Intro

Just a few days ago my girlfriend and I witnessed a variation of the Nigerian Prince Scam, that I want to share with my readers. The information about this scammer was not yet available online through search engines, and thus I want to post it here, hoping that it will help others who happen to be targeted by these fraudsters.

The Premise Of The Scam

This scam targets rising content creators on Instagram, YouTube, TikTok and other social media platforms. My girlfriend happens to be a content creator on those platforms as well. Her accounts have several thousand followers, and thus it may not be unusual for her to receive offers to run promotions on her channel.

She is usually very careful about the messages she answers, especially concerning various unsolicited offers. This ploy though was somewhat elaborate, that took fraudsters a lot of effort to pull off. Thus we played along to see how far they can take it.

The Scam

As it often happens it started from a message that my girlfriend received to her Instagram account. It came from someone named Derran_weldon, using the handle _.weldon._ (which is most certainly a stolen Instagram account.) The account read:

Digital creator
Being kind and stylish have one thing in common💼
Both are a touch of class♟️♟️
fashion.
•|corporate model scout promoter
likeshop.me/sephora

As you can see that account had four thousand followers, thus it looked believable. My guess is that they either paid to get those followers, or it was a hacked account. The pictures though were quite suspicious, showing some stock images of men in suits, and probably a couple of stolen images of some guy.

The introductory message read:

Hello ..
My name is Stanley, working with @sephora, a beauty and merchandising franchise based in European-American market...
Your profile was brought forward by one of our scouting teams in your region. and I would like engage you and discuss a marketing opportunity with our brand as part of our an expansion program if you would be interested ?

The conversation that ensued lasted for a few days. I should give it to these scammers as they refrained from going for the money for quite a long time and sounded quite professional until the very end.

I will include some excerpts from what they messaged my girlfriend, in case they are using a pre-written script and someone finds it through Google search:

I'm pleased to hear from you.

We are looking to expand our market into three African region.. North, East and the southern part of Africa according to my algorithm I presume you are from Kenya region in Eastern Africa?

According to research Africa is one of the fastest growing fashion hubs in the world. We would like to tap into the market and explore as it grows.

Over the past 10 years, fashion and beauty has taken a huge step forward in Africa and is a vastly growing industry.......the problem is, you don't have too many resources and even the ones that are there tend to get older, trends keep coming in so a lot of people are forced to have to shop from other countries to keep up.

Then after priming her, the scammer went for the punch line:

Well we would like to first test out and showcase our brand and merchandise out there through models and ambassadors who are familiar with and are from the regions. With a target number of up to 200 professional and micro regionalised creatives to assist by getting response from different demographics before we can set up shop.

I've checked out your feed and been able to go through your profile and I think it's really got some potential with a creative originality.

I would like to work with you on this. With a little bit of guidance and work on your page you should be able to run this.

Why don't we get down to a brief on strategies and a few questions to assist determine your eligibility and capabilities to work with with us on this. And you may also understand what exactly we are after.

Would you be comfortable with and open to collaborative assignments with other models and ambassadors throughout the course of the project?

And are you able to and available for travel whenever the need arises?

This will simply be promotional tasks handed out to you with instructions on how to carry them on working with other creatives, As for travel this is not currently a mandatory requirement but upon advancement of your working capacity we might be tasking you with specific projects within or outside your region which will require your physical participation including product launches and much more.

In that case, I think everything is in order but before we can decide what position you can work with us in there's a couple of things we need to look through first.

Our tech team shall be analysing your account, and based the public outreach capabilities portrayed we can decide what capacity you can work with us in.

I have forwarded your account details for analysis under the position for potential ambassadors in the region, as soon as they are done I shall get back to you with the results.

Through a similar algorithm as we use to determine potential profiles from specific regions our tech team analyses your account through your posts and audience interaction in order to determine the best working capacity suiting your capabilities and asign you a position as an ambassador, influencer or brand promoter.

