Are non-English speakers better protected from (international) phishing?

Question

After I received dozen of spam mails over the last year with my thrashmail (used for "You must log in once to check out this product.."-Sites, etc.) I noticed they were mostly translated (if they are at all) horribly.

I thought about that after reading the Wikipedia article about the ransomware "Locky" where the Spam Message pattern was shown.

Dear (random name):

Please find attached our invoice for services rendered and additional disbursements in the above-mentioned matter.

Hoping the above to your satisfaction, we remain

Sincerely, (random name) (random title)

Refering to my experience, only a few mails were translated well enough to even consider it as my native tongue (German, by the way).

So, I was wondering If non-English users are theoretically better protected from international scam/phishing than native speakers. Of course there are a lot of properly translated versions out there, or they are also based in the same country, but my inbox is dominated by non-German Spammers.

Or would you (as a 'normal' user) trust a [insert random title here] who can't properly speak your native language and therefore sounds like Master Yoda with Dyslexia? Or if it was in English I'd wonder "Why the heck would a [insert radnom country I've never heard of] Lawyer write to me in English?"

I believe these users are a bit safer, as Phishing is mostly about gaining the victim's trust.

I'm interested in whether this thesis is true.

---

Edit: It's awesome to see how multifarious the Answers and Comments are. Kudos to the Stack InfoSec Community.

Answer 1

There is a really, really good paper on this here.

Tl;dr:

• 95% of spam is in English
• In f.ex. Germany only 17% of the spam is in German
• In Scandinavia it's less than 1% in the local language

Conclusion I: Yes, generic phishing is mostly directed to English speaking people. I can only confirm that many German people will not even consider opening a mail with a non-German subject.

Conclusion II: The main factor for the phishers will be to gain proficiency at the target language. Target languages are English and other "first world" languages, but they are differently hard to learn. Since it's much easier to auto-translate and learn basic English than for example Icelandic, phishing will be much less effective on non-English speakers.

But: Spear phising is much more dangerous and will always be done in a local language, so statistics can't take that into account.

Answer 2

In my opinion (this is a subjective question) they are even less protected.

If you read a phishing mail in your own language (or any other language that you understand) from someone that claims to be "your bank manager" (for example) you may understand better what's going on, and you won't click the link.

But if the mail is in English, and you don't understand the language properly, then you may, unconsciously, click the phishing link to the fake bank website. That's due to the well-known fact that English is the international and business language (even if you can't speak English, you know that fact).

That's more or less how Social Engineering works.

Answer 3

I'd say that is true, but only to the extent that it filters out people who don't know the language the email was written in at all (completely unintelligible). The truth of the matter is if it was profitable for them to have properly translated, grammatically correct, spam emails then they would do it. Sending an email is extremely cheap in regards to labor and cost. The expensive part is the next step where they interact with the respondents. To quote a Microsoft Research paper:

Far-fetched tales of West African riches strike most as comical. Our analysis suggests that is an advantage to the attacker, not a disadvantage. Since his attack has a low density of victims the Nigerian scammer has an over-riding need to reduce false positives. By sending an email that repels all but the most gullible the scammer gets the most promising marks to self-select, and tilts the true to false positive ratio in his favor.

Crappy graphics and poor grammar weed out the people who are less likely to end up sending them money. People who respond despite those factors are more likely to end up sending them money.

In my extended family on my wife's side there is one individual who was almost baited into a "Bill Gates wants to give you millions" scam a couple of years ago. Luckily I was able to convince them that it was a scam, but only barely even though it was blatantly obvious to me. This same person lost a fortune to the Bernie Madoff of Peru many years ago. They also got involved in a business deal more recently with a shyster and ended up losing a good amount of money due to the partner's bad faith. They are a wonderful person, and unfortunately exactly the mark a scammer wants. They don't want someone that will be spooked by poor grammar.

Answer 4

Short answer : No.

Long answer : Limited samples does not justify your conclusion.

1. Phish campaign are never free, phisher need to make sure there is enough target fall into prey to pay their bills.
2. Regionalised phishing campaign increase success rates. A phisher will make use of online advertiser regionalised tracking features. It is cheaper to piggy back on the online advertiser relayed information than run your own script (that is costly to build and easily blocked by Antivirus software)
3. Phisher also run their own statistic on the phishing campaign, to tune the layout, wording, etc.

For example : If you go to popular regional website, when you click on the phishing advertising campaign adverts(which can be anything that you deem interested), it will send all the regional information, including all the advertiser tracking information to the phisher. Then the phisher just show you correspondence contents according to the region. The infamous ransomware are indeed using this tactics, e.g. show crafted Italian page when it know you are a Italian user, show a German page to German user.

(update) Checkout this German DHL security notes. Imagine you are one of those user awaiting package and an unclaimed package email appear in your mail box, what will you do? You can view the sample phish email image here

That's why a tracker blocker/ads blocker will mitigate a lots of malware campaign, because it reduce the entropy of tracking information relay to the phisher through online advertiser.

---

For email phisher, using geo-ip to pin point designated language is not difficult.

First, Phisher can put a web beacon inside the email. (That's why you should open not view unknown email in HTML format). For example,

<img src=http://phisher.com/[email protected]/beacon.jpg> 

And the phisher web server parsed the url, and immediately know you IP address. What they need to do is just match your IP address Geo-IP with the email address.

Then you can guess what happens next : a email that target the specify region will be send, e.g. send a DHL phish mail to user with Germany GeoIP.

IMPORTANT NOTES: Even getting an external report, you must aware about sampling bias on regional user base. If you read statistic from Symantec, it is mostly USA based. If you get statistic from Avast, then statistic might eccentric in middle Europe and Russia. If you go checkout Avira threat statistic, you will see tons of Germany figures.