# Recent trends in Social Engineering Scams and Case study of Gift Card Scam

Rajasekhar Chaganti, Bharat Bhushan, Anand Nayyar, Azrour Mourade Rajasekhar
Chaganti was with University of Texas at San Antonio, San Antonio, Texas
78249, USA. e-mail: (Raj.chaganti2@gmail.com)Bharat Bhushan was with
Department of Computer Science and Engineering, School of Engineering and
Technology (SET), Sharda University, India (bharat_bhushan1989@yahoo.com)Anand
Nayyar was with Graduate School, Duy Tan University, Da Nang 550000, Vietnam
Faculty of Information Technology, Duy Tan University,, Da Nang 550000,
Vietnam (anandnayyar@duytan.edu.vn)Azrour Mourade was with Computer Sciences
Department, Faculty of Sciences and Technics, Moulay Ismail University,
Morocco<EMAIL_ADDRESS>
###### Abstract

Social engineering scams (SES) has been existed since the adoption of the
telecommunications by humankind. An earlier version of the scams include
leveraging premium phone service to charge the consumers and service providers
but not limited to. There are variety of techniques being considered to scam
the people due to the advancements in digital data access capabilities and
Internet technology. A lot of research has been done to identify the scammer
methodologies and characteristics of the scams. However, the scammers finding
new ways to lure the consumers and stealing their financial assets. An example
would be a recent circumstance of Covid-19 unemployment, which was used as a
weapon to scam the US citizens. These scams will not be stopping here, and
will keep appearing with new social engineering strategies in the near future.
So, to better prepare these kind of scams in ever-changing world, we describe
the recent trends of various social engineering scams targeting the innocent
people all over the world, who oversight the consequences of scams, and also
give detailed description of recent social engineering scams including Covid
scams. The social engineering scan threat model architecture is also proposed
to map various scams. In addition, we discuss the case study of real-time gift
card scam targeting various enterprise organization customers to steal their
money and put the organization reputation in stake. We also provide
recommendations to internet users for not falling a victim of social
engineering scams. In the end, we provide insights on how to prepare/respond
to the social engineering scams by following the security incident detection
and response life cycle in enterprises.

###### Index Terms:

Social Engineering Attacks; Gift card Scam; Fake Toll-free numbers; Internet
Infrastructure; COVID-19 pandemic; IRS Scam; Phone number spoofing

##  I Introduction

The communication technologies advancement and progression over the years has
enabled human beings from all over the world even living in rural areas to get
connected and communicate one and other. The communication media can be text,
image, audio and video form and the different communication channels like
telephone network, computer networks can be used to exchange the information.
The user identities should be verified/identified in some manner to enable the
communication between two end users using the available technology. The
technological user identities may be phone number, email address or social
network profile address are used to recognize the users. Although the
technology usage for user remote communication improves the quality of the
life and remove the distance barriers between people, these technologies pose
new threats such as identity theft, social engineering attack/scams, data
breaches in organization, ransomware and malware infection etc. [1] [2]. Some
non-profit organizations, security service providers and government entities
help to protect the user devices and improve the security and privacy of the
end users. These security protection services or products at least implemented
and followed by organizations so that to align with compliance, protect
employees from malicious attempts and maintain their businesses. However, the
normal user hardly think about security on a daily basis when using the
technology devices. So, they are most likely be the victims of the malicious
attempts including social engineering attacks (SEA) [3]. The normal user
exploitation is even easier if the user is not at all aware of how the
technology works.

Social engineering attacks are well known to be used to target individual
users, as the individual users are influenced to become a victim of the social
engineering attempts [4]. An adversary may send the phishing emails or deploy
maladvertisements in daily browsing websites to perform the social engineering
attacks. These attempts may be stopped by security tools in user devices if
they have installed security detection tools in the devices. So, the adversary
may rely less on technology dependent SES to achieve the malicious tasks. The
main difference between the SEA and SES is that SES are mainly performed to
manipulate the users with human persuasion rather than weaknesses in
technology, even though technology can be leveraged during the execution of
SES. As the SEA problem is well explored in literature and various technology
solutions based on the machine learning, deep learning, end point security are
proposed for addressing the issue [5] [6], we focused on SES and herein the
social engineering exploitation based scams are discussed in the paper. These
scams are very well organized to target section of people. The scammers
usually establish the scam life cycle arrangements such as the user
manipulation stories preparation, let the users send money to their mule
accounts or buy gift cards to share with them, and arrangements to transfer
the money internationally in scammer accounts prior to performing scams.

Based on the US scam statistics in recent years, the number of reported scams
has been increasing year by year [7]. The scammers always trying to find new
avenues to scam the people and most likely get succeed if the victim is not
aware of it. As per the Federal Trade Committee (FTC), the total number of the
frauds reported by the US citizens increased from 130966 to 2263502 during the
four-year period 2017 to 2020 [7]. We can clearly see in Figure 1 that the
fraud reports increases steadily year by year. Furthermore, not to forget,
most likely the social engineering scam victims may not report to the
government organizations due to the lack of awareness. So, the total number of
scams can probably even more than what officially reported in the government
public website. Similar to fraud report trends, the fraud loss has estimated
to be increased from 1081.3 to 3438.5 million dollars during the four-year
period 2017 to 2020 [7]. The mammoth fraud loss statistics shows that the
social engineering scams need to be taken seriously and prevent these scams
happening again in the future.

Figure 1: Total fraud reports received by FTC in US

The SES has been evolving constantly and scammers particularly look for
current trend social causes or events influencing the normal users to carry
out the scams. Notably, the COVID-19 pandemic has been a sensation all over
the world in 2020, impacted many lives and changed the human lifestyle. In
particular, the work from home scenario for employees has been a norm in
almost every organization during the pandemic. Scammers may take advantage of
the COVID-19 pandemic circumstances to target innocent people. To support the
claim, we can see that the number of covid fraud cases reports by US citizens
is more than 25000 in every month of the first half of 2021 [7]. As shown in
the Figure 2, the maximum number of fraud cases reported in the month of March
is 57348. Furthermore, the reported covid fraud loss is estimated to be $545
million US dollars so far in 2021. So, these COVID-19 pandemic fraud
statistics show that the social engineering scams keep evolving and may see
the new avenues for scams in the future.

Figure 2: Total Covid-19 theme based monthly fraud reports in US

As discussed in previous paragraphs, most of the existing research works focus
on social engineering attacks discusses technical phishing detection and
mitigation solutions, and the impact of the cyberattacks in enterprise
organizations when social engineering attack strategies are used for
compromising the employee machines [8] [9]. Even though these solutions may
help to prevent phishing attacks or enterprise attacks to some extent, the
main social engineering exploitation techniques focusing on the human
persuasion is still needed to addressed. There are only few works discussing
the human aspects and behavior to understand how the social engineering scams
target the individuals. The few existing works on the scams mainly focussing
on investigating any particular scam, and determining the impact, behavior,
characteristics and other essential information about the scams [1] [10] [11].
These works solely concentrate any particular scam and may not be used to
understand the scam patterns and correlation between different scams.

In addition, based on our knowledge, the existing literature also mainly
focused on addressing the scammer initiated phishing or social engineering
attacks and scams [12] [13]. These attacks include phishing emails, vishing,
smishing initiated by the scammer. But, very few works in the prior art
explored and discussed on the victim initiated connection to the scammer, and
then being fallen as a victim for the scams [14] [15]. For example, victim
visits a social network site and pick a scammer phone number from
maladvertisements on the website. Then, the victim may call the scammer and
become a target to the scammer. So, overall, in order to give an overview of
the human persuasion based social engineering scams rather than technical
aspect of the phishing attacks, and also considering the victim initiated
scams, we perform a comprehensive review of the recent social engineering
scams including the recent covid scams and victim initiated attacks.
Furthermore, the real time gift card scam targeting organizations attack life
cycle is described with examples to provide security awareness among the
internet users and consumer users. The tools used in the investigation are
also described to enable even a normal internet user can identify these scams
with minimal technology skills. We also described the security incident and
response guidelines for enterprise security teams to prepare for mitigation of
gift card scams targeting enterprise customers and indirectly enterprise
organization with internet presence. To the end, the main contributions of
work is as follows.

  * •

This paper discusses the recent social engineering scam trends covering
various scam types and the detail description of their operations.

  * •

This paper also describe the latest scam trends utilizing the COVID pandemic
for performing social engineering scams.

  * •

This paper proposes a social engineering scam threat model architecture to map
any scam with network components so that one can understand the scam life
cycle for crime investigation and monitoring.

  * •

This paper presents a real time gift card scam case study targeted on
organizations and provide the guidelines for security incident and response
teams to handle the scams.

  * •

This paper also describe the scam threat model for recent COVID unemployment
fraud scam and classic technical support scam as a classic examples.

The remaining sections of this paper are organized as follows: Section II
includes the literature survey of social engineering scams and attack/scam
surveys. Section III includes the threat model for social engineering
attacks/scams life cycle with examples. Section IV shows the detail review of
various social engineering scams. Section V and VI presents the case study on
gift card scam and the guidelines for security incident and response. Section
VIII concludes the paper.

##  II Literature Review

Social engineering exploitation still has been a part of the cyber crimes,
even though the technology has been advanced and defenders using advanced
technologies like machine learning, deep learning to detect the fraud
detection and prevent the cyber crimes. Even in organization security, humans
are the weakest link to compromise and perform cyberattacks against an
organization. In social engineering, the human behavior/emotions, perception
towards the things and tendencies are exploited to successfully perform the
attack’s and breach the organization. The same social engineering human
persuasion is performed to scam the individual users as well.

