After I received dozen of spam mails over the last year with my thrashmail (used for "You must log in once to check out this product.."-Sites, etc.) I noticed they were mostly translated (if they are at all) horribly.

I thought about that after reading the Wikipedia article about the ransomware "Locky" where the Spam Message pattern was shown.


  Dear (random name):
  
  Please find attached our invoice for services rendered and additional
  disbursements in the above-mentioned matter.
  
  Hoping the above to your satisfaction, we remain
  
  Sincerely,
  (random name)
  (random title)


Refering to my experience, only a few mails were translated well enough to even consider it as my native tongue (German, by the way).

So, I was wondering If non-English users are theoretically better protected from international scam/phishing than native speakers. Of course there are a lot of properly translated versions out there, or they are also based in the same country, but my inbox is dominated by non-German Spammers.

Or would you (as a 'normal' user) trust a [insert random title here] who can't properly speak your native language and therefore sounds like Master Yoda with Dyslexia? Or if it was in English I'd wonder "Why the heck would a [insert radnom country I've never heard of] Lawyer write to me in English?"

I believe these users are a bit safer, as Phishing is mostly about gaining the victim's trust.

I'm interested in whether this thesis is true.

Edit: It's awesome to see how multifarious the Answers and Comments are. Kudos to the Stack InfoSec Community.

There is a really, really good paper on this here.

Tl;dr: 


95% of spam is in English
In f.ex. Germany only 17% of the spam is in German
In Scandinavia it's less than 1% in the local language


Conclusion I: Yes, generic phishing is mostly directed to English speaking people. I can only confirm that many German people will not even consider opening a mail with a non-German subject.

Conclusion II: The main factor for the phishers will be to gain proficiency at the target language. Target languages are English and other "first world" languages, but they are differently hard to learn. Since it's much easier to auto-translate and learn basic English than for example Icelandic, phishing will be much less effective on non-English speakers.

But: Spear phising is much more dangerous and will always be done in a local language, so statistics can't take that into account.
