Hacker News Reader

"I have your lottery winnings. Send (amount) to me to process sending you the money."

That's a scam, right?

"I have encrypted your files. Send (amount) and I'll decrypt them for you."

Not a scam?

It often isn't. The criminals know that the game theory is such that the criminals know that if they don't actually provide the files when paid, none of them will get paid in the future as people will just assume the files are destroyed unrecoverably and move on. The scam critical depends on you being able to be confident that the files actually are recoverable and thus that paying the ransom is a viable option.

Encryption viruses are probably some of the best QA'ed code in the world.

I've heard of enough cases where the ransomware gang have not followed through after payment of the ransom, that I think that time ("if they don't actually provide the files when paid") has already passed.

Reply on news.ycombinator.com