Loading today’s stories
Security1 distinct publisher3 min readPublished
Erin West and Paul Raffile ran a decoy teenage account, logged the IPs behind the sextortion DMs, captured a face through a browser permission prompt, and got to a legal name and GPS coordinates on open tooling.
The Watch · Security desk
invest
Meta's $16.68bn child-harm settlement prices platform design as a cleanup liability1 distinct publisher
product
A $500 fake cleared Rolex's own London workbench, and staff called it beautiful1 distinct publisher
security
New Zealand's under-16 bill makes age checks a statutory duty, and someone has to hold the scans2 distinct publishers
product
Age assurance without a spec: France cuts verification, New Zealand promises 10 percent2 distinct publishers
Compiled by The WatchSomething wrong?How this is made
Each step in the chain traded a weak identifier for a stronger one, and none of them needed legal process. When the scammers demanded money, the pair said they could pay only in Bitcoin and sent a link to a site that logged the visitor's IP address, which placed the crew in Lagos [4]. On a second deployment, run from inside Nigeria, one scammer granted the page more browser permissions; the tool was built to read precise location and to switch on the camera, and that time it worked, producing a face [5]. A different scammer asked to move the conversation from Instagram to WhatsApp, which surfaces a phone number by design [6]. The number went into TrueCaller, which indexes harvested contact lists and returned the handle Big Dollar [7]. West passed the same number to contacts, and another expert produced the man's real name, after which they found further profiles including a TikTok account carrying posted blackmail messages [8].
Two windows are on the record: a couple of days for the first approaches to arrive after the decoy accounts went up [2], and around six days on the ground before the trip stopped being financially viable [3]. Those sum to roughly eight days of active work, before travel and setup [1]. Out of it came six identifiers: city, face, phone number, handle, legal name, and GPS coordinates for a village [2].
The operational tell here is the absence of tradecraft. Forty-five minutes outside Lagos, a scammer travelling with West and Raffile brought a photo of his target and the identity he had stolen to a two and a half hour ritual with a local spiritual leader, herbs, talismans and an animal sacrifice, with neighbours gathered outside [16]. West described the trip as a chance to put some fear into a class of people who are not really afraid of being arrested [11]. That is a rational read of their risk, and it is why the identifiers were sitting in plain sight.
The scale behind the single case is what makes it a campaign rather than an anecdote: the model is impersonate a teenager, extract explicit video, then threaten release unless paid [12], and at least dozens of young boys in the US have taken their own lives after being targeted [13]. Raffile says the activity is surging [14].
This is one account, given by the two people who ran it. The real name is not published, and 404 Media reports no arrest, no charge, and no completed referral [18]. The lever they actually had was a phone call telling Big Dollar that the FBI was next, and the reported effect was his social accounts going dark [10]. The result is displacement measured in handles, short of disruption measured in cases.
Ranked by verification strength, evidence, and original report placement.
Erin West is the founder of Operation Shamrock, an organization that aims to disrupt scam operations; Paul Raffile is a longtime cybercrime researcher who focuses especially on sextortion.
West and Raffile created an Instagram and a Snapchat account pretending to be a young person, and within a couple of days began receiving suspicious direct messages; West said she was flabbergasted at how quickly the messages came in.
Once they landed in Nigeria the pair had around six days to find a scammer, because it would not be financially viable to sit around in Lagos indefinitely.
As the chats progressed and the scammers demanded money, the pair said they could only pay in Bitcoin and sent a link to a website where the scammer could allegedly claim payment; the site was grabbing the scammers' IP addresses, and showed they were in Lagos, Nigeria.
The pair deployed the IP-grabbing website again from Nigeria, and this time one scammer granted the tool more permissions in his browser; the tool was designed to get exact location or turn on the camera if possible, it worked, and they obtained a scammer's face.
Another scammer asked the pair to move from Instagram to WhatsApp, which revealed the scammer's phone number.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 31, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
The participants, retelling their own trip, to one outlet
404 Media was not in the hut, not on the call to Big Dollar, and not looking over the fixer's shoulder at the TrueCaller screen. What we have is West and Raffile recounting an eight-day operation: no screenshots, no logs, no filings, and no word from the four platforms in the chain or from the FBI. The tradecraft is coherent step by step, which is why this scores at all, but the single most serious assertion — that a named man in a named village sent the messages — rests on unnamed contacts and an unnamed expert.
Two people, one trip, nobody else doing it yet
Counted honestly, uptake is two field deployments of a homemade link and one lookup in a commercial app, by a pair who explicitly could not afford to stay in Lagos past six days. Nothing in the reporting shows another investigator, NGO, platform or police force repeating the method, and the technique's dependence on a target clicking and granting permissions makes it a hand-built approach rather than a pipeline.
Doorstep, not handcuffs
The arc promises pursuit and delivers identification. Big Dollar declined to meet, the FBI turns up as a threat spoken on a phone call rather than a referral anyone filed, and the closing evidence of impact — accounts going dark — is equally consistent with a scammer rotating handles. To 404 Media's credit it does not claim otherwise; the overstatement lives in the shape of the story, where a chain that establishes who ends up standing in for something that changed.
The protagonists are the sources
West runs an organisation whose purpose is disrupting scams and which benefits from a story where disruption looks achievable; Raffile's specialty is precisely the crime the piece elevates; both control the record of what happened on those eight days. There is no counterparty in the story at all — no platform, no Nigerian police, no response from the man named. That does not make the account untrue, but every incentive in it pulls the same way.
Believe the method, hold the man loosely
The mechanics — decoy account, IP-logging pretext, permission prompt, WhatsApp number, reverse lookup — are specific, ordinary and easy to believe; they are also the parts a reader could reproduce. Confidence drops sharply at the identification and at the background statistics, both of which are asserted rather than evidenced. One outlet, one telling, no documents: enough to report on, not enough to treat as an established case.