ScamChatBot: An End-to-End Analysis of Fake Account Recovery on Social Media via Chatbots

Motivation and contribution

• The study addresses the scalability limits of prior deception research by using LLM-generated human-style messages instead of relying heavily on manually crafted engagement.The authors seek deeper insight into the scam lifecycle while reducing redundant manual effort.Source: §1 · p. 2

System design

• ScamChatBot uses honeyposts, LLM-powered conversations, and tracking to attract scammers, automate engagement, and link social-media and payment-profile data.The system poses as users with account-recovery problems, filters legitimate interactions, and analyzes conversations, shared payment methods, and scam lifecycles.Source: §1 · p. 2, Figure 1 · p. 2

Study scope and findings

• 11,700+ scammers interacted with the system, and 450 were engaged in chatbot conversations across Instagram, X, and email.The study generated about 19,000 honeyposts between late November 2023 and late March 2024; scammers typically replied on all three channels within two hours.Source: §1 · p. 2

Scam operations

• Scammers used numerous social-media profiles while directing users toward only one or two communication channels.Some scammers were associated with as many as 71 social-media profiles.Source: §1 · p. 2

Scammer tactics

• Scammers request verification, private information, and payment for fake support, and may use extortion or emotional manipulation when demands are refused.The study reports that scammers can threaten personal-information leakage, extending harms beyond direct financial loss.Source: §1 · p. 2
• 28.4% of scammers were likely to use automated text-generation tools, and scammers revealed payment profiles after an average of seven interactive dialogues.The dialogue-length finding indicates that repeated interaction was required to obtain relevant payment information.Source: §1 · p. 2

Detection and disruption

• The system collects fraudulent payment profiles in real time and shares validated findings with platforms and payment-related organizations.The researchers collaborated with X, PayPal, and Chainabuse, which validated scam activity and financial losses associated with disclosed profiles.Source: §1 · p. 3

2 System Design

• ScamChatBot integrates decoy interactions, LLM-powered automated conversations, and tracking to connect scammer activity across the scam lifecycle.The tracking module analyzes profile metadata, conversations, payment methods, and end-to-end activity.Source: §2 · p. 3, §2.4 · p. 6

2.1 Attracting Scammers via Decoys

• The system posts tailored account-recovery honeyposts through six X profiles covering five social platforms and ten cryptocurrency wallets.Three profiles target social-account recovery and three target wallet recovery, using posts structured around account-access problems and urgent help requests.Source: §2.1 · pp. 3–4

2.2.1 Engagement Pre-processing Filtration

• Before automated engagement, ScamChatBot filters verified, official, and benign accounts to reduce interactions with legitimate support providers.The benign-account criteria include continuing through new communication channels and posing as official representatives, while benign accounts typically stop after the initial interaction.Source: §2.2.1 · p. 4

2.2.2 Scammer Engagement

• LLM-configured personas converse through email, X, and Instagram while maintaining context and eliciting payment information from scammers.The system uses separate accounts and APIs, aggregates prior interactions, and can request multiple payment methods by claiming earlier payment attempts failed.Source: §2.2.2 · pp. 4–5

2.3.1 Legitimacy of Data Filtration and Methodology Accuracy

• In 45 manually reviewed conversations, no legitimate or official-support accounts were mistakenly engaged, while scammers disclosed payment profiles despite sometimes suspecting a bot.Three conversations involved suspicion caused by repetitive exchanges, but payment profiles were still disclosed.Source: §2.3 · p. 5, §2.3.1 · p. 5, §2.3.2 · p. 5

2.3.3 Limitation to External Channel Communication

• The system could not conduct in-depth analysis when scammers redirected conversations to newly introduced channels, including X accounts, email-linked cryptocurrency requests, and other external routes.Three redirection attempts were identified, but the system was not configured to continue through the scammer-provided channels.Source: §2.3.3 · pp. 5–6

3.1 Interaction with Decoy Profiles

• 90.0% (20,046/22,285) of distinct scam-account messages targeted cryptocurrency-related profiles, compared with lower interaction rates for social-media recovery posts.Overall, 35.7% (6,782/19,001) of posted tweets received comments from 11,769 potential scammers.Source: §3.1 · p. 6

