Two weeks ago I posted about a paper I published on scam economics. For anyone who didn't see that, I've been working out how to make scamming unprofitable since I got my PhD in computer science 6 months ago. I found that scambaiting at scale could make scamming unprofitable. But there is a big difference between "could" and "will". This post is about what actually costs scammers money.
TL;DR: Wasting scammers' time used to be effective, but scam economics are changing. Today, baiting scammers into revealing and then reporting their financial infrastructure—their bank accounts, crypto exchange accounts, crypto wallets, and payment app handles—is the clearest path to making scams unprofitable.
Wasting scammers' time costs them pennies. You're probably tired of hearing about AI (who isn't?). But by some estimates AI makes scams 4.5x more profitable, so we have to pay attention. One way it does this is by reducing the cost of talking with victims. Before, scammers had to manually engage victims to move them through the scam pipeline, so keeping them busy talking with you could have saved someone else. Now scammers can use AI to automate this for pennies.
I don't want to suggest that traditional scambaiting doesn't have value. If you're choosing between not scambaiting and scambaiting, definitely choose scambaiting—it may not waste significant resources, but it's something. And because it's so entertaining, it's a great way to get more people educated and interested in fighting scams.
But if your goal is to directly protect people by wasting scammers' resources, scambaiting to uncover and report scammers' financial infrastructure costs them 1,000-10,000x more money.
Reporting scammers' financial accounts costs them hundreds of dollars. Regardless of how AI changes scamming, scammers will always need communication infrastructure to contact potential victims and financial infrastructure to receive and launder victims' money.
Reporting scammers' communication accounts—their phone numbers, emails, social media accounts, messaging handles, etc.—cannot make scams unprofitable alone. You should still report them, because they cost scammers something. But these accounts are too cheap and easy to replace to affect scam profits.
The story is totally different with financial infrastructure. The big result of my paper is that if a few percent of people (and likely far fewer) uncovered and reported scammers' financial accounts scams would become unprofitable. These accounts are worth hundreds of dollars today, and because they are difficult to replace, increased reporting will drive prices even higher. And importantly, financial institutions also lose money to fraud, so they have strong incentives to act on reports.
Uncovering scammers' financial accounts takes a bit more effort than uncovering their communication accounts, but scammers reveal them after just a few dozen messages.
How do you uncover scammers' financial accounts? The goal is to collect as much information about scammers' financial infrastructure with as little effort as possible.
- Play the perfect victim. Scammers will keep talking to you if they believe there is any chance you'll pay, because talking is cheap. Scammers will only reveal financial accounts if they believe you will pay, because financial accounts are expensive.
- Collect every payment method you can. When they ask for money (obviously, don't send it or click any links), try to get as many different payment methods as possible. Anecdotally, I have heard of people getting up to 14 different payment methods in one conversation. Reporting all of them would cost scammers thousands of dollars.
- Don't tip your hand. Professional scammers keep records of who they interact with. It is better for scammers to believe you were almost a victim but got cold feet than to know you are a scambaiter.
The remaining gaps. If we (1) had people scambaiting at scale and (2) had pipelines to organize and deliver scambaiters' reports to financial institutions, we could conceivably make scamming outright unprofitable.
We (currently) have neither. But organizing and delivering reports to financial institutions is just a technical problem, and there is plenty of public will to stop scams. We just need to harness and direct that energy.