How Cyber Sleuths Tracked Down a Nigerian Scammer

0:01This episode is brought to you by Google Chrome. You think you know a browser, but Gemini and Chrome, that's new. It can help you with practically anything on the web, like restoring a vintage motorcycle from a 50-page restoration block, or finally break down that long article you've had open for weeks. Gemini and Chrome is here for it. Ready to make anything online make sense? There's no place like Chrome. Check responses set up required, compatibility and availability varies 18+. and that's when i said no i'm not brayden's mom at all in fact i'm a former prosecutor i'm here with the sextortion expert we came all the way from the united states to figure out if we could track down people like you hello and welcome to the 404 media podcast where we bring you unparalleled access to hidden worlds both online and irl 404 media is a german's family company and needs your support.

0:53To subscribe, go to 404media.co. As well as bonus content every single week, subscribers also get access to additional episodes where we respond to their best comments. And they get early access to our interview series too, like this episode. Gain access to that content at 404media.co. Also, do remember to subscribe to our YouTube channel where you can watch all of our episodes, just like this one. subscribe at youtube.com slash at 404media.co. This week, I'm joined by Erin West and Paul Raphael. Erin is the founder of Operation Shamrock, a nonprofit combating scams all over the world, coordinating law enforcement with other bodies and experts and all of that sort of thing.

1:39Paul is a scam expert I've been following for years, probably by this point, and is absolutely one of the leading voices when it comes to not just the mechanics, but also the impact of sextortion scams. Now, as some of you may know, sextortion is rampant across the world, but also especially the United States as well. This is where scammers, many of them based in Nigeria, will pretend to be young, attractive boys or girls. They will message a young person in their target country. They will trick them into sending over nude images and then they will extort them. Sometimes this is quote-unquote just for a few hundred dollars, but that's a lot of money to a child or a teenager who is likely far too embarrassed to go to their friends or go to their family about it.

2:34The scammers will then threaten and sometimes carry out and actually do it sending those images of the new child to their family members or their friends their facebook friends instagram connections whatever um unfortunately young people are taking their own lives over this this is a very very real problem so what erin and paul did is that they wanted to figure out can we track down a scammer and then can we go find them in nigeria these are called yahoo boys that's the type of scammer in nigeria they're called that because they used to use predominantly yahoo email addresses to do those nigerian print scams right now they've moved on to this sort of stuff as i've reported they use some real-time video deepfakes and other ai technology as well such as voice changes i think this interview is really really interesting for a bunch of reasons but they actually went there and they came face to face with these people and came back, I think, with some pretty surprising insights as well.

3:41Thank you both so much for this. I've really been looking forward to this conversation. We'll get to everything you saw on your trip, but how did this plan, this adventure, this dangerous trip, this fact-finding mission, how did it come about in the first place, Erin? I had been following Paul for a long time. I just really admired the work he was doing. And at the same time, I was trying to expose what was happening in Southeast Asia. And that had gotten the attention of a company who was willing to sponsor me to do more trips. And so when I was thinking about where we could go next, I happened to run into Paul and I was like, Nigeria, there is a place I would not want to go by myself.

4:29And Paul's an expert. Why not? Why not suggest it to Paul? And so I pitched it to him. And to my surprise, he was all in from the jump. Paul, what was your reaction to hearing this plan of let's go to Nigeria and find these scammers? I think I initially agreed to do this with Aaron because I didn't think it was serious at first. but then but then by lunchtime aaron said all right i've got the funding i've got the sponsors for the trip let's go and then it became quite a bit more serious from then we kind of wanted to to figure out okay what's the plan what's the storyline and kind of what we keyed into was you know sextortion is a huge problem this scam is dangerous it's targeting youth it's surging i wonder can we hatch a plan where we put ourselves out there as a target create our own fake account, get scammed by these criminals, and then trace the criminal back to their home turf.

5:29And we did exactly that. Yeah, I guess. And maybe this changed. Maybe this changed when you did get there and you got new information. But at this point, when you're hatching this plan, in your head, for both of you, what is the goal? Erin, you'd made trips before. So what was the goal with this trip specifically? I think there were two things for me. One, I was continuing my education about transnational organized crime, and I wanted to know, has China set up there into a potentially really explosive combination of Chinese organized crime industrialization married to Nigerian excellence in social engineering and getting people to do things?

