Scamming

This spring, my partner and I were strolling through the streets of downtown Bangkok, on our way to visit yet another breathtaking temple and then consume our body weight in pad thai. But before we could get there, we were intercepted by a man in a suit who looked Thai but spoke impeccable English. He asked where we were from, what our plans were for the day, and if we wanted any advice from a local about the city. My partner and I glanced at each other, wary of where this strange interaction was headed and consciously keeping one hand on our possessions at all times. 

The man explained that we happened to be visiting during the annual Buddha holiday week, a very special time with lots of opportunities to visit sacred temples that were normally closed to the public, and particularly huge sales for custom-made dresses and suits. He rambled on about how the government helped fund these sales from the designer suit brands and even paid the tuk-tuk drivers to drive people around this week as a way to promote tourism. In the moment, we were both incredibly skeptical, and looking back, we had every right to be. So far, this man had brought up many of the main hallmarks of a good scam: this was a special, once-in-a-blue-moon opportunity, we were essentially pulled off the street by sheer good fortune, and it seemed too good to be true (it usually is). 

Although we were suspicious of this obvious scam, we were also incredibly curious about where this situation was headed. I would certainly not recommend engaging with anyone who seems to be scamming you, and we were admittedly naive to the very real dangers of the situation, although we somehow felt less vulnerable knowing that we were being targeted. We ended up getting in a tuk-tuk with a second man who “happened to be” driving by at the perfect moment to pick us up and take us to the place the first man had recommended (the two were obviously in cahoots but we couldn’t figure out why or how), getting dropped off at a temple, and meeting a third man who conspicuously brought up the same suit sales that the first man had discussed. That was enough to get us to Google the situation, where we discovered that we were living out one of the most common scams in Thailand. 

Through a complex web of deception, huge groups of scammers typically work together to target tourists and channel them through a procession of people who each play a role in the chain of events, eventually funneling them to a location where they’re tricked into purchasing fraudulently labelled goods (often silks and tailored suits, like the man on the street had promised us) or even fake airline tickets or tourism passes. In the worst cases, victims are robbed violently or even taken hostage. Luckily for us, we were able to walk away with minimal harassment.

Scams like this thrive because they prey on the very qualities that make us human: curiosity, trust, and the tendency to believe in serendipity when we’re far from home. At its core, scamming involves deliberate acts of deception designed to manipulate people emotionally, cognitively, and often socially, into giving up money, personal information, or control. They come in endless varieties, from the charming tuk-tuk driver and the “helpful” local in Bangkok to high-tech voice-cloning vishing attacks and AI-generated crypto schemes. What unites them all is their reliance on behavioral psychology: scammers exploit heuristics like authority, scarcity, and urgency to override our critical thinking. In this article, we’ll unpack how scams work, explore their devastating impacts, examine what behavioral science can teach us about how to resist them, and uncover how society as a whole can do a better job of stopping them.

Social Engineering: The psychological manipulation of people into performing actions or divulging confidential information, often the foundation of modern scams.

Phishing: A deceptive technique used by malicious actors to trick individuals into revealing sensitive information such as passwords, credit card numbers, or personal data by posing as a trustworthy entity via email, websites, or messages. 

Vishing: Short for “voice phishing,” this is when scammers call pretending to be a trusted entity to trick victims into giving up sensitive information.

Smishing: A mashup of “SMS” and “phishing,” referring to scams delivered via text messages designed to lure victims into clicking malicious links.

Authority Bias: A cognitive bias where people are more likely to comply with requests from perceived authority figures—a favorite lever for scammers posing as banks or government agencies.

Urgency Cues: Psychological tactics that create a sense of time pressure (“Act now or lose access!”), reducing critical thinking in victims.

Spoofing: A technique where scammers fake phone numbers, emails, or websites to make them look legitimate and bypass suspicion.

Cognitive Load: The mental effort required to process information. Scammers often strike when targets are overloaded, distracted, or emotionally vulnerable.

