PaperlayerView exact revision on arXiv

Source-linked AI summary

Beyond the Prank: The Hidden Expertise of TSS Scambaiters

Saleh Alsyefi, Anish Chand, Matthew Edwards, Phani Vadrevu

arXiv:2609.06103v1cs.CRcs.CY

TL;DR

Technical support scams cause substantial losses, and research has overlooked scambaiters’ resources and expertise. The authors interviewed 17 scambaiters and found that many combine scam disruption with evidence collection and reporting, while facing substantial demands.

  • Problem

    TSS cause substantial financial losses, while research has overlooked scambaiters’ resources and how technology can support them.

    Source: §1 · p. 1

  • Method

    The authors used a careful selection strategy and semi-structured interviews with 17 active TSS scambaiters.

    Source: §1 · p. 2, §3.2 · p. 3

  • Results

    Many scambaiters collect, analyze, and report scam information to disrupt operations, using prepared deceptive environments and tools while carrying a substantial manual burden.

    Source: §7 · p. 12, §8 · p. 14

  • Takeaways & Limitations

    The authors offer recommendations for five stakeholder groups to support safer scambaiting and use community expertise in defensive efforts.

    Source: §7 · p. 12

    The authors do not claim the findings represent the entire scambaiting community; participants came from overlapping communities and findings focus on TSS scambaiting.

    Source: §7.6 · p. 14

Abstract

from arXiv · show

This research studies how Technical Support Scams (TSS) are being countered by a uniquely dedicated community of volunteer counter-fraud operatives. Using a careful subject selection strategy, we interviewed 17 individuals who actively engage in TSS scambaiting activities in order to obtain insight into their motivations, the operational methods of the scammers they combat, the undocumented nuances of effective scambaiting action, and the various challenges scambaiters face. In our analysis, we find a community rich not only with insight into offenders, but with technical and operational expertise that is often lacking in research efforts targeting these same populations. At the same time, we find key areas where the community could be better supported and enabled. We discuss the implications of our findings for both future research and community protection strategies.

1 Introduction

Technical support scams exploit trust through real-time conversations and reach victims at scale, while researchers have paid limited attention to scambaiters’ resources and expertise. This study interviews 17 scambaiters to understand their practices, goals, and challenges and consider how their knowledge can inform defenses.

1 Introduction

  • Reported U.S. losses from TSS exceeded $1.46 billion in 2024, amid an ecosystem that reaches and monetizes victims at scale.Common exposure channels include web search poisoning, malvertising, and email.Source: §1 · p. 1
  • Scambaiters impersonate potential victims to engage, stall, and expose scammers, although popular portrayals often reduce their activity to entertainment or time-wasting.TSS involve impersonation of technical support, fraudulent payment or computer access, and real-time conversations used to build trust and guide victims.Source: §1 · p. 1
  • Researchers have overlooked scambaiters’ resources and how technology could support them, limiting operational deployment of countermeasures and data collection.Prior studies using forums or public videos offer limited insight into preparation, strategy, and post-call actions.Source: §1 · pp. 1–2
  • The study interviews 17 scambaiters to examine their motivations, preparation, skills, knowledge acquisition, challenges, and community needs.Participants span experience levels and engagement styles, including everyday community members and highly visible scambaiters.Source: §1 · p. 2
  • The study finds that many scambaiters prioritize systematic evidence collection and reporting, identifies persistent challenges, and recommends ways stakeholders can use community expertise.The authors describe this as the first systematic effort, to their knowledge, to directly engage scambaiters and harness their experiential knowledge.Source: §1 · p. 2

2 Background and Related Work

The background reviews technical support scams and scambaiting as a fraud-prevention activity, alongside research on scam operations, public scambaiting outputs, and automation. Prior work also debates the impact and desirability of scambaiting.

2.1 Understanding Technical Support Scams

  • TSS operators impersonate support agents and use urgent warnings, confusing technical claims, and deceptive channels to persuade victims to pay for intervention.Prior research examines their social-engineering tactics, advertising and search infrastructure, scams targeting Japanese victims, and evolving technologies and payment methods.Source: §2.1 · p. 2

2.2 The Phenomenon of Scambaiting

  • Scambaiters intentionally interact with scammers without paying, using tactics such as virtual machines, fake personas, and scripts to waste time, gather intelligence, and expose methods.Interactions are often documented online for public education and entertainment.Source: §2.2 · p. 2
  • Research describes scambaiting as a possible countermeasure but also raises concerns about participants’ motives, legality, and online vigilantism.Public accounts include scambaiters assisting law enforcement, while researchers have also analyzed public interactions and developed automated approaches.Source: §2.2 · p. 2

3 Methodology

The study uses semi-structured interviews and hybrid deductive-inductive thematic analysis to examine scambaiters’ experiences, tactics, and motivations. Recruitment and screening were designed to identify knowledgeable participants in a suspicious community.

