Scam Town: Can Scam Education Spread Like a Vaccine?

Simiao Ren; Tommy Duong; Xingyu Shen; Jiaqi Gan; Tsang Ng; Ankit Raj; Kidus Zewde; Huaiyu Guo

cs.SIOct 18, 2026

Scam Town: Can Scam Education Spread Like a Vaccine?

Authors: Simiao Ren, Tommy Duong, Xingyu Shen, Jiaqi Gan, Tsang Ng, Ankit Raj, Kidus Zewde, Huaiyu Guo,

Abstract

Most older adults who hear a warning about scams hear it from someone they know: a relative, a neighbour, or a friend who was targeted. Yet research on scam prevention almost always studies one person at a time. We ask whether scam awareness can spread through a community and protect it the way a vaccine does, since a warning protects whoever hears it and can be passed on. To find out, we built Scam Town, a simulated community in which a large language model plays each resident. Scam centres phone the residents, and after a call a resident can warn the people they know. Word of mouth helped, but it did not take off on its own: each warning led to fewer than one more, so a community cannot count on warnings "going viral". Across 80 simulated towns, everyday talk cut the number of people scammed by roughly a fifth. The largest gains came when an official warning, from a bank, a senior centre, or an agency, reached most of a town and residents then talked about it: in simulation (a combination we did not test live) the two together cut scams by about half. Protection was greatest when warnings reached the people scammers actually call, who here were older residents. Because our residents are language-model stand-ins rather than real people, we treat these findings as predictions to test with people, not as proof. They point to a simple recipe for scam education: give people a clear story they can retell, design campaigns to be passed along, and reach first those most likely to be called.

Figures & tables

Figure 1: Scam Town: scam education modelled as a transmissible vaccine (schematic). A scam call centre (left) and legitimate callers (right: bank, pharmacy, Medicare) phone residents (double circle: aged 65+). A trusted educator (a community centre, a nonprofit, or an agency such as the FBI) broadcasts a tale that warns many residents at once; tales also pass one to one, though some victims stay silent. The LLM decides each answer and the wording of each warning; the model sets ties, calls, who is told and broadcasts. Schematic.

Figure 2: The town, the model and who is protected. (a, b) One live LLM town (seed 705, P1, word of mouth on) on days 6 and 30. Fill shows how many different people have warned a resident about the scam they know most about (S none, W1 one, W2+ two or more); red rings mark victims; large nodes are residents aged 65+. (c) The two layers: scam calls, and tales told, relayed, believed and forgotten. (d–f) Fast simulator on the 20 consolidation-experiment town graphs at survey-level settings with 14-day forgetting, under the LLM-measured protection curve (scenario L, § 3 ): (d) victims per day, word of mouth off and on; (e) residents aged 65+ holding warnings (d and e run to 90 days); (f) victimisations averted by ties and household size: the least connected gain least.

LLM-driven (Qwen3.7 Flash)	Modelled probabilistically (from literature or assumed)
Answer to every scam and legitimate call: comply, verify, resist, hang up, or not answer	Town graph, households, tie strengths, personas (random traits)
After one’s own scam call: the private takeaway and the wording of the warning	Call schedule, lead lists, 65+ targeting, sucker lists, pattern switching
	Whether a resident tells anyone, how many and whom
	Belief, passing on, maximum chain length
	Memory fading, merging and the prompt cap; education campaigns

Table 1: Who decides what. LLM decisions are checked for plausibility (realism gates), not against human rates; two calibrations to real-world compliance failed. Social behaviour was modelled after the LLM failed at it (it believed 99.8% of warnings; 82–93% of LLM victims would tell someone), from the literature where possible, otherwise by assumption (Appendix K ). The fast simulator replaces LLM call decisions by measured probabilities (Eq. 1 ).

