Ukraine dating scams going to miam her
After opening the mailboxes, next step is to "fill them up", as they call it, or in the Russian scam slang: "zakidka". That means to get as many letters from their potential victims as they possibly can, per each mailbox. This task can be accomplished by 2 ways: either through the dating sites, or by purchasing a database of e-mails of "amers" and spamming them. "Amer", "pindos" or "loh", that's how they call their victims.
If they choose to do it through the dating services, the next step is acquiring a database of stolen credit card numbers and PayPal accounts. These are sold by hackers and can be obtained on the Russian Internet.
After that, all depends if it is a scammer-beginner, or a "boss". The scammer-beginner usually does all dirty work himself, and "filling up the mailboxes" is considered a dirty work. So, in some cases, the ones who place profiles on the dating services and contact you over there are not the ones who will later conduct correspondence with you via e-mail.
Their preferences of the dating services are: the ones that don't boot them off too soon (let them last at least 4-5 days), that don't have too many warnings about scams, that allow them to easily pay with the stolen credit cards, and of course the ones where they can get the most response from victims and make money. They like big paid sites, like Yahoo Personals, they get most of their "revenue" from there. They still use the smaller free ones, but they know that on the small sites are mostly "hunters", that's how they call scambaiters. Also, their logic is: "on the small free sites are cheap losers who cannot afford paying for memberships" (their words, not mine!).
For webmasters: please, DO post warnings about scams!! With big letters, on the mailbox pages. It DOES work, and scammers hate it. They started hating match.com because of that. It cuts their revenue. Many people fall victims not because they are dumb, but simply because they are new to the Internet and never heard of these types of scams before. Most people are NOT dumb, and a simple warning on the dating services will do the job! They will be more careful.
OK, so they signup on the dating services (this is called "fishing" on their slang) and pay for their memberships with the stolen credit cards. Of course they don't say they are from Russia, because the stolen CC is issued to some person in another country. Further more, when they signup, they use socks proxies. They don't sign up through their own IP address if they are planning to use a stolen CC. This proxy MUST match the location of the real owner of the stolen credit card. They pay a special attention to it. They get their proxies from the paid lists like this: 5socks.net, these are NOT free anonymous HTML proxies. These proxies are hard to detect. Especially if they match the credit card addresses!
Again, for the webmasters: if you accept credit cards and PayPal, and some girl pays, but looks Russian: judging from her picture, from the bad English in her profile which looks like online translator, and most importantly if she starts mass-mailing men, delete such profile immediately and refuse the payment! Even if her IP address looks OK. IP bans and IP checks are not as effective as they used to be: nowadays almost every "scammerito" knows about socks proxies. If you don't remove her, sooner or later you will get a chargeback.
After they signup and pay, they start contacting men. The times of massive mailings are almost in the past. Well, of course if a dating service is so bad to allow that, they will still do it. But most services are already aware of it, and don't allow to send more than 30-50 letters per day. And scammers know that they can get booted off for mass-mailing. So, they try to sign up on as many sites as they can, and send about 10 letters per site per day, so it doesn't look very suspicious. Still, believe me, 10 letters per day for a REAL Russian girl is too much! Their search criteria is usually set from 30 to 50-60. Too young is bad (no money!), too old is also bad (suspicious). They leave their e-mail address in mailings and ask to contact them there. If they can, they also sneak their e-mail addy in profile, or onto their picture. This is how the "filling up of the mailboxes" starts.
Some statistics: they fill up 600-1000 victims per mailbox. This takes them 2 days of work, 3 hours per day. Out of this amount, there are 100-200 actual victims left per mailbox. The rest are either not interested, or don't reply, or become suspicious.
The other way of filling up the mailboxes is buying the databases of e-mails. There are many offers from such sellers in forums and on ICQ. The price depends on how fresh are e-mails and if the have been worked out already. This is where e-mails to your private e-mail box "out of the blue" from the Russian girls come from. If you get one, this is a 100% scam. Sometimes "mailbox fillers" do their dirty job, and "bosses" then re-sell the filled up mailboxes to other scammers, for further work.