3 Methodology

  • The researchers used semi-structured interviews to examine scambaiters’ lived experiences, technical tactics, and motivations.Interviews lasted about 60 minutes, followed a seven-topic guide, were recorded and manually transcribed, and were stripped of identifying information.Source: §3 · p. 2, §3.3 · p. 3

3.1 Participant Recruitment

  • Recruitment used specialized forums and Discord, Reddit communities, and introductions through community gatekeepers, with $30 compensation offered for interviews.The protocol was IRB-approved; researchers also contacted one prominent scambaiter directly.Source: §3.1 · pp. 2–3

3.2 Screening and Fraud Mitigation

  • To screen out fraudulent applicants, researchers concealed the TSS focus, checked for experience across voice calls and remote desktop, and manually reviewed written answers.The qualitative override retained knowledgeable candidates who might fail binary checks; 59 applicants qualified after screening.Source: §3.2 · p. 3
  • After two deliberately included test fraudsters were excluded, the final dataset contained 17 valid interviews; many screened candidates did not respond or attend.The authors report 37 invitees did not reply and four scheduled interviews were missed, which they relate to community suspicion and concerns about exposure or legal scrutiny.Source: §3.2 · p. 3

3.4 Data Analysis: Thematic Analysis

  • Two coders developed and refined a shared codebook, applied section-specific scoping, and coded the remaining transcripts after consensus work.For four transcripts, conceptual agreement on segments coded by both raters yielded κ≈0.84; the authors caution that this is not exhaustive agreement or a standalone rigor measure.Source: §3.4 · pp. 3–4
  • The study did not use saturation as a formal stopping rule and describes its participant-count terms as semi-quantitative descriptors, not quantitative results.Sample size was determined pragmatically by recruitment feasibility and participant availability; Figure 1 presents terminology for participant-count ranges.Source: §3.4 · p. 4, Figure 1 · p. 4

4 Scambaiting Motivations, Preparation and Risk Mitigation

Participants described motivations ranging from frustration and enjoyment to community protection, with goals that combined disrupting scams and collecting reportable intelligence. Their work required detailed preparation, realistic deception, and safeguards against both scammers and personal exposure.

4.1.1 From Frustration to Engagement

  • Participants’ motivations included frustration and retaliation, enjoyment and resistance, and a desire to protect vulnerable people and their communities.Many described scambaiting as public service as well as entertainment, and protective motivations shaped goals and preparation.Source: §4.1.1 · p. 4, §4.1 · p. 4

4.1.2 Operational Goals

  • Scambaiters combined time-wasting and disruption with collecting actionable financial, contact, and technical information for reporting.Almost all described forwarding evidence to law enforcement, carriers, banks, or forums; some judged success by resulting shutdowns, arrests, or infrastructure disruption.Source: §4.1.2 · pp. 4–5

4.1.3 Educational and Technical Background

  • About half of participants entered scambaiting without formal technical training, relying partly on shared tools, informal mentorship, and peer support.Community resources included a pop-up generator and a forum megathread with practical guidance.Source: §4.1.3 · p. 5

4.2.1 Preparing Victim Personas

  • About half prepared victim personas, maintaining fabricated biographical details and, in some cases, altered voices that had to remain consistent.Managing multiple personas could require tracking fake addresses, phone numbers, emails, and accounts; participants also reported using hardware voice changers when software sounded artificial.Source: §4.2.1 · p. 5, §4.2.4 · p. 6

4.2.2 Isolated Execution and Environment Stealth

  • Participants isolated scammer access in virtual machines or dedicated hardware, but also modified environments to conceal virtualization and appear like genuine user systems.They generated persona-matched usage artifacts, simulated expected peripherals, and used safeguards to retain control; community-shared preconfigured images packaged these realism and protection modifications.Source: §4.2.2 · pp. 5–6

