The Anatomy of Scam Scenarios: Large-Scale Characterization and Conversation-Aware Detection

2026-06-14

AI Summary

This study addresses the limitation of existing research that treats psychological tactics (PTs) as isolated features, overlooking their systematic reuse within scam contexts. To bridge this gap, the work proposes a novel operational-goal-oriented hierarchical taxonomy that jointly models scam scenarios and PTs. Leveraging 102,054 real-world scam reports, it identifies six high-level strategies and 18 fine-grained scenarios, uncovering strong associations between PTs and specific scam contexts as well as large-scale reuse of scam infrastructure. Building on these insights, the authors design a dialogue-aware detection framework that integrates a data-driven pipeline, hierarchical clustering, and contextual modeling to enable real-time scam scenario alerting in financial institution customer interactions, thereby facilitating the effective translation of contextual knowledge into defensive practice.

Abstract

Online scams have become a pervasive global threat, causing substantial financial, psychological, and operational harm. Scammers embed psychological techniques (PTs) within reusable operational schemes to scale scam campaigns with minimal adaptation. However, existing studies often analyze PTs as isolated features, overlooking the recurring scam scenarios in which they are systematically deployed. To address this gap, we first conduct a large-scale empirical study to jointly characterize scam scenarios and their associated PTs. Specifically, we develop a data-driven pipeline to derive a hierarchical taxonomy of scam scenarios, consisting of 18 fine-grained scenarios grouped into 6 high-level tactics based on their PT profiles. Furthermore, to transfer this scenario-level knowledge to practical defense, we design a conversation-aware scam scenario detection approach for financial-institution customer interactions, enabling timely warning and intervention. Our study on 102,054 real-world scam incident reports, spanning 2024-02-01 to 2025-10-31, reveals that PT usage is significantly associated with scam scenarios. We further show that scammers organize scenarios around different operational goals, such as broad victim exposure, high victim conversion, and high-value extraction, and reuse infrastructure, including IP addresses, domains, email addresses, and phone numbers, to launch coordinated campaigns at scale. Evaluation on

Problem

• online scams
• psychological techniques
• scam scenarios
• large-scale characterization
• conversation-aware detection

Innovation

• scam scenarios
• psychological techniques
• conversation-aware detection
• hierarchical taxonomy
• large-scale characterization