One letter is all it takes to get fooled.
Over the last few weeks, music promoters, festivals and venues across the continent have been getting emails from agents representing A-list music talent – Rihanna, Eminem, Lady Gaga, System of A Down – laying out Asia tour dates for these artists and inviting offers.
So far, so normal. The names are right, the signature is solid. The artists and their touring requirements seem correct. But you read enough of these emails, and you notice something eerie.
They’re all on the same template – a terse “Dear Promoter”, wonky formatting, the exact same structure to every email. The doubts creep in. Why are these agents, many of whom know many of us by first name, sending impersonal mass-emails to our generic company info@ account?
Then you notice the e-mail suffixes:
@wmeentertainment.co
@xraytouring.co
@Caa-uk.co
That’s right – they’re fake emails from fake URL’s. But the rabbit hole goes deeper. Reply with interest, and there’s reasonable detail in their modus operandi. They reply promptly, know the industry lingo, they have relevant artist materials (riders and press assets) and they know how to fake it. So much so that one festival promoter (that we know) actually got hoodwinked into forking over a deposit. And speaking to the agents themselves, apparently this is pretty common practice.
Thankfully, the bank flagged the transaction and all was well, but the depth of this scam raises some interesting questions.
- How did the scammers manage to impersonate the language of agent emails this convincingly? They’re not perfect, but these are far more professional than the Nigerian Prince scams of yore. A simple WHOIS search reveals that two of the scam emails come from China-registered and hosted domains, but the trail goes cold there.
- How did they chance upon this extremely niche method of bullshit artistry? And what’s stopping some devious schemers from using machine learning and some basic data-mining to cast this phishing net very wide? All they’ll need is some a simple algorithm that finds upcoming releases and touring artists and matches them to an email database, which then impersonates the most likely represent….okay, okay.
We shouldn’t be giving the scammers ideas. This was an insane, highly original scheme and we hope no one was screwed over. At the same thing, we can’t help but say we’re a little bit impressed. Just a little bit.