Hacking Back Scammers

The talk opens with the scale of phone, romance, tech support and employment scams, citing 2021 loss figures and noting that older and younger people tend to be targeted by different scam types. The speakers, students from Arizona State University, present their capstone project as a way to gather actionable intelligence on scammers so victims can be warned and cases reported. They stress that the work is meant to stay within the law.

The core of the talk is a scam-baiting checklist. The team builds an isolated environment with virtual machines, a VPN, a VoIP phone service and separate email accounts, and configures a Windows machine to resemble an ordinary victim's computer. Before each call they set a goal, which is mainly to waste the scammer's time, then pick a scam and research it using community forums and scam-number databases. They build a fake persona whose details can pass basic checks, including addresses, area codes, and card numbers that pass a Luhn check. During calls, roles are split between the person on the phone, a note-taker, a researcher and someone who keeps the persona consistent, with shared notes kept live.

A case study showed a caller keeping a scammer engaged for well over an hour, until the scammer was sent a fake verification link that led to a dating site and exposed network details. Reports go to different places depending on the scam: domain abuse teams, platforms such as Instagram, or the FBI's cybercrime unit. The main takeaways are to define a clear goal, keep the persona believable and consistent, isolate the environment carefully, and expect scammers to grow more suspicious over time.