How Cyber Sleuths Tracked a Nigerian Scammer to His Doorstep

Read the original at 404 Media ↗
Cite

Cox, J. (2026, August 31). How Cyber Sleuths Tracked a Nigerian Scammer to His Doorstep. 404 Media. https://www.404media.co/how-cyber-sleuths-tracked-a-nigerian-scammer-to-his-doorstep/

Dated when The Aporia collected the article, usually within hours of publication. Check the original for its exact date and byline.

404 Media · collected 2026-08-31 · by Joseph Cox

Quick Summary

Erin West and Paul Raffile, cybercrime experts, tracked down a Nigerian scammer by creating a fake social media account and sending it out as bait, which was quickly targeted by multiple scammers pretending to be young women. They used an IP address-grabbing website to identify the scammers' location in Lagos, Nigeria, where they traveled to gather more information. The duo found that a local spiritual leader, or "baba lao," would perform rituals to enhance the scammers' fortune and blockage. Sextortion is a growing concern, with at least dozens of young boys having taken their own lives after being targeted on social media platforms in the US.
Written locally by qwen2.5:14b on 2026-08-31, using this article's own text rather than the other coverage of the same event (that is the story summary below).

AI analysis runs on qwen2.5:14b, locally

Story summary

Erin West and Paul Raffile, two experts on scams, tracked down a Nigerian scammer to his home in Lagos, Nigeria. They arrived at the location 45 minutes outside of the city and walked through a muddy field to reach a hut where a local spiritual leader known as "baba lao" was performing a ritual to increase the scammer's earnings from blackmailing or manipulating victims overseas. The scammer had already obtained a photo of his victim and had impersonated their identity, and the baba lao attempted to fuse these two souls together for greater fortune. During the two-and-a-half hour ritual, the baba lao performed various tasks, including grinding herbs, creating talismans, and sacrificing an animal, while locals gathered outside the hut.

Written for “Nigerian Internet Scam Exposed” on 2026-10-17, grounded in this article and the 0 other(s) covering the same event.

Story

📰 Nigerian Internet Scam Exposed
Crime & Law · 1 article(s) covering the same event.

Compared with similar articles

Nothing to compare against. No article is close enough to this one for the pipeline to have linked or judged the pair.
How this article was measured signals, leaning charts, publisher record, byline, topics and claims

Signals How these are calculated →

Claims extracted
41
sentences that state something as happening or true
Uncertain
7%
3 of 41 hedged ("reportedly", "may", "according to")
Leaning
not political
takes no side on a contested political question
Publisher signals
95/100
404 Media's corrections and hedging, across everything collected from it. Not a measure of accuracy.
Outlets on this story
1
Crime & Law
Same framing elsewhere
1
articles that frame the event the way this one does
Analyzed 2026-08-31 · how these are computed

How this is being covered How these are calculated →

Article leaning vs. publisher reliability
Source leaning vs. consistency

Publisher

404 Media · 136 article(s) · 0 correction(s) detected
No corrections detected for this publisher. That may mean careful reporting, or simply that nothing has been checked.

Who wrote this

Joseph Cox
25 article(s) here · 1 carrying a prediction
🔮 A letter written by Telegram, and providing a specific user’s phone number, user ID, and IP address, reads: Dear Sir or Madam, For this particular case, the following information was available: User #7149269705 : +201155664529 [Mahmoud Almohtadi] IP 184.186.72.239, 8 Oct 2025 2:08:12 We hope this information will be helpful in your investigation. Kind regards, The Telegram Team The letter says Telegram provided the data “voluntarily” and that by providing it, Telegram is “not conceding that we are subject to U.S. jurisdiction for this or any other request or any purpose.”
🔮 This is pretty normal in the advertising world, but I seriously doubt that when most of ChatGPT’s many, many users see an ad, they realize that might be because someone, somewhere, uploaded their phone number into OpenAI’s systems.
2026-10-15 · assertive framing · ChatGPT Ads Target Your Phone Number, Email
🔮 Multiple Democrat, Republican, and Independent lawmakers have introduced new pieces of legislation that, if passed, would dramatically curb federal agencies’ access to Flock cameras, with the lawmakers referencing reporting by 404 Media in their explanations for why the legislation is needed.
🔮 Although any potential damage will be less if ShinyHunters doesn’t publish the data publicly, the theft happening at all still presents much of those same national security risks, with the data providing granular insight into how the FBI operates. “Since the very beginning we had made our decision that we would never publish this data.
🔮 What is different in this latest Copilot episode, and 404 Media’s reporting on contractors at other AI companies like OpenAI, is that the content humans are reviewing are prompts and uploads that chatbot users may assume are private, and that the contractors are not looking at this material to train the models to filter out offensive images or for some other safety concern.
🔮 And the ALPR Hostlist Management Audit report details changes made to alerts the agency may receive.
🔮 Georgia State University has rescinded a job offer given to a high profile activist who is currently fighting a case in which he allegedly wiped a security-focused Android phone before Customs and Border Protection (CBP) could search it.
🔮 The prompts these people review can include whole conversations between users and the chatbot, conversations that most of ChatGPT’s more than 900 million users probably don’t realize may be read by actual people.
🔮 Apparently over the cross of that source and interviewer relationship, Biden “asked if he could use our mailing list whenever he launched a new product,” according to a statement posted by Channel 5 to X on Monday.
🔮 Border Patrol is running secretive predictive policing units that analyze Americans’ financial activity and other data, then feed that intelligence to local police who pull people over who are not suspected of any specific crime, but which the government thinks may be worth searching, 404 Media has found.
Also by Joseph Cox
Nothing else under this byline is closely related to this article, so these are simply their most recent.
All 25 articles by Joseph Cox →

Topics

Instagram Lagos Nigeria Nigerian U.S.