Parameter	P1 (survey-level) / P2 (what-if)	Literature range	Source
Telling, victims	0.43 / 0.8	0.43 told family or friends	Binette [35] , Ianzito [36]
Telling, resisters	formula, $\approx$ 0.5 / 0.8	no direct measure	shape: Parti and Tahir [37]
People told per teller	2 / 3	1.6–3.6 close contacts	Cornwell et al. [32]
Passing on $\rho$	0.2 / 0.4	0.05–0.35; $\leq 0.45$	Kumaraguru et al. [38] , Rader et al. [8]
Belief, personal ties	1.0 (upper bound)	0.60–0.85	Shearer [39] , Silver et al. [40]
Memory half-life	14 days	2 weeks to 4 months	Scheibe et al. [3] , Maertens et al. [41]

Table 2: Key parameters of the live test (P1, P2) and the fast simulator’s survey-level settings. Only victims’ telling is measured directly; the other levels are assumptions within literature bounds, converted to the model’s units (Appendix B ).

Figure 3: Exploratory dose-response of warnings in LLM residents (one scam pattern, one backbone). (a) Compliance with a grandparent-scam call by warnings held,

D

(60 residents, 5 calls per state; 95% resident-cluster bootstrap; vermilion, the 30 aged 65+) against independent doses

1-(1-e_{1})^{D}

: two warnings give

e_{2}=0.88

against 0.47 expected. (b) Control arms (3,600 calls): padding one warning to the length of two did not lower compliance (0.137, as unpadded), two accounts in one memory did (0.037), and neutral wording makes one warning strong (0.050). (c) Super-additivity

S

by run (run 1 is (a), run 2 a replication, run 3 the anchors of (b); diamond, pooled; intervals pass 1 where resamples give

e_{1}<0

). Pooled (two accounts, one standard-format memory)

S=0.44

[0.09, 1.05]; run 3 alone, separate memories and neutral wording cross zero.

Figure 4: When does telling more give collective protection? (a–c) Victimisations averted in a 30-day run with 14-day forgetting (scenario L, 20 graphs $\times$ 25 replicates per cell) over telling $T$ and relay $\rho$ , for relayers telling about 1.5, 2 or 3 people. Vermilion: the critical line $R_{\mathrm{warn}}=1$ (simulated), at $\rho=0.70$ , 0.51 and 0.35; white dashed: 25%; dotted box: literature range. Stars: positions of the live-test settings P1 and P2 only; their towns did not forget, so their reductions (21%, 61%) cannot be read off this map. (d) Each cell against its $R_{\mathrm{warn}}$ : literature-box cells have $R_{\mathrm{warn}}\leq 0.68$ and avert at most 15.6% (L) or 14.2% (H); reductions saturate at 45–55% (L) only at $R_{\mathrm{warn}}\geq 2$ . (e) If only deliveries from new senders are relayed, warnings persist after calls stop at day 15 (any believed delivery on days 65–74) only with waning memory, which recreates unwarned residents as in SIS models, at $R_{\mathrm{warn}}\approx 1.4$ (towns of 100) or near 1 (larger towns).

Reduction	Memory	Curve	Forget?	Where
8.6%	14-day half-life	L (survey-level)	yes	§ 4.2 reference; Appendix D
7.4%	14-day half-life	H	yes	§ 4.2 ; Appendix D
12.1%	kept (engine)	L	no	§ 4.2 ; Appendix D
14.6%	kept (engine)	panel curve, P1 graphs	no	Appendix D ; forecast in § 4.4
19.1%	kept (engine)	in-town table, P1 graphs	no	Appendix D ; P1 forecast
21.0%	kept (live towns)	in-town (live)	no	§ 4.4 , measured

Table 3: Word of mouth alone: one reduction, read under different rules. The same quantity (relative reduction in the 30-day attack rate from word of mouth, no broadcast) takes several values across the paper. The differences are configuration, not disagreement: they follow the memory rule, the protection curve and whether towns forget. Live towns do not forget.