4.2.3 Deception Tools for Payment

  • To continue through payment without transferring real money, participants used fake banking portals, gift-card generators, invoices, cryptocurrency wallets, and physical props.Some prepared simulated histories, accounts, and transfers to withstand scrutiny.Source: §4.2.3 · p. 6
  • Some participants simulated travel and in-person payment scenarios with driving, walking, and store sounds or by acting as a store clerk.The authors note that such scenarios can sustain engagement beyond payment, where actionable evidence may be elicited.Source: §4.2.3 · p. 6

4.3 Protection and Risk Mitigation Practices

  • Participants separated their real and scambaiting identities using pseudonyms, anonymous accounts, disposable telephony, VPNs, and voice changers amid risks of phishing, spoofing, and SWATing.These risks included temporary account loss, misattributed calls, harassment, and police responses to false emergency reports.Source: §4.3 · pp. 6–7

5 Findings: Active Engagement

Scambaiters source active targets, navigate scammers’ screening and conversational tactics, and gather information for reporting. Their practices span community intelligence, deliberate engagement strategies, and technical evidence collection.

5.1 Target Sourcing

  • Community forums, private peer networks, automated web searches, honeypots, and—in one case—phone-company records helped participants find active scam operations.About half used web-scraping tools and about half described honeypot setups.Source: §5.1.1 · p. 7, §5.1.2 · p. 7

5.2 Scammer Verification & Evasion Tactics

  • Scammers screened callers through phone-number providers, pop-up codes, and ZIP-code consistency checks; failed checks could still supply numbers for resale, while rapid rotation made targets quickly stale.Participants also described numbers staying active for less than a day, reinforcing the value of a steady stream of community-verified leads.Source: §5.2 · pp. 7–8

5.3 Crucial Conversational Techniques

  • To handle hard-sell tactics, participants used confusion, maintained victim personas, and brushed off fear-based pressure.Some acted technically naive or invented excuses about online banking to delay payment demands.Source: §5.3.1 · p. 8, §5.3.2 · p. 8

5.3.3 Session Termination.

  • Participants ended calls by ghosting after obtaining information, revealing the bait, or refusing payment until scammers gave up; mistakes or overloaded lines could also end sessions unexpectedly.About half described ending without revealing themselves after collecting the information they wanted.Source: §5.3.3 · p. 8

5.4.1 Intelligence Extraction Methods.

  • Participants combined notes and technical logging with call-level cues and external corroboration to extract intelligence and investigate scam operations.Methods ranged from engagement and behavioral notes to network captures; some used background sounds to infer location and checked phone ownership or community reports.Source: §5.4.1 · pp. 8–9

5.4.2 Target Artifacts for Reporting.

  • Scambaiters collect financial, contact, and technical artifacts—including bank accounts, payment accounts, phone numbers, IP addresses, and remote-access session identifiers—for reporting.Some also inspect fake payment sites to identify company ownership, and one participant reported collecting 73 bank accounts.Source: §5.4.2 · p. 9

6 Findings: Outcomes, Challenges, and Evolving Practices in Scambaiting

Participants documented engagements, shared intelligence with external recipients, and evaluated their efforts, while encountering workload, reporting, awareness, and legal or ethical challenges. Their accounts also identify practical boundaries on what collected information can accomplish.

6.1.1 Documentation and Artifact Collection.

  • Recordings and notes helped participants review scam scripts and improve strategies, while peer feedback supported learning; these artifacts may inform research, subject to varying recording-consent rules.Participants described revisiting recordings and receiving real-time guidance from peers.Source: §6.1.1 · p. 9

6.1.2 Reporting to External Entities.

  • Participants routed financial intelligence to banks and other reports to law-enforcement agencies, viewing banks as able to freeze accounts or stop transactions and law enforcement as a longer-term route to investigation or prosecution.Some participants built direct contacts inside banks or law enforcement, though one information-sharing channel remained in progress.Source: §6.1.2 · pp. 9–10
  • Participants also reported phone numbers, domains, emails, and IP addresses to carriers, registrars, service providers, forums, and antifraud organizations.These reports were directed to entities responsible for the relevant infrastructure or to community and organizational channels.Source: §6.1.2 · p. 10

6.2.1 Time Workload and Burnout.

  • Long calls make scambaiting difficult to balance with personal and professional obligations, and sustained adversarial engagement can take a psychological toll and lead to burnout.One participant described a typical successful call as lasting around two to three hours.Source: §6.2.1 · p. 10

