We Talk to Scammers So You Don’t Have To

A few real-world examples show what happens when you actually follow scams down their rabbit hole

Anyone who has gotten a phone call about their “car’s extended warranty” may have thought about keeping the person calling on the line for hours and wasting as much of their time as possible. A lot of people even turn that type of interaction into content.

But it’s usually easiest to hang up on that caller, delete that obvious scammy text message, or report a phishing email and move on.

At Netcraft, we’ve developed tools that automatically keep text-based scam conversations going, gathering intelligence that helps us detect and disrupt scams.

Netcraft's Scam Intelligence includes an automated “digital victim” designed to engage with scammers and fraudsters at scale.

Working across channels such as SMS, email, and other messaging platforms, the system helps uncover indicators of fraud, including malicious websites, contact details, payment destinations, and other infrastructure used to facilitate scams.

These interactions can consume scammers’ time while exposing infrastructure used to target real victims. And these conversations reveal a great deal about attackers’ endgames and the common tactics users should be on the lookout for.

Scam Intelligence sees many traditional romance scams, in which threat actors shower the target with affection and attention, a tactic known as “love bombing.” These scammers typically pose as someone else, using a fake persona and stolen or misleading images. After cultivating a relationship with the target, the scammer typically asks for money via wire transfers, payment apps, gift cards, etc. Here’s a look at how these conversations often start:

A few things stand out in this attacker’s introduction: The sender says English isn’t their first language, which may help explain away errors in the message. They also ask several questions about the target, which builds rapport quickly and helps the victim feel comfortable sharing information with the scammer.

Attackers will further pull on targets’ heartstrings if targets take too long to respond to a message or don’t comply with payment requests, again playing up the emotional aspect of these scams.

Scammers in other types of attacks lean on guilt in similar ways.

They might try to guilt-trip the target, too, by blaming them for delays or claiming that the sender has family responsibilities they must meet.

More recently, Netcraft researchers have come across several examples of threat actors posing as “reformed” scammers who say they are reaching out to make amends.

In one attempt, a scam email claimed to come from a “James Morrison,” aka “Hush Puppy,” asking the target to contact the scammer’s “pastor” because they wanted to repent for past cybercriminal activities and repay the people they had defrauded. The sender promised $500,000 to every person in the scammer’s contacts, payable once the recipient contacted the “pastor,” adding the emotional twist that they had less than 48 hours to live and had been diagnosed with lung cancer.

“Hushpuppi” is the nickname of a real Nigerian fraudster previously based in Dubai, so it’s likely this scammer is trying to lend some credibility to their message by using the moniker. The real Hushpuppi was sentenced in November 2022 to 11 years and three months in federal prison after pleading guilty to conspiracy to engage in money laundering.

Another advance-fee fraud message came from someone claiming they were one of the “good guys,” hunting down scammers and forcing them to pay back money they had stolen from victims. This scam promised $9.5 million in “compensation funds” recovered from these unnamed scammers. The message is riddled with typos and grammatical errors, which can raise suspicion.

The personas and storylines change from one conversation to the next, but the mechanics rarely do. Whether it’s a romantic interest who needs money, a dying fraudster looking to atone, or someone promising $9.5 million in supposedly recovered funds, each message is built to trigger an emotional response and get the target to act on it.

Typos and awkward phrasing remain a common giveaway, as the last example shows, but the story is doing most of the work in these scams, and a more polished message would be just as fraudulent.

One of the clearest warning signs is an unexpected request for money or sensitive information, whether that’s a payment, personal information, a reply that opens the door to requests for money or personal information. For most people, the right move is still to hang up, delete, or report the message. Leave the long conversations to us.