Skip to main content

The Industrialization of Messaging Scams in the LLM Era

Gilad Gressel ; Rahul Pankajakshan ; Ling Li ; Ivan Franceschini ; Krishnashree Achuthan ; Yisroel Mirsky (2026) — Workshop on security implications of Deepfakes and Cheapfakes (WDC ’26), June 1–5, 2026, Bangalore, India

Citation activity

Total citations · Google Scholar
Unavailable
Average per calendar year
Citation count unavailable

Counts reflect Google Scholar’s coverage and do not measure research quality. Source, calculation and limitations

View Original Source (opens in a new tab)

DOI: 10.1145/3803629.3803676 (opens in a new tab)

Country:   Global
Tags:   Conversational Grooming, Large Language Models, Messaging Scams, Pig Butchering, Romance Baiting, Scam Compounds, Social Engineering, Trajectory Level Detection
What do these research terms mean?
Preprint
A manuscript shared before formal peer review and publication. Check whether a later published version is available.
Dataset
A collection of data or examples for others to inspect or reuse. It can appear in Library search and topic mapping, but RSRC does not use dataset records as evidence in Research Insights.
Dissertation or thesis
Research submitted for an academic degree. This describes its format, not its reliability.
Journal article
An article published in a journal. This label alone does not establish peer review, study quality, or how well the findings apply elsewhere.
Qualitative research
Examines experiences, meanings, or processes, often through interviews or observations. It can explain how something happens without estimating how common it is.
Quantitative research
Uses numerical measurements to describe patterns or test relationships. A relationship between two measurements does not by itself show that one causes the other.
Systematic review
Uses a planned, documented method to find and assess research addressing a question. Its conclusions still depend on the included studies and what the search covered.
Meta-analysis
Statistically combines results from multiple studies. Combining studies does not remove weaknesses in their design or make unlike populations interchangeable.
Not classified
This record has no recognized label in this filter. It does not mean the publication used no method, or that no research exists.

Definitions draw on DataCite resource types; Cochrane review methods; NLM: association and causation. RSRC’s dataset and classification rules are explained in our methodology.

Citation tools
Download RIS Download BibTeX 


              
              

            

          

        


      

      

    

        
Transparency

        
Evidence and review status

        
This page contains AI-generated content. No human content review or subject-matter-expert review is recorded.

    


    

                    

                
Source basis

                

                    Downloaded PDF
                

            

                    

                
Source updates

                

                    No notice found at last check
                

            

                    

                
AI-generated page content

                

                    Yes
                

            

                    

                
Automated checks

                

                    Passed
                

            

                    

                
Administrative approval

                

                    Yes
                

            

                    

                
Human content review

                

                    Not recorded
                

            

                    

                
Subject-matter-expert review

                

                    Not recorded
                

            

            


    

        
            How this was prepared
        
        

                            

                    
Source basis

                    

                    
RSRC downloaded and privately stored a copy of the paper for internal analysis. The PDF is not offered to viewers from this page.


                                            
    
                                                            
  • 
                                    PDF added to RSRC:
                                    
                                
    • 
                                                    

                    
                                        

                

                            

                    
Source updates

                    

                    
No incoming update notice was found in the dated Crossref response. Coverage is incomplete, particularly for corrections and expressions of concern; this is not a guarantee that the source is valid or unchanged.


                                            
    
                                                            
  • 
                                    Last source-status attempt:
                                    
                                
    • 
                                                    

                    
                                        

                

                            

                    
AI-generated page content

                    

                    
AI-generated research notes displayed on this page: Synopsis, Identified gaps, Methods, Limitations, Future work. The paper itself is not described as AI-generated.


                                            
    
                                                            
  • 
                                    Document analysis recorded:
                                    
                                
    • 
                                                            
  • 
                                    Synopsis generation recorded:
                                    
                                
    • 
                                                            
  • 
                                    Page record updated:
                                    
                                
    • 
                                                    

                    
                                        

                

                            

                    
Automated checks

                    

                    
The current, source-bound synopsis passed the recorded versioned publication checks.