Multi-Factor Authentication Fatigue: A growing phenomenon where users get tired of security prompts, making them more likely to bypass safeguards (or fall for fake verification requests).

Non-Punishment Principle: A legal standard asserting that trafficking victims forced into scam work should not be prosecuted for crimes committed under coercion.

Digital Trust Erosion: The societal phenomenon where constant scams make people suspicious of legitimate communications, leading to missed calls, emails, or even medical appointments.

Nowadays, it seems like everyone is talking about scamming, its risks, and how to protect ourselves (and our children, employees, parents, and grandparents) from scams. Although there are certainly a lot of new types of digital scams, the act of attempting to deceive someone else for personal gain is a tale as old as time. 

Just think back to the Greek myth of the Trojan Horse, wherein the Greeks, unable to conquer the city of Troy after a long siege, built a giant wooden horse and left it outside the city gates as a supposed gift. They pretended to sail away, but they’d secretly left a few soldiers hidden inside the horse. The Trojans believed the horse was a victory offering and brought it inside the city walls, which allowed the hidden Greek soldiers to emerge and open the city gates for the returning Greek army. This is a textbook example of the basic premise of a scam, digital or otherwise, and the term “Trojan horse” is even used colloquially to describe something that appears harmless or even beneficial on the surface, but conceals a hidden danger or malicious intent. 

Thus, scamming has existed for centuries, but it wasn’t until the 1980s that digital-era phone scamming gained traction. Fraudsters leveraged telecom loopholes to trick victims into costly calls. The 1990s brought the first phishing programs like AOHell, targeting AOL accounts and setting the stage for scripted impersonation schemes.¹ For children (and adults) watching U.S. TV in the 80s and 90s, ads were used to trick people into dialing expensive 1-900 numbers, charging an absurd amount for every minute spent on the phone. The premise was that the stations could either provide incredibly low-quality content over the phone and charge people by the minute, or simply trick children into calling the expensive phone numbers, leaving their parents to discover a large phone bill down the line.²

The term “vishing” emerged in 2006, as Voice over Internet Protocol (VoIP) technology enabled scammers to spoof caller IDs and scale phone-based fraud with alarming ease. Baseline scams included robocalls warning of fraudulent bank activity, which is a common phone scam exploiting trust in familiar numbers and authoritative voices. Between 2011 and 2014, two Romanian hackers, Costea and Dumitrescu, ran automated vishing and smishing operations targeting thousands across the U.S., netting over $18 million in stolen bank details. Their operation used voice-response systems and spoofing to harvest millions of financial credentials, highlighting the maturation of vishing into an industrial-scale crime.³

On July 15, 2020, chaos erupted on Twitter (as it often does) when several high-profile accounts, including those of Barack Obama, Elon Musk, Apple, and major cryptocurrency companies, were hijacked in a coordinated cyberattack. For hours, the world watched as hackers tweeted out a simple “double your Bitcoin” scam from verified accounts, luring unsuspecting followers into sending over $118,000 in cryptocurrency.⁴ The hack wasn’t pulled off with cutting-edge malware or sophisticated exploits, but instead, the perpetrators (led by a 17-year-old hacker) used vishing. They called Twitter’s IT support, posed as company staff, and tricked employees into handing over credentials for internal tools that granted access to any user account.

The incident exposed just how fragile even the biggest platforms can be in the face of social engineering, and Twitter (now X), a $37 billion tech giant with over 330 million active users, became a cautionary tale of how our trust in authority, fear of breaking company processes, and a multitude of other biases can actually help hackers bypass even the strongest digital defenses.⁴ If attackers could manipulate help desk staff into handing over the keys to one of the world’s largest social networks, the potential for market manipulation, election interference, or any other type of major geopolitical disruption is chilling. Thus, the hack sparked widespread calls for stricter cybersecurity standards for systemically important platforms and highlighted how easily a voice on the other end of the line can become a weapon in the hands of adversaries.