Firstly, we review the previous works on different social engineering scams
and then we compare our contribution in the paper with existing relevant
social engineering attack and scams review works. George et al. [16] revisited
the famous Nigerian check scam in 2009. The authors discussed slight variation
of the classical check scam, in which the scammer offers to buy a product and
send a check intentionally with payment more than the price of the product.
Then, the scammer may convince the victim that more than the price of the
product sent in the check by mistake. The scammer also convince the seller to
wire transfer the difference pay amount. Later, the check will be determined
as bogus and the victim has to pay the check bill when the victim visit the
bank for check cash out. The authors also provided recommendations for victim
and banker to quickly react to those scenarios. Youngsam et al. [14] set up a
honeypot magnetic advertisements in Craigslist to analyze Nigerian scammer
behavior, location and other details when the scammers give the response to
the posts in email. The scammers send emails to the assumed victims
(researchers) in response to their posts and then the emails header and
content information is analyzed to identify the behavior of the scammers.
These advertisements are set up particularly targeting scammer automated
scripts running when responding to the advertisements and intentionally
keeping high prices in Craigslist to let the legitimate users not opting to
buy the products. The Nigerian scammer groups and their activity signatures
are identified in this work using honeypot advertisements. However, this work
is limited to scammer responding to the victim/user advertisements in
Craigslist. Marzuoli et al. [17] created a honeypot to collect the robocalls
and spam calls originating from the scammers. Then machine learning techniques
applied on the robocalls first few seconds of the audio to cluster the scammer
groups. The bad actor fingerprints also determined to distinguish the scammer
group. However, the study on small scale robocalls may not cover all the
telephone based scams and groups behind them. Ting-Fang et al. [15] discussed
various romance scams, including luring the dating app victim to visit third
party sites by clicking advertisements, sending romance emails and performing
romance phone calls. By using the simulated spam filter, the authors able to
determine that the scammers respond to 2% of the received auto generated
emails.

Najmeh et al. [13] performed a detailed study on the technical support scams
by automatically crawling the maladvetisements on the internet and collecting
the scam phone numbers and URLs for further study. Furthermore, validation of
the URL and phone numbers is performed for detecting the technical support
maladvertisements. Later on, 60 different scammers are selected to talk with
them and collected all the details including scam process and tactics used by
scammers for performing the scam. Park et al. [18] performed an empirical
assessment of the Craigslist rental scams. The Craigslist rental scam posts
are analyzed using automated bot and then classified posts into group
campaigns. Additionally, the authors interacted with the scammers to identify
the infrastructure needed for operating this scam. Overall, the authors deduce
that considering credit card payment system protection may reduce these scams
in the future, as they mentioned that 80 percent of the rental scams relying
on the credit card transactions to steal the money from the users. Vidros et
al. [19] introduced automated recruitment fraud detection using natural
language and machine learning techniques. The recruitment dataset of 17,880
annotated job ads are collected and released for public. Srishti et al. [20]
performed a study on large scale social media campaigns used to distribute the
scammer phone numbers in the social media networks. They identified that 202
campaign groups actively posting phone numbers on the web and also mentioned
that some social network (twitter) can red flag as spam campaign better than
the other popular social media network (Facebook). The authors recommended the
necessity of sharing the threat intelligence data among the social media
networks for early detection of spams.

Hu et al. [21] presented a systematic study on the fraudulent dating apps.
Millions of apps collected from the android play store and then performed
static analysis to identify the in-app purchase apps. The identified apps are
then clustered into group of app families. These app families are manually
inspected and also analyzed the user comments on the apps to determine the
fraudulent dating apps. These fraud apps use the chatbots to influence the
users buying the premium services. Suarez et al. [22] proposed automatic
detection of online dating fraud user profiles. The scraped user profile are
used to extract the demographic, image and profile description content. Then,
the features are created for each of these categories. The ensemble based
machine learning technique is used to classify the given profile is legitimate
or fraud using those features. The authors reported that the optimal results
obtained for the experiments performed on the user profile features using
ensemble methods. Agari [23] solely described on the phishing romance scams
and mentioned that the targeted category of the people are becoming the
victims of this scam. They also mentioned that divorced, farmer and disabled
people are mostly being impacted by these attacks.

Pastrana et al. [24] presented a semi-automatic analysis on ewhoring scams
using the underground forums. The machine learning and natural language
processing solutions are proposed to extract the threads posted on underground
forums. Then, the extracted URL and images from the threads are considered to
find out child abuse material. The reverse image search analysis, domain
lookup tools are used for finding ewhoring cases.

The review of the above prior art scams reveal that few of the scams such as
dating scams, romance scams, technical support, Craigslist rental, online
dating apps scams are studied and performed in depth analysis for
identification. However, some of the scams such as law firm scam, Cat scam,
Gift card scam, Mortgage scams detection and analysis are not covered in the
state of the art. So, we wanted to address this issue by discussing all the
recent social engineering scams, and provide awareness and recommendations to
handle these scams. Furthermore, our work can be used as a reference to
perform the research on the research gaps in recent social engineering scams.

TABLE I: social engineering scams categorization

Author | Scam Name | Technique | Advantages | Comments
---|---|---|---|---
George et al. [16] | Nigerian check | larger amount check | The check scam protection discussion | Only two ways of performing check scam mentioned
Youngsam et al. [14] | Nigerian Craigslist | magnetic honeypot advertisements | better understand Nigerian scammer patterns, tools, email usage etc. | 10 groups responsible for most of the activity
Aude et al. [17] | Telephone scams | Honeypot, Audio machine learning | Able to group the scammers | Identified one third of the calls are robocalls
Ting-Fang et al. [15] | Romance scams | Simulated spam filter to track the scammers | Discussed different types of romance scam | Affiliated market scams using online dating apps
Najmeh et al. [13] | Technical support | Discovering advertisement in web | Automated discovery | Still considered as most dangerous scam
Youngsam et al.[18] | Craigslist Rental | Web crawling, automated responses | Able to identify the scammer infrastructure used | less than half of the scams Craigslist identified and removed from portal
Vidros et al. [19] | Recruitment fraud | Automated web page crawling | first dataset available in public | ML based techniques used for detection
Srishti et al. [20] | Spam campaigns | Automated crawling of webpages | large scale study covering posts on multiple social networks | Twitter can suspend spam accounts better than Facebook
Yangyu et al. [21] | Dating App scam | Crawling dating apps in Android store | Large scale analysis and fraud app detection | The chatbot accounts influence the users buy premium
Suarez et al. [22] | Dating fraud | ML classifier | Achieved 96% correct identification | Online profile based analysis efficient compared to bot based
Agari [23] | Romance scams | Phishing emails | - | target divorced, farmer, disabled people
Pastrana et al. [24] | eWhoring scam | Crawl Underground forum | Pipeline framework to identify these scams | Performed URL and image analysis during the investigation

In order to show the uniqueness of our work and contributions, we compare our
work with the social engineering related works in the prior art. Chitrey et
al. [25] conducted a social engineering attack survey to understand the IT
service provider employees and students from top IT colleges perception on the
attacks. The authors mentioned that the obtained results can be used to
develop the information security policy and security awareness programs for
organizations. Tu et al. [26] provided a detail review of the existing
telephone scams and evaluated the existing telephone scam solutions in the
state of the art. They concluded that there is no universal solution to stop
the telephone scams. So, based on the desired requirement like usability,
deployability, and robustness, the solutions can be implemented and combat
these scams. In contrast to our work on scams, tu et al. [26] mainly focused
on the telephone scams.

Anjum et al. [27] performed a review on the phishing attacks and anti phishing
schemes for mitigating the phishing email. However, the review is limited to
phishing emails and none of the scams are discussed in the article. Fatima et
al. [4] performed social engineering attacks survey. They described various
social engineering attacks, prevention and mitigation techniques.
Additionally, various computer based countermeasures and mitigation techniques
are compared to identify the advantages and limitations of each technique.
However, the paper only covers attack originating from the scammers and social
engineer attacks needed technology to execute the attacks.

Yasin2019 [28] performed literature review of social engineering attack and
human persuasion methods used for those attacks. The authors described that
thematic and game-based analysis techniques are effective to better understand
the attack scenarios. The empirical evaluation gives neutral results on the
game based analysis of security awareness assessment.

Alzahrani et al. [29] discussed the coronavirus social engineering attacks and
recommended security awareness is the solution to mitigate these attacks.
Although the author’s work can be used as a good reference for covid social
engineering attacks, the article did not describe the detail description of
the covid social engineering scenarios.

The authors [30] performed a detailed review of phishing attacks, which covers
the different attack types, attack vectors and communication medium. They also
described the anti phishing methodologies to mitigate the attacks and future
challenges. However, the paper did not address the victim initiated scams used
to let the victim reach out to the scammer and getting scammed. Venkatesha et
al. [31] emphasized the social engineering attacks leveraging the COVID
pandemic. The authors discussed the social attack trend shifting as the COVID
pandemic emerged, and discussed the COVID thematic attacks. However, all the
covid based attacks/scams are not covered in the article. In [32], the authors
performed an analysis on the COVID theme phishing emails. These COVID based
phishing emails used authority, liking and commitment as the principles in
those emails. The intention of these emails is to let the victim respond back
to the scammers so that they could demand the money as part of the scam.
Additionally, the personal information also being gathered in the email based
phishing scam.