Figure 5: Live test: word of mouth switched off or on in 20 pairs of live LLM towns per setting (paired by seed; 30 days), against forecasts committed before any live result was read. (a) Attack rate (victimisations per resident over 30 days) with word of mouth off (grey) and on (green); orange diamonds, forecasts. Survey-level settings (P1): 0.250 to 0.198,

-21

% [11, 29], forecast 19% (

[-3,40]

once batch-to-batch noise is included). What-if setting (P2, shaded; more telling and relay): 0.283 to 0.112,

-61

% [56, 64], forecast 47%. (b) Co-primary endpoints: P1 passes both; P2 is direction only (larger) on both, so the model is not forecast-validated. (c) Observed/forecast ratios (P1 filled, P2 open): reach within 0.97–1.03; protection under-forecast at P2. (d) Of the 2.1-point P2 compliance miss, 1.6 comes from the off arm.

Figure 6: A broadcast averts more when people also talk about it (fast simulator on the 20 live-test town graphs, no forgetting, 30 days, 60 replicates per town; Monte Carlo error about

\pm

0.5 points). Victimisations averted, against no education, when a trusted source warns a share of the town on day 0, believed by all (faint: by half). Black: broadcast alone; green: plus survey-level word of mouth (dark: a second broadcast on day 14; orange: residents aged 65+ reached first); dotted: word of mouth alone (14.6% in a, 13.4% in b); grey dash-dot: the sum of the two separate effects (38.0% at 90% in a); the gap above it is the synergy. (a) Scenario L; (b) scenario H (human-anchored): the same pattern, smaller. (c) In-town curve at 90% coverage: 53.1% alone, 67.4% with word of mouth, below the 72.8% sum: talk still adds 14 points, but the two overlap.

Appendix figures & tables14 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 7: Full model structure. Scam centres (the reservoir) dial residents from lead lists that over-weight residents aged 65+ and resell victims (sucker list). Each answered call is a spillover event. The callee complies (becomes V) with probability $c$ , which falls with their own earlier answered calls (E) and with the number $D$ of distinct warnings they hold about the call’s pattern. Answered calls may generate first-hand warnings to the callee’s ties, moving recipients from S to W1 and W2+. Believers relay with probability $\rho$ , and held warnings wane at rate $\omega$ . Protection at exposure acts from W1 and W2+.

Figure 8: The town. (a) One live town (seed 600); node colour is age, squares are community hubs, and edge colour is tie type. (b) Mean ties per resident by age group and tie type, against the core discussion network (3.6) and primary group (1.6) of older adults [ 32 ] . (c) Share in W2+ at day 30 and reduction in expected victimisations, by degree tertile and household size.

Parameter	Value (engine; lit; sweep)	Evidence	Status
Victim $P(\text{tell})$	formula $\approx$ 0.14–0.17 (65+); 0.43; 0.1–0.9	43% of victims warned family or friends (survey releases) [ 35 , 36 ] ; 77–84% told someone [ 47 , 48 ] ; older victims who lost money describe concealment [ 37 ]	[S] level
Resister $P(\text{tell})$	formula $\approx$ 0.46–0.55; kept; global $T$ 0.1–0.9	no direct measure; 73% discuss local crime with friends, family and neighbours [ 39 ]	[A], decisive
First-hand recipients $k_{0}$	mean 1.8; 2; {1.5, 2, 3}	core discussion network 3.6 and primary group 1.6 in older adults [ 32 ] ; 2.08 core confidants for US adults [ 49 ]	[A, bounded S]
Relay recipients $k_{r}$	mean $\approx$ 1.46; 2; {1.5, 2, 3}	none	[A], decisive for $R_{\mathrm{warn}}=1$
Belief $b$	1.0; 1.0; 0.85/0.75/0.60	72% judge friends’ and family’s crime news accurate [ 39 ] ; 44% trust most neighbours [ 40 ]	[A] upper bound
Relay $\rho$	0.2; 0.2; 0–0.9	converted: 0.13 discussed tips within 30 days [ 38 ] ; $\leq$ 0.45 retold a recalled story [ 8 ] ; per-neighbour passing 0.05–0.35 is a different unit [ 50 ]	[S] band

Appendix

Table 4: Parameters, values and sources. [S] sourced; [A] assumption; [A, dir S] direction sourced, level assumed. “Engine” is the configuration of the live consolidation towns; “lit” is the literature centre.

