The Yahoo Boys Are Not Masterminds. That Is the Scary Part.

In 2022, a Spanish journalist named Carlos Barragán moved to Lagos, Nigeria, to find the people behind the romance scams draining American bank accounts.

He went looking for villains. He found something closer to an entry-level job.

Barragán's book, *The Yahoo Boys* — featured last month on NPR's Book of the Day — profiles the young Nigerian men behind so-called sweetheart scams: fake online personas built to pull victims, many of them American, into romances that end in money transfers. The name traces to the Yahoo email scams of the 1990s. The modern version is the same hustle with better tooling.

The thing Barragán stresses in the NPR interview is who these scammers are not. They are not, in his words, "masterminds of the universe playing with your minds." They are ordinary young men working scripts, personas, and patience — at volume.

That should be comforting. It is the opposite.

Why escrow should care

Escrow files are what a scripted, high-volume operation wants: predictable documents, predictable roles, predictable moments when instructions change and money moves.

The attempts arriving at California offices are mostly unremarkable. That is the trap. Unremarkable is what gets waved through when the defense is vigilance instead of procedure.

An office that expects genius will be beaten by the ten-thousandth ordinary email. An office that runs and records the same boring review on every file has taken luck off its own side of the table — the only side it controls.

Volume doesn't need genius

A large grid of anonymous repeated attempts meets one consistent five-part review gate.

A mastermind is rare, expensive, and self-limiting. There is one of him, and he can only run so many schemes.

A script is none of those things. A script can be handed to a nineteen-year-old in his first week. It can be copied, translated, tested against a thousand targets, and revised by whatever survives. The persona photos are borrowed. The emotional beats are documented. The operator contributes hours.

To be fair to the book: Barragán is writing about romance scams against consumers, not escrow. Nothing in it touches a closing file. What travels is the economics.

This is the same shape The Economist found in Southeast Asia's compounds and INTERPOL keeps finding worldwide — fraud as a repetition business. And repetition businesses share one property that matters to anyone building a defense: their output is mostly mediocre. The typical fraudulent contact is not brilliant. It has typos, an off cadence, a wrong detail. It fails constantly. It only has to land occasionally, because attempts are nearly free.

So the message that reaches your desk without tripping your instincts is not evidence of a genius adversary. It is a survivor — the one variant out of thousands that happened to fit your file, your day, your attention.

Selection did the work intelligence didn't.

Stop designing for Moriarty

Here is where offices quietly get the threat model wrong. Controls built on noticing — "our officers would spot it," "that email felt off," "we know our clients" — are controls calibrated against cleverness. They assume the dangerous attempt will feel clever, and that experienced people will feel it.

Against a volume adversary, noticing has a math problem. It has to win every time, against a stream of attempts filtered — by the failures of all the earlier ones — to not feel like anything.

The defense that matches the threat is the one that does not depend on noticing at all. A fixed set of checks. Run identically on every file. Recorded as they happen. The ordinary attempt dies against the ordinary procedure — the callback to the source row on file, the comparison against the dated payoff demand, the open item retained instead of waved through. No insight required. That is the feature.

And a fair word to experienced officers, because it needs saying out loud: procedure is not an insult to your judgment. It is what lets your judgment apply to the file you are not looking at. The sharpest instincts in the office work forty hours a week. The volume adversary works all of them.

The record matters as much as the checks. A procedure that runs "usually" is, from the other side's seat, a procedure with scheduled gaps — and the attempts will find the gaps by arithmetic. Writing the review down on every file is how an office knows, and can later show, that the procedure ran on the one file where it counted. Our piece on the record before the wire goes deeper on that failure pattern.

What should be written down before money moves

Before the money moves, the file should answer five questions:

What changed.
What was checked, and against which source.
What stayed open.
Who reviewed.
What the office did.

The same five, on every file — not just the ones that feel wrong, because the dangerous file is the one that didn't. Where each instruction came from, channel and date. The source row it was checked against — the document or number already in the file, never one supplied with the request. What matched, what stayed open in plain words, who reviewed, and the office's decision.

Five minutes of clerical honesty. No exceptions for files that feel fine. Feeling fine is the one signal the survivors are selected to produce.

Operator takeaway

Retire the mastermind from your threat model. Replace him with a script and a numbers game, and match it: same checks, every file, in writing.

Consistency, unlike vigilance, is something an office can schedule.

You do not have to be smarter than the fraud economy.

You have to be more consistent than it is lucky.

— Sebastian Heyneman

Sources

Boundaries: the book and interview concern romance scams against consumers; no escrow transaction appears in either. "The same shape" across The Economist's and INTERPOL's reporting is our synthesis, and the volume-adversary framing is our reading of Barragán's account, not his language.