TABLE II: State-of-the-art comparison with our work

Author | Scam/Attacks | Article Focus | Advantages | Comments | Case study | Covid Scam
---|---|---|---|---|---|---
Chitrey et al. [25] | Attacks | Employee and student survey | Collecting the user perception samples on SE | limited to India | - | -
Tu et al. [26] | Scam | Review of telephone scams | Detailed overview of all telephone scams | No universal solution for telephone scams | - | -
Anjum et al. [27] | Attacks | Phishing email based survey | - | limited to phishing emails | - | -
Fatima et al. [4] | Attacks | Social engineering attacks survey | Review of the most technical SE attacks | The human aspects of SE is not covered | - | -
Yasin2019 [28] | Attacks | SE attacks and human persuasion methods review | Many attacks in literature are covered in the review | game-based analysis on SE produced neutral results | - | -
Alzahrani et al. [29] | Generic | Corona phishing survey | Recent trend attacks and scams discussion | limited to coronavirus SE | - | Yes
Alaban et al. [30] | Attacks | Phishing attacks review and countermeasures | Detailed survey on SE attacks/scams | Only covers scammer initiated attacks | - | -
Venkatesha et al. [31] | Generic | Covid thematic | Discussion on COVID attacks/scams | Only Covid thematic attacks/scams covered | - | Yes
Akdemir [32] | Generic | Content analysis of Covid emails | Analysis of covid scams | Only phishing Covid emails discussed | - | Yes
Our work | Scam | Review of scams and case study | Threat model to map any SE scam/attack | - | Yes | Yes

Overall, based on our review of the proposed solutions for combating the
social engineering scams, and the review of the existing social engineering
attacks and covid social engineering surveys, there is clearly a gap on
discussing the recent attack or scam trends targeting innocent people, and
particularly the review of the recent scams is not discussed in the prior art.
The recent works rather focused on the technical aspects of the social
engineering attacks. We try to address the research gap and aim to present an
overview of the scams with emphasis on the human persuasion. Additionally, the
threat model for social engineering is not discussed in the prior art. We have
presented a threat model architecture for addressing the social engineering
attacks.

##  III Threat Model

Social engineering scammer identification is much more challenging than one
can think of, as the scams involve intricate steps to trace out and multiple
stakeholders involves during the scam lifecycle. So, a common language and
criteria is required to identify the scammers and reduce the scope of the
scammer presence for catching them. Another reason for identifying the
scammers are difficult because they use combination of technologies like
telecommunications, internet, social media, web searches to execute their plan
of actions. It is also challenging to have security workforce, who are
proficient in multiple disciplines to track the scammers and work with
multiple stakeholders. Another challenging task is the jurisdiction issue when
professionals working internationally to catch scammers located in remote
countries. In order to understand the terminology and techniques used in
social engineering scam life cycle, we have proposed a social engineering
threat model architecture, which can be used to map any social engineering
scam happening anywhere in the world starting from scammer origin to victim
location. The proposed social engineering scam threat model is inspired by
telephony and internet architecture [33] [34].

Figure 3: Social engineering scam threat model architecture

As shown in Figure 3, the social engineering scams threat model architecture
mainly consist of the victim national communication network, international
gateway, scammer national communication network and scammer data center
modules. Additionally, the data collection sources, public internet resources
are mentioned to be used in scam life cycle. The detail description of each
component in the module are discussed to understand the role of each component
in the social engineering scam life cycle.

###  III-A Public internet:

Scammers get abundant information regarding the people to scam from internet.
As the social media applications usage has grown significantly over the years,
users share lot of private information in these sites, and don’t consider the
privacy is an issue. Scammers collect targeted user group information from
these sites. Furthermore, some websites provide services to sell the personal
information for profit. So, it is not difficult for the scammers to create the
user database with personal information like phone number, occupation, name
etc. For instance, the Facebook and Instagram social media sites publicly
provide the users data, who don’t set their privacy settings to private [35].
A scammer may run a web crawler with API calls to collect all the targeted
user’s information and save it in a database. Some of the essential
technologies on the internet are used for social engineering are described
below.

Google Ads: Google offers Ad service to customers, who wants to promote their
products and services [36]. A traditional way of showing Google Ads in Google
search results based on the keywords used in the search. The Google Ads
usually show the service or product website and phone numbers when the
relevant keywords used for search. For instance, if a user search for “home
rentals near me” in Google search, the number of results will appear along
with Google rental ads. Scammer may use the keywords like “home rentals” and
“near me” to pop up their fake website or their phone number to attract the
users contacting them. So, Google Ads can be used a secret weapon in social
engineering scams to let the user calling the scammers and scam the users.

Hosted fake website: The scammers misdirect the users using fake web
applications deployed in public internet. They may post illegitimate
information or scammer contact number to contact the scammers. Scammer may
simply need domain name and domain registration with registrar to start using
the domain for hosting the applications. Based on the targeted victims, they
may post the relevant content to attract the victim to visit their pages and
then direct them to achieve the intended goal. Most of the time, the fake
website is used to provide the scammer contact details in scams so that the
user/victim can reach out to them, and then execute the scam. Later, the
scammer may ask them to wire transfer the money or buy gift cards from store
and then the scammers use them for buying goods etc. So, based on the scammer
goal and their strategy, they instruct the victims and direct them to involve
them in scams.

Social network Ads: Google Ads may be having limited visibility and few daily
visitors. This may be due to few of them would like to focus on ads when
searching for any content. But social network Ads has larger reach, as most of
the social media users spend time for fun and most likely they will explore
the Ads for entertainment purpose. So, social media Ads has got more attention
recently and it is convenient to reach out many people [37]. Scammers started
leveraging the social media Ads to attract the users and perform the scams.
For instance, to scam the people who love cats, the scammer may populate the
cat related post Ad pages with cat scam relevant social media Ads. Users are
most likely to visit and explore these Ads to buy a cat. The scammers can now
scam them to pay money for cat online order and shipping to their location.
Later, the scammers may disappear once money is received. Similarly, there are
many other types of scams performed by posting fake Ads in the social media,
as discussed in section IV

Content Specific website: Scammer may also focus on the specific targeted
users for financial gain, popularity, or political advantage to their clients
by posting the specific content in targeted websites. For instance, during the
elections, the scammers may host fake website hosting content supporting a
particular presidential candidate and indirectly support them to gain more
votes by the influencing the voters who visit the fake websites. The scammer
may benefit indirectly, possibly some supporters pay them money for hosting
the content and supporting their candidate. Although the people not directly
involved to be a victim of the attacks, Scammers still earn money by
indirectly influencing them.

###  III-B Victim:

Users are being targeted by scammer and few of them are really being impacted
by the scams. All the impacted users will be the victims in the context of our
social engineering scam threat model architecture. The communication can be
initiated by the victim to visit the Google Ads or social website Ads, or the
scammers may phone call or email the victims [38].

###  III-C Victim National Communication Network:

Victim national communication network mainly comprised the victim
mobile/carrier network, internet service provider network and VoIP service
provider network to connect with the scammers resided in the victim living
country or international connection to the scammer country. It is essential to
understand that the victim resided communication network components in detail
to better protect the users and implement the security mechanisms [33].

Mobile/Carrier network: Mobile network involves in the social engineering scam
when the scammer connected to the user through phone call/messages. For
example, the main carriers like AT&T, T-Mobile, Verizon in the United States
only process the messages/phone calls when the victim is using the same set of
carriers and the scammer is trying to send a message or call them. The network
connection could be LTE, 3G, 4G or 5G to perform telecommunication operations.
However, security monitoring at the carrier level may be ineffective for scam
call detection, as the legitimate call and scam calls are difficult to
distinguish. It is very challenging to implement any security solutions for
social engineering scam detection at the mobile network level. So, it is very
unlikely that the mobile networks can help to prevent the scams. However, if
the scammer calling from spoofed phone number, A recent proposal of
STIR/SHAKEN protocol implementation at the carrier network level may
authenticate the caller ID and prevent the robocalls. This may reduce to an
extent the scammers who rely on caller ID spoofing for social engineering
scams. But the protocol implementation may not completely prevent the scams.
Mobile networks can also help the users to detect the phishing or scam
messages. Currently, the users still receive the phishing or scam messages in
the mobile phones, and detection and prevention of the scam message solutions
are required. We have not described the technique used for performing the
telephone scams in the mobile network targeting operators, third party service
provider etc. the detail description of those scams can be found here [33].

Internet service provider There may be instances where the users may rely on
the wireless internet connection to complete the phone calls. These calls are
processed as VoIP packets and passed through the user internet service
provider network prior to forward to the core network and international
gateway. Although there is more visibility on the VoIP packets passing through
the internet service provider, the packet level analysis is unlikely helping
to identify if the call is scam call or not. So, security controls
implementation for scam mitigation or prevention may not be a viable option at
internet service provider level and are extremely unlikely to detect scams at
the internet service provider level.

VoIP service provider Voice over Internet protocol (VoIP) services [34] are
most likely provided by third-party network like Bandwidth.com to connect the
international VoIP calls. The scammer may leverage these services to obtain
the victim country phone numbers and may use it to call forward the
international calls. These services make it difficult for an end user to
identify the called person location. The STIR caller identity protocol
implementation may alleviate some of these scam problems with identity
authentication, even though it won’t completely eliminate the scam issues.

###  III-D International exchange gateways

The international exchange gateways forward internet or telecommunication
connections from one country to other country. For instance, the optical
fiber-based network connects through sea for communicating between the two
networks. As the traffic rate is huge and enormous, the scam related network
traffic monitoring is almost impossible. Furthermore, gateway operator or
owner is not involved in scams. So, they have little or no interest to even
consider the scams are really a concern. In general, the scam detection
implementation is impossible and practically not a viable option, as the scams
are mostly based on the human persuasion rather than fixing the technical
problem. So, we may not rely on preventing the scams at the international
exchange gateway level.

