Microsoft Research showed scam emails' obvious flaws are a deliberate filter

Advance-fee emails full of far-fetched tales of West African riches have long been a standing joke, so the natural assumption was that the senders were incompetent. Yet the genre persists, which led Microsoft Research's Cormac Herley to ask whether the absurdity is the design.

Herley treated the scammer's choice of whom to contact as a classification problem and analyzed it with ROC economics. Each person contacted who never pays is a false positive: it burns effort and raises risk while yielding nothing. Because genuine victims are a tiny fraction of recipients, a 10x fall in victim density can produce a 1000x fall in the number of victims found — and at very low density only an attacker who can distinguish viable from non-viable users with great accuracy can profit, a Catch-22.

The obviously fake email resolves that Catch-22 by making victims identify themselves. A message that repels everyone but the most gullible gets the most promising marks to self-select, tilting the true-to-false-positive ratio in the scammer's favor; the vetting happens at the recipient's end, so the sender never spends effort filtering a single reply. The ridiculous story is a feature, not a bug.

Absurdity is the filter that makes marks self-select

Low victim density makes every false positive the dominant cost

An absurd offer makes non-victims reject it with no effort from the sender

Only the most gullible reply, so the attacker never vets contacts

Self-selection filters before any interaction begins

When only a tiny fraction will say yes, don't widen the funnel — make the wrong audience repel itself. Defenders should shrink the pool of viable victims: education and defaults beat smarter filters.

Presented at WEIS 2012, Herley's analysis became the standard answer to why 419 emails look ridiculous. It still circulates years later: in a December 2016 Hacker News thread on deceptive interfaces, commenters quoted the paper verbatim as the explanation for why spammers never clean up their obvious tells, and Microsoft Research still hosts the publication.