Subjects

Raffile PERSON · 6× Nigeria GPE · 5× West PERSON · 5× Instagram ORG · 3× Big Dollar ORG · 2× Lagos GPE · 2× U.S. GPE · 2× Erin West PERSON · 1× Nigerian NORP · 1× Paul Raffile PERSON · 1×

Narrative

This is where scammers, like those in Nigeria, will assume the identity of a young person, approach teenagers in the U.S. on apps like Instagram, have them record explicit videos, then pull the mask away and threaten to release the videos to the victim’s friends and family unless they pay up.
framing: assertive · carried by 1 article(s) · first seen 2026-08-31
🔮 The baba lao was going to do a ritual designed to ensure a Nigerian scammer would make more money in his blackmailing or manipulation of an overseas victim, maybe back in the United States.
2026-08-31 · 404 Media
How Cyber Sleuths Tracked a Nigerian Scammer to His Doorstep · assertive framing

Claims (41 extracted, 3 hedged)

Erin West and Paul Raffile stepped out of their van about 45 minutes outside Lagos, Nigeria, and walked down a muddy hill. asserted
West → step → hill
At the bottom, they entered a field with houses made of corrugated steel and cardboard. asserted
they → enter → steel
Raffile kept falling into the mud. asserted
Raffile → keep → mud
After walking about a quarter of a mile, the pair came to a hut, six feet high on stilts, and climbed up a ladder. asserted
pair → walk → ladder
The baba lao was going to do a ritual designed to ensure a Nigerian scammer would make more money in his blackmailing or manipulation of an overseas victim, maybe back in the United States. asserted
scammer → go → States
A scammer who accompanied West and Raffile had a photo of the victim he was trying to get money from, and the identity he had impersonated to do so. asserted
he → accompany → money
The baba lao then fused these two souls together to bring more fortune to the scammer, Raffile recalled. asserted
Raffile → fuse → scammer
For two and a half hours, the baba lao jumped between grinding herbs, creating talismans, sacrificing an animal. asserted
lao → jump → animal
Locals gathered outside the hut. asserted
Locals → gather → hut
West and Raffile are scam experts: West is the founder of Operation Shamrock, an organization that aims to disrupt scam operations, and Raffile is a long time cybercrime researcher, who focuses especially on sextortion. asserted
who → aim → sextortion
This is where scammers, like those in Nigeria, will assume the identity of a young person, approach teenagers in the U.S. on apps like Instagram, have them record explicit videos, then pull the mask away and threaten to release the videos to the victim’s friends and family unless they pay up. asserted
they → assume → friends
Sextortion is common across U.S. social media platforms; at least dozens of young boys have taken their own lives after being targeted. asserted
dozens → take → lives
The pair hatched a plan to go to Nigeria to see if they could actually track down a scammer. uncertain
they → hatch → scammer
The trip provided rare insight into how some scammers live and how brazenly many of them flaunt their scams. asserted
many → provide → scams
Sextortion is “targeting youth. asserted
Sextortion → target → youth
It's surging,” Raffile said. asserted
Raffile → surge → ?
“I wonder, can we hatch a plan where we put ourselves out there as a target, create our own fake account, get scammed by these criminals, and then trace the criminal back to their home turf?” asserted
we → wonder → turf
They made an Instagram and Snapchat account pretending to be a young person. asserted
They → make → account
Within a couple of days, they started receiving suspicious direct messages. asserted
they → start → messages
West said she was “flabagasted” at how quickly the messages came in. asserted
messages → say → ?
The scammers were pretending to be young women, often using photos stolen from OnlyFans models. asserted
scammers → pretend → models
As the chat progressed and the scammers demanded money, the pair said they could only pay in Bitcoin, and sent a link to a website where the scammer could allegedly claim their payment. uncertain
scammer → progress → payment
The site was actually grabbing the scammers’ IP addresses. asserted
site → grab → addresses
It showed the scammers were in Lagos, Nigeria. asserted
scammers → show → Lagos
With not much to go on just yet, the pair got on a flight to Nigeria. asserted
pair → go → Nigeria
Once they landed, they had around six days to find a scammer. asserted
they → land → scammer
It would not be financially viable to sit around in Lagos forever. asserted
It → sit → Lagos
The pair deployed the IP address grabbing website again, but this time one of the scammers granted the tool more permissions in his browser. asserted
one → deploy → browser
The tool was also designed to, if possible, get their exact location, or turn on its camera and see their face. asserted
tool → design → face
This time, it worked. asserted
it → work → ?
They had a scammer’s face. asserted
They → have → face
At one point, another scammer asked the pair to move from Instagram, where the conversation initially happened, over to WhatsApp, which revealed the scammer’s phone number. asserted
which → ask → number
The pair’s fixer put that number into TrueCaller— an app that harvests peoples’ phone contact lists and makes them searchable, essentially — which revealed the name Big Dollar. asserted
which → put → name
West also provided the number to some contacts who investigated it. asserted
who → provide → it
They worked with another expert too who was able to dig up more information and find the scammer’s real name. asserted
who → work → name
They then found other social media profiles belonging to Big Dollar, including a TikTok account that had posted blackmail messages. asserted
that → find → messages
The pair were given GPS coordinates of where this scammer might be. uncertain
scammer → give → coordinates
They drove to Big Dollar’s village, and ultimately he refused to meet the pair. asserted
he → drive → pair
West told Big Dollar on the phone, we know who you are, we know where you live, and the next step is we’re going to give this information to the FBI. asserted
we → tell → FBI
Around this time, they saw Big Dollar’s social media accounts go dark. asserted
accounts → see → time
…and 1 more, not listed.
💬Give feedback
🕘History 🎫Support