Cybersecurity researcher Mark Collier, who specializes in telecom fraud, began working on anti-spoofing technologies during this period. Collier helped develop STIR/SHAKEN, a framework designed to authenticate caller IDs and block spoofed numbers.⁵ Unfortunately, deployment was slow, and scammers stayed one step ahead by shifting tactics, often blending vishing with smishing (SMS phishing) and email phishing for multi-pronged attacks. Meanwhile, Jessica Barker, a cybersecurity advocate with a focus on human behavior, was one of the first to highlight that technology alone wouldn’t solve the problem. In her 2015 talks, Barker argued that authority bias, our tendency to trust someone who sounds official, was a key vulnerability scammers exploited. She began designing user education campaigns that encouraged people to pause and question even the most confident voices on the line.⁶

In September 2024, researchers introduced ViKing, a proof-of-concept AI-powered vishing attack that used conversational bots to successfully extract sensitive information from participants, demonstrating that voice-based scams can now be automated at scale.⁷ Simultaneously, some sources say that since 2020, phishing and scam activity have increased 95%, with millions of new scam pages popping up every month.⁸ As access to AI tools increases, so does the potential for digital and AI scams, which can be produced faster, more convincingly, and at a larger scale. Looking ahead, the challenge will be finding ways to advance scam and fraud-detection technology to keep up with the pace of scammers’ endeavors.

Teodor Costea 

A Romanian hacker who co-led a massive vishing and smishing scheme from 2011–2014, stealing over 36,000 financial account numbers and causing $18 million in losses before being extradited to the U.S. and sentenced to 8 years in prison.³

Robert Dumitrescu

Costea’s partner in the operation, Dumitrescu helped deploy automated calls and texts impersonating banks, compromising thousands of accounts and earning a 7-year U.S. prison sentence after his 2018 extradition.³

Mark Collier 

A cybersecurity expert who’s been tracking the evolution of vishing and helped develop anti-spoofing technologies in the 2010s.⁵

Jessica Barker

A behavioral science-focused cybersecurity advocate who has highlighted why human psychology is the weakest link in preventing vishing.⁶

Scams are bad. That much is clear. Distinguishing between the financial, emotional, and social impacts of different scams can be an exhausting process in itself, as many scams impact us in a multitude of interconnected ways. With more and more technology available at our fingertips, and with the spread of AI and cryptocurrency, scam artists now have even more opportunities to not only deceive people but also hijack their life savings with the click of a button. 

Financial consequences of scams

Scamming extracts serious financial costs, both for individuals and organizations, and this is especially apparent when it comes to vishing (voice phishing, where scammers use fake voices or real calls to phish for personal data). According to FBI data, over 20,000 vishing-related complaints were reported in 2022 alone, resulting in more than $530 million in losses.9 At the corporate level, experts estimate that a single successful vishing attack can cost an average of $123,000, not to mention damage from investigations, reputational fallout, and disrupted workflows.⁹ Alarmingly, projections suggest global losses from vishing and related scams could surpass $2.5 billion by 2025.⁸

Hidden beneath these headline figures, however, is the chaos of stolen retirement savings, drained bank accounts, and shattered investment plans. Consider the extreme case of a Texas retiree who was duped out of $250,000 via a vishing-based crypto fraud, nearly wiping out his life savings.¹⁰ Even smaller losses are devastating: a typical vishing victim reports losing around $9,700 per incident.⁸ These financial wounds often go beyond the numbers on a bank statement; they can ripple into long-term debt, ruined credit, and eventually bankruptcy. Research consistently shows that the severity of the emotional impact, not just the dollar amount, determines the long-term harm, with losses triggering mental health issues and decreased trust in institutions.