Stage 2: correspondence.
Next stage is correspondence. Once again, they try more and more often to use socks proxies. Most likely, soon we will not see Mari El IPs at all. Still, it doesn't change anything: please DO check e-mail headers. If you see something that should not be there, it's a scam. Their IP should be from Russia and correspond the city they claim they are from. Or at least some nearby big city. No American IPs, no Canadian IPs, no British IPs, and definitely no Latin American or Asian IPs!
But the main reason they use proxies is not even to fool their victims. They know that most men are not going to check the headers, so if it was just men they wouldn't even bother, considering that it costs them money to use socks. They are doing this mainly to hide their IPs from authorities. Because they know they CAN be traced if authorities know their real IPs and wish to do something about it. Their providers keep logs and see their moves. They work hard to hide their traces, and sometimes even hide behind not one, but a chain of proxies. Once again: if you see something in headers that shouldn't be there, it is a 100% scam. Anyway, since they are afraid so much to show their IPs, this is what authorities should look into. Probably set up much tougher censoring of all Internet providers in Mari El.
Their letters is just a bunch of templates that they also purchase from each other. These templates are written in Russian. They translate them into English with programs, like Prompt. The dead giveaway is that bad stupid English generated with a translator, aka "Scamglish". I don't think this part of their scam ever gonna change with most Mari El scammers. And not because they don't speak English. Some of them do, and much better English than in those letters. But there is a LOT of templates. If they had to translate them manually into a good or least somewhat better English, this would be very time consuming. If they had to pay somebody to do the job, or purchase English templates, this would cost them too much money. And they are cheap!! You wouldn't believe how cheap they are! They say, Americans are greedy. This is nothing compared to how greedy they are, and with all that money they make of scams. The letters from Lugansk scammers are better in this way. Their letters are written in good English, but they don't have such a high volume of correspondence as Mari El does, so they can afford it.
The templates have some spaces to fill in. Like names, cities, age, some small phrases. These spaces they don't fill in manually. This is the job of The Bat!, it is designed to work with templates, and they configure it to fill in those spaces with whatever is necessary, automatically. If they do read your letter, they will answer a question or two in postscript, so it looks more natural. But the template itself they wont change. Too much trouble!
Now, their photos. Most sets of their photos are stolen from the Internet, from Russian social networks like vk.com. Most girls on the pictures are NOT scammers and have no idea their pictures are stolen and used in scams.
However, scammers sometimes also purchase the sets of photos of real girls, who pose for money and will do personalize pictures. Some scammers have their own girls. They work with scammers. These are the most valuable ones, and if they end up on the scamlists, they get upset. Some good scamlists, like agencyscams, which constantly publishes pics of their real girls, make them especially mad. But they are very unwilling to give up the pictures, even when those are already "burnt" and listed. As long as somebody is still paying, they will use and re-use it till the very end. The good looking real girls are not that easy to get. And they are not really afraid, because they can always say: "somebody stole my photos". That's what they think. Wrong! Another thing for authorities to look into. So, guys please DO check scamlists and browse pictures!! The pictures with signs can be easily altered in photoshop. What they hate is when guys ask to send pics of a girl blowing a kiss. That really pisses them off. So DO IT! Most of the passports and visas templates they find through a Google image search. They alter them later with their own pics and name.
OK, and finally the tendency of correspondence. The scammers already figured out that falling in love in 2 letters is like "showing a red rag to a bull" (their words!). So, that probably is going to change eventually, will require more work on their side, but nobody said scamming was easy! LOL
They have girls who speak good English, German, whatever. They use them for the phone calls, they call it "prozvon". Mostly use Skype. They also "sell" those girls services to scammers-newbiees. I don't know how good these girls speak English, but if you get the garbage-like, barely understandable letters, and all of sudden a girl calls you and speaks relatively good English, maybe just with an accent, that's a red flag! Shouldn't she speak the same garbage as she writes? ;) They don't like chats. They say it takes too much time. But they may do it if you insist. So, a messenger chat is not a sign of a real girl.
