cs.SIOct 18, 2026
SaveScam Town: Can Scam Education Spread Like a Vaccine?
Abstract
Most older adults who hear a warning about scams hear it from someone they know: a relative, a neighbour, or a friend who was targeted. Yet research on scam prevention almost always studies one person at a time. We ask whether scam awareness can spread through a community and protect it the way a vaccine does, since a warning protects whoever hears it and can be passed on. To find out, we built Scam Town, a simulated community in which a large language model plays each resident. Scam centres phone the residents, and after a call a resident can warn the people they know. Word of mouth helped, but it did not take off on its own: each warning led to fewer than one more, so a community cannot count on warnings "going viral". Across 80 simulated towns, everyday talk cut the number of people scammed by roughly a fifth. The largest gains came when an official warning, from a bank, a senior centre, or an agency, reached most of a town and residents then talked about it: in simulation (a combination we did not test live) the two together cut scams by about half. Protection was greatest when warnings reached the people scammers actually call, who here were older residents. Because our residents are language-model stand-ins rather than real people, we treat these findings as predictions to test with people, not as proof. They point to a simple recipe for scam education: give people a clear story they can retell, design campaigns to be passed along, and reach first those most likely to be called.
Figures & tables
Figure 1: Scam Town: scam education modelled as a transmissible vaccine (schematic). A scam call centre (left) and legitimate callers (right: bank, pharmacy, Medicare) phone residents (double circle: aged 65+). A trusted educator (a community centre, a nonprofit, or an agency such as the FBI) broadcasts a tale that warns many residents at once; tales also pass one to one, though some victims stay silent. The LLM decides each answer and the wording of each warning; the model sets ties, calls, who is told and broadcasts. Schematic.
Figure 2: The town, the model and who is protected. (a, b) One live LLM town (seed 705, P1, word of mouth on) on days 6 and 30. Fill shows how many different people have warned a resident about the scam they know most about (S none, W1 one, W2+ two or more); red rings mark victims; large nodes are residents aged 65+. (c) The two layers: scam calls, and tales told, relayed, believed and forgotten. (d–f) Fast simulator on the 20 consolidation-experiment town graphs at survey-level settings with 14-day forgetting, under the LLM-measured protection curve (scenario L, § 3 ): (d) victims per day, word of mouth off and on; (e) residents aged 65+ holding warnings (d and e run to 90 days); (f) victimisations averted by ties and household size: the least connected gain least.
| LLM-driven (Qwen3.7 Flash) | Modelled probabilistically (from literature or assumed) |
|---|---|
| Answer to every scam and legitimate call: comply, verify, resist, hang up, or not answer | Town graph, households, tie strengths, personas (random traits) |
| After one’s own scam call: the private takeaway and the wording of the warning | Call schedule, lead lists, 65+ targeting, sucker lists, pattern switching |
| Whether a resident tells anyone, how many and whom | |
| Belief, passing on, maximum chain length | |
| Memory fading, merging and the prompt cap; education campaigns |
Table 1: Who decides what. LLM decisions are checked for plausibility (realism gates), not against human rates; two calibrations to real-world compliance failed. Social behaviour was modelled after the LLM failed at it (it believed 99.8% of warnings; 82–93% of LLM victims would tell someone), from the literature where possible, otherwise by assumption (Appendix K ). The fast simulator replaces LLM call decisions by measured probabilities (Eq. 1 ).
| Parameter | P1 (survey-level) / P2 (what-if) | Literature range | Source |
|---|---|---|---|
| Telling, victims | 0.43 / 0.8 | 0.43 told family or friends | Binette [35] , Ianzito [36] |
| Telling, resisters | formula, 0.5 / 0.8 | no direct measure | shape: Parti and Tahir [37] |
| People told per teller | 2 / 3 | 1.6–3.6 close contacts | Cornwell et al. [32] |
| Passing on | 0.2 / 0.4 | 0.05–0.35; | Kumaraguru et al. [38] , Rader et al. [8] |
| Belief, personal ties | 1.0 (upper bound) | 0.60–0.85 | Shearer [39] , Silver et al. [40] |
| Memory half-life | 14 days | 2 weeks to 4 months | Scheibe et al. [3] , Maertens et al. [41] |
Table 2: Key parameters of the live test (P1, P2) and the fast simulator’s survey-level settings. Only victims’ telling is measured directly; the other levels are assumptions within literature bounds, converted to the model’s units (Appendix B ).
