I lost my blackmail virginity last weekend. The ransom email was sent on a Saturday night as I stood waiting in Dino's chipper in Kinsale. It gave me 48 hours to pay thousands of euro to a man called Hybert or he would set about "destroying [my] life".
His email was long and full of casual menace. I scanned it, first with amusement and then dismay as I realised Hybert knew my password, one I’ve been using since the mid-1990s and one which, I’ve long assumed, was known to me alone.
Hybert blew that assumption out of the water and he told me he was “aware about [sic] [my] secret and have proof of this”. He assured me I didn’t know him and it was simply my “hard luck that [he] found [my] misdemeanour”.
I'm not looking to break your bank. I am just looking to get compensated for my time I put into investigating you
And what was my “misdemeanour”? According to Hybert, I’d visited a porn website “to experience fun (you know what I mean)”. He said while I’d been busy watching dodgy clips, he’d been busy installing dodgy software on my machine and had collected the contacts “from [my] social networks, as well as mailbox”.
He explained he’d “put in more hours than I should have looking into your life and made a double-screen video. The first part displays the video you were viewing and next part displays the video from your cam. It’s you doing inappropriate things.”
The good news was Hybert was now “ready to forget” me and let me get on with my life. The bad news was he wanted $3,600 as a “privacy tip”. He told me there was no point contacting the police as he’d taken steps “to ensure this email message can’t be traced plus it will not stop the evidence from destroying your life. I’m not looking to break your bank. I am just looking to get compensated for my time I put into investigating you.”
He concluded by warning me that if he didn’t get Bitcoin soon he would “no doubt send out your video recording to your contacts including members of your family, coworkers, etc. You better come up with an excuse before they find out.”
I smelled a rat. Actually, I smelled several. For a start, the address Hybert mailed was ancient, as was the password. But, ultimately, his ruse was exposed because had Hybert really “put in more hours than [he] should have looking into your life” he’d have realised how dull it was.
The password is the key to this scam. It makes people question their security and ask themselves what else might the scammer might know
He'd have recorded endless hours of me scowling at Donald Trump's tweets, and checking my fantasy football team. He would have seen me trawling through the Instagram feeds of strangers, eating tins of vile Polish pâté for review purposes, repeatedly mis-spelling the word Laoghaire and forgetting how to get a fada on the word Dún or an accent on the word pâté.
Hybert was also wrong to assume I’d a spare three grand or any notion what Bitcoin is or how I might get some.
So, at best, his research was shoddy.
My research was better, and a 30-second Google search confirmed the email to be a scam. It also told me that whoever was behind it had made tens of thousands of dollars from nervous porn users worldwide in under a week and I found out my old password had been stolen in a LinkedIn hack years ago and flogged on the dark web.
The password is the key to this scam. It makes people question their security and ask themselves if the sender knows this one intimate detail of their online life, what else might they know? What else might they have seen? What might they do next?
I convince scammers to call me, and once I even succeeded in bringing a scoundrel from the centre of Amsterdam to Schiphol Airport to meet me off a flight from Dublin
It’s a troubling advance in the social engineering scam space, and it made me yearn for simpler days when the world’s con artists contented themselves with sending me subliterate mails purportedly from sub-Saharan princesses keen to spirit blood diamonds out of their country.
For years I’ve enjoyed baiting these people. I even have a dedicated email address – under the name Anaive Eejit – set up to waste the time of ne’er-do-wells. I figure if they’re dealing with me, then they can’t be stealing from someone else. The breathlessly excited responses sent from Anaive Eejit to scammers mostly fall on deaf ears and dead email addresses, but sometimes I get a correspondence chain to stretch to more than a dozen emails.
Less frequently, I convince scammers to call me, and once I even succeeded in bringing a scoundrel from the centre of Amsterdam to Schiphol Airport to meet me off a flight from Dublin. I can’t begin to tell you how delighted I was to get an agitated call from him late one Friday night wondering why Anaive Eejit had not come through the arrival doors as scheduled.
He was very cross when I told him he’d been had. It is the sort of carry on that Hybert might have seen had he actually been watching me, and I’m pretty sure he would have been most displeased by my version of online “fun (you know what I mean)”.