3.2 Interaction with Automated Chat Module

• Scammers typically verify account details and identity, request an advance fee or secret phrase, then delay recovery behind purported technical work.Requested information includes account identifiers, locations, contact details, screenshots, videos, and sometimes wallet seed phrases.Source: §3.2 · pp. 6–7
• Scammers requested payment through gift cards, cryptocurrencies, PayPal, Venmo, CashApp, or external links, sometimes using PayPal’s non-refundable family-and-friends option.They also requested payment screenshots for confirmation.Source: §3.2 · p. 7
• After failed-payment excuses, scammers expressed frustration, used profanity, and sometimes threatened personal harm, showing that the scam could extend into extortion and abuse.The study used payment failures to elicit additional payment methods.Source: §3.2 · p. 7
• ScamChatBot engaged 450 scammers across X, Instagram, and email after filtering out opt-outs and requests for unsupported external channels.The system continued engagement for six weeks after the tweet module ended to accommodate persistent scammers.Source: §3.2 · pp. 6–7
• Of 18,678 recorded messages, 46.7% (8,721/18,678) were written by scammers, while Instagram produced 73.2% (13,668/18,678) of the collected message volume.The engagement breakdown covers email, X, and Instagram.Source: §3.2 · p. 7, Table 2 · p. 7

4 Investigation into Scammer Tactics

• Scammers’ operational analysis examined response timing, persistence, weekly activity, profile and channel coordination, ML-generated text, dialogue length, and payment disclosure.The investigation used ScamChatBot interactions across three communication channels.Source: §4 · p. 8, §4.1 · p. 8, §4.2 · p. 8

4.1.1 Initial Response Time

• 15.6% (70/450) of communication channels used initial auto-scripts, while median response time was 1 hour and 48 minutes and the 90th percentile was 9 days.Email responses were fastest, with a 33-minute, 9-second median, compared with more than 2 days on X.Source: §4.1.1 · p. 8

4.1.2 Total Time Spent Analysis

• More than 80% of scammers stopped after the first day, but the remaining 20% continued conversations from their last interaction point.Overall engagement averaged 57 minutes and 30 seconds, with the 90th percentile lasting approximately 6 days and 22 hours.Source: §4.1.2 · p. 8, Figure 3 · p. 9

4.2.1 Week Period Scammer Communication Analysis

• Scammer activity varied by weekday and platform: Instagram activity was lowest on Saturdays, email activity increased on weekends, and X activity was steadier from Wednesday through Saturday.These patterns were measured from chat interactions across Instagram, email, and X.Source: §4.2.1 · p. 9, Figure 4 · p. 9

4.2.2 Scam Network Operation

• 42.6% (5,012/11,769) of scam profiles used multiple communication channels, with one profile using 71 and 16.5% using all three channels.Profile similarities included shared names, descriptions, and followers, suggesting clusters of organized scamming operations.Source: §4.2.2 · p. 9

4.2.3 Potential Operation of ML ChatBot

• 28.4% (128/450) of scammers had a probability score of at least 50 for using ML text generation, while 26.0% (117/450) scored at least 90.Sapling API aggregated text-generation likelihood across conversations and communication channels.Source: §4.2.3 · pp. 9–10, Table 5 · p. 10

4.3 Analysis of Dialogue Length and Scamming Payment Information Disclosure

• Instagram conversations were longest, with median dialogue lengths of 22 messages versus 2 for email and 6 for X.The maximum dialogue lengths were 81 for Instagram, 62 for email, and 65 for X.Source: §4.3 · p. 10, Figure 5 · p. 10
• Payment profiles were disclosed after median dialogue lengths of 1 message for email, 10 for Instagram, and 7 for X.The corresponding maximum dialogue lengths before disclosure were 13, 47, and 41 messages.Source: §4.3 · p. 10, Figure 5 · p. 10

5 Qualitative Study on Chat Dialogue

• The qualitative workflow manually inspected 150 dialogues, converted observations into questionnaires, and used ChatGPT prompts for individual conversation analysis.Manual review of the prompted outputs produced the reported persona, scammer-behavior, and language findings.Source: §5 · p. 10