Figure 3: Exploratory dose-response of warnings in LLM residents (one scam pattern, one backbone). (a) Compliance with a grandparent-scam call by warnings held, (60 residents, 5 calls per state; 95% resident-cluster bootstrap; vermilion, the 30 aged 65+) against independent doses : two warnings give against 0.47 expected. (b) Control arms (3,600 calls): padding one warning to the length of two did not lower compliance (0.137, as unpadded), two accounts in one memory did (0.037), and neutral wording makes one warning strong (0.050). (c) Super-additivity by run (run 1 is (a), run 2 a replication, run 3 the anchors of (b); diamond, pooled; intervals pass 1 where resamples give ). Pooled (two accounts, one standard-format memory) [0.09, 1.05]; run 3 alone, separate memories and neutral wording cross zero.
Figure 4: When does telling more give collective protection? (a–c) Victimisations averted in a 30-day run with 14-day forgetting (scenario L, 20 graphs 25 replicates per cell) over telling and relay , for relayers telling about 1.5, 2 or 3 people. Vermilion: the critical line (simulated), at , 0.51 and 0.35; white dashed: 25%; dotted box: literature range. Stars: positions of the live-test settings P1 and P2 only; their towns did not forget, so their reductions (21%, 61%) cannot be read off this map. (d) Each cell against its : literature-box cells have and avert at most 15.6% (L) or 14.2% (H); reductions saturate at 45–55% (L) only at . (e) If only deliveries from new senders are relayed, warnings persist after calls stop at day 15 (any believed delivery on days 65–74) only with waning memory, which recreates unwarned residents as in SIS models, at (towns of 100) or near 1 (larger towns).
| Reduction | Memory | Curve | Forget? | Where |
|---|---|---|---|---|
| 8.6% | 14-day half-life | L (survey-level) | yes | § 4.2 reference; Appendix D |
| 7.4% | 14-day half-life | H | yes | § 4.2 ; Appendix D |
| 12.1% | kept (engine) | L | no | § 4.2 ; Appendix D |
| 14.6% | kept (engine) | panel curve, P1 graphs | no | Appendix D ; forecast in § 4.4 |
| 19.1% | kept (engine) | in-town table, P1 graphs | no | Appendix D ; P1 forecast |
| 21.0% | kept (live towns) | in-town (live) | no | § 4.4 , measured |
Table 3: Word of mouth alone: one reduction, read under different rules. The same quantity (relative reduction in the 30-day attack rate from word of mouth, no broadcast) takes several values across the paper. The differences are configuration, not disagreement: they follow the memory rule, the protection curve and whether towns forget. Live towns do not forget.
Figure 5: Live test: word of mouth switched off or on in 20 pairs of live LLM towns per setting (paired by seed; 30 days), against forecasts committed before any live result was read. (a) Attack rate (victimisations per resident over 30 days) with word of mouth off (grey) and on (green); orange diamonds, forecasts. Survey-level settings (P1): 0.250 to 0.198, % [11, 29], forecast 19% ( once batch-to-batch noise is included). What-if setting (P2, shaded; more telling and relay): 0.283 to 0.112, % [56, 64], forecast 47%. (b) Co-primary endpoints: P1 passes both; P2 is direction only (larger) on both, so the model is not forecast-validated. (c) Observed/forecast ratios (P1 filled, P2 open): reach within 0.97–1.03; protection under-forecast at P2. (d) Of the 2.1-point P2 compliance miss, 1.6 comes from the off arm.
Figure 6: A broadcast averts more when people also talk about it (fast simulator on the 20 live-test town graphs, no forgetting, 30 days, 60 replicates per town; Monte Carlo error about 0.5 points). Victimisations averted, against no education, when a trusted source warns a share of the town on day 0, believed by all (faint: by half). Black: broadcast alone; green: plus survey-level word of mouth (dark: a second broadcast on day 14; orange: residents aged 65+ reached first); dotted: word of mouth alone (14.6% in a, 13.4% in b); grey dash-dot: the sum of the two separate effects (38.0% at 90% in a); the gap above it is the synergy. (a) Scenario L; (b) scenario H (human-anchored): the same pattern, smaller. (c) In-town curve at 90% coverage: 53.1% alone, 67.4% with word of mouth, below the 72.8% sum: talk still adds 14 points, but the two overlap.
