Why Nobody Has Ever Tried to Scam You Properly

There is a sticker on the parking meter outside my building. Laminated, peeling at one corner, a QR code and the words SCAN TO PAY underneath in a font nobody chose.

I have obeyed it about forty times.

Obeyed is the right word. I can’t scan that sticker. Neither can you. Nobody has ever looked at a QR code and known what was in it. We point a camera at a square, the square tells the phone where to go, and the phone goes.

Leave the sticker where it is. We’re coming back for it, and when we do you’re going to like it a great deal less.

Because here is what I believed my entire adult life, sincerely, and with a small warm feeling I’m not proud of: scams are obvious, and the people who fall for them are not like me.

And I had evidence. So do you. The prince with the frozen inheritance. The customs fee from a courier that doesn’t exist, at a company whose name is spelled two different ways in the same message. Nobody who wanted your money would send that.

Which is exactly what I thought, in exactly those words, about two weeks before I typed my card number into one.

The Two Weeks Between Being Funny and Being an Idiot

First scene. I’m in a group chat, a fake bank SMS has arrived, and I do what a man of taste does: screenshot it, send it to five people, add a joke.

It was a good joke. I want that on the record, because nothing else in this section is going to go well for me.

Fourteen days later I was actually expecting a parcel. Specific parcel, specific country, four days late, and I’d already checked the tracking page twice that morning.

Then: a text. Parcel held. Customs charge outstanding. €1.99.

And here’s the thought. I can still see the screen brightness I had it on. It’s the stupidest thought I have ever had, and at the time it felt like caution:

€1.99 is too small to be a scam.

Which isn’t insane. Nobody builds a criminal enterprise around two euros. Two euros is what you lose in a sofa. If somebody were coming for me they’d come for something worth coming for, so the smallness was, I concluded, evidence of legitimacy.

Card number. Expiry. Name as it appears on the card.

What stopped me was not judgment. What stopped me was my bank app, which pinged, and which said, in the flat voice of a system that does not care about my self-image:

Authorize payment of €480.00

€1.99 was the doorway. €480 was the room. And the €1.99 wasn’t lazy pricing. It was chosen, by somebody, precisely so I would think the thought I thought.

So I went looking for who writes these things, expecting to find idiots, and found a business model instead. You may have met the first half of it. The clever explanation for why scam emails are so badly written has been doing laps of the internet for a decade (Mental Floss ran it, NBC ran it, I have four tabs of it open), so we’ll be quick, because it is not the interesting part. The interesting part is what it says about you.

What’s left, so you know a trail exists: one criminal’s spreadsheet, one Brussels footnote from 1985, and a number I’d rather not have run.

Congratulations, You Have Been Hired by a Criminal

Meet Nenad. A laptop with a cracked corner, a spreadsheet with a tab called leads, and a problem any small business owner would recognize instantly. You’ve been hired. Head of Operations. The pay is bad and the work is evil, and you’re going to be very good at it, which is the part to notice on your way through.

His list: ten million addresses. Mailing all ten million costs him nothing, because the sending happens on machines belonging to people who don’t know about it. Converting one person who bites costs him hours. His own. Somebody has to answer, invent a lawyer, invent a delay, invent a second fee, apologize for the first fee, and stay in character for weeks.

Sending the pitch costs him nothing. Talking to you costs him hours.

So say you’re good at your new job. Clean grammar, real courier branding, a tracking number with the right number of digits. It converts better than anything you have ever built. Which is the disaster. Now make it stupid instead. Put the prince back in. Misspell the bank. Sign it from a Colonel. Set the sum at forty-one million euros, which is not a number any real transaction has ever produced.

                    plausible      stupidSent               10,000,000  10,000,000Reply rate              0.02%     0.0002%Replies                 2,000          20× 6 hours each         12,000         120=               six working   three weeks                      years

In any other industry the left column gets you promoted. Here, most of those two thousand were never going to pay, because most people who reply to an email eventually stop replying to an email, and every reply from someone who will eventually say no is a loss, paid in the one resource he can’t steal from a machine.

Now look at who the twenty are. The twenty out of ten million who read “Colonel,” and “forty-one million euros,” and “kindly revert,” which is a real phrase, typed on purpose, by a person nobody has ever asked to stop, and thought: this could be for me. They were in the two thousand as well, indistinguishable from the other 1,980, costing him six hours each to find. The 1,980 were never revenue. They were the bill.