5.1 System Interaction with Scammer Analysis

• The system used cryptocurrency-user, naive-investor, and phishing-victim personas, and simulated payment outcomes including 117/450 cryptocurrency and 16/450 PayPal confirmations.The personas conveyed distress, fear, naivety, and urgency about recovering inaccessible accounts or wallets.Source: §5.1 · p. 11

5.2 Scammer Interaction with System Analysis

• 271/450 scammers presented themselves as representatives or agents offering account recovery, while 137/450 claimed support-team roles and others claimed hacking or expert identities.The observed roles included customer, wallet, technical, media-recovery, official-support, hacking, and blockchain-related titles.Source: §5.2 · p. 11
• Scammers requested private keys from 69/450 interactions and sought screenshots, calls, messaging apps, video calls, or identity documents for verification.These requests included transaction hashes, contact details, investment information, locations, VPN evidence, passports, and driver’s licenses.Source: §5.2 · p. 11
• 207/450 scammers expressed resentment before ending conversations, while common termination triggers included missing payment proof and insufficient response or verification.The most frequent recorded reason was inability to provide payment proof, affecting 85/450 conversations.Source: §5.2 · p. 12

5.3 Diversity Qualitative Measure

• Among 63 responders in the multilingual experiment, 11/63 used non-English automated chats, including Spanish, Dutch, German, and French.Native-speaker evaluations found translation artifacts and occasional suspicion that the system was a robot.Source: §5.3 · p. 12

6 Scam Validation and Tracking

• The shared dataset comprised 11,769 X accounts, 743 email addresses, and 51 cryptocurrency addresses, enabling partner validation beyond social-media profile analysis.Source: §6 · p. 13

6.1 Scam Validation through X

• X confirmed abuse for over 80% of shared accounts and identified and remediated over 3 million accounts linked to the dataset, predominantly involving spam, impersonation, scams, and bot behavior.Source: §6.1 · p. 13

6.2 Tracking Email-based Payment Methods

• PayPal confirmed accounts associated with 163 of 743 shared email addresses, including 41.1% linked to risk or fraud typologies and 10 using PayPal cryptocurrency products.Source: §6.2 · p. 13

6 Scam Validation and Tracking

• Partner feedback indicated that technical-support scammers participate in multiple fraud types, suggesting coordinated activity that may require ecosystem-level remediation.Source: §6.2 · p. 13, §6.1 · p. 13

6.3 Tracking Cryptocurrency Addresses

• Among 48 valid cryptocurrency addresses, 37 had transaction histories totaling $23,650,278 in incoming funds, including $56,126 across four reported recovery-fraud accounts.Source: §6.3 · p. 13
• The cryptocurrency analysis is based on observed transaction histories and reported fraud categories, without conclusive proof that all transactions were scam-related.Source: §6.3 · p. 13

7 Discussion

• ScamChatbot is limited by its ability to detect official account-recovery support entities, engage scammers promptly, and capture communications on other platforms.Source: §7 · p. 14
• Detecting official recovery entities requires pre-existing knowledge of popular global and regional platforms and their official recovery procedures.Source: §7 · p. 14
• Timely engagement depends on integrated-platform API limits, while some scammers may become inactive before the system responds.Source: §7 · p. 14
• The system may miss communications through Telegram, phone calls, forms, and other channels, requiring channel tailoring and additional resources or compute to expand coverage.Source: §7 · p. 14

Automated Conversation

• Unlike passive automated email scam-baiting that wastes scammers’ time, this work seeks financial details to track money flows and coordinate action with industry partners.Source: §8 · p. 14

Social Media Honeypots

• ScamChatbot closes the scalability gap in prior social-media honeypots by combining honeyposts and fully automated chatbot interactions to study scammers in detail.Source: §8 · p. 14

Cryptocurrency and Technical Support Scams

• Earlier cryptocurrency and technical-support studies scraped content to label scams, whereas this work interacts with scammers to identify their real-time modus operandi.Source: §8 · p. 14

Social Media: Fake, Spam and Phishing Studies

• Prior fake-account, spam, and phishing studies examined abusive social-media profiles but did not share the modus operandi of technical-support attacks targeting account-recovery users.Source: §8 · p. 14