Gate	Simulated	Observed (live)	Tolerance	Verdict
G-A1 depth 0 / 1 / 2 / 3+ (dialled calls)	0.668 / 0.232 / 0.073 / 0.027	0.655 / 0.240 / 0.077 / 0.027	$\pm$ 0.03 each	pass
G-A2 $\varphi_{\geq 2}$	0.100	0.104	$\pm$ 0.02	pass
G-A3 compliance, answered calls	0.0617	0.0615	$\pm$ 0.01	pass
G-A4 consolidation ON $-$ OFF	$-0.0060$	$-0.0057$ [ $-0.0145$ , $+0.0031$ ]	inside CI	pass

Appendix

Table 5: Fidelity gate. Closed-loop model on the 20 live consolidation-experiment graphs (200 replicates per town per arm) against the observed live towns. All four declared gates passed.

Figure 9: Fidelity gate. (a) Depth distribution of dialled scam calls in the 20 live towns (grey; bars show the $\pm$ 0.03 gate tolerance) and in the model (blue). (b) Per-town share of calls reaching a twice-warned resident, model against observation ( $r=0.70$ ). (c) Compliance on answered calls by day of the wave.

Scenario	Days	Parameters	AR, no warnings	Relative reduction	Towns	$\varphi_{\geq 2}$	$R_{\mathrm{warn}}$ / WBS
L	30	engine defaults	0.237	0.088	0.06 / 0.08 / 0.13	0.100	0.28 / 0.23
L	30	literature centre	0.237	0.086	0.06 / 0.08 / 0.12	0.082	0.38 / 0.28
L	90	engine defaults	0.369	0.199	0.15 / 0.20 / 0.24	0.264	0.29 / 0.33
L	90	literature centre	0.369	0.134	0.09 / 0.13 / 0.20	0.133	0.40 / 0.39
H	30	engine defaults	0.768	0.080	0.05 / 0.07 / 0.12	0.111	0.28 / 0.25
H	30	literature centre	0.768	0.074	0.04 / 0.07 / 0.12	0.093	0.39 / 0.31

Appendix

Table 6: Baseline collective protection. Relative reduction in the attack rate (AR) against a town without warnings, on 20 live graphs (100 replicates per graph at 30 days, 50 at 90 days). “Towns” gives the min / median / max of per-town reductions. The 30-day literature-centre rows are the paper’s reference values. Relative reductions carry Monte-Carlo error of about

\pm

0.005, so the literature-centre scenario-L value appears as 0.082–0.086 across runs (it is quoted as 0.086 in the main text, 0.085 in Appendix E , and 0.082 in the memory-rule contrast).

Mean number told	$R_{\mathrm{warn}}$ at $\rho=0.2$	$\rho$ at $R_{\mathrm{warn}}=1$ (simulated)	Predicted before the run
engine rule ( $\mathbb{E}[k_{r,\mathrm{eff}}]\approx 1.43$ )	0.28	0.70 ( $R_{\mathrm{warn}}=1.00$ )	$\approx$ 0.7
2	0.39	$\approx$ 0.51 (0.97 at $\rho=0.5$ )	0.5–0.55
3	0.58	$\approx$ 0.35 (1.02 at $\rho=0.35$ )	0.35–0.4

Appendix

Table 7: Where

R_{\mathrm{warn}}=1

sits (scenario L, 20 graphs

\times

25 replicates; “simulated” is the measured branching ratio).

R_{\mathrm{warn}}

depends only on relay and the number told, not on telling.

Figure 10: Full parameter maps with cell values , relative reduction in the 30-day attack rate, scenarios L (top) and H (bottom). The relay axis has non-uniform steps. Vermilion marks simulated $R_{\mathrm{warn}}=1$ ; dashed white the 25% contour; the dotted box the literature box. 20 graphs $\times$ 25 replicates per cell; Monte Carlo error about $\pm 0.005$ .

