LAS VEGAS — One of the cruelest forms of cybercrime is the long con, when a far-off scammer builds a trust relationship with the victim and then sweet-talks the victim into sending them money.
Sometimes the scammer offers
a chance at romance. Other times, it's
a lucrative job offer. Or maybe it's a one-in-a-million opportunity to
get rich in cryptocurrency.
The scam starts with a social-media post, an email message inquiring about a botched hotel reservation, or a text message from a stranger who seems to have the wrong number but wants to keep chatting anyway.
If you respond, the other person will engage you in a pleasant, off-and-on conversation that can last days or even weeks, slowly gaining your trust by sharing jokes, personal anecdotes and common interests.
The criminals who run these sometimes call them "
pig butchering" scams. From their point of view, they're fattening you up like a hog before slaughter. Meanwhile, the low-level scammers with whom you're trading messages are often victims themselves, trapped in prison-like conditions in lawless parts of Southeast Asia.
Thousands of people lose millions of dollars every year to these scams. The promised job offer doesn't materialize after the "application fee" is sent. The Bitcoin investment evaporates into thin air. The handsome stranger whose ticket to America you paid for doesn't arrive at the airport.
Scrutinizing the scammers
Because the scams take so long to come to fruition, it's hard to study them at scale. No human researcher has the time or patience to continually engage with hundreds of scammers for days or weeks at a time.
Fortunately,
AI does. BeeSafe AI Co-founder Ariana Marian, who showed us last year that
phishing training doesn't really work, returned last week to the BSides Las Vegas hacker conference to present her AI-driven research into pig-butchering scams.
"We tracked over 1,000 conversations that lasted seven or eight days on average," Mirian said in her presentation last Monday (Aug. 3). "Job scams, sympathy scams, romance scams, pig butchering, whatever you can think of."
Her AI platform sets up fake personas, complete with social-media profiles, to convince the scammers that these are real victims. The AIs keep up their ends of the conversations, engaging the scammers in friendly, sometimes flirty chit-chat, and can change their tones according to the direction of the conversation.
After about 10 exchanges, Mirian said, it becomes pretty clear who's a scammer willing to continue the conversation and who's just someone who accidentally texted or emailed the wrong person. The non-scam conversations are terminated while the scam ones keep going.
"Our system is completely passive, sending one message at a time, reviewing every 10 steps," she explained. "This yields only scammers."
According to Mirian, these scams, whatever their guiding topic, tend to follow patterns. The messages from the scammer are pleasant, positive, and contain a lot of photos, videos and music files. Often the scammer presents themselves as an attractive man or woman, using a photo stolen from social media.
The scammer also seems to have a lot in common with the target. If you like classic rock or baseball, Mirian said, the scammer will pretend to like those too. If you're on Truth Social or BlueSky, the scammer will express political views tailored to those platforms. All of this is to establish a "friendship" with the victim.
"A ton of personalization is happening here," Mirian said. "The trust-building is very deep and very intentional."
No calls, please, but let's move to WhatsApp
But one thing the scammers never want to do, she explained, is to have a one-on-one voice conversation. That might reveal their poor English skills or the fact that they're halfway around the world.
In about two-thirds of cases, after about 25 message exchanges, the scammer suddenly wants to switch platforms. A chat that started on Twitter, Facebook, email or text jumps to WhatsApp, Telegram, WeChat or Signal. If the victim doesn't have the mobile app for one of those platforms, the scammer asks them to install it.
This happens, Mirian explained, because the new platform is generally
end-to-end encrypted. Because of that, law enforcement can't get the records of the second half of the conversation and can't gather evidence to prosecute the scammers.
The payoff comes after about 60 exchanges. The scammer asks for a financial contribution: an investment in cryptocurrency, a loan to help a sick parent, money for a plane ticket. Even after the money is sent, the conversation continues a little longer until the victim realized they've been had.
Are the scammers using AI yet? Surprisingly, Marian said, not very much. While some voice files may be generated, the images and videos are usually real ones stolen from someplace else. The scammers seem to be doing fine by just using forced labor. But that may change, Marian warned.
"For the most part, it's still humans on the other end," she said. "It's still human-scale. But with AI, a single adversary can launch global-scale scams for just a few bucks."
