WeTransfer Scam: most subtle phishing attempt ever

In all my time examining online scams and teasing their perpetrators, never have I before run across a so sophisticated phishing attempt like this WeTransfer scam I am about to describe in this article. In fact, this scamming attack was so subtle and personalized that, to this day, I maintain a trace of doubt, however slight, with regard to whether it indeed was a fraud. That’s why I feel obliged to express my reserved apologies to the involved person, for a highly unlikely case he was not, after all, a scammer but just a silly old man. But dude, if that was by any chance the case, you should stop requesting random folks on the internet to download your shit from WeTransfer.

The scamming operation began with an email sent to me via my blog’s contact form, from the address [email protected]. It read as follows:

Hi again, I wrote to you some weeks ago but haven’t received a reply yet. I was interested in hi-res versions of a couple of shots of the dragon houses of Ochi. My son and his wife and two grandsons have a house on Evia. Maybe they can contact you. I asked my son David to climb Ochi again as I missed getting shots of the houses last year. I’m 79 so it will be hard for me to go again.
Best wishes Charles

WeTransfer scam

I checked my spam folder and spotted the missed first letter the dude is referring to here. Notwithstanding it had ended up junked there, nothing was yet suspicious about the whole thing, so I proceeded with reading it. It said:

Hi, I am an amateur audio visual maker and a fellow of the Royal Photographic Society. During a visit to Athens to see my son in 2019 we hiked to see the dragon house on top of Mt Ochi on Evia. They have a holiday place in Marmari.
After hiking up the same route you took, I got separated from my son and two grandsons who also came along. Eventually I saw what I thought was the dragon house and made my way there hoping to also find my family. Just as I got there we saw each other and joined up again. I was 78, so the hike had made me very tired and I began to photograph what I though was the dragon house. I now know that what I photographed was the church and I am short of images of the actual dragon house that was apparently about 200m nearby. We then turned back down the mountain. I’m most annoyed with not seeing and photographing the DH to use in a production I have started on this topic. I have many images of the other DHs at Styra I will use as well. I would be very grateful if you could allow me to use higher resolution images of the Mt. Ochi DH that you have. I will give you a credit at the end of course and will send you a copy of the finished production. I’m also looking for suitable mysterious, dramatic music to use with my production – this is always the most frustrating period until I find the right piece or pieces. Any suggestions will be gratefully received.
Best wishes – Charles

WeTransfer scam

The dude is talking about a mountain on the south of Evia Island, Greece, where I organize hiking tours, and folks ofttimes contact me with related to it queries after finding my relevant post online. Later on, I felt rather astonished by the degree of research these fraudsters did to carry out their scam – the geographical or otherwise details included in this mail are surprisingly accurate even for someone with a genuine interest in the place. For now, however, everything about this email seemed perfectly normal and polite. I could sure pass him those pictures, and perhaps I could also get his son to book a tour with me. So I replied:

Hi Charles, it seems I missed your first letter or it didn’t get through for some reason. Sure, I can send these pictures to you, but in September, when I will have access to the hard drive where I keep them stored. I happen to be on Evia, too, now, Chalkida. I’d be glad to hear from your son. Best wishes.

Me

And he soon got back to me:

Hi Dimi,
 
That’s great!  How can my son David contact you.  I’ll ring him shortly and give him your email address.  His WhatsApp contact is [email protected]. He is in Marmari with his two boys.  His wife Natasa is working in Athens.   
 
He wants to climb Mt Ochi to take some pictures for me of the dragon house up there.  However, he needs someone to climb with him in case of accidents etc.  The boys are not keen on doing it again.
Last year we stopped at the church and I was most annoyed when I got home to find I had not seen the dragon house.  I’ve made an AV called The Search and all it needs now is the shots of the dragon house.
 
I’ll send you what I have done so far via WeTransfer.  I enter these productions in international festivals.  As it’s about my search it would be best if they were my shots but it may be some time before I get back there.
 
Thanks and All the best
Charles

WeTransfer scam

Here again, nothing suspicious, and nothing too interesting either. He didn’t ask me directly for a tour, so there was nothing to particularly care about from my side. I glanced at the letter’s concluding part about his AV – whatever that was – and WeTransfer, but I hardly registered it mentally. I would send him those pictures when I could, and I would discuss a potential tour, but that was as much attention I could afford for this guy. I wasn’t going to answer, but he persisted:

Hi again,
 
Just checking.  Are you able to download about 50Mb easily.  Actually David has a copy already so that’s another option for viewing it.
 
Charles

WeTransfer scam

Here is where my suspicions are given birth. Download 50 MB? What is that dude talking about? I would download half a bloody byte. Why should I? Although it crossed my mind that it may be a scam, I still was more inclined to believe that Charles was a wacky old man, perhaps a bit too anxious about people seeing his AV projects – whatever these could be again. Anyhow, I wrote back to him:

Hi again Charles, sure, you can send me a link to what you do. Your son may contact me on this email address or on WhatsApp +***. If I understand well, they look for a mountain guide? Or? 

Me

Here I’m basically saying: Okay, man, I can have a look at your whatever it is if you send me it online, but don’t waste more of my time. Do you want a tour or not?

Hi Dimi,
 
Yes, it is possible that David needs a companion to get up the mountain again as his boys don’t want to do it again.  But, he tells me you are 4-5 hours from Marmari so how could you do that in a day without staying in Marmari.
 
He also doesn’t have a good camera.  He will use his iPhone I think, which may be OK.  At the moment the AV has a shot of a dragon house that is not on Ochi plus several of the church buildings that I have used instead of the actual dragon house on Ochi.
 