###  III-E Scammer call center

Scammers usually operate as a legitimate company managing call center
services. Based on the historical scam events, most of the call centers are
known to be operated from India or Nigeria. For instance, the Indian police
busted a call center cheating Americans for 14 million dollars recently [39].
They reported that the call center hires the employees and train them to talk
in American accent. The scammer employees are also instructed to following
vetted script while talking to Americans. They basically use various scam
scripts to obtain gift card or wire transfer money from victims. Typically,
the call centers may contain VoIP gateway setup to perform international
calls, computer equipment that a typical call center requires.

###  III-F Data Source

Scammers collect the targeted user information from disparate sources prior to
initiating the scam operations on them. This is the first step and one of the
essential steps in scam operation life cycle. If the scammers have more user
dataset, they may get more chances to succeed. The user information is
typically the phone number, email address to get in touch with the users. The
most often used data sources are described here.
Dark web Scammers find dark web is the most reliable place for buying the
targeted user data illegally. The data should be coming from data breaches,
stolen information, unknown disclosure etc. The data can be sold in cheaper
prices at times compared to lucrative amount made when the scam is successful.
Cryptocurrency may be used to do financial transactions and maintaining the
user anonymity. So, the identification of the real person involved in these
transactions is almost impossible. Most of the time, the normal user
credentials are being sold in dark web after collecting from data breach
disclosures.
Online sale A number of third-party services provide user data available for
legitimate sale through business websites. The user data may include the phone
number, email, username, location etc. However, they may not sell the personal
credential, banking information. It is partly easier to get the user data like
name, date of birth, location, phone number etc. Additionally, scammers can
also freely collect the basic user information in bulk from the legitimate
sites, which are maintained for tracking purpose.
Social network Social network collects and store lot of user information. So,
scammers run slow web crawlers to periodically perform API calls for
collecting vast amount of user data for scamming purposes and evading the
security detection. The social networks like Facebook and Instagram maintain
lot of information and even google search crawler can help to download lot of
public user information. For instance, the user details of any particular
organization or location can be extracted with simple search queries in
google.

###  III-G Technical support scam threat model

The technical support scam threat model defines the various components between
scammer and victim while performing scams. In the first phase, the scammers
obtain the user phone numbers from multiple sources such as public internet
sites, social network profiles, random selection of the phone number using
state and area codes. The scammers maintain list of users database and
typically recruit the people who are desperate to work for any job. They may
maintain a datacenter to perform scamming operations. As we can see in the
Figure 4, the second and third phase covers the communication between the
scammer and the victims. As the phone calls are being used to reach out to the
victims and use VoIP protocol to spoof the phone number, the IP network is
being used as a communication network 4. In phase 4, the victim is being
instructed to visit the scammer-controlled web application for making them
believe that the victim is indeed have a performance or virus issue. The
scammer make them believe that their machine is compromised with virus and
demand service charges. The victim may wire transfer the money or sending gift
cards to scammers to complete the scam based on the scenario.

Figure 4: Tech support scam threat model

###  III-H Covid unemployment scam threat model

The threat model for covid unemployment has a unique characteristic that the
victim is not directed contacted by the scammer. So, the communication modules
between victim and scammers have been eliminated. As shown in Figure 5, the
threat model comprise three phases to complete the scam. Firstly, the US
citizen’s personal information including the phone number and the social
security number is collected from either posted data breaches in dark web or
third-party private sales. In this scam, the username and social security
number was enough to successfully divert the government unemployment claim
refunds to scammer bank accounts. The scammers fill the applications in
government unemployment claim web application portal, as shown in the phase
two of the model 5. The scammer leverages the weaknesses in the web
application for identity verification. They may provide the bank account of
mules or scammer operated account to collect the money. The unemployment claim
funds moved to the scammer bank accounts in phase three. Later, when victim
try to fill the unemployment application for COVID unemployment, the web
application rejects the case as the claim is already processed by the
scammers.

