer demands amounts in the thousands, that’s a strong indicator they’re from Ivory Coast.  People sometimes talk about the scammers like they’re some kind of criminal mastermind, but it’s far more likely they’re simply copying the “format” of another scammer.  We can go even further back and point out that the “419 scam” we know today is nothing more than the “Spanish prisoner” scam that originated in the 18th century, with the only major difference being the means used to send the scam out.  Back then it would have been done by mail, whereas now the scammers use email.

The emails themselves are often nothing more than recycled or reused scripts.  Here’s two examples from our forum that show almost identical wording in two emails from almost six years apart:

Here’s another example of what’s known as the “dying widow scam” from five years apart.  This time it has a particular mistake in it that remained for many years:

 

The point we’re making here is that scammers aren’t criminal geniuses.  Most are using pre-written texts that have been around for years, and doing nothing more than copy and pasting it to thousands of people at once in the hopes that at least one will fall for it.  There are clever scammers out there, don’t let this make you feel otherwise.  Someone had to come up with that format in the first place after all.  Most however, from the refugee scammer in Ivory Coast to the romance scammer in Ukraine are doing nothing more than playing a game of “monkey see, monkey do”.