Scam As A Service Powered By Telegram

Aurimas Rudinskis, who leads a security engineering team at Vinted, describes scams run as organized businesses on Telegram. His investigation started after a former scammer contacted the company and pointed to forums and group chats. The scam groups have a small leadership layer, large pools of workers, and recurring costs such as translators and office rent.

The tooling is the core of the talk. Scam-as-a-service bots are rented for a monthly fee and can generate phishing sites from a marketplace listing. Other bots scrape classifieds for new sellers, sell fake or compromised accounts, forge identity documents and act as escrow middlemen. Workers are recruited through channels advertising earnings, targeted countries and payout splits, and monthly competitions reward the top earners.

The speaker also described the response side: reporting phishing domains to registrars and Google Safe Browsing to raise operating costs, and reading worker chats to find pressure points. Audience questions covered financial disruption, whether AI could replace human workers, and regional differences in fraud types. The takeaway is that these operations are cheap to join and hard to remove, so attacking their infrastructure and economics is the practical lever.