Figure 5: Covid unemployment threat model

##  IV Recent Social Engineering Scam Trends

In this section, various SE scams are discussed in detail including the COVID
scams. In addition, the SE scams are compared and classified based on the SE
principles, scam initiations, entity involved, locations, technologies
involved and targeting victim ages.
Covid Unemployment Scam: Social scammers quickly adapt their techniques to
perform scams on targeted innocent people. COVID-19 pandemic has been a topic
for the last one and half years, and people from all over the world are
concerned about the wide spread of the virus. Number of people have been
impacted with unemployment due to COVID lockdown. The governments standstill
to support their citizens and helped to financially support them. Scammers use
the unemployment reporting loopholes to fraudulently claim the citizen
unemployment funds, and transfer the money to mule’s accounts so that the
funds moved out of the country to remote scammer bank accounts. US covid
unemployment scam is an example of this category [40]. Firstly, the scammer
collects the US citizen’s personal information including the social security
number from data breach disclosure sales in dark web or compromising victim
machines to steal the personal information or collecting from third-party
sellers. Furthermore, additional personal details like email, phone numbers
collect from the public websites through web searches. Then, scammers fill the
unemployment claim forms through state level government websites. As some of
the websites did not actively verify the identity and lack of security
measures like multifactor authentication installed on the applications, the
scammers use the loophole to claim the citizen’s unemployment benefits. The
government then release the unemployment funds to assume that the actual
citizen claiming the unemployment funds. But, the financial transactions
received by the scammers operated mule accounts. Later, the money is wire
transferred to international bank accounts without getting caught by bankers.
If the US citizen really job impacted with Covid later tries to submit the
unemployment claims, the websites report them that the submission already
received, and says that the funds are transferred. The innocent citizens are
being scammed and has to file complaints to government for support. This is a
classic social engineering scam leveraging the latest trends without even the
victim involved in the scam life cycle [41]. As the reports seen from multiple
members, the US government was able to quickly identify the scam and fix the
website application issues in many states with more protection and identity
validation for reimbursement. There have been reports that the stolen money
bank accounts have been seized and recovered some amount of money from the
scammers [41]. Unfortunately, the victim is not involved and most of them not
aware of these scams to take precautionary actions.
Covid Vaccine Scam: The scammers adapting the scamming strategy according to
the covid vaccination scenarios and vaccine development stages since the covid
pandemic existed. During the early stages of Covid, the vaccine is not
available and still scammers run fake websites offering covid vaccines.
Additionally, the robocalls used to reach out the people and lure them with
vaccine for money [29]. Once the money is received, the scammer will disappear
from the user radar. The scammers also collect the personal information for
data gathering purpose using vaccines scams. Later on, when the covid vaccine
is approved, the scammers using the covid vaccination appointment booking fake
websites for collecting the information. Overall, as the vaccine transition
from developing to available state, scammers changed their strategies to
execute scams with content appropriate to the situation
COVID-19 survey scams: The survey are mainly used to collect the personal
information such as names, location, phone number, email etc. The collected
information may be used to execute various scams or phishing attacks or
selling the data in underworld communities. The scammer create fake covid
survey content websites, similar to fake information spreading websites seen
during the US election in 2020 [42]. So, the users should be aware of the web
links they browse when using the internet. The survey requests may also come
through the phone messages. It is recommended not to click the web links
received through phone messages so that the used are not being scammed.
Coivd-19 stimulus scam: The stimulus packages offered by US government is also
a topic of interest for the scammers. They would like to perform scams using
stimulus as a topic and gather personal information. They may ask to request
bank account credentials to steal the money. A proper stimulus receiving
confirmation is required and only need to talk with the government official
when someone approached through phone or emails so that not become a victim of
these scams. Scammers may also offer tests, health and human services grants,
and medicare prescription cards in exchange for personal details, including
medicare information [31].
Covid fake donation/charity scam: The scammers may use the fake donation
organization or charity names to collect the money from innocent people. The
scammers leverage the goodness of the people and lure them to pay the money
for donation. Instead of sending the money to fake organizations, the money is
transferred to scammer bank account and then scammers will cut the contact
from the victims [43]. These are also mostly happen through internet or phone
calls. So, the security awareness of scams is needed to combat these scams.
Gift Card Scam In Gift card scams, the scammer contacts the victim through
social media networks, phone messaging to initiate conversation and make them
believe that they are legit. As the victim believes them as legit people, the
scammer offers to help them financially in return for buying the gift cards
from stores like Walmart, target, CVS etc. If the victim is greedy and not
aware of repercussions of the scams, they may end up buying the gift cards
from the stores and share the gift card numbers with the scammers. Whenever
the scammers receive the gift card number, they disconnect from the victim and
never be in contact with victims. So, the victim loses all the gift card money
through these gift card scams. The scammer may use different ways to monetize
the stolen gift card numbers. If the scammer is operating from another
country, he/she may use mules to spend the gift cards for buying things and
later the mules pay the money to the scammers. Some scammers may use those
gift cards to buy things for themselves and leave no traces to track them. It
is highly difficult to track and identify the scammers even if the victim
reported to the authorities or gift card bought stores within the short span
of time, as tracking the gift card used store, identifying the scammer
involves working with multiple stakeholders like legal, ethical, technical
teams from multiple entities like laws enforcement, gift card provider etc.
Unless it is an organized multi-million dollar scam impacting the reputation
of the organizations and lot of people were reported to be a victim of the
scam.
Romance Scam Scammer leverage the people liking tendency towards someone as
their weakness for performing scams. The romance scam mainly involves social
media networks, dating sites to connect with the victims. Scammers create fake
dating profiles with fraudulent information trying to attract people in
different age groups. They build a relationship and constantly pursue to
impress them for gaining trust among each other. The scammers may even pursue
to let them build the sympathy towards them. For instance, the scammer may
tell stories involving family issues, jobs issues and employment issues in
their country etc. to get attention and sympathy from the victims. Once the
trust is built, the scammer may exploit the victim to borrow money for a
favor, financial assistance to help other people etc. to collect the money.
When the scammer gained the intended financial help, he/she may disconnect
from the partner/victim and delete the social media accounts/phone numbers for
disappearing from the victim world. The number of romance cases has been
growing recently, as the number of websites/apps increased tremendously [44].
The romance scams have been changing as the technology advances with instance
video chat, international dating apps etc. Another type of romance scam is
faking the profile as a woman and pursing the men with love and lust to steal
the money from them. The scammers build a relationship claiming to be women
and then blackmail them to post their content in public. If the victim has
reputation in the society, he may pay the money to scammers to save their
reputation and get away from it.
IRS Scam Internal Revenue System (IRS) scam is known to be one of the oldest
and well-known scams in the scam history [45]. A scammer collects the list of
the phone numbers and their personal information from the third-party vendors
or public search websites. The aged people contact details are collected for
ease of scamming. Once the numbers list obtained, scammer located in other
countries like Nigeria call them claiming to be IRS officials. The victim can
see the call is coming from the United States, as the scammers use
international VoIP phone services to hide the originating phone number. The
scammer tries to convince them that they are from IRS and instruct them to pay
the fabricated IRS taxes, which the victim is not liable to IRS in reality. If
the victim is frightened or not aware of these scams, he/she may transfer the
money to the scammer bank accounts with fear. Once the funds are transferred
to the scammer, he/she stop talking to the victim and may elect another victim
to perform the fraud. Unfortunately, the victim reaches out to the legit IRS
for resolving the issues and the IRS could not be able to help them to
retrieve the funds from scammers in this case. The scammers are using new
technologies to reach out to the victims nowadays, even though the scam format
has not been changed over the years [1]. So, simply knowing the fact that IRS
will not call you or reach out in social media to pay the taxes would prevent
the citizens for not being a victim of these scams.
Check Scam Scammers may use the loophole in banking system, i.e, usually take
few days to find the fraudulent checks once submitted to perform the check
scams. Scammers send you a check with an amount more than you are supposed to
be receiving from an entity, and tell you to transfer the overpayment or ask
you to pay the money in alternative forms. Initially, the scammers request the
victims to draw the cash in check and give fake checks in exchange for money
by saying urgent need of money [46]. The check scam trends have been changing
with the advancement of the internet. Now, the scammers may give you
legitimate checks owned by mules or legitimate users. Then, they ask the
victims to transfer the money and cash out the check in the bank in exchange.
Scammers first receive the money through wire transfer, and then when the
victim visit the bank, he will be notified that the check will not work. Now,
the victim can’t retrieve the money sent through wire. So, it is highly
recommended to not accept the checks which value more than the intended price
and don’t use the money offered through check for sending gift cards or money
wire transfer.
Mortgage Scam Mortgage Scams on the rise targeting desperate homeowners to be
scammed [47] Scammers may create a fake mortgage company website or claim to
be calling from mortgage company to engage with homeowners for best offers,
upfront costs, or deeds payment [48]. The scammer may collect the owner’s
information from third-party or public search internet. For instance, scammer
may tell the financially unstable homeowners to pay the upfront cost so that
the company manages to pay the installments rest of the months until the
homeowner able to pay the money back. If the homeowner pays the money through
wire transfer, the scammer will disappear with the money and the homeowner
victim will never be able to reach out to them for payments or get the money
back. The scammers may shut down the fake company website domain or stop using
the phone numbers used to contact the victims. If the scammer is an
international caller, it is even much more complex to track the scammer and
too late to respond to the scam.
Recruitment Scam Recruitment scams focus on the desperate jobseekers to let
them believe that the jobs are available with great returns, packages in few
days [49]. These scams are carried out through internet by hosting fake job
posting websites operated by scammers. When the jobseeker browse these
websites, they are being directed to scammer contact details page or personal
information filling page. The user is also lured with lucrative job offers and
instruct them to pay the placement fees. If the desperate jobseekers believe
that these are legit requests, they may pay the fees with the hope that job
offer is in their hands. But, when the amount transferred to scammers, they
will not respond and usually too late to receive money back from the scammers.
Some scammers may also use alternative strategies as per the jobseeker social
and financial status to lure the money during the recruitment or job scam. It
is always recommended to use legitimate and official websites to apply for
jobs and never pay the money to receive the job offer [50].
Technical Support Scam Technical support scams mainly target the people, who
has limited knowledge on computer technologies. Scammers contact the users
claiming to be from Microsoft or dell companies and offer help to eradicate
computer virus or fix the computer performance issues [51]. It is inherent
that the companies never call to any customers to fixing an issue. The
customer first need to reach out to the company support if the device has
warranty. If the user not able to identify them as scammers, they follow the
instructions provided by scammers to install the remote monitoring solutions
like team viewer for troubleshooting the issue or removing the fake malware.
Once they access the victim machine using remote access applications, they may
encrypt all the data and ask for ransom to retrieve their information back. In
other cases, they may request the tech support fee for resolving the issue. If
the victim send money to the scammer operated accounts, it is very unlikely to
get back money layer. They simply disconnect the calls or machines once they
receive the payment. To make the users believe that they are infected with
virus, they instruct them to browse a fake website controlled by them [12].
When the victim browser the website, a pop-up is displayed to instruct them to
contact the scammer customer support phone number.
Law Firm Scam Scammers take advantage of the attorney reputation to
impersonate them and collect the money from people on behalf of the attorneys
[52]. For instance, scammer spoof the attorney email and send flood of emails
to the people in the attorney county with a link to GoFundMe for raising money
to a good cause. If the normal people, who thinks that it is actually posted
by their beloved and respected attorney in the county, they may donate the
money. This money is actually received by the scammers. On the other hand, the
scammers can also cheat the attorneys to wire transfer the money in exchange
to the money paid through check. The scammers claim to settle their issues
with an attorney and pay the money through check as an advance to work on the
case. They also demand to pay the additional money on the check in wire
transfer before cash out the money using check in the bank. If the attorney is
not aware of these scams, they may transfer the money to the scammer account
and they disappear from the attorney radar.
Cat Scam Some people became a victim of cat/dog scams in recent times.
Normally, people have a tendency to adopt the cats whenever possible and can
bear the costs. Scammers post the online ads and host some websites luring the
people to buy or adopt the cute and adorable cats pictures. If the people are
not paid lot of attention towards this scam, they would order the cat online
for shipping [53]. The scammers charge them the cost and shipping, and even
will not send the cats within the time frame. The scammers may even delay and
further blackmail the buyers to book animal abusing cases. They demand even
more money from the people and earn more money from the legitimate people.
When the scammers receive the money, they shut down the domains and may start
similar campaigns with some other domain names to continue their scamming
operations. Unfortunately, the victims can not take any action to receive
their money, as the scammer operating bank accounts internationally, and don’t
leave some clues to find them staying anywhere in the world.
Landlord Scam/Rental Scam The scammers post fake house renting post in social
media or paper ads to let the people read them and future renters reach out to
the scammers for house inquiry [18]. Furthermore, the scammers pursue the
renters to convince them for renting the home and demand them to pay advance
payment as part of the house renting confirmation. If the renter performs wire
transfer to the scammer, the claimed landlord scammers won’t respond once the
payment received. Scammers can also act as a renter and may collect money from
the landlords by scamming them. Scammers reach out to the landlords and offer
the willingness to take the lease. If the landlord asks for advance payment,
the scammer trick them to pay through check with amount more than asked and
later ask the landlord to return the money with wire transfer. The landlord
will become a victim of the scam and scammers will disappear from the victim
radar.
Craigslist Scam Craigslist is a common web marketplace for sellers and buyers
to exchange goods and perform trading. Scammers use Craigslist as a platform
to lure victim with great offers and get money from them. Typically, scammer
post a good deal Ad on the product or any item for sale. If any buyer wanted
to buy the product, the scammer would offer them for a good price, and ask
them to transfer money prior to shipping the product. The scammers may tell
realistic stories to make the buyers believe them and perform a wire transfer
before even receiving the product. When the money is transferred to the
scammer related account, the Ad will be disappeared from the site, and they
may create similar ads in the Craigslist to continue their scam operations
[54]. So, it is highly recommended looking for the originality of the product
in the Ad and identity verification of the seller prior to buying through
online portals like Craigslist.
Ewhoring Scam As the pandemic hits the world since last year, most of the
people spend lot of time in their home. The Ewhoring scams are reportedly
increased during the pandemic, as the people living alone in home may spend
more time on internet. Ewhoring scam involves targeting the young adults and
let them pose with private videos or pictures when scammers talking to them
with fake online profiles[24]. The scammers record the private videos or
pictures, and demand the money for not disclosing these videos in public.
Although the scam may seem to be difficult, it is highly possible to lure the
money from the people and get away from the victim. Hence, the online or
social media users should pay attention to the new friend requests and should
pay more attention while talking to stranger in online social media.