6:14How bad could that be? That was one thing I was looking at. But another thing that I think about and talk about all the time is that none of this is that hard. And we should be putting a lot more effort into taking this seriously. And so what I wanted to show was, hey, could the two of us go over there, get sex sorted, get blackmailed? And what would it take for the two of us to figure out who was behind it? And that was my interest in showing what could be done with pretty minimal effort. Paul, I feel like you have developed an expertise in basically getting scammed in a way, in order to identify the attackers, obviously.

7:00So how did the both of you go about setting that up? I mean, it's one thing to have the idea of, well, let's get sex sorted and then we'll track down the attackers. that's kind of non-trivial like how did you even go about that uh initially even from the creation of a like for lack of a better word or better way to describe like a convincing account if you know what i mean the starting point here was to create the perfect victim someone who these criminals would target and we know based on the victim demographics sextortion scammers are largely targeting young men and teenage boys. So that was step one, figuring out that persona that we wanted to take on.

7:43Then it came to the social media account creation. So we had Instagram account, we had a Snapchat account at one point, kind of across the gamut, and we put ourselves out there as bait. At the same time, these criminals are actively discussing, you know, how to target people, where to target people. So using that intelligence, we're able to insert ourselves a little bit higher up on the targeting list than maybe the average person would be. So we found basically a way to get blackmailed. Then the question became, now how do we trace or how do we track who our scammer is? And that turned out to be much more complicated than we originally thought.

8:21Sure. Let's get to that in a second. But just on the sort of raising yourself through the priority list of targets, when you said these people discuss who they want to eventually sex or what do you mean by that? Is that a Telegram group where they're swapping targets or something and you injected yourself into there? Like, what do you mean by that? Yeah, I think that's kind of right. So the criminals, right, they are actively talking in groups, whether it be Telegram, WhatsApp, Facebook groups, etc. And we know that one of the things they do is they target people who follow certain pages, who interact with certain groups, who may be part of specific sports teams.

8:57And, you know, they may be targeting a specific high school or a specific sports team today. And then next week, they're targeting a completely different one. So the identity we created, they were athletic into sports, but also a gamer. So they liked a bunch of those games and things like that. And using that method, we were able to create our own convincing profile that got targeted. So you set up the account and you do get targeted. How quickly does that happen? And what does that look like in practice? Like they send you a DM or? Yeah, I think it was only a couple of days until we started receiving some suspicious direct messages.

9:36But over the span of a week or two, we had received at least 10 suspicious messages from accounts that we believe are sextortion scammers. During the whole process, I think we got sextorted three or four times by different criminals. And so kind of as we are even in Nigeria and the week before, we don't even know which criminal we're going to end up actually finding. It's kind of a mystery up until the very end. I could not believe how quickly, how relatively quickly these people were reaching out. And it just really was eye opening. What a target, a young boy who plays sports and appears to be a totally normal kid, what kind of attention they got and how quickly they got it.

10:26And it just seemed so much more prolific than I expected. Yeah. So these accounts reaching out that you were taken aback by how many there were, what were they purporting to be? Young girls of a similar age of the boy you've created? Or what was the demographic that the scammers were trying to emulate? Sure. These scammers were impersonating young, attractive females. else. We found out later on that a lot of the profile pictures that they had stolen were actually coming from OnlyFans models or other adult film stars. But yeah, so the scammers, they appear to be attractive young women. And the conversation starts out normal.

11:10They would slide into our DMs and just say, hey, how's it going? I saw you in my friend's suggestions list. I hope that's not rude that I sent you a message. It starts out normal, but then it very quickly turns flirtatious. They ask like where do we live can i see a selfie what do you look like right now and as that conversation goes on that's when it starts to take a sexual turn before the blackmail begins so you're getting these messages you continue to engage with these people you haven't left for nigeria yet what's the next stage do you need to choose one to focus on do you already have an idea like what's the next step in this conversation that you're uh having with them you know after these conversations go on for a bit the scammer will typically send a provocative photo and request that we send one of ourselves and when that happens that's when they flip the script and the blackmail begins they say, hey, I'm going to ruin your life unless you pay me$500 right now.