Emotional harm and the degradation of societal trust 

The emotional toll of scamming can manifest in a number of ways. Victims commonly report symptoms like shame, self-blame, anxiety, depression, and even PTSD after realizing they've been manipulated. One poignant case involved a UK resident who lost £80,000 after falling for a vishing scam where the caller claimed they were from the bank. The victim described a feeling of mental disintegration and psychological devastation, comparing it to being clubbed around the head.¹¹ 

Studies show that other fraud victims often internalize the blame: 61% in one U.S. survey reported labeling themselves “too trusting,” while 47% felt personally at fault.12 This self-blame can deter reporting, making the problem invisible and perpetuating the stigma. AARP found that two-thirds of American scam victims experienced negative emotional effects, ranging from sleep issues to a profound loss of self-worth.¹² The ripple effects extend to relationships, too; in cases of romance (sometimes known as “pig-butchering” scams), betrayal trauma can destroy families and social support systems, making recovery even harder.¹²

Beyond personal harm, scamming erodes collective trust in communication systems and weakens the social contract. In some countries, over 50% of phone calls are now scam attempts, creating a phenomenon called “call fatigue” where users simply stop answering the phone, even for legitimate requests, because they’re so tired of answering and talking to a robot or scammer.¹³ Behavioral psychologists call this “signal-to-noise overload” or “digital trust erosion,” where people become desensitized or outright suspicious of all voices on the line. This refusal can delay essential services because people miss real fraud alerts, postpone medical appointments, or ignore emergency updates. 

To counteract this, businesses and institutions have implemented some systemic safeguards, and many firms now offer anti-vishing training. However, only around 30% of people targeted in some scams report to authorities, and only around 4% of victims recover their losses, so there are huge segments of the population who are likely still quite vulnerable.¹³ Similar to how many people have developed call fatigue, some experience multi-factor authentication fatigue, where their attempts to strengthen the security of their devices with multi-factor authentication have led to an overabundance of passwords and security measures. If people get too tired or frustrated from juggling so many passwords, they may end up with even less protection in response.

Crypto scams

Cryptocurrency was supposed to democratize finance by offering an open, decentralized system where anyone could participate, but in practice, it’s become fertile ground for scammers who exploit the novelty and complexity of digital assets. It seems like every time you open social media, there’s a new cryptocurrency being hyped up (and every time you open the news, a new currency that’s gone bust). Behavioral science helps explain why crypto scams are so effective: they prey on cognitive biases like overconfidence, FOMO, authority bias, and our tendency to trust systems we don’t fully understand.

Recently, two main types of crypto schemes have become almost routine in crypto markets. The first is the rug pull, where developers promote a new project to attract investor funds, then suddenly abandon or shut down the project, taking the investors' money with them and leaving them with worthless assets. A 2021 report from Chainalysis found that rug pulls alone accounted for $2.8 billion in investor losses in that year.¹⁴ In pump and dump schemes, scammers manipulate the stock market the same way they do in any non-crypto stock market scam, artificially inflating the price and then selling everything overnight. Scammers also exploit the decentralized and pseudonymous nature of blockchain: once funds are transferred, they’re nearly impossible to recover. Unlike traditional banks, there’s no fraud hotline to call and no centralized authority to reverse a transaction.¹⁴

And then there’s crypto phishing, which can involve vishing and smishing as well as other spoofing attempts. Scammers call or text crypto investors posing as exchange support staff, warning of “suspicious activity” and urging them to hand over login credentials or recovery phrases.¹⁴ Once armed with this information, the scammers drain wallets and vanish into the anonymity of blockchain mixers. These tactics leverage psychological principles like urgency bias (the belief that immediate action is required) and authority bias (trusting someone who sounds official).