Told	$\rho$	$R_{\mathrm{warn}}$	Message rule, $N=100$	New-sender, engine memory, $N$ = 100 / 1,000	New-sender, 14-d waning, $N$ = 100 / 300 / 1,000
2	0.2	0.40	0.00	0.00 / 0.00	0.00 / 0.00 / 0.00
2	0.35	0.70	0.00	0.00 / 0.00	0.00 / 0.00 / 0.00
2	0.5	1.00	0.98	0.00 / 0.17	0.01 / 0.25 / 0.83
2	0.7	1.40	1.00 (explosive)	0.00 / 0.00	0.68 / 1.00 / 1.00
2	0.9	1.80	1.00 (explosive)	0.00 / 0.00	0.88 / 1.00 / 1.00
3	0.2	0.60	0.00	0.00 / 0.00	0.00 / 0.00 / 0.00

Appendix

Table 8: Do warnings persist after calls stop? Literature centre, scenario L; calls stop at day 15; horizon day 75. Persist means at least one believed delivery in days 65–74, or explosive growth.

N=100

: 20 live graphs

\times

10 replicates;

N=300

: 5 generated towns

\times

N=1{,}000

: 3

\times

Warning curve	$e_{\mathrm{own}}$ in-town (0.92 / 0.98)	$e_{\mathrm{own}}=0.5$	$e_{\mathrm{own}}=0.15$	$e_{\mathrm{own}}=0$
LLM panel (isolated-call)	0.093 / 0.085 / 0.313	0.140 / 0.129 / 0.465	0.153 / 0.140 / 0.500	0.158 / 0.144 / 0.520
LLM in town (first calls)	0.130 / 0.130 / 0.309	0.199 / 0.199 / 0.434	0.223 / 0.205 / 0.458	0.226 / 0.217 / 0.475
independent doses (LLM $e_{1}$ )	0.071 / 0.068 / 0.207	0.107 / 0.101 / 0.310	0.118 / 0.103 / 0.337	0.120 / 0.114 / 0.349
human-upper	0.049 / 0.047 / 0.160	0.071 / 0.063 / 0.242	0.074 / 0.074 / 0.261	0.082 / 0.074 / 0.277
human-lower (independent, human $e_{1}$ )	0.039 / 0.041 / 0.126	0.063 / 0.054 / 0.184	0.063 / 0.065 / 0.206	0.070 / 0.066 / 0.209

Appendix

Table 9: Efficacy curve

\times

own-call efficacy. Relative reduction in the 30-day attack rate at three anchors: engine defaults / literature centre / near threshold (literature with

\rho=0.35

and three told). 25 replicates per graph.

Figure 11: Education campaigns, robustness and scammer exit (survey-level settings with 14-day forgetting, 20 consolidation-experiment graphs

\times

25 replicates; 95% Monte Carlo intervals about

\pm

0.7 points). (a) Extra victimisations averted by a pre-wave education campaign giving each seeded resident one tale (scenario L, on top of word of mouth): targeting those scammers call most (12.8% at 20% coverage; an oracle, since a real campaign cannot know the lead lists) or residents aged 65+ (11.4%, its feasible proxy) beats random (6.8%), hubs (4.6%) and younger kin (3.3%). Relay saves about a quarter of the seeds: 10% most-called seeds with relay match about 13% without. (b) Victimisations averted in each sensitivity arm (L circles, H triangles) and under five efficacy curves; none reaches the 25% line (range across all arms 4–22%). (c) Labelled extension: probability that all four centres exit by day 90 when yield falls below an assumed break-even

R_{\mathrm{scam}}

. In scenario L all exit even without warnings; in H, exit becomes likely only with near-threshold warnings (67–94% at

R_{\mathrm{scam}}\leq 2

Figure 12: Scammer economics , 90 days, 20 graphs $\times$ 15 replicates. (a) Probability that all four centres exit by day 90; (b) share of centre-days active; (c) attack rate relative to no exit and no warnings. Solid lines show scenario L and dashed lines scenario H.