The stupidity is the filter: it screens out everyone he can’t afford to talk to, free, using their own judgment. Cormac Herley at Microsoft Research wrote this up in 2012 under the best title in security research, Why Do Nigerian Scammers Say They Are From Nigeria? Because Nigeria is the filter. The word does the screening.

(Herley is less comfortable than I’ve made him sound. The sign repels some of the payers too, because it’s one sign and everyone reads it, so Nenad keeps a fraction of the money for a hundredth of the hours and takes the smaller pile because it’s the one he can carry. Not a clever business. A thin one.)

And none of this needed email. The Spanish Prisoner letter was doing it in the 1890s, down to the daughter’s hand in marriage, and back then every letter cost a stamp, so the filter mattered more. A hundred and thirty years of a bet with postage on it.

Now price the alternative. Suppose Nenad went handmade: learn each target’s real bank, their sister’s name, write each of them a personal lie. Four minutes each, which is a fantasy, but be generous:

  10,000,000 targets× 4 minutes= 40,000,000 minutes÷ 60= 666,667 hours÷ 8,766 hours in a year= 76 YEARS of continuous typing.

No sleep, no weekends, and he still hasn’t opened a single reply.

So he doesn’t. Nobody does. And that’s the reason nobody has ever tried to scam you properly: not because you’re difficult, but because you were never worth four minutes. You’ve been protected your whole life by the price of a lie, and by nothing else, and you’ve been quietly taking the credit ever since.

Your promotion is canceled.

Two Hours in Your Living Room, and Then the Coffee

So far this has been about a man with a spreadsheet. Now the other side of the wall, and I have to start by taking something off you. Not a flaw. A credential. Believing people is not a mistake you make. It is the setting you run on, and it is the correct one. Give people statements, ask them to sort true from false, and they land here:

Your accuracy            54%A coin                   50%A detective, 20 years    54%

A coin flip with a limp. Bond and DePaulo stacked up every study anyone had run, about three hundred of them, and that is what fell out. It holds for police, judges and customs officers too.

Experience buys confidence. It does not buy accuracy.

Which is not a defect. I spent one week of my life running at a higher setting, the week after the €480, and I was unbearable. I asked a courier for ID. I made my own mother identify herself on the phone. I lasted six days. So 54% isn’t a weakness. It’s a budget, and somebody set it correctly.

So the question was never why they believed it. Belief was free. The question is what was supposed to have stopped them, and the answer is nothing about the message. Something about the room.

Nobody has ever bought a two-thousand-euro vacuum cleaner from a leaflet. Not once. What happens is a man rings your bell, and he’s pleasant, and he asks for twenty minutes.

He gets two hours. Somewhere in there he shampoos a patch of your carpet. You make him a coffee, because you’re not a monster. I have watched this happen in my mother’s hallway, and she made the coffee. And at some point he shows you the filter disc, which is gray and furred and is, he explains, you. Your skin. Off your floor.

Then he names the price, and you have to say no.

Look at what “no” costs now. Two hours of a man’s labor, in your home, at your invitation. A coffee he drank. A small pile of your own body on a paper disc. And the word has to be said out loud, to his face, by you.

The price was never justified. The refusal was made expensive.

Which is Nenad’s equation with one number changed. Nenad has ten million shots and no contact cost, so he filters with absurdity. The man in your hallway gets six doors a day. He can’t afford to filter at all, so he selects on who opens the door and then loads the no. Both of them are buying a yes from somebody who will actually pay, with whatever the room is selling. One of them is a spreadsheet. The other one drank my coffee, and he is the one that frightens me.

Brussels Worked This Out in 1985 and Filed It Under Paragraph Three

In 1985, somebody in Brussels whose name I will never learn sat down to write the preamble to a directive on doorstep selling. Passive voice. Paragraph three. The flattest prose the European Communities could manufacture, and they could manufacture a lot of it. It gives two reasons the doorstep needs a law of its own. One: the trader starts the conversation, and the consumer is unprepared. Two, and read this one twice: the consumer is “unable to compare the offer with alternatives”.

A bureaucrat wrote the second half of this essay as a footnote to a shopping regulation, and it has been law since before I could read.

