In the Slatest, Jeffrey Bloomer has an interesting post on why email scammers claim to be from Nigeria, a country that has become almost synonymous with email scams. A new paper from Microsoft Research’s Cormac Herley offers an ingenious explanation for the implausibility of the famous hoax: The scammers want most people to know it’s a scam. With limited time and resources, they only want the most gullible people to respond. So “Nigeria” functions as a sort of code to weed out responses from people who wouldn’t be likely to actually hand over any cash.

It’s a hypothesis I’ve heard before, but I’ve never seen the case made nearly as convincingly as Herley makes it. For those interested, the paper itself is well worth a read. I have just two things to add.

One is that, as thorough as Herley’s paper is, it doesn’t purport to prove that scammers deliberately make their emails implausible. He didn’t actually ask any scammers why they claim to be Nigerian. His theory is backed up by math and logic, not empirical evidence. What the paper shows is that bogus-sounding emails filled with clichés would make an effective strategy for weeding out false positives.

The second point is so simple that most readers might have already assumed it, but it was never explicitly addressed in the paper or much of the media coverage. The other reason that so many email scammers claim to be from Nigeria is that they are in fact from Nigeria. For a combination of reasons, Lagos has long been the world capital of advance fee fraud scams. In fact, the Nigerian email scam has been around since before most people used email—fraudsters in Lagos sent similar appeals via snail mail in the 1980s. The scams are often called 419 fraud, apparently in reference to the section of the Nigerian criminal code that covers such scams.

It’s impossible to get precise figures on where email scams originate, but experts estimate that well over 50 percent of advance fee fraud emails come from Nigeria. The Dutch firm Ultrascan Advanced Global Investigations used to publish an annual report on 419 scams. In the latest report I could find, from 2009, they counted at least 250,000 that originated in Nigeria, with another 50,000 or so coming from 69 other countries around the world.

Other countries have, for various reasons of their own, become hubs for other types of cybercrime. Hackers who steal customers’ credit card information from restaurants often hail from Russia. The FBI last fall traced one of the world’s largest click-fraud scams to a ring of cybercriminals in Estonia.

So Herley’s paper explains why Nigerian email scammers admit to being from Nigeria. Why Nigerians become email scammers in the first place is, perhaps, a question for another paper. My guess is that it’s some combination of tradition—once a few Nigerians started making money this way, others followed—access to technology, high unemployment, and relatively weak law enforcement.

Security experts tell me the Nigerian government has been stepping up its efforts to go after scammers, but Lagos is one of the world’s most crowded and fastest-growing cities, and prosecuting cybercrime is difficult even in the best of circumstances. It’s not impossible, though: In 2009, U.S. authorities tracked down and convicted a Nigerian cybercrook who had immigrated to the United States the previous year. The rare prosecution showed just how lucrative the scam can be: Over a six-year period, the man had bilked 67 victims out of $1.3 million.