Threat library · Sourced field guide

Know the script.
Break the spell.

A scam rarely begins with a payment. It begins with a story designed to manufacture trust, fear, shame, urgency, isolation, or hope.

Choose a topic below to recognize the pattern and find a response. Each case keeps its sources, historical context, and reported figures alongside the practical guidance. The checking and monitoring features described elsewhere are still planned.

Core case files

The costume changes.
The pressure repeats.

Scamurai’s detector should look for combinations of verifiable behavior. It should never treat a platform, country, language, age, disability, or relationship as proof of harm.

01

Messaging · Smishing

Scam texts and “wrong number” openings

$470M reported lost · 2024

What it is

A believable alert, offer, delivery problem, toll notice, bank warning, job lead, or accidental message is used to trigger a reply, click, call, credential entry, or payment. “Smishing” is phishing delivered by SMS.

Signals, history and sources

Detection signals

  • Unexpected package, toll, purchase, bank, job, or “wrong number” message
  • Link domain does not match the named organization
  • One-time code, password, card, or identity request
  • Small fee or account-closure threat under a deadline
  • Friendly mistake that pivots to romance, work, or investing

Who faces exposure

Anyone with a phone. Context raises risk: expecting a delivery, actively job hunting, traveling, or responding in a second language. The condition, rather than the person, is the target.

Documented milestone

Security agencies treat smishing as a channel variant of phishing, not a con invented by one culture. In 2024, consumers reported $470 million lost to scams that began by text, more than five times the 2020 figure.

02

Relationships · Investment

WhatsApp romance and relationship-investment fraud

$929.3M IC3 loss · 2025

What it is

A criminal builds affection, friendship, or exclusivity, then invents a crisis or steers the relationship toward a fake crypto, gold, forex, or private investment platform.

Signals, history and sources

Detection signals

  • Rapid affection, exclusivity, or a shared-future script
  • Fast move from a social or dating platform to WhatsApp
  • Repeated inability to meet or verify live
  • Military, travel, medical, visa, or frozen-account crisis
  • Private investment group, fake profits, then withdrawal “taxes”

Who faces exposure

People seeking connection, grieving, isolated, newly divorced, traveling, or exploring investments may receive tailored approaches. Nearly 60% of people reporting a romance-scam loss to the FTC in 2025 said it began on social media.

History, scale, and enforcement

Online romance fraud predates WhatsApp. The FBI recorded nearly 15,000 confidence/romance complaints and over $230 million lost in 2016. IC3 recorded 23,159 complaints and $929.3 million lost in 2025 across all channels. In June 2024, two women were arrested in an alleged scheme involving at least 16 alleged victims and more than $7 million; charges remain allegations until proved.

03

Identity · Social media

Facebook catfishing and borrowed identities

$2.1B social-origin loss · 2025

What it is

Catfishing means presenting a fabricated or stolen identity online. It can lead to romance fraud, investment loss, sexual exploitation, stalking, or emotional harm, but not every fake profile requests money.

Signals, history and sources

Detection signals

  • New account with sparse authentic history
  • Photos or biography inconsistent across sources
  • Immediate intensity and off-platform pressure
  • Refusal of spontaneous voice, video, or independent verification
  • Repeated failed meetings followed by money, image, or access requests

Evidence test

Check account age and history, perform a reverse-image search outside the conversation, ask for a spontaneous non-sensitive verification, and call known contacts through a saved number.

Documented milestone

The FBI was publicly using and defining “catfishing” by December 2013. That is an early authoritative record, not proof that impersonation began then. FTC data show $2.1 billion lost to all social-media-originated scams in 2025; that total is not catfishing loss.

04

Child safety · Online enticement

Grooming, sextortion, and coercive online networks

1.4M NCMEC reports · 2025

What it is

An offender uses shared interests, flattery, gifts, secrecy, sexual conversation, threats, or escalating tasks to exploit a child or teen. It can begin in games, social media, messaging apps, or community servers.

Signals, history and sources

History and major event

NCMEC’s CyberTipline has accepted child-exploitation reports since 1998; Discord is a delivery environment, not the origin of grooming. In April 2025, alleged leaders of the “764” network were charged over conduct said to span late 2020 through early 2025. Charges remain allegations unless proved.