Quite promising so far, hah? Who would say no to that. 😁

Then after a few days, the scammer continued:

Your account review results came out and we are pleased to offer you an intern ambassadorial position with us... This comes with constant supply and update of merchandise for promotion purposes and a substantial allowance that runs with it too.

I am glad you are pleased with the position we offered.

I have also gone through your account's technical analysis and they are not bad. This just enables us to decide on a starting position and working capacity which is always open to growth and advancement as we work together for longer and entirely dependent on your output and determination but at the moment we are currently able to offer you an ambassadorial position as an intern for evaluation and during the course of our expansion project. After that we can always revise the position depending on the deliverables and the dedication you put into your work.

For the marketing opportunity we are presenting you in capacity of working with us to create content for products that Sephora stocks and see the metrics and analytics your posts would have on specific demographics and maybe potential clients wanting to purchase from us.

According to our calculations and your country's economic statistics we concluded that a 350$ weekly allowance and free access to promotional merchandise together with content creation and communication gadgets would be enough to cover your professional expenses minus travel costs and allowances.

This is subject to review depending on the derivation of work you do and advancement in working capacity.

As you can see, these lines sounded quite professional. They were either stolen from an actual talent scout, or they are employing one of those guys to type all this. In other words, it was somewhat believable.

Stage Two

At this stage though my girlfriend started to have her suspicions about the whole thing, and she decided to ask the scammer if there's a contract for this position, to confirm what she was already thinking. For which they replied:

Since your position is currently internal there is no official contract to be signed, but once we are done with setting up or even in case of any advancement in your working capacity then a contract shall be drawn up.

Then the scammer went for more priming. The next message, after a day or two, included a request to send my girlfriend's pictures and the address to send their promotional merchandise to:

Let me have your details: hair specifications and skin complexion together with your shipment details so I can forward them to the packaging team.

And also a couple of portrait photos with clear appearance of your natural hair and skin, preferably with minimal or no make up. This will help us discern what exactly to get you.

Quite professional stuff, isn't it?

Then they sent her an example of what they want to receive:

One can only imagine where those images came from. This was probably one of the victims of these fraudsters.

After a while, they decided to expand their reach by switching to another platform:

Do you have WhatsApp messenger?

I have briefed one of my associates from logistics,
+358 75 3252997

Interestingly enough, the country code for the +358753252997 phone number points to Finland.

That is Therese please reach out to her and share both the portraits and shipping details with her.

That is her contact number, reach out to her WhatsApp and she will direct you on what to send and get your package ready.

My guess is that WhatsApp allowed them to expand the conversation in case Instagram blocked them.

Stage Three - WhatsApp

At this stage we were introduced to a new character, Theresa Sefora, with the WhatsApp account registered under the number +358 75 3252997:

If that's a different person, she didn't waste any time and jumped right in:

Hello misse👋.

Pleased to e-meet you.
I was informed to await communication earlier, you were to reach out with your details and specifications....

Although saying "she" is probably an overstatement. Let's just use a generic "scammer".

For your shipping details, let me have.. names, email address, phone number and delivery location for the freight company.

We provided her with the shipping address. At this point we were curious to see where this will lead to:

I am fowarding these to the packaging team to work on your disbursal.

Once they are done I'll get back to you with the pictures and specifications of whatever we manage to get you.

Then after a few days we heard from her again:

Hello misse 👋

Your package is all done.... We shall dispatch the batch to ship out later in the day

The details for shipping I shall share once I receive from the courier company.

Now it was getting interesting.

Would you like to see?

Just a minute let me fetch your parcel specifics.

For sure, show us the loot!

These are some of what we managed to get you.

Followed by some stock pictures of Sephora boxes, mixed with images of DSLR cameras and iPads:

She continued:

We got you merchandise that you can work with over a span of 4-6 weeks.

All the make up products are in three shades closest to your complexion, I will need you to confirm the exact shade that suits you once you receive the package.

For communication enhancement, this is so that your agent can be able to communicate via bino Skype and with much ease we've sent out an ipad device for better and easier access to you or when we need to discuss your daily output ideas whenever necessary. This is also to assist with tracking your work progress and records.