TABLE III: Recent social engineering scams technology comparison Scam Type | Techniques | Device/Applications | Technologies Involved
---|---|---|---
Gift card Scam [55] | Phone SE, Online SE | Phone | Google Ads, toll-free service, Fake domains, Fake social profile accounts
Romance Scam [56] | Phone SE, Online SE | Phone/laptop | Social Network Account, Fake email
IRS Scam [1] | Phone SE, Robo Calling | Phone | VoIP call service, International Call forwarding service
COVID Unemployment [40] | Loophole in public website | Web | Fake Emails, Fake Bank Accounts
Check Scam [16] | Online SE | Laptop/Phone | Fake Email, Fake Phone calls
Mortgage Scam [48] | Phone SE, Online SE | Laptop/Phone | Fake Email, Fake Phone calls, Fake websites
Recruitment Scam [49] | Phone SE, Online SE | Laptop/Phone | Google Ads, Fake Phone calls, fake website domains
Technical Support Scam [51] | Online SE, Phone SE | Computer, Laptop | Remote Access software, Internet
Law Firm Scams [52] | Online SE | Web, Email service | Email spoofing, fake emails
Cat Scam [53] | Online SE | Web | Google Ads, fake website domains
Landlord Scam/Rental [18] | Online SE | Web | Google Ads, fake website domains, fake website applications
Craigslist Scam [54] | Online SE | Web | Craigslist Website
eWhoring Scam [24] | Online SE | Web | Internet/online chat

The Table III illustrates the comparison of the SE scams based on the scammer
techniques, device or applications involved and technology involved to execute
the scams. We can clearly see that all the scams either rely on phone or
online SE techniques except COVID unemployment scam. Additionally, these scams
involve device or applications, which may include the phone, computer, laptop,
email services, or web applications. So, the user must be conscious about
scams when receiving the phone calls or browsing the web applications. The
phone based scams such as gift card, IRS, romance, mortgage and recruitment
scams can be mitigated if the phone identity is verified by the carrier
networks. On contrary, the eWhoring and Craigslist, landlord scams are
actively seen in the web application based scam category. The technologies
such as email, domain, Google Ads, social network accounts, websites are
mainly involved to perform these scams. Overall, based on the Table III, we
can say that the scams can be mitigated if the user is aware of the phone
calls, in which whom they are talking to and only browsing safe applications
with little efforts to identify the scams. However, the understanding of how
businesses work and the relationship between different business entities is
the key to distinguish the scam or legit actions.

TABLE IV: Recent social engineering scam detection signs comparison

Scam Type | SE Principles | Scammer Location | Scam Initiated by | Entities Involved
---|---|---|---|---
Gift card Scam [55] | Greedy | Nigeria, India [57] | Victim | Public Companies, individuals, Companies offering Gift cards
Romance Scam [56] | Liking, | Nigeria, India | Scammer | Social Network Companies, individuals,
IRS Scam [1] | Scared | India [45] | Scammer | US Government, Individuals
COVID Unemployment [40] | - | Nigeria | Scammer | US Government, Individuals
Check Scam [16] | Greedy | Nigeria | Scammer | Check Companies, Individuals, Mediators
Mortgage Scam [48] | Greedy, Scared | Nigeria | Scammer | Homeowners
Recruitment Scam [49] | Social Proof | - | Victim | Job Seekers
Technical Support Scam [51] | Authority, Commitment | India, Nigeria | Scammer | Individuals, Companies like Microsoft
Law Firm Scams [52] | Social Proof | Nigeria | Scammer | Attorneys
Cat Scam [53] | Liking, | African Countries | Victim | Pet Owners, Pet lovers
Landlord Scam/Rental [18] | Greedy, Commitment | African Countries | Scammer, Victim | Homeowners
Craigslist Scam [54] | Greedy | Nigeria | Victim | Craigslist, Individuals
eWhoring Scam [24] | Liking, Social proof, Commitment | Nigeria | Scammer, Victim | Individuals, Social network Companies

The Table IV describes the categorization of the scams based on the SE
principle used by scammer, scammer location, scam initiated by victim or
scammer and the entities involved. Most of the scams performed based on the
human greediness to let the user become victim by himself. The liking
principle is also used in the three scams to lure the innocent people. The
majority of scams are initiated by the scammers. So, the attention is required
when receiving a phone call from unknown number or email from unknown address.
The gift card scam, recruitment and Craigslist scams are initiated by victims,
who trust the source of getting scammer email or phone number. Hence, the
users should be aware of scams when referring online sources or phone number
or email address. Another way of identifying the scammers is to recognize
their accent. We have determined that the most of the scammers either located
from Nigeria and India. So, identifying the accent of the caller and comparing
with the typical nation’s people accent can be helpful to detect the scams.
Furthermore, there were multiple stakeholders involved in the scams and
tracking the scammers is much more complex once scammed. So, the precautions
like security awareness and education should be taken to not fall a victim of
these scams.

TABLE V: Social engineering scam age and location based comparison Scam | Age | Location | Victim | International/National
---|---|---|---|---
Gift card Scam [55] | Any | Anywhere | Individuals | International
Romance Scam [56] | Above 40 | Anywhere | Individuals | International
IRS Scam [1] | Any | Anywhere | US Individuals | USA
COVID Unemployment [40] | Any | Anywhere | US Individuals | USA
Check Scam [16] | Above 18 | Rural areas | US Individuals | USA
Mortgage Scam [48] | Above 18 | Anywhere | US Individuals | USA
Recruitment Scam [49] | 18-50 | Urban | US Individuals | USA
Technical Support [51] | Any | Anywhere | US Individuals | USA
Law Firm Scams [52] | Above 20 | Anywhere | US Individuals | USA
Cat Scam [53] | Any | Anywhere | US Individuals | Pet friendly countries
Landlord Scam [18] | Above 18 | Anywhere | US Individuals | USA

The SE scams are further studied to perform age and location based comparison,
as shown in Table V. It is clear that most of the scams discussed in the
article targeted US citizens. Few of the scams like Gift card scam and Romance
scam are targeted to people internationally. Further, we determine that the
scams can be targeted to victims located in either urban or rural areas as
long as the victim has phone number and Internet. Most of the scams targeted
to people of any ages. However, some of the scams are specially focused on few
age groups people. For instance, Romance scams mostly target women, who are
older than 40. So, the age based classification can be helpful for better
understanding the different scams.

##  V Gift Card Scam Case Study

Scammers have been leveraging various ways to steal the money from the
victims. Most well-known method was to use fake bank accounts and diverting
the money to bank accounts across the nations prior to scammer receive the
money. However, there are still possibilities to get caught, in particular,
leaving the traces of bank accounts. So, scammers are looking advanced ways to
hide their identity when being involved in scam operations. For example,
scammers steal the gift card numbers from the victims, who brought from
commercial stores such as Walmart, Target, Apple Store, Amazon.
This section discusses one of the gift card scams happened recently focusing
on travel industry customers across the world population and particularly
focusing on US population as a case study. It also uncovers various social
engineering techniques and technologies used by scammers to deceive the
customers.

Figure 6: Google Ads displaying fake customer contact phone number

Unlike popular scamming techniques like robocalling, phishing emails, Scammers
leverage the public internet and popular web search engines like google search
to post fake customer service numbers claiming to be travel company contact
members. In general, the travel companies are usually not known about these
fake customer service numbers distributing across the internet, as these are
well crafted posts focused on the customer location as well as the time of the
location with ephemeral in nature. In this case study, working for one of the
leading travel companies in the world, we observed that the scammers were
using the Google Ad services to register a fake travel consulting websites
with maladvertising the scammer phone numbers as travel company customer
service contact number. As shown in Figure 6, when a user browses the internet
and search for the travel company customer service number using Google Search,
the first few results indexed in the Google search are related to the Google
Ad Services and those ads hosts alike travel website with scammer fake phone
number. When the user clicking the phone number (877) 334-8963 highlighted in
the figure redirects the call to the scammer.

These fake phone numbers are appeared so random when the user search Google
for customer service phone number and makes it even difficult to identify by
Google teams as well as the customers trying to call the Expedia customer
service with Google search phone number. As shown in the Figure 7, when click
on the advertised phone number (877) 392-8999, it’s redirecting to another
toll-free number like (855) 802-1157 operated by scammers. When google search
performed multiple times from a single machine and observed that more than 20
unique fake toll-free phone numbers appeared as seen in the Figure 7.

Figure 7: Google Ads published phone number redirecting to multiple phone
numbers

An innocent customer found the fake customer service phone number in internet
would be contacted to scammers to inquire the travel itineraries including the
travel cancellation, travel prepone or postpone, book a travel trip and other
inquires. A scammer acts like travel company customer service representative
and gather more details of the customer, possibly customer phone number,
itinerary number and travel details using social engineering skills. Further,
He/She makes fake claims saying that “currently great offer going on travel
ticket sales and if you buy a gift card, you will have great discounts on
travel booking” and lure the customers/victims to buy the gift card from
public stores like Target, Walmart etc. They continue the conversation insist
on sharing those bought gift card numbers and might use “greedy” tendency as a
social engineering technique to pursue the gift card stealing during the call
if victim is unwilling to provide the gift card. If the victim is disconnected
during the call conversation, the scammer follows up with the victim through
reverse voice call or message service, as shown in Figure 8. Once the gift
card numbers shared with scammer, victims would be cutoff, and they are in
dilemma of what happened to them. In this way, scammer use the technology and
social engineering skills to pursue the scams in large scale across the
nations and put the travel companies’ reputation in stake.

Figure 8: Scammer sending phishing email to victim

Few of the customers had started calling fake customer phone number and become
a victim of spending money for gift cards. Later, we were seen the reports
from customers claiming to fallen for these scams. A sample report is shown in
Figure 9. Based on our experience handling these gift card scams in real time,
we provide the security incident and guidelines in the next section for
effective mitigation of this scam.

Figure 9: Customer Email sample report

##  VI Incident Response

In this section, we present the security incident response analysis to defend
these scams in enterprise organizations following the NIST.SP.800-61r2 steps
to handle an incident [58]. The analysis contains how we have defended these
scams in each step of the security incident life cycle as well as how the
organizations get prepared to monitor and mitigate these social engineering
scams.

Preparation: The enterprise stakeholders such as marketing Ad management,
Security incident and Response, Legal team, public relations team, Customer
support team are trained to understand the roles and responsibility when the
customer is being impacted with social engineering scams. Usually, the
customer agents are being notify if the customer is impacted with the scam.
The customer agent may engage or escalate to the security team for
investigation. The Security team may work with other stakeholders as per
necessity to take further actions.