Detection signals

  • Older user pretends to be the child’s age
  • Praise, game currency, food, gifts, or favors build obligation
  • Move to a private room, encrypted app, or adult space
  • Requests for images, private video, secrecy, or an offline meeting
  • Threats of exposure, self-harm tasks, doxxing, or swatting

Who faces exposure

NCMEC reports that teenage boys are frequently targeted in financially motivated sextortion. The FBI says violent online networks deliberately seek children experiencing depression, eating disorders, or suicidal ideation. That is offender targeting, not fault in the child.

05

Family · Caregiving · Elder justice

Older-adult exploitation and grandchild emergencies

$7.748B IC3 loss · 2025

What it is

Strangers may impersonate relatives, banks, police, lawyers, tech support, or romantic partners. Financial exploitation may also come from a trusted caregiver, friend, fiduciary, or relative.

Signals, history and sources

Detection signals

  • Relative claims arrest, crash, injury, kidnapping, or travel crisis
  • Call passes to a supposed lawyer, doctor, police officer, or bondsman
  • “Gag order” or instruction not to tell family or the bank
  • Cash courier, wire, crypto, or gift-card demand
  • New signer, beneficiary, unexplained withdrawal, or caregiver control

History and major case

The FBI says IC3 had received grandparent-scam reports since 2008. In March 2025, prosecutors charged 25 Canadian nationals in an alleged call-center conspiracy said to have taken over $21 million from older Americans in more than 40 states.

Scale without exaggeration

FinCEN analyzed $27 billion in suspicious elder-exploitation activity in filings from June 2022–June 2023. That is not a loss total: it can include attempts, duplicates, transfers, and amendments. About 80% of analyzed filings involved stranger/imposter scams and 20% theft by someone trusted.

06

Banking · Account takeover

Fake fraud departments and “safe account” transfers

Nearly $1B business-imposter loss · 2025

What it is

A supposed bank security team reports suspicious activity, then asks for a one-time code, remote access, or a transfer to “protect” the money. A real bank does not need a customer to move funds into a stranger-controlled safe account.

Signals, history and sources

Detection signals

  • Password reset, MFA change, SIM port, or new recovery method
  • Unknown-device login or sudden account lockout
  • Fraud alert followed by a one-time-code request
  • New payee and rapid wire, ACH, P2P, or crypto transfer
  • Instruction to ignore the number on the bank card

Safe response

End the contact. Call the number printed on the bank card or use the institution’s known app. Ask the fraud team to verify recent security changes and transfers. Report active theft quickly; recovery options narrow with time.

Reported scale

The FTC said people reported nearly $1 billion lost to business impersonators in 2025, with bank impersonators producing the highest losses in that group. IC3 separately approximated 4,700 account-takeover complaints and $359.7 million in loss.

07

Extortion · Reputation

Sextortion, deepfake threats, and professional blackmail

75,000+ IC3 submissions · 2025

What it is

Real, stolen, altered, or fabricated intimate material is used to demand money, more content, access, silence, or another act. A teacher, executive, official, or public figure may face threats aimed at students, parents, boards, voters, coworkers, or media.

Signals, history and sources

Reported scale

IC3 received more than 75,000 sextortion submissions in 2025 and referred over 5,700 involving children to NCMEC. The age rows total about $44.2 million in adjusted loss, but financial loss does not capture safety or psychological harm.

Detection signals

  • Fast request for intimate media or private video
  • Immediate screenshot of followers, school, employer, or family
  • Collage or deepfake paired with an exposure threat
  • Gift-card, P2P, wire, or crypto demand
  • Repeated demand after payment or compliance

Who faces exposure

IC3’s largest 2025 complaint count was ages 20–29; under-20 complainants numbered 11,316. Current authoritative data do not establish that teachers or people in power are the most frequently targeted group, only that public-facing roles can increase threatened reputational harm.