Some scammers say that they never ask for money directly but wait until a victim offers first. But most agree that it's too long to wait. They like to picture some hard situation, then in the next several letters explain how expensive it is, and here it comes: hit for money. That's besides visa and ticket scams, of course.
Stage 3 (final): picking up money.
The women who pick up money are called "drops". They are paid to do that. This is the most tricky and risky part for scammers. The drops don't write letters and usually never even show up in the scammers offices. Because most scammers who got caught were traced through their drops. This is the growing problem for scammers, because Western Union becomes more and more strict, in many locations they started taking photocopies of drops passports. Besides, WU maintains its own blacklist of drops, so in many cases when you are about to transfer money, WU can tell you right away that it's a scam and refuse the transfer.
Unfortunately, it works only if you transfer by telephone or via Internet. In your local WU location they may not have a list and not tell you this info. Nowadays scammers try to avoid suggesting their victims to transfer via Internet or by phone, and try to convince them to go to a local WU location, which is BAD. But even this small progress of WU makes scammers pretty much upset.
They try to find alternative ways of getting money. Like direct bank transfers. Or, which is more popular, to use the special services, which use their own drops, they will pick up money for scammers and transfer money into their WebMoney accounts. WebMoney is a system similar to PayPal, but in Russia. This process is called "obnal". But "obnal" is costly, they have to pay up to 35-40% commissions, and they hate that. They are greedy, remember? :)
Anyway, their problems with money pick ups should be something that authorities together with WU may look more closely into and make it even harder on them. What is bad for scammers is good for us! In the meantime, for the scam victims: DO REPORT TO WESTERN UNION AND MONEYGRAM! Wherever else you choose to report or not to report (reporting to Embassies is less effective, because most likely they will never apply for visa), but a Western Union report is a must! You may not get your money back, but may save several victims who come next.
Scammers and scamlists
Scammers hate scamlists. They are their major enemies. That's not a news though.They even discuss some "brilliant" ideas of hiring hackers to perform the DDOS attacks against scamlists (yawn). They also discuss how to "whitelist" their blacklisted girls: to tell men that "she was corresponding with some jerk, and he started asking for her nude pictures, she refused and he placed her on the scamlist as a revenge". Old story! They even discussed the possibility of creating their own scamlist of men who supposedly do the above-mentioned thing. Of course, the candidates for that "list" are those who refused to send money. But even scammers themselves agree that this idea is stupid, these "lists" will very soon end up on the real scamlists too, and nobody is gonna buy it. They even have a small list of scambaiters, but the list is so pathetic! The bottom line: they hate scamlists and scambaiters. So, guys keep up the good work! Keep listing and keep baiting.
Well, and finally, to sum it up. Yes, most scammers are men. Some of those who do "mailbox filling up" job may be girls. Drops are also girls. But most of those who send letters and operate The Bat! are men. They are the "bosses". Sure they are, they would never let their girls to "boss" on them. They even talk about their own women in a very disrespectful manner.
And yes, most of scams originate from Mari El. Scammers even admit it themselves. On one of the Mari El forums somebody asked: is it true that all young people in Yoshkar Ola are scamming? And another proudly replied: yes! Now not only they are scamming in Yoshkar Ola, but they are also opening the new operation cells in Nizhny Novgorod, Cheboksary, Kazan, Moscow and Saint Petersburg, but still, all scammers are originally from Mari El. And he was very proud of it. Yoshkar Ola is a second Nigeria. There is something wrong with young people's heads over there. They say: "scamming is not a job. It's lifestyle."