The explosion of deepfake technology only raises the stakes. In one 2023 case, scammers used an AI-generated video of Elon Musk promoting a fake crypto giveaway to lure in victims.16 This is even more sinister because we know from research that humans are hardwired to trust faces and voices, making us especially vulnerable when social engineering intersects with emerging technologies.¹⁶

To combat these scams, regulators are scrambling to catch up. The U.S. Federal Trade Commission reported over $1 billion in crypto-related scam losses between 2021 and 2022, with nearly half of those incidents originating on social media platforms.¹⁷ Some behavioral researchers argue for more “pre-bunking” campaigns, which are educational efforts that teach potential victims how scams work before they encounter them. Studies show that inoculating people with knowledge about common persuasion tactics can significantly reduce their likelihood of falling for fraud.¹⁷ But as long as crypto remains an opaque, hype-driven ecosystem, scammers will have no shortage of psychological levers to pull.

Scamming, like any other crime, is controversial because it usually involves one person hurting or taking advantage of another. But for some scams, figuring out how we protect victims and prosecute criminals can be more complicated than what meets the eye. In a world where scammers are sometimes victims themselves, how do we decide who is at fault, and how do we know when to comply with a scammer’s request, even if it means protecting ourselves? 

The non-punishment principle in times of crisis 

As scam operations grow in scale and sophistication, a darker truth has emerged: not all scammers are willing participants. In Southeast Asia, sprawling scam call centers often rely on trafficked workers who are lured in by fake job ads and then trapped under threat of violence. Once inside these compounds, passports are confiscated, physical abuse is rampant, and victims are forced to make thousands of scam calls under constant surveillance. But when law enforcement agencies raid these centers, the distinction between perpetrator and victim often vanishes. Trafficked workers are frequently arrested alongside their captors and charged with cybercrime or fraud, a practice that human rights groups argue violates international law.¹⁸

Central to this debate is the United Nations Office on Drugs and Crime’s (UNODC) Non-Punishment Principle, which states that trafficking victims should not be prosecuted for crimes they were coerced into committing.¹⁸ In theory, this protects victims from double victimization. In practice, only a handful of countries in Southeast Asia explicitly uphold it. In Cambodia, Myanmar, and Laos (which are key hubs for scam operations), anti-trafficking laws are either vague or narrowly applied, leaving many victims in legal limbo. Behavioral scientists point out that law enforcement may be unconsciously swayed by authority bias and stereotypes of what a “real” trafficking victim looks like, making it harder to recognize individuals who don’t fit familiar narratives (e.g., young men with tech skills forced to run crypto scams).¹⁸

This legal and ethical gray area has ripple effects far beyond the individuals involved. Survivors who are criminalized are less likely to cooperate with investigations, making it harder to dismantle the transnational networks behind these operations. Some experts call for survivor-centered approaches, including specialized training for police to recognize behavioral cues of coercion and trauma.¹⁸ But until these protections are codified into law and enforced, the line between scammer and victim will remain dangerously blurred, fueling cycles of exploitation rather than breaking them.

Blaming the victim: Is “user vigilance” a fair expectation?

As with many crimes, a recurring point of contention in the fight against scams is where responsibility lies and whether it’s fair to expect individuals to serve as their own line of defense. Public awareness campaigns routinely emphasize the need for users to be vigilant, reminding people not to click suspicious links, to verify what they’re doing or who they’re talking to before trusting them, and even to hang up if something feels off. And while these messages are well-intentioned, behavioral scientists argue they rest on a flawed assumption: that humans can stay in a state of hyper-alertness all the time.¹ In reality, people are busy, distracted, and wired for trust, which are traits that scammers are experts at exploiting. Concepts like authority bias and urgency cues are baked into human cognition, which means even highly educated, tech-savvy individuals can fall prey.

Critics say this “personal responsibility” framing conveniently shifts blame away from the institutions that design the vulnerable systems in the first place. Telecom companies, banks, and tech platforms often argue they’ve provided users with the necessary tools like two-factor authentication, fraud alerts, and spam filters, but they leave the burden of spotting scams to end users.¹ This dynamic becomes even more troubling when victims are treated with suspicion by banks or insurers after reporting losses, leading to underreporting and deepening the shame that many victims already feel. When we zoom out to take a more systems-level perspective on the issue, we can see where some of the inconsistencies lie in terms of public health and safety. For example, we don’t expect people to build their own seatbelts or design their own fire alarms, so why do we expect them to be their own cybersecurity team?