Detection and Analysis: When the security incident response team is notified
about the customer report. They may work and investigate the root cause of
these reports. Most of the time, customer may not provide more information, in
specific, how they are being impacted to lose the money. It may be important
to work with the customers and get their feedback on the scam events happened.
It also needed to collect the number of customer reports so that the impact
and severity of the incident report can be determined, and actions taken
accordingly. In most of the scenarios, the scammer collects the phone number
and send a scam message to contact back to the scammer. An innocent customer
may call the scammer assuming that they are talking to the company customer
agent. So, the details like scammer phone number, voice recognition, behavior
patterns, user location etc. can be obtained for tracking the scammers. If the
root cause is found, for example, fake Google Ads in Gift card scheme,
Security incident response team may interact with the team supports Google Ads
to work with Google team for resolution. Google may assist to remove the fake
Ads and implementing the future precautionary steps.

Containment, Eradication, and Recovery: The containment is difficult process
in Gift card scams, as the Scammer already collected the Gift card number and
It’s too late to cancel gift cards. He/She may simply use those gift cards
within few minutes, which leaves the customer or victim to have no idea on how
it happened. However, the wide spread of the scams can be contained by taking
precautionary measures and to fix the root cause. For instance, the fake
google Ads created to reach out to the victim can be dismantled and may cancel
the Google domain names. There is highly likely that the scammer come back
with new google Ads. So, a constant pursues of taking down the Ads could
permanently contain the gift card scams. We may also take additional
countermeasures to monitor the Google Ads when type the relevant key work
searches in google. Eradication involves further follow-ups with FTC and legal
to report the evidence. They may take further actions to work with people in
different country/state jurisdictions and coordinate to track down the scammer
datacenters/locations to completely shut down their operations. But this
requires much more efforts than we can think of. So, depends on the impact of
the scam, the extent of the further actions is taken. Recovery step usually
involves collecting the scammer stolen money from the customers. As the
scammers operate from other countries in most of the time, it may be taken
more than expected to recover the money if possible. If the notable number of
people get impacted, then recovery efforts may be extensively needed. Overall,
it depends on the scale of the scam, the recovery steps will be changes.

Post-Incident Activity: Once the corresponding actions taken to mitigate the
scam incident, The impacted customers are notified the root cause and let them
sink in no involvement of the company. All the customers may be notified for
identifying the scams and providing the awareness of how the scammer may
leverage the company reputation for stealing the customer money. Further, a
thorough investigation of the company misuse in social media and public
internet and take the proper actions to remove those fake posts,
advertisements to protect the people from not being a victim of these scams.

##  VII Future Directions

Security Awareness Training/Education The absolute eradication of the social
engineering scams require educating the users on how to identify the different
type of scams, providing the training on how to use the internet for web
browsing, social network for communications and answering the phone calls
without being impact by the robot or scammer calls. As the scammers mostly
focused on the elder people and people living in rural areas, the scam
awareness training should be provided the most probably impacting people.
Furthermore, the phishing and scam identification education/training should be
included in K-12 school curriculum to prepare the next generation for not
being impacted with scams in the future.

Data Analytics for scammer detection The scammer detection/tracking is a
difficult task, as the little evidence leave by the scammers, and usually
scammers operate from far from the victim nations. The jurisdiction rules and
policies, Ownership issues on owning the scams for investigation when multiple
stakeholders involved in the scams makes it even take a lot of time to resolve
the scam cases. The Machine Learning/Artificial Intelligence (AI) technical
solutions may need to be applied to detect the scam groups, behaviors in
large-scale scams targeting the victims. The scammer advertisements or posts
in the social network, scammer message conversations, scammer email
conversations can be used as a dataset to apply data analytics algorithm and
predict the scammer groups or locations and other information [19] [6] [5].
The applications of data analytics for scammer detection is one of the future
directions going forward to mitigate the scams.

Proactive Scam Information sharing The scammer move quickly to other scams and
change their identities once the scam is successful and the scammer is
financially benefited. It is too late to identify the scammer, if the victim
reports to the official authorities and started investigating the scams. The
jurisdiction issue even makes it almost impossible to catch the scammers. It
requires the mutual support from the two nations and should consider
expediting the investigation process. So, technology may be used for proposing
solutions to proactively sharing the information among the stakeholders and
alerting the probably future targeting victims in advance. For instance, the
blockchain technology may be used for secured data sharing among the
stakeholders, and both private and public organizations react quickly to the
scammer activity.

Phone caller ID Authentication Most of the phone call based scams rely on
robocalls to automate the tasks and let the victim respond to the scammer. The
robocalls usually spoof the phone number and perform the calls to let the
victim think that the calls are legitimate. The phone number identity
authentication needs to be implemented to across all carriers to block the
spoofed phone calls and mitigate some of the scam attempts. US FCC is working
towards STIR/SHAKEN call ID authentication protocol implementation across the
carriers and provided the guidelines for implementation [59] FCC. However,
there is no guarantee that the implementation may stop the spoofed phone
calls, as the scammer may leverage the vulnerabilities in the STIR
implementation in the carrier network and bypass the caller ID authentication.
So, the proper implementation of the STIR protocol across the
telecommunication industry is needed to prevent spoofed phone call based
scams.

##  VIII Conclusion

In this article, we have performed a review of the various social engineering
scams including COVID-19 pandemic scams, which are mainly relying on the human
persuasion by scammer rather than technological aspects like social
engineering phishing email attacks. The existing works on the social
engineering scam technical contributions are discussed and presented a social
engineering attack/scam threat model architecture to represent any social
engineering attack/scam with various core components or devices involved in
the attack/scam life cycle. Additionally, two classic scams such as technical
support scam and the COVID unemployment scam threat models are presented as an
example. For scams awareness in organizations and individuals, we have
leveraged the real time gift card scam targeting organization customers as a
case study and presented a detail description of how the scam is executed by
the scammers. Furthermore, the security incident response guidelines provided
to prepare social engineering scams, which has nothing to do to the technical
aspects and rather prepare the processes within the organization so that these
scams can be prevented sooner and protect the organization reputation and
customer base. We believe that our work can be used as a reference to continue
technical research towards gaps in identifying the scams like cat scam, law
firm, mortgage scam detection/prevention and proposing data analytics based
scam detection solutions. Our work can also be used as a reference for anyone
not to become a victim of the scams in the future.