12:15I'm going to get you kicked off your sports team, expelled from school. I'm going to shame you in front of your parents. I'm going to make these images go viral. And the criminals have, you know, screenshotted our profile, our friends, you know, all of these things and really ruthless, terrible threats, especially thinking, you know, potentially a teenager going through that experience. So yeah, we had a great partner in this fight, Kitboga. You may know him from YouTube. And yeah, he has this tool that we were able to access that basically appeared to be a Bitcoin redeem website. So when these criminals were demanding money from us, we would say, okay, but I can only pay you in Bitcoin.

12:57Here's the website, here's the code to redeem it. And on that website, we were able to see their IP address, where they came from. But then that website also asked them, do you allow your browser to get your exact location? Do you allow your browser or do you allow this website to see your face, turn the camera on? All these sorts of permissions that we asked for. Now, before the trip, our scammers were smart, right? All we saw was their IP address. So we know that they were located in or around Lagos, Nigeria. But we hadn't seen their face and we hadn't gotten their exact location yet. but we still decided to embark on the trip to Nigeria because we thought we could still track them down.

13:38That is a very, very interesting tool to use against these people specifically. I mean, you're essentially social, you're social engineering them for good, basically. So you have that information. You have like, okay, there's an IP address. They're in Nigeria. I guess we'll go, we'll figure it out there. Aaron, when you both arrive, what's the first item on the agenda when you've flown all the way to Nigeria and now you have to figure out what to do. What do you literally do when you first get there? I came a couple of days. Well, I came actually like 36 hours before Paul and met with some law enforcement contacts.

14:13But from the jump, when Paul hit the ground, we were very much on a time clock. We were very much, we've got six days to get this done. Where are we? Who's talking to us? What do we know about anyone who's talking to us? the entire time we were on the ground, we were mission driven in trying to accomplish this task, while at the same time, really taking advantage of some amazing opportunities that we also had to see other parts of the scam and meet Yahoo boys. But we were very much trying to figure out, is this going to be possible? We were well aware of the time ticking away the entire time we were on the ground of, are we going to be able to actually figure this out and make contact with a scammer?

15:04Yeah. And that time limit is mostly purely for logistical budget reasons, I imagine. You can't afford to go to Nigeria indefinitely to figure out who these people are. So you do that. Then, Paul, how do you go about figuring that out? You mentioned that tool. Do you deploy that same tool again and then you do get their location? How do you go a step further to actually figure that out? Yeah, we kept trying. And at one point, while on the ground, we actually were able to convince one of the scammers to accept and approve the face scan for security purposes on this Bitcoin Redeem website. So we have their face.

15:47Again, that's great intelligence, but it still feels so far away from us actually getting to our answer. There's millions of people in Lagos alone. But there was one piece of critical evidence. And one of these scammers, they tried to deep platform us. They brought us from Instagram, where they initially targeted us, over to WhatsApp. So we had a phone number. And interestingly, the phone number started with a country code 234. That's the country code for Nigeria. So given that, we know that we have a legitimate local phone number. And that ended up being a pivotal piece of evidence. Our fixer, Priye, threw that phone number in his phone for Truecaller to see kind of, all right, is this phone number saved with a certain name or something?

16:35And the name that he saw on it was Big Dollar. So we have a potential suspect name. Additionally, Aaron had some contacts who ran additional searches on that phone number. Aaron, I'll let you take that part. Yeah, at that point, we were pulling every thread we could. So one of the interesting pieces of this was we had that picture of the guy in his room. And we were pulling pieces of what's on the walls in that room. What is that poster? We were throwing that into Google Lens and trying to figure out we figured out what the poster was on his wall. And it turned out to be a very popular Nigerian rapper.

17:11And so that was just some interesting flavor. But where we really were able to make headway is after we had the true caller number and we were able to provide that to some of our contacts at home. I work with Professor Gary Warner from University of Alabama, and he was able to take that piece of information and give us back other pieces of information. And ultimately, he was able to give us the true name of this scammer. So now we've got the scammer's name, Next Stop Social Media. And then we started using our colleagues back home who do a lot of work in social media and OSINT, and they put that to work.

