A recent email scam has been uncovered by cybersecurity firm Proofpoint, featuring deceptive piano-themed messages aimed at perpetrating advance fee fraud (AFF) schemes. These fraudulent campaigns have been active since at least January 2024, primarily targeting students and faculty at North American colleges and universities. However, other industries such as healthcare and food and beverage services have also fallen victim to this scam. Proofpoint has reported that over 125,000 emails have been linked to this fraudulent activity so far this year.
The scam operates by offering a free piano in the email content, often accompanied by a fabricated story such as a family member’s passing. Recipients of these emails are then directed to a fake shipping company, controlled by the scammers, which requests payment for the delivery of the piano before it can be sent out. The fraudsters accept payments through various platforms, including Zelle, Cash App, PayPal, Apple Pay, and even cryptocurrency. Additionally, they try to extract personal information such as names, addresses, and phone numbers from their victims.
One significant finding in the investigation was the discovery of a Bitcoin wallet used by the scammers, which has facilitated transactions totaling over $900,000. The high transaction volume indicates that multiple threat actors may be utilizing this wallet for various scams. Despite the consistency in email content, the sender addresses vary and are composed of combinations of names and numbers, typically utilizing free email services. These campaigns also display several variations of email content and contact addresses.
To delve deeper into the workings of the scammers, Proofpoint engaged in conversations with them, employing a researcher-managed redirect service to capture one scammer’s IP address and device information. This data led researchers to deduce that a portion of the operation is based in Nigeria. Advance Fee Fraud, also known as 419 scams, involves scammers soliciting a small upfront payment in return for a larger promised payout. These schemes often involve elaborate narratives about inheritances, job opportunities, or other enticing offers. Once the victim sends the initial payment, the scammers cut off all communication and abscond with the money.
These fraudulent activities heavily rely on social engineering tactics and a variety of payment methods. Given this, Proofpoint has cautioned the public to remain vigilant. The company advised individuals to be aware of the common tactics employed by threat actors and to remember that if an unsolicited email seems too good to be true, it likely is.
In light of these developments, it is crucial for individuals and organizations to exercise caution when dealing with unsolicited emails offering enticing deals or opportunities. By remaining vigilant and informed about the tactics used by scammers, people can better protect themselves from falling victim to advance fee fraud schemes.