                                            
    
                                                            
  • 
                                    Checks completed:
                                    
                                
    • 
                                                    

                    
                                            

                            
                                View passed checks (3)
                            
                            
    
                                                                    
  • Length, completeness, repetition, refusal, boilerplate, and active-markup screening
    • 
                                                                    
  • Numerical claims checked against the available source text
    • 
                                                                    
  • English-source lexical grounding check
    • 
                                                            

                        

                                        

                

                            

                    
Administrative approval

                    

                    
An authenticated administrator approved the bibliographic record for public Library display. This is not a review of every research claim.


                                            
    
                                                            
  • 
                                    Approved for public display:
                                    
                                
    • 
                                                    

                    
                                        

                

                            

                    
Human content review

                    

                    
No human review is recorded for the AI-generated content displayed on this page.


                    
                                        

                

                            

                    
Subject-matter-expert review

                    

                    
RSRC has not recorded review of this content by a subject-matter or methods expert.


                    
                                        

                

                    

    


    

        Review-state definitions

        Found a possible error?
        Request a correction.
    



    



              

        
                  

            
Synopsis

            
This publication examines how large language models (LLMs) are transforming messaging scams into scalable, prolonged, text-based operations. The authors define messaging scams as social-engineering campaigns conducted through ongoing dialogue over text channels, including romance, authority impersonation, investment schemes, and other fraud types. They argue that LLMs enable core advantages for scammers—scalability, multilingual reach, and the ability to tailor tone and tactics in real time—by maintaining many conversations in parallel, translating across languages, and adapting to victims’ responses. To ground their analysis, the authors present a two-pronged approach. First, they systematize a landscape of scam families and delineate a lifecycle and taxonomy that capture the interdependent stages of initiation, framing, grooming, constraint, and extraction. They emphasize that the conversational channel is the mechanism of attack, not merely a medium for fraud, and highlight how automation can centralize labor while preserving human handoffs at critical moments. Second, they report on an insider, field-based study of Southeast Asian scam compounds using 145 interviews with operators and managers conducted between 2022 and 2026. The study reveals organizational structures, labor division, standardized scripts, and extended use of AI specialists who deploy LLMs to polish language, translate content, and generate context-aware replies. The findings suggest that LLM-enabled automation is already reshaping how these scams operate, enabling broader scale and greater consistency, with extraction remaining a high-stakes human activity. The authors discuss defense imperatives, including shifting from per-message detection to trajectory-based monitoring, increasing public awareness and verification norms, and disrupting the financial and infrastructural pipelines that sustain these networks.

          

        
                  

            
Identified Gaps

            
The paper identifies limited attention to LLM-enabled messaging scams and argues that existing content moderation, turn-level detection, and model-side malicious-intent monitoring are poorly suited to long, benign-looking grooming conversations. It highlights the need for defenses that identify behavioral trajectories and cross-channel handoffs rather than isolated suspicious messages.

          

        
                  

            
Methods

            
The study used a qualitative insider investigation of Southeast Asia-based scam compounds. From 2022 to 2026, researchers conducted semi-structured interviews with 145 insiders, including 115 low-level operators and 30 higher-level personnel, plus five victims. Recruitment was purposive and trauma-informed through NGOs, survivor networks, and field contacts. Data were captured in detailed field notes and post-interview memos, then analyzed through iterative thematic analysis; a subset yielded Cohen's kappa of 0.82.

          

        
                  

            
Limitations

            
Evidence relies on self-reported insider accounts, which may involve recall bias or motivated framing. Interviews were not audio- or video-recorded for safety, limiting the available record. Higher-level personnel were constrained by safety considerations and may be underrepresented. Findings focus on Southeast Asia-based compounds and may not generalize to other regions or organizational models. Because 2022–2026 was a period of rapid LLM adoption, observed AI practices may change quickly.

          

        
                  

            
Future Work

            
Research should develop long-horizon, trajectory-level detection for conversational scam patterns; assess user-facing challenge-response and verification tools; and revisit the taxonomy as scam tooling and playbooks evolve. The paper also calls for research on behavioral detection that can distinguish benign rapport from grooming that scaffolds financial exploitation.

          

              

    
    

        
Related Research Insights

        

            See how this publication connects to RSRC's living evidence syntheses through current citations and research-topic mapping.