## References

  * [1] Morvareed Bidgoli and Jens Grossklags.  ’Hello. This is the IRS calling.’: A case study on scams, extortion, impersonation, and phone spoofing.  eCrime Researchers Summit, eCrime, pages 57–69, 2017.
  * [2] Abeer Iftikhar Tahirkheli, Muhammad Shiraz, Bashir Hayat, Muhammad Idrees, Ahthasham Sajid, Rahat Ullah, Nasir Ayub, and Ki Il Kim.  A survey on modern cloud computing security over smart city networks: Threats, vulnerabilities, consequences, countermeasures and challenges.  Electronics (Switzerland), 10(15), 2021.
  * [3] Ryan Heartfield and George Loukas.  A taxonomy of attacks and a survey of defence mechanisms for semantic social engineering attacks.  ACM Computing Surveys, 48(3):1–38, 2015.
  * [4] Fatima Salahdine and Naima Kaabouch.  Social engineering attacks: A survey.  Future Internet, 11(4), 2019.
  * [5] Merton Lansley, Francois Mouton, Stelios Kapetanakis, and Nikolaos Polatidis.  SEADEr++: Social engineering attack detection in online environments using machine learning.  Journal of Information and Telecommunication, 4(3):346–362, 2020\.
  * [6] Merton Lansley, Nikolaos Polatidis, Stelios Kapetanakis, Kareem Amin, George Samakovitis, and Miltos Petridis.  Seen the villains: Detecting social engineering attacks using case-based reasoning and deep learning.  CEUR Workshop Proceedings, 2567:39–48, 2019.
  * [7] FTC.  COVID-19 and Stimulus Reports - Federal Trade Commission — Tableau Public.  https://public.tableau.com/profile/federal.trade.commission#!/vizhome/COVID-19andStimulusReports/Map, 2020\.
  * [8] Andrei Butnaru, Alexios Mylonas, and Nikolaos Pitropakis.  Towards lightweight url-based phishing detection.  Future Internet, 13(6):1–15, 2021.
  * [9] Qian Cui, Guy-Vincent Jourdan, Russell Couturier, and R&d Strategist.  Tracking Phishing Attacks Over Time.  pages 667–676, 2017.
  * [10] Jason W. Clark and Damon McCoy.  There are no free iPads: An analysis of survey scams as a business.  6th USENIX Workshop on Large-Scale Exploits and Emergent Threats, LEET 2013, pages 2–5, 2013.
  * [11] Amin Kharraz, William Robertson, and Engin Kirda.  Surveylance: Automatically Detecting Online Survey Scams.  Proceedings - IEEE Symposium on Security and Privacy, 2018-May:70–86, 2018.
  * [12] Sampsa Rauti and Ville Leppanen.  ’You have a Potential Hacker’s Infection’: A Study on Technical Support Scams.  IEEE CIT 2017 - 17th IEEE International Conference on Computer and Information Technology, pages 197–203, 2017.
  * [13] Najmeh Miramirkhani, Oleksii Starov, and Nick Nikiforakis.  Dial One for Scam: A Large-Scale Analysis of Technical Support Scams.  Technical report, 2016.
  * [14] Youngsam Park, Jackie Jones, Damon Mccoy, Elaine Shi, and Markus Jakobsson.  Scambaiter: Understanding Targeted Nigerian Scams on Craigslist.  Technical report, 2014.
  * [15] Ting-Fang Yen and Markus Jakobsson.  Case Study: Romance Scams.  In Understanding Social Engineering Based Scams, pages 103–113. Springer New York, 2016.
  * [16] George Brandon and Matthew J Ohre.  THE NIGERIAN CHECK SCAM: AN OLDIE REVISITED.  Technical report, 2009.
  * [17] Aude Marzuoli, Hassan A Kingravi, David Dewey, Aaron Dallas, Telvis Calhoun, Terry Nelms, and Robert Pienta.  Call me: Gathering threat intelligence on telephony scams to detect fraud.  BlackHat, 2015.
  * [18] Youngsam Park, Damon McCoy, and Elaine Shi.  Understanding craigslist rental scams.  Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 9603 LNCS:3–21, 2017.
  * [19] Sokratis Vidros, Constantinos Kolias, Georgios Kambourakis, and Leman Akoglu.  Automatic detection of online recruitment frauds: Characteristics, methods, and a public datase.  Future Internet, 9(1):1–19, 2017.
  * [20] Srishti Gupta, Dhruv Kuchhal, Payas Gupta Pindrop, Mustaque Ahamad, Manish Gupta, Ponnurangam Kumaraguru, and Payas Gupta.  Under the Shadow of Sunshine: Characterizing Spam Campaigns Abusing Phone Numbers Across Online Social Networks.  WebSci ’18, 18, 2018.
  * [21] Yangyu Hu, Haoyu Wang, Yajin Zhou, Yao Guo, Li Li, Bingxuan Luo, and Fangren Xu.  Dating with Scambots: Understanding the Ecosystem of Fraudulent Dating Applications.  IEEE Transactions on Dependable and Secure Computing, 5971(c):1–18, 2019.
  * [22] Guillermo Suarez-Tangil, Matthew Edwards, Claudia Peersman, Gianluca Stringhini, Awais Rashid, and Monica Whitty.  Automatically Dismantling Online Dating Fraud.  IEEE Transactions on Information Forensics and Security, 2019.
  * [23] Agari.  Scarlet Widow Breaking Hearts for Profit Part 1: Nigeria-Based Romance Scam Operation Targets Vulnerable Populations.  Technical report, 2019.
  * [24] Sergio Pastrana, Alice Hutchings, Daniel Thomas, and Juan Tapiador.  Measuring eWhoring.  IMC, 15, 2019.
  * [25] Anubhav Chitrey, Dharmendra Singh, and Vrijendra Singh.  A Comprehensive Study of Social Engineering Based Attacks in India to Develop a Conceptual Model.  International Journal of Information and Network Security (IJINS), 1(2), 2012.
  * [26] Huahong Tu, Adam Doupe, Ziming Zhao, and Gail Joon Ahn.  SoK: Everyone Hates Robocalls: A Survey of Techniques Against Telephone Spam.  In Proceedings - 2016 IEEE Symposium on Security and Privacy, SP 2016, pages 320–338. Institute of Electrical and Electronics Engineers Inc., aug 2016.
  * [27] Anjum N. Shaikh, Antesar M. Shabut, and M. A. Hossain.  A literature review on phishing crime, prevention review and investigation of gaps.  SKIMA 2016 - 2016 10th International Conference on Software, Knowledge, Information Management and Applications, (March 2018):9–15, 2017\.
  * [28] Affan Yasin, Rubia Fatima, Lin Liu, Awaid Yasin, and Jianmin Wang.  Contemplating social engineering studies and attack scenarios: A review study.  Security and Privacy, 2(4):1–14, 2019.
  * [29] Ahmed Alzahrani.  Coronavirus social engineering attacks: Issues and recommendations.  International Journal of Advanced Computer Science and Applications, 11(5):154–161, 2020.
  * [30] Rana Alabdan.  Phishing attacks survey: Types, vectors, and technical approaches.  Future Internet, 12(10):1–39, 2020.
  * [31] Sushruth Venkatesha, K. Rahul Reddy, and B. R. Chandavarkar.  Social Engineering Attacks During the COVID-19 Pandemic.  SN Computer Science, 2(2):1–9, 2021.
  * [32] Naci Akdemir and Serkan Yenal.  How Phishers Exploit the Coronavirus Pandemic: A Content Analysis of COVID-19 Themed Phishing Emails.  SAGE Open, 11(3), 2021.
  * [33] Merve Sahin, Aurélien Francillon, Payas Gupta, and Mustaque Ahamad.  SoK: Fraud in Telephony Networks.  In Proceedings - 2nd IEEE European Symposium on Security and Privacy, EuroS and P 2017, pages 235–240. Institute of Electrical and Electronics Engineers Inc., jun 2017.
  * [34] N Mcinnes, E J Zaluska, and G Wills.  Analysis of threats on a VoIP Based PBX Honeypot.  2018\.
  * [35] Sue Yeon Syn and Sanghee Oh.  Why do social network site users share information on Facebook and Twitter?  Journal of Information Science, 41(5):553–569, 2015.
  * [36] Micky Lee.  Google ads and the blindspot debate.  Media, Culture and Society, 33(3):433–447, 2011.
  * [37] Ali Abdallah Alalwan.  Investigating the impact of social media advertising features on customer purchase intention.  International Journal of Information Management, 42(June):65–77, 2018.
  * [38] Payas Gupta, Bharat Srinivasan, Vijay Balasubramaniyan, and Mustaque Ahamad.  Phoneypot: Data-driven Understanding of Telephony Threats.  2015\.
  * [39] Amrit Dhillon.  Indian call centre that cheated Americans of US$14 million gave staff Christmas bonuses — South China Morning Post.  https://www.scmp.com/week-asia/economics/article/3114953/indian-call-centre-cheated-americans-us14-million-gave-staff, 2021\.
  * [40] FOX TV Digital Team.  FTC warns of ‘large scale’ unemployment fraud scam amid coronavirus pandemic.  https://rb.gy/hfsor9, 2020.
  * [41] Glenn Farley.  Washington vows to recover millions in stolen cash from fake unemployment claims — king5.com.  https://www.king5.com/article/news/health/coronavirus/washington-unemployment-fraud-investigation/281-784c21a4-b9d3-4e7b-b9a2-28ea97139996, 2020\.
  * [42] Rajasekhar Chaganti.  An Analysis of Domain Squatting : US 2020 Presidential Election.  2020\.
  * [43] Navid Ali Khan, Sarfraz Nawaz Brohi, and Noor Zaman.  Ten Deadly Cyber Security Threats Amid COVID-19 Pandemic.  TechRxiv Powered by IEEE, (May):1–6, 2020.
  * [44] W5 Official.  W5: Exploring Canada’s costliest romance scam.  https://www.youtube.com/watch?app=desktop&v=v6OKnD9u6bY&ab_channel=OfficialW5, 2020\.
  * [45] Mansi Choksi.  This Indian Cop Took Down a Massive IRS Call-Center Scam.  https://narratively.com/this-indian-cop-took-down-a-massive-irs-call-center-scam/, 2017\.
  * [46] Pleasant Green.  Nigerian Scammer Pays Back His Victim! - YouTube.  https://www.youtube.com/watch?app=desktop&v=y4C4v0A6U7U&ab_channel=PleasantGreen, 2020\.
  * [47] Pleasant Green.  Behind the Mortgage Closing Scam.  https://www.youtube.com/watch?app=desktop&v=SWaZMGSNbKc&list=RDCMUCAPrhJwVweWZA8GEPoClSdw&index=5&ab_channel=PleasantGreen, 2019\.
  * [48] Delta Community Credit Union.  Mortgage Scams Are on the Rise.  https://www.deltacommunitycu.com/knowledge-center/blog/august-2020/mortgage-scams-are-on-the-rise.aspx, 2020\.
  * [49] Pleasant Green.  Illuminati Recruitment Scammer Strikes Back! - YouTube.  https://www.youtube.com/watch?app=desktop&v=LrUiLZxCmr4&list=RDCMUCAPrhJwVweWZA8GEPoClSdw&index=15&ab_channel=PleasantGreen, 2019\.
  * [50] How to Spot an Online Recruitment Scam — Oilfield Job Shop.  https://www.oilfieldjobshop.com/articles/how-to-spot-an-online-recruitment-scam/, 2020\.
  * [51] Tony Romm.  Robocalls reached a peak in October.Congress is now taking action.  https://rb.gy/sdyvle, 2019.
  * [52] Sheila Blackford.  The Fake Law Firm Scam.  https://osbplf.org/inpractice/the-fake-law-firm-scam/, 2020.
  * [53] Brian Roche.  Susquehanna Valley woman loses nearly $1,000 to munchkin cat scam.  https://www.wgal.com/article/woman-loses-nearly-one-thousand-dollars-to-munchkin-cat-scam/37222143#, 2021\.
  * [54] Markus Jakobsson Youngsam Park, Jackie Jones, Damon McCoy, Elaine Shi.  Scambaiter: Understanding Targeted Nigerian Scams on Craigslist.  NDSS, 2020.
  * [55] Ronnie Tokazowski.  A Look into Gift Card Scams as an Emerging BEC Method.  https://www.agari.com/email-security-blog/gift-cards-emerging-bec-method/, 2019\.
  * [56] Monica T. Whitty.  Anatomy of the online dating romance scam.  Security Journal, 28(4):443–455, oct 2015.
  * [57] Gary Warner.  126 Arrests:The Emergence of India’s Cyber Crime Detectives Fighting Call Center Scams.  https://rb.gy/vhsios, 2018.
  * [58] Paul Cichonski, Tom Millar, Tim Grance, and Karen Scarfone.  Computer Security Incident Handling Guide Recommendations of the National Institute of Standards and Technology.  Technical report, 2012.
  * [59] Federal Communications Commission.  Combating Spoofed Robocalls with Caller ID Authentication — Federal Communications Commission.  https://www.fcc.gov/call-authentication.