Attention! Financial scam targeting Less Wrong users

Recently, multiple suspicious user accounts were created on Less Wrong. These accounts don't post any content in the forum. Instead, they are used only to send private messages to the existing users.

Many users have received a copy of the same message, but different variants exist, too. Here are the examples I know about. If you have received a different variant, please post it in a comment below this article:

 

Hi good day. My boss is interested on donating to MIRI's project and he is wondering if he could send money through you and you donate to miri through your company and thus accelertaing the value created. He wants to use "match donations" as a way of donating thats why he is looking for people in companies like you. I want to discuss more about this so if you could see this message please give me a reply. Thank you!

 

hi. ive made 500k+ the last half year on esport betting and i can show proof. i was a great poker player before that so i have reason to believe i am good and wellsuited at this. i want to offer free education to one of the efw people that have their priorities straight in this world and will work towards minimising existential risk. the higher intelligence the better. ultimately i would like to offload some work to someone because currently i am gettin gquite a bit burnt out and i would like to study finance, and having someone take advantage of the incredible ineffeciencies in this area is of huge importance. i would like to discuss this with someone and how to make it real, and have exchange of thoughts on all of the aspects on how to best do it. i can post proof and make donations to miri to show im serious so that we or someone else could have a discussion about it

 

I don't know yet about anyone who replied and got scammed, so this is all based on indirect evidence. If you got scammed, please tell me. If you are ashamed, I can publish your story anonymously. Your story could help other potential victims.

Most likely, the scheme is the following:

  1. The scammer will send you money.
  2. Then they will ask some of the money back because they changed their mind, or they mistakenly sent you more than they wanted, or their financial situation suddenly changed, or whatever.
  3. After receiving the money from you, they will flag the original transaction as a fraud, so they get back the money they originally sent you, plus the money you sent them back. Then they disappear, or it will turn out they used a stolen identity, etc.

(Thanks to ChristianKl for explaining the system in the Open Thread.)

If you replied to the original message and now you are already in the middle of the process, please inform your bank as soon as possible! Even if the step 2 didn't happen yet, so you can still get out without losing money, warning your bank about the scammer could help other potential victims.

 

Warning: If you have already received a check or a payment confirmation, and someone is asking you to send the overpayment back quickly, do not send anything. The check or the payment confirmation is fake, and the goal is to make you send money before you find out. (Thanks to qsz for explaining.)

Comments

sorted by
magical algorithm
Highlighting new comments since Today at 2:49 AM
Select new highlight date
Rendering 50/94 comments  show more

If I wanted to run an experiment to test how susceptible to scams the LW community actually was, this is exactly how I would do it.

I would probably use better spelling in the messages. It reduces credibility of the scammer.

no actually; they want to weed out people who notice spelling. If you notice spelling you also probably notice scams. (this is a commonly known pattern of email scams). if only good scammable people respond; all the better for them.

Today in Hacker News there's a research article speaking exactly of this.

https://news.ycombinator.com/item?id=11909111

Makes me think that a possible method to mitigate spam would be to answer each email with a LSTM-generated blob of text, so the attackers are swarmed with false positives and cannot continue the attack. Of course, this would have to be implemented by the email provider.

Please note, in most versions of such scams the perpetrator does not actually send money (as in step 1 in the OP). Instead they use some combination of fake checks (yes, printed checks!), fake "payment confirmation" emails or fake websites along with social engineering and time pressure, to make the victim think money has been sent, in the hope that they will "refund" the overpayment before realising the initial payment was not real.

So if you're reading the OP and thinking "I can just collect the money in step 1 and then ignore the refund request" (whether planning to donate yourself, or even keep it), it's not likely to work out either.

Gotta give props to them for steelmanning their marks. Leswrong cant be the most gullible user base.

I was messaged by and responded to both. I suspect they're different people.

I also am not sure they're scams in the traditional sense. An employer match is the sort of thing that encourages this sort of thinking:

Whether or not this is within the letter of a match policy depends on the specific policy, but it's typically against the spirit and recommended against by Double the Donation. So even if there is no lurking chargeback, I would caution against this as burning the commons for short-term gain.

Also, if you have a strange story, keep Robin Hanson's recent Facebook post in mind:

If someone ever wants to give me $1M+ out of the blue, I hope they'll do more than send me an email w/o phone number I could call to confirm


Keeping that in mind, so far hans_jonsson seems legit. (I've only put a moderate amount of effort into verifying his claims.)

I was messaged by and responded to both. I suspect they're different people.

Update: they are different people, but the first one was working for the second one.

I also am not sure they're scams in the traditional sense.

If there is nothing fishy, why do they contact people via private messages instead of posting in the forum?