Quantity	P1 predicted	P1 observed	P1 verdict	P2 predicted	P2 observed	P2 verdict
ON $-$ OFF compliance	$\mathbf{-0.014}$	$\mathbf{-0.0167}$ [ $-0.0254$ , $-0.0080$ ], $p=0.0004$	pass	$\mathbf{-0.033}$	$\mathbf{-0.0537}$ [ $-0.0629$ , $-0.0446$ ], $p<10^{-9}$	direction only, larger
Relative AR reduction	19%	21.0% [11.4%, 29.4%], $p\leq 0.0003$	pass	47%	60.6% [56.4%, 64.4%], $p\leq 0.0003$	direction only, larger
Compliance, OFF arm	0.071	0.077	–	0.071	0.087	–
Compliance, ON arm	0.057	0.060	–	0.038	0.033	–
AR, OFF $\rightarrow$ ON	0.235 $\rightarrow$ 0.190	0.250 $\rightarrow$ 0.198	–	0.235 $\rightarrow$ 0.125	0.283 $\rightarrow$ 0.112	–
Ever-victim share, OFF $\rightarrow$ ON	0.211 $\rightarrow$ 0.175	0.214 $\rightarrow$ 0.169	–	0.211 $\rightarrow$ 0.120	0.235 $\rightarrow$ 0.102	–

Appendix

Table 10: Live forecast test: committed predictions, observations and verdicts (20 seed-paired towns per point, 30 days).

p

values are one-sided and Holm-adjusted over four tests; attack-rate

p

values are at the bootstrap resolution floor. Batch-inflated intervals (post hoc, added after the live results were read; A13), which add the batch-to-batch variance estimated from the gap between the two identically configured OFF arms: P1 compliance

-0.0167

[

-0.0380

+0.0046

] and attack-rate reduction 21.0% [

-3.3

%, 39.6%], against P2

-0.0537

[

-0.0752

-0.0323

] and 60.6% [48.7%, 69.7%]; the batch variance rests on a single OFF–OFF replicate.

Stage	Date	Declared	Outcome
Stage 1–A3	10-10/11	first transmission test (MiniMax-M3); calibration to real-world rates	pipeline check; calibration failed, real-rate matching dropped
A4	10-11	realistic call scripts; realism gates; backbone screen	gates pass; Qwen3.7 Flash selected (rule not blind)
A5–A7.1	10-11/12	belief-probe transmission tests; LLM-decided vs modelled disclosure and uptake	not supported; LLM social behaviour unrealistic, so modelled
A8	10-12	personal ties always believed	design change
A9, A9.5	10-12	isolated-call dose-response panel and replication	0.197 / 0.143 / 0.023 / 0.007 (exploratory)
A10, A10.1	10-12	live consolidation test (confirmatory, 20 pairs)	$-0.0057$ [ $-0.0145$ , $+0.0031$ ], not supported; reach forecast met

Appendix

Table 11: Declaration and amendment trail , compact (git commit dates, 2026; full log in the repository).

May 12, 2026

PreScam: A Benchmark for Predicting Scam Progression from Early Conversations

Conversational scams, such as romance and investment scams, are emerging as a major form of online fraud. Unlike one-shot scam lures such as fake lottery or unpaid toll messages, they unfold through multi-turn conversations in which scammers gradually manipulate victims using evolving psychological techniques. However, existing research mainly focuses on static scam detection or synthetic scams, leaving open whether language models can understand how real-world scams progress over time. We introduce PreScam, a benchmark for modeling scam progression from early conversations. Built from user-submitted scam reports, PreScam filters and structures 177,989 raw reports into 11,573 conversational scam instances spanning 20 scam categories. Each instance is hierarchically structured according to the scam lifecycle defined by the proposed scam kill chain, and further annotated at the turn level with scammer psychological actions and victim responses. We benchmark models on two tasks: real-time termination prediction, which estimates whether a conversation is approaching the termination stage, and scammer action prediction, which forecasts the scammer's subsequent actions. Results show a clear gap between surface-level fluency and progression modeling: supervised encoders substantially outperform zero-shot LLMs on real-time termination prediction, while next-action prediction remains only moderately successful even for strong LLMs. Taken together, these results show that current models can capture some scam-related cues, yet still struggle to track how risk escalates and how manipulation unfolds across turns.