17:52And we were able to find other social media profiles that we hadn't found initially. And as we were doing all of this, we kept getting confused because we had our one guy with the face and the Nigerian musician. And then we had this other one where we didn't have a face, but we were able to figure out social media and phone numbers, and we were having trouble keeping track of both of them. And Paul said, I wish we had a whiteboard. And then Paul's like, we do have a whiteboard. He pulls out a dry erase marker, and we map this thing out on the mirror in Paul's room, trying to keep separate who each of these players are so that we can keep them straight.

18:32It is funny how we can all access stuff like Maltigo, and other various OSINT tools and that sort of thing. At the end of the day, you just need a whiteboard, or in this case, just write stuff down. I'm absolutely the same way when I'm trying to especially find the identity of somebody online and doing OSINT and that sort of thing. So you do that, you're mapping that out, you're getting closer. Paul, at this point, are you confident you have an identity? How do you overcome that confusion, sort of the fog of war, once you start mapping it out? Do you land on an identity and some more information?

19:14Yeah, so essentially in the past, the last 24 hours is when this whole case comes together. And I think that's maybe a little bit of our desperation, like just searching for answers and needing to find something. So when we get some of the results back on the open source searches and tools, I always take those with a grain of salt because there's all sorts of errors that can happen in that data. But the thing that really convinced me is when we got that TikTok account back, we looked through the TikTok account. It looks normal. It looks specific to the region. But then I start flipping through some of the recent posts.

19:48And on one of the carousels, I see, oh, six days ago, this person has uploaded a photo carousel. And it has blackmailing messages, like the same messages we were getting. threatening messages, threatening to leak news and, you know, make you go viral unless this person pays. And it even showed the name of the contact at the top of the chat was Jaden, in this case, so likely another victim. That to me was, I think, very convincing. And there's a part that comes a little bit later on when we actually get to confront our scammer where that social media profile then goes dark. It goes private, the username changes, all of these things change once the criminal knows we're onto him.

20:29And that to me is clear and convincing evidence. We have the right guy. We know who he is. Yeah. In the videos that you both have posted, you are traveling around with armed security, right? I think there's one way or a couple where you're in a Jeep and there's someone with like an AK-47 style assault rifle, that sort of thing in the passenger seat. Did you have security essentially for the entire trip? And I know this is somewhat of a stupid question. I feel like it's obvious, but why the need for that security? So I won't comment on when we did or didn't have security. But what I will say is that on the particular day when we were going outside the city of Lagos to a two and a half hour away remote location, it wouldn't be wise for two white people with cameras to show up unprotected in that location.

21:26It's unspoken, but certainly we all know that there are dangers in going to Nigeria. There are people who are kidnapped. It is a legitimate problem that people are kidnapped and held for ransom. We spoke before we went, we spoke with a number of sources about how do we keep ourselves safe? Is this smart? Is this doable? How would we do it? And so we really took security seriously. And I think there were points for both of us when we were contemplating this of, does this make sense for us? Like, is this too over the line? Are we really pushing too far this time? Or is this something that can be done with appropriate security?

22:06And I think for me, and I don't want to speak for Paul, but we really felt like we were in the hands of a fixer who had done this more than once, who had been responsible for people in that country and who provided them with adequate security. And that certainly made me feel a lot more comfortable about doing what we did. Yeah. How did you feel about it, Paul, about the security and the going to certain locations? Yeah, I think maybe three out of the six days on the ground, I probably had an internal thought saying, oh, is this safe? This can't be safe. There's no way this is safe. But then, right, relying on our fixer, relying on our local teams.

22:45I trusted them. So we made it out in one piece. So you have the identity and now it's time to find them and go confront them. How exactly do you do that? Do you send a message and say, Hey, we've identified you. We would love to meet you. How do you actually approach that, first of all? When we were going out there, we had been provided GPS coordinates as to where this person could be located by day and by night. And so we were going to those coordinates to see what we could see when we got there. So when we got to the first location, our fixer got out and started walking around to the building that we thought was the home of our scammer.

23:31And immediately, we're obvious. We're obvious. We're on dirt roads with a big car, with a man in the front, with a machine gun. And I'll tell you what, local people were not, I mean, we were obvious and we drew attention from the jump. And I have a great picture of this woman just standing there like this, looking at us like, what, what gives, what are you doing here? And then behind her was a man like on his cell phone. And we're, you know, we're talking about a village where everybody knows everybody. we stood out and the location we thought we'd find him was empty. And so I'll pass it to Paul to talk about what our fixer did next.