Ransomware payments: Should governments and companies pay scammers?

To me, it seems like most action movies where someone is kidnapped or blackmailed involve someone paying the ransom or pretending to and then somehow scamming the scammer. In real life, it’s actually a very tricky question about whether victims, and especially large organizations, should ever pay scammers to recover stolen data or regain access to locked systems. Supporters of paying argue that in some cases, ransom payments are the only way to prevent catastrophic consequences. When hospitals lose access to patient records or energy grids grind to a halt, the pressure to resolve an attack quickly can feel overwhelming. A notable example came in 2021, when Colonial Pipeline, which supplies nearly half of the fuel for the U.S. East Coast, paid a $4.4 million ransom after a ransomware attack disrupted fuel delivery and caused mass panic buying. Company leaders later explained that they felt they had no choice given the potential societal fallout.¹⁹

Critics, however, warn that these payments act like oxygen for the ransomware economy, directly funding organized criminal groups and emboldening them to launch even more attacks. Law enforcement agencies like the FBI and Europol have repeatedly cautioned against paying ransoms, pointing to cases where victims never regained access to their data or were hit with additional demands after payment. In some instances, paying up has made organizations a target for repeat attacks because it signals they are willing to negotiate.⁹ This has led to calls for bans or strict regulations on ransom payments. For example, Australia and the U.S. have both explored laws prohibiting companies from paying cybercriminals, while some cybersecurity experts argue for mandatory reporting of any ransom payment to prevent under-the-table deals.⁹

But this hardline approach isn’t without risks. If ransom payments are banned outright, some victims might avoid going to law enforcement entirely, fearing legal or reputational consequences. This could leave attacks underreported and make it harder for authorities to track and dismantle criminal networks. Behavioral scientists add another layer to the debate, noting that decision-making under conditions of extreme stress (like a major cyberattack) can skew toward short-term solutions. Companies facing public outrage and financial losses may feel an irresistible pull to make the problem go away, even if it undermines broader cybersecurity efforts.

As ransomware gangs evolve their tactics, demanding payments in cryptocurrencies and using sophisticated social engineering schemes like vishing to infiltrate systems, the stakes are only growing. The controversy over ransom payments underscores a broader question: how do we balance immediate harm reduction with long-term deterrence in a digital world where the line between victim and enabler is increasingly blurry?

The infamous OneCoin crypto scam

The OneCoin scam stands as one of the largest and most notorious cases of cryptocurrency fraud in recent history. Launched in 2014 by Ruja Ignatova, OneCoin was marketed as a revolutionary digital currency poised to rival Bitcoin and other legitimate cryptocurrencies.²⁰ The scheme attracted millions of investors worldwide by promising huge returns through buying OneCoin tokens and recruiting others into a multi-level marketing structure. However, unlike genuine cryptocurrencies, OneCoin had no blockchain or verifiable ledger. Essentially, it was a Ponzi scheme disguised as innovative technology.²⁰

The scam’s business model relied heavily on social engineering and exploiting the trust of individuals eager to participate in the booming crypto market. Investors were lured in with slick presentations, seminars, and claims of proprietary technology that was “too complex” for outsiders to understand. Instead of transparency, OneCoin operators created an opaque system where the tokens held no real value and withdrawal of funds was nearly impossible.²⁰ As people recruited others, the flow of new money kept the illusion alive, but eventually, the scheme collapsed under regulatory scrutiny and law enforcement actions across multiple countries.²⁰

The fallout from OneCoin was immense, with estimated losses exceeding $4 billion globally.²⁰ Ruja Ignatova disappeared in 2017 and remains at large, earning the nickname “Cryptoqueen.” Meanwhile, other key figures have faced arrest and prosecution, but many victims have struggled to recover their investments.²⁰ The OneCoin case highlights how scammers can manipulate emerging technologies and human psychology, particularly greed and trust, to perpetrate sophisticated frauds. It also underscores the importance of due diligence, regulation, and education in protecting investors from too-good-to-be-true cryptocurrency schemes.