6.2.2 Delays and Routing Gaps in Reporting.

  • Participants struggled to identify the right recipient for intelligence and reported that institutional action could be slow; rapidly rotating scam infrastructure can make indicators stale before action.Some also described ineffective carrier responses, which could reduce their willingness to report.Source: §6.2.2 · p. 10, §6.2.3 · p. 10

6.2.3 Irresponsible Actors.

  • Participants described public education and accessible reporting guidance as needs, and used scambaiting content to explain scam tactics and responses.They framed victim education as part of efforts to reduce susceptibility to scams.Source: §6.2.4 · p. 11

6.2.5 Ethical Risks and Legal Gray Areas.

  • Participants distinguished phone-based information gathering from unauthorized system access, while acknowledging legally ambiguous practices and cross-national gray areas.They also described precautions around persona creation, avoiding doxxing, and community rules intended to protect innocent third parties.Source: §6.2.5 · p. 11

6.3 Evolving Scam Ecosystem

Participants reported changes in scam tools, scripts, payment methods, and awareness of scambaiting. They also described emerging automation, while emphasizing human involvement and practical design requirements for automated engagement systems.

6.3 Evolving Scam Ecosystem

  • Participants described more persistent remote-access tools, adaptive scripts that blend scam types, a shift toward cryptocurrency, and scammers learning from scambaiting content.They reported that ScreenConnect removed customization features that had enabled concealment or impersonation.Source: §6.3 · p. 11

6.4 Towards Automation and AI

  • Scambaiting automation ranged from predictable pre-recorded bots to human-in-the-loop LLM support, while participants varied in openness to AI and some envisioned bots overwhelming call centers.Participants identified real scam scripts, conversational resilience, suitable voices and personas, and collecting actionable intelligence as design requirements.Source: §6.4 · pp. 11–12

7 Discussion and Recommendations

The discussion frames scambaiting as community-driven defense built on extensive preparation, deceptive tools, intelligence collection, and reporting, while noting its manual burden and reporting frustrations. It recommends supporting safer engagement and making the community’s expertise useful to research and coordinated TSS response.

7 Discussion and Recommendations

  • Participants’ prosocial motivations support a workflow of preparation, varied engagement, tool use, intelligence collection, and reporting, but repetitive work and reporting difficulties contribute to burnout and frustration.The recommendations aim to support safer scambaiting and help stakeholders use community expertise in defensive efforts.Source: §7 · p. 12

7.1.1 Detection and Mitigation Systems.

  • Researchers should use active scambaiting forums as potential sources of current scam intelligence, validate public data, and build adaptive defenses that account for scammers’ screening tactics.Scambaiters’ caller-number verification, pop-up code screening, and regional consistency checks may inform automated engagement systems.Source: §7.1.1 · p. 12, §7.1.2 · p. 12

7.1.2 Automated Scam Engagement Systems.

  • Automated engagement systems should maintain believable victim personas, use deception tools to continue beyond payment stages, and support intelligence collection, while researchers plan for retaliation risks.Participants’ use of fake online banking sites offers a way to continue engagement without disengaging or paying scammers; researchers should consider identity separation and anonymity.Source: §7.1.2 · p. 12, §7.1.3 · p. 12

7.1.3 Design for Participant and Researcher Safety.

  • Safety-focused tools should automate repetitive preparation while keeping high-risk number verification manual, and research should account for anonymity, retaliation, and psychological costs.Tools should also prioritize usability and accessibility across differing levels of technical expertise.Source: §7.1.3 · p. 13, §7.1.4 · p. 13

7.1.4 Automation that Preserves Meaningful Participation.

  • Automation should preserve meaningful community interaction because experienced scambaiters produce current adversarial intelligence that may not be easily replaced.The authors frame this as a tradeoff, not a reason to prioritize scambaiting as a hobby over other outcomes.Source: §7.1.4 · p. 13

7.2 For Law Enforcement

  • Law enforcement should provide clear reporting channels, learn from scambaiters’ screening and investigative practices, and act promptly on short-lived indicators while larger investigations continue.The authors also suggest that agencies could collaborate with researchers to operationalize automated engagement, detection, and mitigation capabilities for investigations.Source: §7.2 · p. 13

7.3 For Policymakers; 7.4 For Financial Institutions

  • Policymakers should coordinate multi-stakeholder responses and support public guidance, while financial institutions should provide reporting pathways and use scambaiting intelligence to update fraud detection and warnings.Participants prioritized banks for financial intelligence because they can freeze accounts or stop transactions quickly; the authors also note scammers’ shift toward cryptocurrency.Source: §7.3 · p. 13, §7.4 · p. 13