24:13Yeah. Our fixer gets on the phone and calls our suspect. Our fixer pretends to be a friend, maybe whose phone number is not saved in the phone. He says, Hey, I'm at your house. I want to come meet with you. That's generally just trying to set up a meet. And it starts to work. The first conversation I think goes well. Then the criminal calls back asking, oh, who are you? What's your name? Do I actually know you? So his suspicion has been raised now at this point. Eventually, the criminal does not immediately agree to meet with us. He is very resistant to this idea. He doesn't know what's going on.

24:52Now, we've already kind of created a bit of a commotion and a stir in the town, as Aaron mentioned. At the same time now, we also start to contact people who might know this scammer, people close to him, people from his social media, people from his contacts, for example. And we ask them, hey, you know, we're here, we want to meet Damilare is the first name of the suspect or Big Dollar. Can you let us know where is Big Dollar? We want to talk with him. And after a couple calls down the list, Big Dollar calls us back. A little bit of time has passed. Big Dollar is essentially begging to hear from us like, okay, why are you calling my friends?

25:32Why are you in my town? What's going on? He's kind of begging now to know what's happening. And then that's when we hand the phone to Erin. And she just does the most badass thing that I've ever seen. But what was that? I just confronted him. I started off with wanting to see what he would tell me. So I pretended that I was Braden's mom and that, hey, I know you blackmailed my son. And he starts in with, oh, no, no, my phone was stolen. I don't know anything about what you're talking about. And I am, you know, rebuffing that and saying, but you do, you know what this is. And he says that, but he's willing to help me.

26:12He's willing to help me figure out who did this to my son. And he's in his mind. He's getting off the phone with us on the under the guise of i'm gonna go help you I needed some time to do that And that's when I said no, i'm not brayden's mom at all. In fact, i'm a former prosecutor I'm here with the sextortion expert We came all the way from the united states to figure out if we could track down people like you and we have And then he kept trying to deny and and argue and And then I just got more stern with him and told him, look, we know exactly who you are. We know where you live. We've seen your social media.

26:49We've seen the evidence that you've independently put out there. And our next step is the police. And we're going to give this to the FBI. And you're going to stop doing what you're doing. And, you know, Paul was watching in real time as social media was getting privatized and names and social media were changing. and clearly there was an impact. I don't know that these people are being confronted in this way and certainly not by people who they know have been in their village this afternoon. I think it was an interesting opportunity to really put some fear in a class of people who aren't really afraid of being arrested.

27:33Yeah, because it's so, so rare for them. It's so, so rare for them to be arrested although it does happen in some cases, but it's pretty rare. And it's even rarer for two people to turn up to their town and be like, yes, we have a mask and we're going to keep talking to you. Does he agree to meet you? Or what happens? He's just like, no, I'm done. Right. Essentially, I think we were all done after that call. But we're armed with every piece of evidence about this guy. We know all kinds of information. about him and he's exposed. And so I hope that he continues in fear. So Paul, what happens next after that sort of phone call?

28:22Because we're getting right to the end of the trip here. As you say, the time was really counting down. So what happens next after that? Yeah, there were, I think, two big endeavors within our trip that we also tackled along the way trying to find our scammer. The first was interviewing nine other sextortion scammers and being able, you know, they were much more forthcoming. From those conversations, we were able to glean information about their tactics, how they target people, the apps that they use, the AI tools that they use. We also learned about the economy, the jobs that support the whole scam, right?

29:00There are jobs for people who sell the fake accounts, people who have the cash app and the Bitcoin and all the other payment systems. So there's a whole economy supporting the scam economy behind it. And then secondly was a ritual that we happen to see called a Yahoo Plus ritual. And, you know, this is, I think, one of the craziest experiences of the trip and also of my life. We get out of the van, you know, we're probably 45 minutes outside the city of Lagos. And Aaron and I are led down this very muddy hill into basically a field, a muddy field. It had rained the last few days with all these dilapidated houses that were up on stilts and made with corrugated steel and cardboard, you know, just a very impoverished area.