The rule underneath it: fourteen days to walk away from anything sold to you off-premises, which is the lawyer’s way of saying “in your hallway.” Some countries stretch it to thirty when the visit was one you didn’t ask for. A yes obtained in your own living room is treated as too unreliable to be binding.

And Brussels wasn’t even first. America ran the same arithmetic in 1972, when the Federal Trade Commission gave you three days to cancel anything you sign for inside your own home, under a rule with a name that sounds like an apology for the whole species: the Cooling-Off Rule.

Two continents. Thirteen years apart. Nobody coordinating. A coffee changes what a signature means.

Marko, and the Only Sum That Closes

Same idea, different room. You have seen this message: a screenshot of some trading app showing €100 turned into €5,000 in three weeks, forwarded by somebody’s cousin, with a link and a first name attached. €100 became €5,000 for Marko.

For years I filed that under greed, and I was wrong. Forget what the scam is offering. Look at what the person receiving it needs.

I made Marko up, down to what’s in his account, and I’ll show you the seam when we get to it. He’s twenty-four. He rents. He needs a car that starts every morning, because the warehouse that pays properly is forty minutes out of town and the first bus arrives forty minutes after his shift begins. A boring, reliable, €6,000 car. (The €1,500 car, the one he can afford, was most of volume 2, and it is a large part of why he has no savings.)

He has €120 in the account. That’s the end of a good month. So how much does his money have to grow?

  €6,000 needed÷   €120 available=     50x his money= a 4,900% return

Now read the message in his group chat again. It promises 5,000%.

That’s the part that made me sit down. The number isn’t absurd to him. The pitch is quoting his life back to him, to within a hundred points, on a target he never picked. And the entry fee: the message asks him to start with €100. He has €120.

Meanwhile, the honest option. A good boring savings account at 6% a year turns his €120 into €127.20. Everything legitimate, everything your uncle would approve of, has €7.20 for him this year. That is not a car. That is most of a sandwich, and he has to wait a year for the sandwich.

He is not miscalculating. He isn’t even being greedy. He has one thing he needs, and the only figure on the entire page that reaches it is the fraudulent one. (There’s the seam: I picked €120 so the numbers would rhyme. Give him €400 and he needs 1,400%, and nothing legitimate on Earth offers that either. The rhyme is mine. The fact that every number which gets him a working car is a number only a liar will say out loud is not.)

So go back to the wall with the hole in it, because I had it wrong. I’d been drawing the hole as a fixed size, cut once by Nenad. It isn’t. Here’s the napkin, which Brussels apparently beat me to by forty years:

  how good the offer looks÷ how good your options are= how hard it pulls

Which means the pull isn’t in the message. You bring it with you.

And it works from the top of the fraction as well as the bottom. My €1.99 did nothing to my options. What it did was shrink the price of saying yes to almost nothing. Marko’s €100 and my €1.99 are one number doing one job, and somebody sat down and chose both of them. I would find that more impressive if it had not worked on me.

Being broke increases the pull. So does being lonely, being new to the language, being eighty-one, having a man in your hallway for two hours, and waiting on a parcel that is genuinely four days late.

And it scales past one man with a bus problem. In 1992 and 1993, Dafiment Bank and Jugoskandik offered Serbs monthly interest that could not survive being written down, and most of a country queued for it anyway. Not a nation of fools. A nation whose alternatives had all been cancelled in the same year: sanctions, hyperinflation, a currency losing value faster than you could physically spend it. Divide by options worth nothing and the pull goes to infinity. A queue around the block is what that division looks like from the street.

It’s also why “just call your bank” is not advice where I’m from. Where I’m from, the bank was the scam.

And that’s where I stopped feeling clever about my €1.99. I hadn’t spent thirty years passing a test. I’d spent thirty years walking past a pinhole in good weather.

The Room Where Nobody Says Anything

Here’s what happened the morning after my €480 near-miss.

Nothing. I told nobody.

Not that day, not that week. I’d spent fourteen days being the man who screenshots scams into group chats with a joke attached, and I had a bank notification saying I was also the other kind of man, and those two facts could not be in the same room. So I put one away.