Appendix figures & tables14 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 7: Full model structure. Scam centres (the reservoir) dial residents from lead lists that over-weight residents aged 65+ and resell victims (sucker list). Each answered call is a spillover event. The callee complies (becomes V) with probability , which falls with their own earlier answered calls (E) and with the number of distinct warnings they hold about the call’s pattern. Answered calls may generate first-hand warnings to the callee’s ties, moving recipients from S to W1 and W2+. Believers relay with probability , and held warnings wane at rate . Protection at exposure acts from W1 and W2+.
Figure 8: The town. (a) One live town (seed 600); node colour is age, squares are community hubs, and edge colour is tie type. (b) Mean ties per resident by age group and tie type, against the core discussion network (3.6) and primary group (1.6) of older adults [ 32 ] . (c) Share in W2+ at day 30 and reduction in expected victimisations, by degree tertile and household size.
| Parameter | Value (engine; lit; sweep) | Evidence | Status |
|---|---|---|---|
| Victim | formula 0.14–0.17 (65+); 0.43; 0.1–0.9 | 43% of victims warned family or friends (survey releases) [ 35 , 36 ] ; 77–84% told someone [ 47 , 48 ] ; older victims who lost money describe concealment [ 37 ] | [S] level |
| Resister | formula 0.46–0.55; kept; global 0.1–0.9 | no direct measure; 73% discuss local crime with friends, family and neighbours [ 39 ] | [A], decisive |
| First-hand recipients | mean 1.8; 2; {1.5, 2, 3} | core discussion network 3.6 and primary group 1.6 in older adults [ 32 ] ; 2.08 core confidants for US adults [ 49 ] | [A, bounded S] |
| Relay recipients | mean 1.46; 2; {1.5, 2, 3} | none | [A], decisive for |
| Belief | 1.0; 1.0; 0.85/0.75/0.60 | 72% judge friends’ and family’s crime news accurate [ 39 ] ; 44% trust most neighbours [ 40 ] | [A] upper bound |
| Relay | 0.2; 0.2; 0–0.9 | converted: 0.13 discussed tips within 30 days [ 38 ] ; 0.45 retold a recalled story [ 8 ] ; per-neighbour passing 0.05–0.35 is a different unit [ 50 ] | [S] band |
Table 4: Parameters, values and sources. [S] sourced; [A] assumption; [A, dir S] direction sourced, level assumed. “Engine” is the configuration of the live consolidation towns; “lit” is the literature centre.
| Gate | Simulated | Observed (live) | Tolerance | Verdict |
| G-A1 depth 0 / 1 / 2 / 3+ (dialled calls) | 0.668 / 0.232 / 0.073 / 0.027 | 0.655 / 0.240 / 0.077 / 0.027 | 0.03 each | pass |
| G-A2 | 0.100 | 0.104 | 0.02 | pass |
| G-A3 compliance, answered calls | 0.0617 | 0.0615 | 0.01 | pass |
| G-A4 consolidation ON OFF | [ , ] | inside CI | pass |
Table 5: Fidelity gate. Closed-loop model on the 20 live consolidation-experiment graphs (200 replicates per town per arm) against the observed live towns. All four declared gates passed.
Figure 9: Fidelity gate. (a) Depth distribution of dialled scam calls in the 20 live towns (grey; bars show the 0.03 gate tolerance) and in the model (blue). (b) Per-town share of calls reaching a twice-warned resident, model against observation ( ). (c) Compliance on answered calls by day of the wave.