Account Recovery

• Account-recovery research examined device, service, and process complexity, while this work adds real-time payment methods associated with scammers.Source: §8 · pp. 14–15

9 Conclusion

• The system attracted 11,769 scammers through decoy X tweets and conducted automated chatbot interactions with 450 of them.Source: §9 · p. 15
• The interactions uncovered tactics for persuading users to share private keys or other sensitive information.Source: §9 · p. 15
• Collaboration with PayPal and Chainabuse validated financial losses and exposed real-world attacks beyond analysis of social-media profiles.Source: §9 · p. 15

A.1 Honeyposts Generation

• The system creates social-media honeyposts describing lost passwords or account-access problems for Gmail, Facebook, and Twitter.Source: §A.1 · p. 17
• Cryptocurrency honeyposts describe users needing help recovering access to wallets such as Trust Wallet, BitPay Wallet, and Badger Wallet.Source: §A.1 · pp. 17–18

Persona Configuration

• ScamChatBot requires persona configurations that define the role, background, communication preferences, and constraints used during direct-message conversations.Source: §A.2 · p. 18
• The chatbot simulates account-recovery victims who may withhold or provide requested credentials, decline phone or identity verification, and ask about payment amounts and destinations.Source: §A.2 · p. 18

Dialogue Examples

• The cryptocurrency-wallet dialogue shows a scammer requesting a wallet address and seed phrase before offering help.Source: §A.2 · p. 19
• After the chatbot asks about cost and payment destination, the scammer requests $100, accepts PayPal, and promises software-based wallet activation within 30 minutes.Source: §A.2 · p. 19
• The chatbot repeatedly requests payment details and confirmation while ultimately declining to proceed with payment in the illustrated interaction.Source: §A.2 · p. 19

A.3 Non-Text Interactions

• Scammers generated 24,085 non-text interactions with Honey Profiles across four interaction types, while impressions accounted for 25.48% of tweets receiving such engagement.Source: §A.3 · p. 20, Table 6 · p. 20

A.4 Qualitative Study: Prompt Questionnaires

• The qualitative study uses GPT-4-1106-preview to analyze JSON chat dialogues with structured questions about scammer tactics, verification requests, payment behavior, personas, and conversation endings.Source: §A.4 · p. 20
• The questionnaire distinguishes scammer and system attributes, including redirection channels, private-information requests, payment confirmation, refusal sentiments, and represented biographical data.Source: §A.4 · p. 20

B Languages-based Interaction Examples

• The appendix includes Spanish and German chat-dialogue examples to illustrate language-based interactions with scammers.Source: B Languages-based Interaction Examples · p. 20

B.1 Spanish Speaking Chat Dialogue

• The scammer asks about the wallet problem, website link, wallet balance, and payment, while the chatbot presents inability to access the wallet and willingness to pay.Source: §B.1 · p. 21
• The scammer requests a wallet link and later states that assistance costs $300, directing the chatbot toward payment.Source: §B.1 · p. 21
• The scammer accepts or insists on cryptocurrency payment, while the chatbot repeatedly prefers PayPal and asks for an alternative payment method.Source: §B.1 · p. 21
• After the chatbot requests PayPal details, the scammer agrees to continue, promises checks, and later reiterates the $300 charge and payment urgency.Source: §B.1 · pp. 21–22
• The scammer pressures the chatbot to pay immediately, citing other work and asking why payment has not been made.Source: §B.1 · p. 22

• The scammer engages a German-speaking user by offering help with recovering access to a cryptocurrency wallet.Source: §B.2 · p. 22
• The scammer asks which wallet type the user employs and requests the login information used to open it.Source: §B.2 · p. 22
• The user discloses a private-key passphrase, but the scammer does not immediately provide recovery instructions.Source: §B.2 · p. 22
• The scammer demands $200 and instructs the user to send credentials and enter a code into an algorithm.Source: §B.2 · p. 22
• The scammer provides a PayPal contact and later requests payment information or proof while claiming the wallet will be restored after payment.Source: §B.2 · p. 23