This was now getting funny:

This also comes with a precoded Sephora guide software.

We are a multinational brand and quality in whatever we present out there is key to ensure we maintain a certain standard.

Hey, why not! iPad with junkware.

They were shipped earlier via express services and which ensures delivery to your doorstep. We also managed to clear both the shipping inclusive of doorstep delivery charges.

Ah, now she is getting to the point.

A few days later, to drive point further, the scammer started with her derogatory:

Hello misse 👋

I am sure you will love the products even more once you get to try them out.

The package is on a 31hr flight to your region we shipped them out earlier today. As soon as the parcel is in country the freight company will contact you using the details you provided earlier on how to receive the parcel.

OK, we're waiting ...

Stage Four - The Courier

We kinda forgot about this whole scam for a while. One morning we were reminded about it by a phone call from 0732 838 891, a Kenyan number 254 732 838 891. A guy on the phone told my girlfriend in Swahili (because he was struggling to speak English) that her package was delivered but she needed to confirm the tracking number for the package, that we could get from the email that they sent.

Oh yeah, that's exactly how shipping companies operate. 😂

The following was the email message from Sephora Africa Direct mail with return address sephora.org.africa@gmail.com:

Subject: SHIPMENT INFORMATION

Dear esteemed customer

Thank you once again for choosing to ship with your reliable and efficient expert partners @Global Express shipping.

Your parcel has been dispatched!

Attached are your shipping details for a package order GEC/5HNBO released on the |27•09•022•|

Tracking Number-1315890216-GEC
Packaging Order -12242278es3337
Warehouse pin-M0345IAT

ETA0031hrs
https://globalexpressintl.websites.co.in is our service website link...feel free to check us out and be sure to leave us a rating.


GLOBAL LOGISTICS Express.

W/app:+254 - 753529888
Call. :+254 - 780037796

2022 ©GLOBAL SHIPPING. all rights reserved.

*shippers copy. To be shared with only the intent recepient *

I have to point out a few immediate red flags in this missive:

1. The return address is a gmail account. Not very professional for Sephora to use one. 😂
2. The website for the "GLOBAL SHIPPING" company was hosted on a free Indian web hosting platform websites.co.in. Hmm, they must be really tight with their finances.
3. Bad English grammar and misspellings.
4. Both phone numbers for contact were based in Kenya, while Google search for that name didn't give any good results.

So after we called the guy back and told him the tracking number, he informed us that:

• Shipping charges ... were cleared.
• Packaging charges ... were cleared.
• Merchandise charge (btw, he named the actual items that were sent - what a talent to see through sealed boxes!) ... were cleared.
• Then was a long pause ...
• Customs charges ... these have not been cleared!

We asked him how much was the customs charges, and he replied that it is $89 USD (in Kenyan Shillings) and that there's no way to bypass those, as those are imposed by the government.

We told the guy that we weren't aware of any charges, and that we need to confirm ...

Then my girlfriend wrote to the previous character Theresa, asking about the charges for passing customs. For which she replied:

Pay!?

Everything was taken care of including doorstep delivery!

Oh no, she didn't know 😁😁

I was not aware they charged duty for non commercial parcels too.....

How much exactly is that and Is the fee payable to the same accounts as when we were shipping?

Good acting!

After we told her the amount for the "customs charges", her amnesia seemed to have disappeared:

Seems like they do.

I think it's the same account.

Who could've thought?

I am reaching out to the finance department to inform them of the same.

I will be reaching out our Attaché to the freight company and find out what exactly is the procedure for clearance of the parcel.

Oh sure, we're waiting...

Stage Five - The Invoice

Finally, we heard back from our friend Theresa Sefora, that said:

Hello misse I am sorry but I don't have any conclusive communication as of yet but I am informed that custom duty is mandatory and it is advised that we clear our parcel out as soon as possible to avoid losing it in storage.

