Erin West and Paul Raffile exited a van roughly 45 minutes outside Lagos, Nigeria, and walked down a muddy hill toward a settlement of corrugated steel and cardboard structures.
Raffile fell repeatedly into the mud as they moved forward. About a quarter of a mile later, they reached a six-foot hut on stilts and climbed a ladder to enter. Inside, a baba lao, a local spiritual leader, prepared to perform a ritual intended to help a Nigerian scammer extract more money from an overseas victim, possibly someone in the United States.
A scammer accompanying the pair provided a photograph of the victim and the identity they had assumed. The baba lao merged these two souls to bring fortune to the fraudster. Raffile noted the leader spent two and a half hours grinding herbs, creating talismans, and sacrificing an animal while locals gathered outside.
The experts
West is the founder of Operation Shamrock, an organisation disrupting scam operations. Raffile is a long-time cybercrime researcher specialising in sextortion. This practice involves scammers assuming the identity of a young person to approach teenagers on apps like Instagram. They coerce victims into recording explicit videos before revealing the mask and threatening to release the footage to friends and family unless payment is made.
Sextortion is common across US social media platforms. At least dozens of young boys have taken their own lives after being targeted.
Tracking the fraudster
The pair devised a plan to travel to Nigeria to track a scammer to their home. Raffile said sextortion is targeting youth and is surging. He proposed creating a fake account to act as a target, getting scammed, and then tracing the criminal back to their location.
They created Instagram and Snapchat profiles pretending to be young people. Within days, they began receiving suspicious direct messages. West described being flabagasted at how quickly the messages arrived.
The scammers pretended to be young women, often using photos stolen from OnlyFans models. When the pair agreed to pay, they could only do so in Bitcoin. They sent a link to a website where the scammer could allegedly claim the payment. The site captured the scammers’ IP addresses, revealing they were in Lagos, Nigeria.
With this information, the pair flew to Nigeria. They had around six days to find a scammer before it became financially unviable to stay in Lagos. They deployed the IP address grabbing website again. This time, one scammer granted the tool more permissions in his browser. The tool obtained their exact location or accessed their camera to see their face. They now had a scammer’s face.
At one point, another scammer requested the pair move the conversation from Instagram to WhatsApp. This revealed the scammer’s phone number. The pair’s fixer entered that number into TrueCaller, an app that harvests phone contact lists and makes them searchable. The result was the name Big Dollar.
West also provided the number to contacts who investigated it. They worked with another expert who dug up more information and found the scammer’s real name. They located other social media profiles belonging to Big Dollar, including a TikTok account that had posted blackmail messages. The pair received GPS coordinates of where the scammer might be.
They drove to Big Dollar’s village. He refused to meet the pair. West told Big Dollar on the phone that they knew who he was, knew where he lived, and the next step was giving this information to the FBI. At that moment, they saw Big Dollar’s social media accounts go dark.
West said it was an interesting opportunity to really put some fear in a class of people who aren’t really afraid of being arrested.
What it means
For the people making things, this case shows that digital trails can lead to physical addresses. It suggests that creating fake accounts to bait criminals is a viable tactic for gathering evidence against fraudsters.