| Scenario | Days | Parameters | AR, no warnings | Relative reduction | Towns | / WBS | |
|---|---|---|---|---|---|---|---|
| L | 30 | engine defaults | 0.237 | 0.088 | 0.06 / 0.08 / 0.13 | 0.100 | 0.28 / 0.23 |
| L | 30 | literature centre | 0.237 | 0.086 | 0.06 / 0.08 / 0.12 | 0.082 | 0.38 / 0.28 |
| L | 90 | engine defaults | 0.369 | 0.199 | 0.15 / 0.20 / 0.24 | 0.264 | 0.29 / 0.33 |
| L | 90 | literature centre | 0.369 | 0.134 | 0.09 / 0.13 / 0.20 | 0.133 | 0.40 / 0.39 |
| H | 30 | engine defaults | 0.768 | 0.080 | 0.05 / 0.07 / 0.12 | 0.111 | 0.28 / 0.25 |
| H | 30 | literature centre | 0.768 | 0.074 | 0.04 / 0.07 / 0.12 | 0.093 | 0.39 / 0.31 |
Table 6: Baseline collective protection. Relative reduction in the attack rate (AR) against a town without warnings, on 20 live graphs (100 replicates per graph at 30 days, 50 at 90 days). “Towns” gives the min / median / max of per-town reductions. The 30-day literature-centre rows are the paper’s reference values. Relative reductions carry Monte-Carlo error of about 0.005, so the literature-centre scenario-L value appears as 0.082–0.086 across runs (it is quoted as 0.086 in the main text, 0.085 in Appendix E , and 0.082 in the memory-rule contrast).
| Mean number told | at | at (simulated) | Predicted before the run |
|---|---|---|---|
| engine rule ( ) | 0.28 | 0.70 ( ) | 0.7 |
| 2 | 0.39 | 0.51 (0.97 at ) | 0.5–0.55 |
| 3 | 0.58 | 0.35 (1.02 at ) | 0.35–0.4 |
Table 7: Where sits (scenario L, 20 graphs 25 replicates; “simulated” is the measured branching ratio). depends only on relay and the number told, not on telling.
Figure 10: Full parameter maps with cell values , relative reduction in the 30-day attack rate, scenarios L (top) and H (bottom). The relay axis has non-uniform steps. Vermilion marks simulated ; dashed white the 25% contour; the dotted box the literature box. 20 graphs 25 replicates per cell; Monte Carlo error about .
| Told | Message rule, | New-sender, engine memory, = 100 / 1,000 | New-sender, 14-d waning, = 100 / 300 / 1,000 | ||
|---|---|---|---|---|---|
| 2 | 0.2 | 0.40 | 0.00 | 0.00 / 0.00 | 0.00 / 0.00 / 0.00 |
| 2 | 0.35 | 0.70 | 0.00 | 0.00 / 0.00 | 0.00 / 0.00 / 0.00 |
| 2 | 0.5 | 1.00 | 0.98 | 0.00 / 0.17 | 0.01 / 0.25 / 0.83 |
| 2 | 0.7 | 1.40 | 1.00 (explosive) | 0.00 / 0.00 | 0.68 / 1.00 / 1.00 |
| 2 | 0.9 | 1.80 | 1.00 (explosive) | 0.00 / 0.00 | 0.88 / 1.00 / 1.00 |
| 3 | 0.2 | 0.60 | 0.00 | 0.00 / 0.00 | 0.00 / 0.00 / 0.00 |
Table 8: Do warnings persist after calls stop? Literature centre, scenario L; calls stop at day 15; horizon day 75. Persist means at least one believed delivery in days 65–74, or explosive growth. : 20 live graphs 10 replicates; : 5 generated towns 4; : 3 2.
| Warning curve | in-town (0.92 / 0.98) | |||
|---|---|---|---|---|
| LLM panel (isolated-call) | 0.093 / 0.085 / 0.313 | 0.140 / 0.129 / 0.465 | 0.153 / 0.140 / 0.500 | 0.158 / 0.144 / 0.520 |
| LLM in town (first calls) | 0.130 / 0.130 / 0.309 | 0.199 / 0.199 / 0.434 | 0.223 / 0.205 / 0.458 | 0.226 / 0.217 / 0.475 |
| independent doses (LLM ) | 0.071 / 0.068 / 0.207 | 0.107 / 0.101 / 0.310 | 0.118 / 0.103 / 0.337 | 0.120 / 0.114 / 0.349 |
| human-upper | 0.049 / 0.047 / 0.160 | 0.071 / 0.063 / 0.242 | 0.074 / 0.074 / 0.261 | 0.082 / 0.074 / 0.277 |
| human-lower (independent, human ) | 0.039 / 0.041 / 0.126 | 0.063 / 0.054 / 0.184 | 0.063 / 0.065 / 0.206 | 0.070 / 0.066 / 0.209 |
Table 9: Efficacy curve own-call efficacy. Relative reduction in the 30-day attack rate at three anchors: engine defaults / literature centre / near threshold (literature with and three told). 25 replicates per graph.
