6 ms·

One day scammers are going to realise they can probably just go on Fiverr and get their instructions copy-checked. Then we’ll be in trouble.

newsbinator 5y ago
They went to all the trouble of shrink-wrapping the box and printing the Ledger logo on the shipping plastic bag. They couldn't get their English right? It's obviously not laziness at play, right?
- dspillett 5y ago
  > They couldn't get their English right? Would you reject the device based solely on the bad English? Many would assume that they threw the documentation job at a relatively new junior/intern unless there were other red flags. I've seen terrible English in documentation from reputable companies.
  - woodrowbarlow 5y ago
    but it's not documentation, it's a letter explaining that you're receiving a free replacement device because the company ducked up. i would expect that letter to have been written very carefully.
    - Scoundreller 5y ago
      This indeed describes ledger’s own website: their technical pages have a clear ESL feel, but not their marketing pages.
coldacid 5y ago
If they thought it was worth the $5 to do it, they would. Most people don't seem to catch onto poor grammar in the first place, it would seem.
albertgoeswoof 5y ago
It's a deliberate filter - if you fall for the grammar you're much more likely to fall for the full scam and keep complying even after you've been scammed already. Otherwise the scammers are wasting their time on people who have better infosec practices and are therefore low ROI targets.
- ceejayoz 5y ago
  This makes sense for scams, but not in the case of a hacked Ledger physical device that doesn't involve any human-to-human interaction. They just need you to plug it in and follow the steps; the skeptical don't waste their time like they would if you had to spend weeks/months winning trust over a messaging app as some 419 scams involve.
  - albertgoeswoof 5y ago
    It's actually loading malware, and it asks the victim to go through a process by providing their recovery keys etc. It's not just about getting the BTC
    - ceejayoz 5y ago
      Right, and you're more likely to do that step if the letter is convincing. There's no "get wheedled one-on-one by someone on the phone into sending iTunes gift cards to pay an IRS debt" step here where filtering down to just gullible people makes sense.
- gruez 5y ago
  >Otherwise the scammers are wasting their time on people who have better infosec practices and are therefore low ROI targets. But in this case they already put a lot of effort into it? ie. they made the fake device, packaged it with shrinkwrap, and paid for shipping. The only thing left is for the victim to enter the seed, which requires zero effort on their part.
- jonplackett 5y ago
  I had never thought of it like that. I can believe this for emails but this seems like something that was deliberately quite polished aside from the wording
egman_ekki 5y ago
isn't it similar with other scam emails where poor grammar basically filters out smart people and only the more gullible carry on? other option is that they are doing a/b test of different messages
- ceejayoz 5y ago
  No. The scam emails tend to lead to a human-to-human interaction, sometimes over quite some time. Romance scams may take months to pull off; a filter early on is useful there. In the case of the fake Ledger devices, there's no similar overhead. A more convincing letter is almost certainly going to lead to more people plugging in the device and going through the steps. The incentive is reversed here.

newsbinator 5y ago

They went to all the trouble of shrink-wrapping the box and printing the Ledger logo on the shipping plastic bag. They couldn't get their English right? It's obviously not laziness at play, right?

dspillett 5y ago
> They couldn't get their English right? Would you reject the device based solely on the bad English? Many would assume that they threw the documentation job at a relatively new junior/intern unless there were other red flags. I've seen terrible English in documentation from reputable companies.
- woodrowbarlow 5y ago
  but it's not documentation, it's a letter explaining that you're receiving a free replacement device because the company ducked up. i would expect that letter to have been written very carefully.
  - Scoundreller 5y ago
    This indeed describes ledger’s own website: their technical pages have a clear ESL feel, but not their marketing pages.

coldacid 5y ago

If they thought it was worth the $5 to do it, they would. Most people don't seem to catch onto poor grammar in the first place, it would seem.

albertgoeswoof 5y ago

It's a deliberate filter - if you fall for the grammar you're much more likely to fall for the full scam and keep complying even after you've been scammed already. Otherwise the scammers are wasting their time on people who have better infosec practices and are therefore low ROI targets.

ceejayoz 5y ago
This makes sense for scams, but not in the case of a hacked Ledger physical device that doesn't involve any human-to-human interaction. They just need you to plug it in and follow the steps; the skeptical don't waste their time like they would if you had to spend weeks/months winning trust over a messaging app as some 419 scams involve.
- albertgoeswoof 5y ago
  It's actually loading malware, and it asks the victim to go through a process by providing their recovery keys etc. It's not just about getting the BTC
  - ceejayoz 5y ago
    Right, and you're more likely to do that step if the letter is convincing. There's no "get wheedled one-on-one by someone on the phone into sending iTunes gift cards to pay an IRS debt" step here where filtering down to just gullible people makes sense.
gruez 5y ago
>Otherwise the scammers are wasting their time on people who have better infosec practices and are therefore low ROI targets. But in this case they already put a lot of effort into it? ie. they made the fake device, packaged it with shrinkwrap, and paid for shipping. The only thing left is for the victim to enter the seed, which requires zero effort on their part.
jonplackett 5y ago
I had never thought of it like that. I can believe this for emails but this seems like something that was deliberately quite polished aside from the wording

egman_ekki 5y ago

isn't it similar with other scam emails where poor grammar basically filters out smart people and only the more gullible carry on? other option is that they are doing a/b test of different messages

ceejayoz 5y ago
No. The scam emails tend to lead to a human-to-human interaction, sometimes over quite some time. Romance scams may take months to pull off; a filter early on is useful there. In the case of the fake Ledger devices, there's no similar overhead. A more convincing letter is almost certainly going to lead to more people plugging in the device and going through the steps. The incentive is reversed here.