08

Work · Authority · Payments

Business-email compromise and executive impersonation

$3.047B IC3 loss · 2025

What it is

A criminal impersonates or compromises an executive, vendor, school administrator, payroll contact, title company, board member, or trusted professional to redirect a payment or sensitive record.

Signals, history and sources

Detection signals

  • New payment instructions or bank-account change
  • Look-alike domain or altered reply-to address
  • Executive urgency paired with secrecy
  • Payroll, W-2, student, donor, or vendor-data request
  • Request bypasses an established approval path

Evidence test

Verify any payment or credential change through a known phone number and a second authorized person. Compare the full domain, reply-to address, prior invoice details, and known vendor process.

Reported scale

IC3 recorded 24,768 business-email-compromise complaints and $3.047 billion in reported loss in 2025, the second-highest cyber-enabled fraud loss category after investment fraud.

09

Immigration · Language · Authority

Notario, embassy, immigration, and legal-service fraud

1,000+ victims in one 2024 case

What it is

A supposed notario, consultant, travel agent, official, or insider guarantees a visa, work permit, green card, asylum result, tax resolution, or special access, then requests money, original documents, or false forms.

Signals, history and sources

Detection signals

  • Guaranteed legal or immigration outcome
  • Payment for free government forms
  • Blank, false, or untranslated document
  • Threat of arrest or deportation unless paid immediately
  • Gift card, crypto, wire, or P2P demand from an “official”

Documented milestone

The U.S. meaning of “notary public” differs sharply from the legal authority associated with notario in parts of Latin America. That semantic mismatch is the mechanism; culture is not the risk. DOJ issued a national notario warning in July 2009.

Major case

In June 2024, a consultant was sentenced to 63 months after a scheme targeting Spanish- and Haitian Creole-speaking communities involved more than 1,000 victims and over $3.9 million. No authoritative nationwide total specific to immigrants or non-English speakers was located in the primary sources reviewed for this guide.

How scammers adapt to context

Global scripts.
Local costume.

These labels describe documented criminal scripts and enforcement ecosystems, not a nation, culture, language, faith, or diaspora. Scamurai tests the threat, secrecy, identity claim, and transfer pattern.

Authority impersonation

Chinese police, embassy, or consulate script

A delivery company, bank, embassy, or consulate transfers a Chinese-speaking target to fake police. False warrants, nonstop video “monitoring,” secrecy, and bail or proof-of-innocence payments follow.

Detect

Foreign-authority claim, surveillance demand, secrecy, and payment, not Chinese language or nationality.

FBI warning, May 9, 2024
Fear + sleight of hand

Blessing or curse valuables-switch scam

Strangers claim illness, a curse, or misfortune threatens a family, request cash or jewelry for a ritual, switch the bag, then delay inspection. The premise deserves respect; the fraud is the threat, valuables request, secrecy, and switch.

Documented impact

SFPD reported about $374,000 in cash/property losses from late 2025 through January 2026.

SFPD safety guidance
Relationship + investment

Romance baiting from transnational scam centers

Criminal organizations build a friendship or romance before steering a target into a fake investment. INTERPOL’s 2024 assessment dates this scam-center romance-baiting variant to Asia in 2019 and says it expanded during the COVID-19 pandemic; some people forced to work in scam centers are themselves trafficking victims.

Reported impact and major action

IC3 recorded $7.228 billion in cryptocurrency-investment loss in 2025. Not every case was relationship-enabled. On April 23, 2026, DOJ announced charges against two alleged scam-center managers, seizure of 503 fake investment domains, and restraint of about $702 million in cryptocurrency.

INTERPOL 2024 assessment FBI 2025 IC3 crypto trends DOJ action, April 23, 2026
Advance fee

“419,” inheritance, and Spanish lottery variants

The historical “419” label refers to a Nigerian criminal-code provision, not Nigerian people. The FBI says the scheme has been around since the early 1980s. The script promises a prize, inheritance, contract, loan, or transfer, but taxes and certificates must be paid first.

Reported impact and major case

IC3 recorded 7,762 advance-fee complaints and $155.9 million lost in 2025. An FBI 2005 Spanish-lottery warning estimated that one variant sent six million letters and took an estimated $24 million a year. In June 2024, a participant was sentenced in a Nigeria-orchestrated advance-fee scheme involving more than $5.6 million worldwide.