Weixiang Sun, Shang Ma, Yiyang Li +5

University of Notre Dame · Arizona State University

LLM Evaluation Cybersecurity

Ask PDF

Aug 25, 2026

Anatomy of a Scam Call: What 10,000 real scam and spam calls reveal about how phone scammers operate

Telephone fraud is pervasive and costly, but its inner workings are rarely observed at scale. We analyze a complete corpus of 10,211 inbound scam and spam calls -- 913 hours of audio and 330,956 transcribed turns from 5,780 distinct numbers -- collected over 54 days by an AI voice-agent honeypot that answered callers and kept them talking, and introduced in a companion data descriptor. We separate outright scams, which solicit sensitive information, from the larger stream of predatory but legal lead generation ("spam") that feeds them. Scam operations keep office hours (6.6x more calls per weekday than weekend day); thousands of disposable numbers run a small catalog of recycled scripts (thirty opening clusters, half the traffic in the top five); and callers solicit identity anchors -- a home address and a date of birth -- far more often than payment credentials, pressing through persistence and manufactured authority rather than overt threats. Our central experiment asks: does it matter who picks up? Every seeded lead carried one of ten fictitious identities drawn uniformly at random, so the identity a fraud operation reaches is fixed before the caller exists. Across 1,823 randomized calls, scammers spent about 15% more conversational turns per decade of the target's apparent age (rate ratio 1.15, 95% CI 1.08-1.23; randomization p = 0.005) -- yet what they asked for did not change (26.3% of calls reached a request for sensitive information; odds ratio 0.99 per decade, 95% CI 0.90-1.08). A second experiment casts early detection as a benchmark: from a scammer's opening lines alone, on a caller-disjoint split, escalation is predictable at 0.72 ROC-AUC from the first line and 0.87 by the eighth, and a plain bag-of-words classifier matches a fine-tuned on-device language model. Telephone fraud emerges as a templated industry that varies how hard it works a target, but not what it wants.

Ethan Traister, Ankit Raj, Jiaqi Gan +7

Financial Fraud Detection

Ask PDF

Oct 24, 2026

FraudSociety: A Generative Agent-Based Society for the Financial-Fraud Economy

Financial fraud caused over $15.9 billion in losses in the United States in 2025, according to the Federal Trade Commission~\citep{ftc2026databook}. Understanding such large-scale harm requires jointly modeling informational and financial dynamics. Yet existing simulators typically capture only one side of this interaction, leaving a gap in modeling how fraud unfolds in the real world. To bridge this gap, we introduce FraudSociety, the first LLM-agent-based simulator that jointly models these coupled dynamics. It integrates a dynamic social environment for information exposure and communication, persistent financial ledgers that preserve payment and loss histories, and a Need-Intent-Action architecture for civilian decision making. Fraudsters further adapt their communication and financial actions to individual interaction histories and ledger states, forming a closed feedback loop between the two dynamics. We validate FraudSociety across macro-level outcomes, micro-level behavior, and intervention effects. At the macro level, the simulated fraud outcomes closely match real-world patterns across multiple key statistics. At the micro level, it reproduces strong loss concentration, with the top 10% of victimization records accounting for 81.1% of total losses, consistent with Canadian Anti-Fraud Centre statistics~\citep{cafc2025annual}. Counter-fraud experiments further reveal variation across intervention strategies, with the best-performing personalized intervention reducing the repeat-payment rate from 49.4% to 10.9%. These results establish FraudSociety as both a high-fidelity simulator and a scalable testbed for evaluating anti-fraud strategies under diverse intervention conditions, thereby advancing research on financial fraud and its prevention.

Keyang Chen, Mingxuan Jiang, Zeping Li +10

Fudan University, Shanghai, China · University of Illinois Urbana-Champaign, Urbana, IL, USA

Financial Fraud Detection Agent-Based Modeling Large Language Model-Based Social Simulation Human Behavior Simulation

Ask PDF

Abstract

Explore similar work

PreScam: A Benchmark for Predicting Scam Progression from Early Conversations

Anatomy of a Scam Call: What 10,000 real scam and spam calls reveal about how phone scammers operate

FraudSociety: A Generative Agent-Based Society for the Financial-Fraud Economy