Typically the reason for contacting people individually, when the public announcement would be the natural way, is to prevent the contacted people from seeing each other's reactions.

If there is nothing fishy, why do they contact people via private messages instead of posting in the forum?

For the first, one may want to not have a public record of attempting to subvert systems; for the second, one may only want to discuss it with specific people instead of anyone who expresses interest.

Note also that our anti-spam measures means that, as far as I'm aware, a new account can only start out posting about this sort of thing in the Open Thread, which may be non-obvious to someone who spends little time on LW.

I and some of my friends have gotten emails from scammers who say they want to buy several paintings from my artist website, but are moving and want to use a bank check- or something similar. What I have done is reply that I will only accept payments through PayPal. Then I never hear from them again. Bitcoins would also work. The problem with testing it out by accepting a check or Bank order and depositing it in case it is for real is that you will get hit by a hefty fee from the bank if it bounces.

After the Nigerian space scam, the Nigerian rationalist scam. The first was surreal, but this... chapeau.

I was surprised to see mention of MIRI and Existential Risk. That means that they did a little research. Without that, I'd be >99% sure it was a scam.

I wonder if this hints at their methodology. Assuming it is a scam, I'd guess they find small but successful charities, then find small tight-knit communities organized around them and target those communities. Broad, catch-all nets may catch a few gullible people, but if enough people have caught on then perhaps a more targeted approach is actually more lucrative?

Really, it's a shame to see this happen even if no one here fell for it, because now we're all a little less likely to be receptive to weird requests/offers. I suspect it's useful for EAs to be able to make random requests of specific people. For example, I can imagine needing a couple hours or days of consulting work from a domain expert. In that situation, I'd be tempted to PM someone knowledgeable in that area, and offer to pay them for some consulting work on the side.

I can actually think of 2 instances where this community has done things like this out in the open (not PM), so it wouldn't surprise me if there are occasional private transactions. (I'd link to examples, but I'd rather not help a potential scammer improve on their methods.) Perhaps a solution would be to route anything that looks suspicious through Bitcoin, so that the transaction can't be cancelled? I wouldn't want to add trivial inconveniences to non-suspicious things, though.

Yes, scammers do the homework needed for this kind of project. I know someone who lost around $8,000 due to a scheme like this, through a letter which seemed completely familiar with my friend's interests. However, when I saw the letter (after the money was already lost), I informed him that it should have been evident from the beginning that it was a scam.

Just mentioning, but It's a good policy to avoid feeling good about figuring out anwers you already knew. ---> http://lesswrong.com/lw/il/hindsight_bias/

We have a pretty stupid banking system if you can cancel a transaction after the target has had time to make a transaction back to you. Or it should be straitghforward and fee-less to cancel that second transaction as a consequence.

"We have a pretty stupid banking system if you can..."

Yes, we do.

It's a complicated system that developed slowly, piece by piece, influenced by legislation, commercial pressures, other (contradictory) commercial pressures, and customers' needs. The need for backwards compatibility makes it impossible to rip up the old system and start again, and no one person is in charge of designing it. Naturally it's messed up and has inconsistencies.

---Meta comment: At first I was writing this with the intention of saying, basically: "Duh! isn't that obvious?". Now I realize that that's really unkind and unfair.

You've encountered something that you hadn't known before, and you "noticed you were surprised". That's a good thing, and it's good that you expressed it so that other people can realize the same thing.

  1. You might want to repost this to Discussion if your intention is for the thread to get as much visibility as possible.

  2. I haven't looked at facebook today but this could be a good thing to repost to the facebook group.

It is promoted now, so it will stay on the main page for a longer time. (I don't know how long the scammers will stay here.)

I reposted it in the facebook group.

Surely, as rationalists, we should do a controlled test to determine if these are scams? This will require some blindly chosen users to respond in a variety of different ways, some of whom should go through with the possible scam, and report the results.

EDIT: I think it's time to come clean. No, I am not the scammer, but this post wasn't serious. I'm rather surprised anyone thought it could be, to be honest!

No, if we're rationalist, we should figure out if the cost of doing the tests is worth the expected gain from getting the test results. If we're fairly certain that it's a scam already (so test results won't change the situation much) and if the tests are expensive, it might be a better idea not to test.

If we're rationalist, we don't start our reasoning with "If we're rationalist, then...".

Surely, as rationalists, we should

So awkward it hurts that this is even a thing.

Surely, as rationalists, we should do a controlled test to determine if these are scams?

Why? Why do you believe that spending resources to run a controlled test is worth the effort?

Has there ever been any investigation to their identity?

None that I'm aware of.

I suspect that no one actually fell for the scam... or if they did, they are too ashamed to admit it... so there is nothing specific to investigate.