FBI: “419” history FBI Spanish-lottery archive DOJ sentence, June 2024
Prize + repeated fee

Jamaica-linked lottery call-center fraud

An unsolicited prize requires taxes or fees before release. Requests escalate, trusted institutions are impersonated, and some targets are recruited to receive or resend other victims’ money. This is a documented transnational criminal ecosystem, not a trait of Jamaican culture.

Major event

A May 2026 sentence involved a broker who sold seven million older Americans’ records to lottery scammers; documented victim losses exceeded $9.5 million.

DOJ sentence, May 28, 2026
Callback charge

One-ring or “Wangiri” fraud

A robocaller rings once, often at night, to provoke a callback to an international premium-rate number. The useful signals are repeated short calls, an unfamiliar country code, and callback charges, not the apparent country itself.

Documented milestone

The U.S. Federal Communications Commission issued a national one-ring alert on May 3, 2019.

FCC one-ring alert

Who is more susceptible?

Exposure is contextual.
It is not destiny.

Useful protection identifies the leverage a criminal selected. It does not label a group as gullible, unstable, or unsafe.

Situational exposure and protective response
Exploited circumstanceCommon scriptProtective countermeasure
Love, grief, loneliness, or a new relationshipRomance, catfishing, investment pivotIndependent identity check; never let an online-only contact direct investments
Fear for a child, grandchild, or reputationEmergency impersonation, sextortion, blackmailFamily safe phrase; known-number callback; preserve and report instead of paying
Unfamiliar language, law, bank, or immigration systemNotario, embassy, tax, or bank authorityQualified interpreter; independently located official contact; licensed or accredited adviser
Cognitive overload, communication or access barriers, distress, or isolationRepeated calls, coercion, caregiver control, escalating tasksTrusted human review; shorter decisions; visible consent; no identity-based risk score
Public role or access to funds and recordsBEC, payroll diversion, deepfake or reputation threatTwo-person verification; known-channel callback; separate payment and identity approval
Adolescence, online belonging, gaming, or secrecyGrooming, gifts, sextortion, violent online networkNon-blaming conversation; transparent family safeguards; rapid trusted-adult escalation

U.S. report and recovery routes

Speed matters.
Shame helps the offender.

Reporting does not guarantee recovery, but it can preserve options, connect related cases, and protect another person. For active theft, contact the bank or payment provider immediately. For imminent danger, call local emergency services or 911; in the U.S., call or text 988 for suicide or mental-health crisis support.

FTC ReportFraudConsumer scams and recovery steps FBI IC3Cyber-enabled crime and rapid financial reporting NCMEC CyberTiplineSuspected child sexual exploitation NCMEC Take It DownLimit online spread of intimate images taken before age 18 DOJ Elder JusticeAdult Protective Services and elder-abuse reporting help National Elder Fraud Hotline833-372-8311 Emergency servicesImminent danger · Call 911 988 LifelineSuicide or mental-health crisis · Call or text 988

Method before mythology

Dates are documented milestones, not invented birthdays.

Many cons evolve over decades or centuries and have no provable creator. This library says “documented by,” “reported since,” or “publicly warned in” unless a reliable primary source establishes an origin.

Reported loss is not audited prevalence. Complaint totals may omit unreported harm, include duplicates, or use different definitions. Figures below identify the reporting system, year, and scope.

2025 reporting snapshot

One year.
Several views of harm.

FTC, FBI IC3, FinCEN, and NCMEC collect different kinds of reports. Their totals overlap and must not be added together.

1.4MNCMEC online-enticement reports

More than 80,000 concerned sextortion; reports are not confirmed unique victims. NCMEC says expanded provider reporting duties under the 2024 REPORT Act affected the total.

NCMEC 2025 CyberTipline data

See the evidence test in motion

Three stories.
Three safer endings.

The Scamurai comics turn the grandchild call, a borrowed romantic identity, and an online grooming sequence into clear visual case files.

Read the comics Review protection boundaries
Back to top