Now think about that at scale. The only scam stories that circulate are the ones nobody was ashamed of: the prince, the funny one, the one you spotted. The story where somebody competent lost four thousand euros to a message that looked exactly like their bank does not circulate, because the person holding it is busy deciding never to say it out loud. So the visible sample is wrong, in one direction, by construction, and it teaches one lesson: only fools fall for this. I learned it. It bought me fourteen days of not checking anything and a group chat in which I was the funniest man.

Victims pay twice. Once in money, and once in silence, and the second payment funds the next victim. Every laugh at a badly spelled text, mine included, is a small deposit. (When people do say it, they say it small. Not “I was scammed.” I had a problem with a payment. That’s what shame sounds like once it’s been sanded down enough to be spoken.)

My mother reads every text message out loud. Has done for years. Then she looks up and asks: is this one real? I used to find it tiring. I’ve started to understand it’s the most effective anti-fraud measure in my family, and that it has nothing to do with judgment. She isn’t asking me to assess the message. She’s refusing to be alone with it.

The Hole in My Own Argument, Before Anyone Else Finds It

A hostile reader would find it in about ninety seconds. Everything above is about a scam where a human being has to sit and talk to you. That’s where the labor cost lives, and the labor cost is the entire reason the filter exists. Now look at the text that nearly got me. It wasn’t badly written. It was fine. Courier logo, plausible amount, a payment page that looked like a payment page. Nobody had to talk to me at all. The whole thing was a form, and a form doesn’t get tired.

So this essay quietly generalized from one family of scams to all of them, and took its evidence from the family where somebody has to sit there and do the talking. I could bury that. I’m telling you instead, because it isn’t a hole. It’s the second half.

And Then Lying Got Cheap

The prince stayed a prince for a hundred and thirty years because plausibility was expensive. The moment plausibility gets cheap, the filter isn’t a saving, it’s a waste, and the thing you’ve spent your life being immune to is the thing that stops being made.

The typo was never the tell. The typo was the price of stamps.

Fine. Argue With Me.

Objections, in ascending order of how much they hurt me.

“The hit rate is microscopic. Who cares?”

The totals run to roughly a trillion dollars a year globally, by survey, so take a zero off. Still a country’s GDP. But the cost isn’t mostly in the hits. It’s the tax the rest of us pay in twenty-second installments, forever. You don’t answer unknown numbers. You read your bank’s real messages with suspicion. Every stranger who contacts you arrives with a burden of proof attached, and you’ve stopped noticing you’re carrying it. Nenad’s twenty replies are the revenue. The other 9,999,980 of us are the externality.

“It only works on people who wanted free money. That’s not tragedy, that’s a purchase.”

This gets real credit, because for the prince it’s true. If the whole industry were princes this essay would be a shrug with sources. But greed was just the cheapest emotion to buy in bulk. The family moved. To fear, which arrives as a tax office and a court date. To love, which arrives over eight months and asks for nothing for seven. To a grandchild in a cell at eleven at night. None of those select for greed. They select for having a grandchild, which is a filter my own grandmother would have failed on the first ring, and she once refused to give her name to a census taker.

And now the one I couldn’t get around for two days.

You: Hold on. You’ve just proved I’m safe.

Me: Go on.

You: Your whole argument is that the pitch is engineered to repel me specifically. I’m the expensive reply Nenad can’t afford. By your own math the machine is actively avoiding me. You’ve written three thousand words to tell me I’m fine.

Me: For the prince, yes. Genuinely. You can keep the crown.

You: Then we’re done.

Me: Not done. A count. How many times over a life does something reach you that needs a judgment? Not spam you never see. A text, a call, a card reader, a link, a stranger at the door.

You: A few a week?

Me: Let’s say one, which is a lie in your favor. And say you get each one right 999 times in a thousand, which is an accuracy no study has ever found in anybody, and I’m handing it to you anyway.

  1 a week × 52 weeks × 60 years= roughly 3,000 judgmentsRight 999 times in 1,000:  0.999 ^ 3,000= 4.97%Chance you never misjudge at all:   5%Chance you misjudge at least once:  95%

Ninety-five percent, at an accuracy nobody has. The real number is worse and I can’t tell you what it is, because it depends on how many of your three thousand moments had something standing behind you. Which turns out to be the real question, and notice that it isn’t a question about you. Misjudging once is not the same as losing the money. I misjudged, all three fields, willingly, and nothing happened to me, because my bank app asked a second question and a system I had never thanked gave me a free go.