Everything that was En-wrong with Enron

In the late 1990s and early 2000s, Enron was hailed as a darling of corporate America, a “new economy” energy company that seemed to turn everything it touched into gold. But behind the glossy earnings reports and sky-high stock price was an elaborate house of cards. Enron’s leadership, including CEO Jeffrey Skilling and CFO Andrew Fastow, employed a web of deceptive accounting practices like “mark-to-market” accounting and shell corporations (called Special Purpose Entities) to hide massive debt and inflate profits.²¹ These tactics allowed Enron to report billions in revenue that didn’t actually exist, luring investors and employees into thinking the company was thriving. Behavioral economists would call this a textbook example of “information asymmetry” and, once again, authority bias, as people trusted Enron because auditors, analysts, and even regulators gave it their blessing.

The scam unraveled in late 2001 when whistleblowers within the company and investigative journalists began pulling at the loose threads. As Enron’s true financial condition came to light, the company’s stock plummeted from over $90 a share to less than $1 within months, wiping out $74 billion in shareholder value.21 Thousands of employees lost their jobs and pensions, while major auditing firm Arthur Andersen, which was Enron’s supposed watchdog, was implicated in shredding incriminating documents and subsequently collapsed.²¹ This wasn’t just a corporate failure; it was also a psychological failure, as entire systems of oversight succumbed to groupthink, greed, and willful blindness.

The fallout was seismic. Enron became a catalyst for sweeping reforms, most notably the Sarbanes-Oxley Act of 2002, which tightened corporate governance and accounting oversight. It also sparked a reckoning about ethical culture in organizations: how charismatic leaders can weaponize trust, how employees can be silenced by fear, and how investors can be dazzled into abandoning due diligence.²¹ From a behavioral science perspective, the Enron scandal illustrates the power of social proof and overconfidence bias because, as long as everyone else believed the myth of Enron, it was hard to question it. But once the spell broke, it became one of the most infamous cautionary tales in corporate history.

Cybersecurity training for employees: How to teach behaviorally-informed counter strategies 

Most scams, including cyber scams, involve taking advantage of cognitive bias vulnerabilities. This article explores why employee training shouldn’t just focus on sharing information; it should help build better and behaviorally-informed habits for combating scam attempts.

What is phishing?  

One of the most common types of online scams is known as phishing, where malicious actors trick people into revealing sensitive information such as passwords, credit card numbers, or personal data. This article explains the background of phishing, including its history, impacts, and ways to protect yourself and loved ones against these types of scams. 