7.5 For Infrastructure and Service Providers; 7.6 Limitations

  • Infrastructure providers should maintain clear reporting channels, respond promptly, and reduce repeated abuse; the study’s voluntary, overlapping-community sample limits claims about the wider scambaiting community.The authors also suggest future work measure tool and reporting-service effects, consolidate community resources, and track shared archives to monitor scammer trends.Source: §7.5 · pp. 13–14, §7.6 · p. 14

8 Conclusion

Interviews with 17 scambaiters reveal varied motivations and substantial operational effort, including intelligence collection and reporting. The authors characterize these activities as community-driven defense and as a resource for researchers.

8 Conclusion

  • Many scambaiters participate from civic goodwill and a desire to protect potential victims, although some prominent participants emphasize entertainment or public awareness.Source: §8 · p. 14
  • Scambaiters prepare deceptive environments, respond to scammer countermeasures, and carry out activities that still involve significant manual effort.Source: §8 · p. 14
  • Many participants collect, analyze, and report scam-related information, making the community’s experience and resources valuable to the research community.Source: §8 · p. 14

A Open Science

The paper makes its qualitative codebook, transcripts, and related materials available, while withholding raw recordings under participant-protection constraints.

A Open Science

  • The authors make the qualitative codebook, transcripts, and scripts for calculating inter-rater reliability publicly available.Source: A Open Science · p. 15
  • Raw video and audio recordings are not shared under IRB protocols and participant consent terms because scambaiters may face retaliation.Source: A Open Science · p. 15

B Ethical Considerations

The study protected participants’ identities and recordings while acknowledging recruitment skepticism and dual-use risks in potential recommendations.

Participant protections

  • Researchers used pseudonyms, anonymized transcripts, secure audio storage, and planned permanent deletion of recordings after publication.Participants were reminded of consent and withdrawal procedures and kept cameras off.Source: B Ethical Considerations · p. 16

Recruitment context

  • Recruitment skepticism was present but not representative of a community-wide consensus; prominent scambaiters supported systematizing their knowledge for research.Their participation also suggested openness to sharing expertise.Source: B Ethical Considerations · p. 16

Dual-use risks

  • Persona-realism tools and automated engagement could be repurposed by threat actors, so researchers should weigh risks when developing or releasing them.Suggested safeguards include restricting sensitive capabilities to vetted practitioners and researchers.Source: B Ethical Considerations · p. 16

C Methodology Appendix

The appendix identifies tables on coding scope, communication-channel distribution, and participant screening, plus a figure depicting recruitment-thread skepticism.

Methodology appendix

  • Table 1 is a breakdown of coding scope by category and interview section.Source: Table 1 · p. 17
  • Table 2 presents the distribution of communication channels reported by participants, with N=146.Source: Table 2 · p. 17
  • Table 3 covers the participant screening and selection process.Source: Table 3 · p. 17
  • Figure 3 depicts an anonymized recruitment thread showing community skepticism.The figure illustrates skepticism encountered during recruitment on public forums.Source: Figure 3 · p. 17, C Methodology Appendix · p. 17

D Interview Guide

The interview guide asks about scambaiters’ backgrounds and motivations, preparation and tools, engagement tactics, challenges, practices, and views on research and automation.

Background

  • Participants were asked about their roles, motivations, experience, scam focus, and technical backgrounds.Source: Introduction · p. 18

Planning and preparation

  • Planning questions covered how participants find and verify scammer contact information, choose communication channels, avoid detection, and address legal and ethical concerns.Source: Introduction · p. 18

Tools and technologies

  • The guide asked about essential hardware and software, protection from scammers’ access attempts, victim-like system configurations, and scambaiting costs.Source: Introduction · p. 18

Engagement process

  • Engagement questions covered session timing, conversation strategy, keeping scammers engaged, handling payment or information requests, suspicion, and intelligence gathering.Source: Introduction · p. 18

Challenges, recommendations, and conclusion

  • The guide asked about challenges and adaptation, recommended practices, skills, automated or AI tools, and scambaiting’s broader impact.Source: Introduction · p. 18

Analysis and outcomes

  • Participants were asked how they define successful calls, how often they succeed, how they analyze engagement data, and how they report scammers.Source: Introduction · p. 18

E Codebook Appendix

The appendix includes a table titled “High-Level Codebook.”

Codebook appendix

Loading 2609.06103v1…