Figure 11: Education campaigns, robustness and scammer exit (survey-level settings with 14-day forgetting, 20 consolidation-experiment graphs 25 replicates; 95% Monte Carlo intervals about 0.7 points). (a) Extra victimisations averted by a pre-wave education campaign giving each seeded resident one tale (scenario L, on top of word of mouth): targeting those scammers call most (12.8% at 20% coverage; an oracle, since a real campaign cannot know the lead lists) or residents aged 65+ (11.4%, its feasible proxy) beats random (6.8%), hubs (4.6%) and younger kin (3.3%). Relay saves about a quarter of the seeds: 10% most-called seeds with relay match about 13% without. (b) Victimisations averted in each sensitivity arm (L circles, H triangles) and under five efficacy curves; none reaches the 25% line (range across all arms 4–22%). (c) Labelled extension: probability that all four centres exit by day 90 when yield falls below an assumed break-even . In scenario L all exit even without warnings; in H, exit becomes likely only with near-threshold warnings (67–94% at ).
Figure 12: Scammer economics , 90 days, 20 graphs 15 replicates. (a) Probability that all four centres exit by day 90; (b) share of centre-days active; (c) attack rate relative to no exit and no warnings. Solid lines show scenario L and dashed lines scenario H.
| Quantity | P1 predicted | P1 observed | P1 verdict | P2 predicted | P2 observed | P2 verdict |
|---|---|---|---|---|---|---|
| ON OFF compliance | [ , ], | pass | [ , ], | direction only, larger | ||
| Relative AR reduction | 19% | 21.0% [11.4%, 29.4%], | pass | 47% | 60.6% [56.4%, 64.4%], | direction only, larger |
| Compliance, OFF arm | 0.071 | 0.077 | – | 0.071 | 0.087 | – |
| Compliance, ON arm | 0.057 | 0.060 | – | 0.038 | 0.033 | – |
| AR, OFF ON | 0.235 0.190 | 0.250 0.198 | – | 0.235 0.125 | 0.283 0.112 | – |
| Ever-victim share, OFF ON | 0.211 0.175 | 0.214 0.169 | – | 0.211 0.120 | 0.235 0.102 | – |
Table 10: Live forecast test: committed predictions, observations and verdicts (20 seed-paired towns per point, 30 days). values are one-sided and Holm-adjusted over four tests; attack-rate values are at the bootstrap resolution floor. Batch-inflated intervals (post hoc, added after the live results were read; A13), which add the batch-to-batch variance estimated from the gap between the two identically configured OFF arms: P1 compliance [ , ] and attack-rate reduction 21.0% [ %, 39.6%], against P2 [ , ] and 60.6% [48.7%, 69.7%]; the batch variance rests on a single OFF–OFF replicate.
| Stage | Date | Declared | Outcome |
|---|---|---|---|
| Stage 1–A3 | 10-10/11 | first transmission test (MiniMax-M3); calibration to real-world rates | pipeline check; calibration failed, real-rate matching dropped |
| A4 | 10-11 | realistic call scripts; realism gates; backbone screen | gates pass; Qwen3.7 Flash selected (rule not blind) |
| A5–A7.1 | 10-11/12 | belief-probe transmission tests; LLM-decided vs modelled disclosure and uptake | not supported; LLM social behaviour unrealistic, so modelled |
| A8 | 10-12 | personal ties always believed | design change |
| A9, A9.5 | 10-12 | isolated-call dose-response panel and replication | 0.197 / 0.143 / 0.023 / 0.007 (exploratory) |
| A10, A10.1 | 10-12 | live consolidation test (confirmatory, 20 pairs) | [ , ], not supported; reach forecast met |
Table 11: Declaration and amendment trail , compact (git commit dates, 2026; full log in the repository).