1. Rader, Marc & Rahman, Shawon. (2015). Exploring Historical and Emerging Phishing Techniques and Mitigating the Associated Security Risks. International Journal of Network Security & Its Applications. 5. 10.5121/ijnsa.2013.5402. 
2. Raviv, S. (2016, October 4). The rise and fall of the 1‑900 number. Priceonomics. https://priceonomics.com/the-rise-and-fall-of-the-1-900-number/
3. U.S. Department of Justice. (2018, December 4). Two Romanian citizens extradited to Atlanta face cyber and fraud charges in connection with internet‑based bank fraud scheme targeting U.S. victims. https://www.justice.gov/usao-ndga/pr/two-romanian-citizens-extradited-atlanta-face-cyber-and-fraud-charges-connection
4. Department of Financial Services, Berman, J., Blattmachr, J., Brookes, D., & Emami, S. (2020, October 14). Twitter Investigation Report. Department of Financial Services. https://www.dfs.ny.gov/Twitter_Report  
5. Figueiredo, J., Carvalho, A., Castro, D., Gonçalves, D., & Santos, N. (2024). On the Feasibility of Fully AI-automated Vishing Attacks. ArXiv. https://arxiv.org/abs/2409.13793
6. Heynen, N. (2024, September 11). AI-powered scams: How to protect yourself in the age of artificial intelligence. IT @ UW–Madison. https://it.wisc.edu/news/ai-powered-scams-how-to-protect-yourself-2024/
7. Wang, S., Delavar, M., Azad, M. A., Nabizadeh, F., Smith, S., & Hao, F. (2023). Spoofing against spoofing: Toward caller ID verification in heterogeneous telecommunication systems. ACM Transactions on Privacy and Security, 27(1), Article 1. https://doi.org/10.1145/3625546 
8. Avast Security News Team. (2019).Voice fraud scams company out of $243,000. Avast. https://blog.avast.com/deepfake-voice-fraud-causes-243k-scam 
9. Federal Bureau of Investigation. (2022, May 4). Business Email Compromise: The $43 billion scam (I-050422-PSA). https://www.ic3.gov/PSA/2022/psa220504
10. Fox Kansas News. (2024, June 17). Retired Texas man loses over $250,000 in elaborate cryptocurrency scam. Fox Kansas News 
11. Whitworth, D. (2024, May 7). Fraud victim’s 18-month fight for £80,000 refund. BBC News. https://www.bbc.com/news/business-68846176  
12. Ianzito, C. (2022). Many victims struggle with mental health in scams' aftermath. AARP. https://www.aarp.org/money/scams-fraud/mental-health-impact/
13. Rogers, S. (2024, November 7). International scammers steal over $1 trillion in 12 months in Global State of Scams Report 2024. Global Anti-Scam Alliance. https://www.gasa.org/post/global-state-of-scams-report-2024-1-trillion-stolen-in-12-months-gasa-feedzai
14. Chainalysis Team. (2021, December 16). The biggest threat to trust in cryptocurrency: Rug pulls put 2021 cryptocurrency scam revenue close to all-time highs. Chainalysis. https://www.chainalysis.com/blog/2021-crypto-scam-revenues/
15. Tidy, J. (2021, March 15). Bitcoin: Fake Elon Musk giveaway scam 'cost man £400,000'. BBC News. https://www.bbc.com/news/technology-56402378 
16. Thompson, S. A. (2024, August 14). How ‘Deepfake Elon Musk’ became the internet’s biggest scammer. The New York Times. https://www.nytimes.com/interactive/2024/08/14/technology/elon-musk-ai-deepfake-scam.html
17. Federal Trade Commission (FTC). (2023). Consumer Sentinel Network data book 2022. https://www.ftc.gov/system/files/ftc_gov/pdf/CSN-Data-Book-2022.pdf 
18. Miller, C., & Koser, K. (2024, June 12). Cyber scamming goes global: Sourcing forced labor for fraud factories. Center for Strategic and International Studies (CSIS). https://www.csis.org/analysis/cyber-scamming-goes-global-sourcing-forced-labor-fraud-factories 
19. Eaton, C., & Volz, D. (2021, May 19). Colonial Pipeline CEO tells why he paid hackers a $4.4 million ransom. The Wall Street Journal. https://www.wsj.com/tech/cybersecurity/colonial-pipeline-ceo-tells-why-he-paid-hackers-a-4-4-million-ransom-11621435636
20. U.S. Department of Justice. (2023, September 12). Co-founder of multibillion-dollar cryptocurrency scheme “OneCoin” sentenced to 20 years in prison. https://www.justice.gov/usao-sdny/pr/co-founder-multibillion-dollar-cryptocurrency-scheme-onecoin-sentenced-20-years-prison
21. Bondarenko, P. (2025, June 20). Enron scandal. Encyclopedia Britannica. https://www.britannica.com/event/Enron-scandal