What survives is Nenad’s side of it. Once is his entire specification. He doesn’t need a season. He needs one Tuesday. The Tuesday you misjudge, and nothing is standing behind you that day: no second question from the bank, no friend across the table, no second look. Nobody designed that. It’s what arithmetic does when one side needs a perfect record and the other needs a Tuesday.

The Test You Didn’t Sit

You are not hard to fool. You are expensive to fool. Those are different things, and only one of them has ever been tested on you. For a hundred and thirty years the only affordable way to reach a million people was to say the same thing to all of them. The only stories cheap enough to say a million times were the thin ones. The ones that insult you on arrival. So every fake you ever spotted, you did not pass a test. There was no test. There was a price. Nobody was ever willing to pay it for you in particular, and you have spent a lifetime reading that refusal as a compliment.

And look at the conditions. Every fake you ever caught, you caught unhurried. You were not broke that day. You were not frightened. You were reading it in a group chat, in daylight, with friends, not at eleven at night in the middle of your own life with a parcel four days late. You sat the easy version of the test, with the answers face-up on the desk, and you read the result as a fact about yourself. It was a fact about the day. You were sharp because the day was easy. Change the day and the sharpness goes with it.

Two Things to Build, and Three to Run on a Thursday

Not a summary. Equipment. The whole essay is one principle: nobody has ever paid what it costs to fool you, and the price, not your eyes, is what has kept you safe. Prices move. So these work on things this essay never mentions, which is the only reason they’re worth carrying.

Build the two things first. The pull isn’t in the message, you bring it with you: it comes from what you need and what you can’t get honestly. So the thing that stops it can’t be you either. It has to stand behind you. A bank app that asks one more question after you’ve already decided. A person in the room you read your texts out loud to. Build either of those and you have a defense that still works at eleven at night, when nothing I write here will.

The other three are for the calm days, the Thursdays, when you can still think. Run them then, because the scam’s best trick isn’t the story. It’s what happens when it misses: you walk away more sure of yourself, and that confidence is what the next one feeds on. Every scam you spot makes you a little easier to catch.

The recruiter who found you. You didn’t go looking. They came to you, and inbound is a flag, not a verdict. Same flag on the clinic that rang about your results and the friendliest person on the dating app. This one needs no cleverness, which is why it comes first: cleverness is exactly what you won’t have at eleven at night.

The trading message you laughed at. Turn the formula around. It looks stupid to you, so ask who it doesn’t look stupid to: the colleague three months between jobs, the friend whose rent went up in March, your father on the third bad day in a row. The pitch that can’t reach you is reaching somebody, and the difference between you is the denominator. I named three people mine was written for before I finished my coffee, which ruined the coffee.

The free consultation. Somebody’s four hours, a test drive, a coffee a friend bought before mentioning the business opportunity. None of it is proof of fraud. All of it is a thumb on your scale, and knowing the thumb is there does most of the job. I now do these sums out loud in car showrooms, which has made me six hundred euros richer and completely unbearable to shop with.

And turn the formula around on the thing I can’t stop turning it around on. If writing a personal, researched, perfectly spelled lie stops costing Nenad four minutes and starts costing a fraction of a cent, his whole reason for sounding stupid evaporates, and the denominator becomes everybody. I don’t have the 2026 answer to that. Nobody I can find does, which is usually where the next one of these starts.

Back to the Parking Meter

Which brings us back to the sticker.

Here’s what I know about that QR code: nothing. Here’s what I can know, standing in the rain with eleven minutes before the warden comes: nothing.

Every defense in this essay lives in reading. The two spaces before the full stop. The Colonel. The company name spelled two ways. Every tell I own needs the lie written down in front of me, where my eyes can reach it. Here there is nothing to read. A printed instruction to obey an address you’re structurally unable to see, stuck to street furniture nobody owns, in weather, under time pressure, next to a machine you already resent. If Nenad designed it he’d be too pleased with himself to shut up at parties.

And somebody has to spend, what, forty cents on a laminated sticker. Forty cents of laminate on one side. On the other, a whole life spent getting expensive to fool. That was the exchange rate the entire time, and I liked it better before I did the arithmetic.

Go and look at yours. It’s probably fine. So is the next one. Probably is the strongest word I have left, and I used to have better ones.