He works for a company in the US and is their top technical guy.  He has a PhD in computing science.
 
I hope he contacts you soon.
 
Best wishes
Charles

WeTransfer scam

Hi again,

Do you use a Mac or PC.
 
Charles

WeTransfer scam

Then he sent me the above two mails in close succession. I read them both together. The second one now, it rather confirmed my suspicions. Charles was a scammer; but the most astute and creative scammer I have ever run into. His good English, the amount of effort he made to research his topic, the personal and personalized way he targeted me… Well, now, here, we have a scammer who actually must be making money. No doubt he could find victims to download his malware, when approached in such a delicate manner. I lost my hope for a potential tour booking, but sure I now got a new interest in playing the game and have some good scamming-the-scammers fun. I replied:

I would be able to go to Ochi only in September, or anytime in autumn. I could drive there as long as my fuel and time costs are covered. And then we’d drive from Marmari to the refuge, and up the summit therefrom. I could also bring along my camera and get some extra nice shots for you. If needed, we could also go to additional dragon houses, apart from the one on the summit – there is a bunch of them throughout the mountain. I haven’t yet understood, what’s the project about? I have a mac.

Me

Now I stated an explicit interest in his project, he is free to concentrate on it:

Hi Dimi,
 
I have just started sending you a copy (mp4) of my AV so far via Wetransfer.  You will get an email re the download link from them which will last for 7 days only. 
 
As you will see I have covered the fact that the houses I show are not the actual dragon house on Ochi.
 
I have many shots of other dragon houses that we went to and these are at the start.  It has a surprise ending.
 
Enjoy!
Charles

WeTransfer scam

And together with the above message, comes the WeTransfer mail notification from the address [email protected]:

[email protected] sent you some files
1 item, 379 MB in total ・ Expires on 28 August, 2020

Hi Dimi, Here is my AV production so far. I’ve made the best of the shots I have of the dragon houses on Ochi and used another to fill in one of the establishing shots. So, I’ve tried to disguise the fact that I don’t have the actual shots of the Ochi dragon house. Charles

WeTransfer notification

Having used the service before, I knew this looks like a perfectly legitimate WeTransfer email. Whether it was an exact replica or an authentic notification, I do not know. But it doesn’t make any difference, anyway. I would never and for no reason download any shit I never asked for, sent from a random dude I do not know, no matter on what platform it is hosted. I checked a bit online and found quite a multitude of blog posts and forum discussions warning about WeTransfer scams, such as this and this official WeTransfer webpage. The idea is rather straightforward: you download a virus, it takes over your computer, and then comes the surprise ending Charles was talking about above: blackmailing you for either retrieving your files or for preventing your sensitive private data from going public. I would have really liked to have some old, useless device to download the file in and see what exactly happens with my own eyes, but unfortunately, I didn’t… So I simply replied:

Wow, Charles, amazing! I very much enjoyed it. And that surprise in the end, phew, I have no words. So, do you want to plan a tour to get more material?

Me

It took him some time to dispatch his next message. I can well imagine him, bewildered, thinking what now? But sure enough, he did eventually reply:

Glad you like it!
 
I’ve been making these things since the late 1970s so I guess I know what to photograph etc.  This one sort of developed, as I didn’t think it had enough in it to be
interesting, but I kept at it until I was happy.  Most people would not know that I fudged things at the end.
 
I’ll talk to David about what he thinks he can do.  I guess he hasn’t contacted you yet.  There is no rush for this and it can be very hot in August so Autumn will be better for climbing.
 
I’ll let you know as soon as I work things out with David. 
 
All the best
Charles

WeTransfer scam

I believe he remained unaware of me knowing he is a scammer, assuming I was just lazy to check out his whatever AV shite. His tactic basically was to continue the conversation like nothing strange has happened, striving to convince me that there is a good prospect of him booking a tour, hoping I may, in the end, get curious about his project and download it. We continued casually with a few back-and-forth messages. But, unfortunately for him – surprise surprise – this thing never happened.

Hi Dimi,
 
I managed to contact David today.  How much will it cost to guide him up the mountain and back.
 
All the best
Charles

WeTransfer scam

Hi again Charles, I would take €100 plus petrol and ferry tickets (shall be coming from Athens). If he has his own car, that would be much less as I can only drive to Rafina, cross as a foot passenger, and be picked up by him on the port to drive together.

Me

Hi again,
 
I’ll have to ask David if he thinks that is a good plan.  There is also a walking tour that is €171 for three people with a guide.
 
Charles

WeTransfer scam

Sure. The price I give you is of course for any number of people that will fit in the car.

Me

Hi Dimi,
 
I forgot to say that my son does of course have a car and he could meet you at Rafina, cross by ferry and drive to the refuge and back to the ferry.  He may have to drop his kids and wife off at Marmari first, but it’s on the way.
 
How much would that cost.
 
Charles

WeTransfer scam

He shouldn’t need to come to Rafina. He could pick me up from Marmari port. Then I would count extra only petrol Athens-Rafina and two ways passenger tickets. So it would be €140 in total. But there is another possibility too, I will happen to be docked in Marmari this weekend while sailing. So in case he’s up for that, we could do it now for a round €100.

Me

Hi Dimi,
 
Just managed to catch up with David.  They are returning to Athens this weekend and he has the house in Marmari to clean etc so this weekend is out. 
 
Also he doesn’t know his movements in September yet due to work commitments and his oldest son going to Wales to study at an unknown date.  I’ll keep in touch.
 
All the best
Charles

WeTransfer scam

And that was the last I heard from Charles.