Disrupting a Gumtree Scam that converges with a Romance Scam
In western countries, less than 1 in 100 cybercrimes are investigated, and less than 1 in 10,000 are prosecuted.
So what can you do? We can’t “solve” these crimes, but we can disrupt the network of “money mules” that these scammers (usually in Western Africa), have set up, using romance scam pretexts, so that the money the scam from other people, can’t be collected.
Here’s how the scams typically work, followed by our disruption tips.
Our cyber investigators played along with an Australian Gumtree scam and pretended to be Bethany, who was selling a car. By playing along with the scammer, we obtained bank account details. This bank account turned out to be from an Australian man who was, unknowingly, involved in a romance scam.
By disrupting this scam we:
- Undid the months of work it took for the scammers to win the trust of their victim to get a money-laundering bank account,
- warned a man who was unwittingly committing a crime that carries a sentence of up to 10-years in prison.
How a Romance Scam works
Phase 1 – Scammer finds victim on dating site
A West African based man pretends to be a beautiful lady called “Amy”. Through sites like Tinder and eHarmony, Brian Smith from Australia falls in love with Amay, aka the scammer. Note, occasionally the male romance scam victims have a telephone or Skype conversation (voice only) with female actors. In some instances, these women are victims of human trafficking and forced to participate.
Phase 2 – Building a relationship
Phase 3 – “Amy” request to use Brian’s bank account
How a Gumtree Scam works
The Gumtree scam is taking place separately from the romance scams, and yet they are related, as you will see.
These screenshots are from email conversations between our investigator and the scammer. The scammer thinks our investigator is his new victim, “Bethany.” Pay close attention to find out how you can trick scammers yourself.
Phase 1 – Victim Bethany puts car up for sale on Gumtree and is contacted by the scammer
Phase 2 – Gumtree victim contacts scammer Bobby
Engage with the scammer as you usually would with a real buyer.
Phase 3 – Scammer wants to pay through PayPal
Phase 4 – Gumtree victim gives PayPal details
Give the scammer fake PayPal details. If it is indeed a scammer you are dealing with, he will “pay” you via PayPal, even though there is no real PayPal account.
Phase 5 – Victim receives FAKE PayPal confirmation
There it is. You are paid on your PayPal account, which doesn’t exist.
Phase 6 – Gumtree victim notices a mistake
The fake PayPal confirmation makes it seem like the scammer overpaid.
Bethany replies by email saying “I received the money, but you paid $1000 too much. Can you cancel and send the correct amount?”
Phase 7 – Scammer asks the victim to pay the truck driver
Phase 8 – Victim asks where to send the money
Play along and agree to the scammer’s request. Ask him where to send the money. This is where you will get the money laundering bank account details.
Phase 9 – Scammer gives Brian Smith’s bank details
This is where the Gumtree scam and romance scam meet.
Once the scammer believes the Gumtree user has fallen for the ruse, the two separate scam operations converge.
The scammer provides the Gumtree car seller with bank account details of the romance scam victim, pretending that he is a tow-truck driver. As long as neither victim gets suspicious, they will be none-the-wiser until it is too late to recover the funds, as explained in the following.
The Romance Scam meets the Gumtree scam
1. “Amy”, asks if her “friend’s” money arrived. Aka the Gumtree victim’s money.
2. Brian Smith, the money mule, converts “Amy’s friend’s” money to Bitcoin.
The romance scam’s money mule transfers the money he received from the Gumtree scam to the providing Bitcoin account. Brian has now, unknowingly, committed the crime of money laundering, which can carry up to 10 years imprisonment.
Nigerian Gumtree Romance Scam Convergence Laundering Process
Romance Scam – part 1
The scammer, aka “Amy,” finds victim Brian through a dating site.
After establishing a “love” relationship, Amy asks Brian if it’s ok for him to receive money from various friends who owe her money.
Brian provides his bank account details.
Gumtree Scam
Using a different identity, the scammer contacts Bethany about a car she is selling on Gumtree. Scammer moves contact to private email to reduce the risk of disruption of Gumtree administrators.
“Bobby,” aka the scammer, is offshore but offers to pay for the car through PayPal.
He overpays and asks Bethany to pay his tow truck driver. After receiving a FAKE PayPal confirmation, Bethany transfers money from her bank account to the “truck driver.” That money is her OWN money because she received nothing from the scammer. The truck driver’s bank account is Brian’s bank account, obtained through the romance scam.
Romance Scam – part 2
Amy asks Brian if her friend’s money arrived. Brian received the Gumtree victim’s money and believes it is from Amy’s friend. Amy asks him to transfer it to Bitcoin, which he does.
Scam completed
-
- Gumtree victim Bethany lost her money.
- The money is converted to Bitcoin, so it’s gone.
- Brian, the money mule, committed a crime without knowing it.
See how we worked with the FBI to unmask a large scammer’s network.