Followed by an email from info.service.globalexpress@gmail.com, with a link to a free Australian invoicing service Bookipi:

Subject: NOTICE OF ARRIVAL: Invoice from Global express courier

Dear esteemed client,

Your parcel has arrived!!
Thank you for shipping with us.
Your parcel #PO-12242278ES sent on express charter has arrived pending clearance and delivery.

Attached please find a copy of your invoice from Global logistics services.
Please clear or collect your parcel within 24hrs to avoid accruing of storage facility charges.

Thank you.

GLOBAL LOGISTICS express


2022 ©GLOBAL SHIPPING. all rights reserved
Amount Due : $89.25

https://i.bookipi.com/<redacted>

The email contained an attachment with the invoice (you can download it as PDF.) I'll copy and paste it here as well:

Invoice
Global express courier
Airport North road, Tana house
KPA Premises building 7
Nairobi Nairobi 254
KE
https://globalexpressshipping.websites.co.in
+254753529888
globalshipping.co.ac.info@gmail.com
Tax Reg No.6678/019 : ISO 00056019

Invoice # INC/GEC11079


Combine make up kits - x3 - $10.05
*no description*

Panasonic Lumix DMC camera - x1 - $20.04
Brand new camera with all accessories

Tripod stand with ring light sets - x1 - $9.33
Brand new tripod with fragile lighting equipment

ipad 11 Pro 2021 - x1 - $22.50
Brand new ipad with accessories and extensions.

Serated gift pack -x1 - $14.00
*no description*

Tripod stand with ring light sets - x1 - $13.33
Brand new tripod with fragile lighting equipment

------------------------
Amount Due: $89.25

Payment Instruction

M-pesa till :9528073
HOC-0114858800(DIANA NGENE)

Multiple questions that come out from this invoice:

1. Why an older iPad. 2021! That's all they could do?
2. Is that a real address in Kenya in the header?
3. And finally, who is DIANA NGENE that registered the M-pesa "Buy goods" account under the till number 9528073? I wonder if Safaricom knows about its use?

At this point we were done answering our questions, we had no doubts that it was a scam. All we could do now is waste more time for these scammers in hopes that this will make them defraud one less person.

I then proceeded to report all their accounts to appropriate services.

Safety Tips

Having shown the elaborate scheme that scammers used to play us, I want to give you a few tips that may help you not to become a victim of this variation of the Nigerian Prince Scam. In no particular order:

• If you didn't ask for it and received some sort of a deal, it is most certainly a scam. Be very skeptical and don't engage the senders.
• Most scams come unsolicited via email, phone, SMS, or instance messages that you may receive on social media.
• Obvious misspellings in emails and in websites. Bad English grammar.
• If some agency contacts you regarding collaboration, verify that they use an email address with the company's domain name. For instance, for Sephora, it should have been persons.name@sephora.com and not sephora.org.africa@gmail.com or some other free email account. This should be an immediate red flag for you.
• In the same vein, a company website should not be hosted on some third party service, eg: websites.co.in.
• Before engaging a potential recruiter or a talent scout, confirm with the company by going to their website and by contacting someone from there.
• If someone offers you something of value and then asks for a small payment to send it to you, this is the basis for the "Nigerian Prince Scam". Don't engage them any further - walk away and block the caller.

And finally, scammers always create an urgency, or a rush to act upon the deal before it goes away. Don't fall for it, take a break and think twice before making your next decision.

Conclusion

The scam that I described above was quite sinister. It targets budding content creators on YouTube, Instagram, TikTok or other social media platforms that struggle to build their online business. It plays quite well along the lines of real talent scouts and promoters that may send messages to content creators, which makes it quite believable and dangerous. Thus, it is very important to stay vigilant and pay extra attention to who you are engaging with, especially if you have an online following.

And be very careful when someone contacts you online. Follow the rules of thumb that I outlined above. And remember, if it sounds too good to be true, this is most certainly a scam!

I hope this post helps you stop scammers before they strike. Stay safe!