Understanding Scam Trends and Rail Paths from Reddit Self-Disclosure Narratives

2026-06-15

AI Summary

This study addresses the lack of systematic, multi-year tracking of multi-stage cyber fraud trajectories and the scarcity of open-source annotated data in existing research. Leveraging self-reported Reddit posts from 2023 to 2025, we construct the first cross-year open-source annotated dataset encompassing four fraud trajectory categories: identity, communication, platform, and payment. By integrating heuristic rules with large language model–assisted reconstruction of complete fraud chains—and validating through manual annotation and community comment topic modeling—we achieve fine-grained, longitudinal tracking of fraud pathways for the first time. Our analysis reveals that fraud incidents commonly span multiple trajectories, exhibit significant year-to-year shifts in dominant types, display systematic differences in pathway complexity, and elicit increasingly nuanced community support behaviors over time.

Abstract

Online scam behavior is inherently multi-stage, and the lifecycle includes temporally ordered rails and events rather than isolated signals. Existing works analyze characteristics of scam types and rails, but they do not track scam trends across years. Moreover, the work on the relations between rails is hampered due to the lack of open-source datasets with annotations and coverage of different scam types. To address these gaps, we build a dataset to analyze the yearly trend of scam characteristics and rail paths using Reddit self-disclosure narratives from 2023 to 2025. We collect 21,304 posts from scam-related subreddits with at least one rail among identity, communication, platform, and payment for trend analysis by heuristic annotation. Then, we label 1,800 posts containing explicit or recoverable scam chains by an LLM-assisted method for scam path analysis. The method is evaluated with human annotation. Lastly, we run a topic model on the comments of the posts to analyze the community support behavior. The results reveal that scam processes are predominantly multi-rail. Across years, different scam types and rail components dominate. Different scam types vary systematically in path complexity. Reddit support behaviors have become more detailed over time. This work supports synthetic scam chain data simulation and AI-related scam risk assessment, though findings may not generalise to other platforms.

Problem

• online scam
• scam trends
• rail paths
• multi-stage behavior
• dataset annotation

Innovation

• scam rails
• LLM-assisted annotation
• temporal trend analysis
• multi-stage scam modeling
• self-disclosure narratives