{"id":"https://openalex.org/W7164900522","doi":"https://doi.org/10.48550/arxiv.2606.16052","title":"The Anatomy of Scam Scenarios: Large-Scale Characterization and Conversation-Aware Detection","display_name":"The Anatomy of Scam Scenarios: Large-Scale Characterization and Conversation-Aware Detection","publication_year":2026,"publication_date":"2026-06-14","ids":{"openalex":"https://openalex.org/W7164900522","doi":"https://doi.org/10.48550/arxiv.2606.16052"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.16052","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.16052","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.16052","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5029374880","display_name":"Shang Ma","orcid":"https://orcid.org/0000-0003-4153-5389"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ma, Shang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138738403","display_name":"Chen Yanai","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yanai, Chen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138711733","display_name":"Avichai Ben","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ben, Avichai","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138699274","display_name":"Zichen Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Zichen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5030866270","display_name":"Y. Ye","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ye, Yanfang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5138714860","display_name":"Xusheng Xiao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xiao, Xusheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.6703000068664551,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.6703000068664551,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.19840000569820404,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.017100000753998756,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/pipeline","display_name":"Pipeline (software)","score":0.6018999814987183},{"id":"https://openalex.org/keywords/reuse","display_name":"Reuse","score":0.5552999973297119},{"id":"https://openalex.org/keywords/phone","display_name":"Phone","score":0.4169999957084656},{"id":"https://openalex.org/keywords/scale","display_name":"Scale (ratio)","score":0.35109999775886536},{"id":"https://openalex.org/keywords/taxonomy","display_name":"Taxonomy (biology)","score":0.33149999380111694},{"id":"https://openalex.org/keywords/component","display_name":"Component (thermodynamics)","score":0.31349998712539673}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7480000257492065},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.6018999814987183},{"id":"https://openalex.org/C206588197","wikidata":"https://www.wikidata.org/wiki/Q846574","display_name":"Reuse","level":2,"score":0.5552999973297119},{"id":"https://openalex.org/C2778707766","wikidata":"https://www.wikidata.org/wiki/Q202064","display_name":"Phone","level":2,"score":0.4169999957084656},{"id":"https://openalex.org/C2778755073","wikidata":"https://www.wikidata.org/wiki/Q10858537","display_name":"Scale (ratio)","level":2,"score":0.35109999775886536},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.33739998936653137},{"id":"https://openalex.org/C58642233","wikidata":"https://www.wikidata.org/wiki/Q8269924","display_name":"Taxonomy (biology)","level":2,"score":0.33149999380111694},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.31349998712539673},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.30320000648498535},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.28529998660087585},{"id":"https://openalex.org/C2776175482","wikidata":"https://www.wikidata.org/wiki/Q1195816","display_name":"Transfer (computing)","level":2,"score":0.27889999747276306},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.26429998874664307}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.16052","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.16052","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.16052","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.16052","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.5640544891357422,"id":"https://metadata.un.org/sdg/9","display_name":"Industry, innovation and infrastructure"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Online":[0],"scams":[1],"have":[2],"become":[3],"a":[4,58,74,79,111],"pervasive":[5],"global":[6],"threat,":[7],"causing":[8],"substantial":[9],"financial,":[10],"psychological,":[11],"and":[12,67,124,167,170,179],"operational":[13,22,157],"harm.":[14],"Scammers":[15],"embed":[16],"psychological":[17],"techniques":[18],"(PTs)":[19],"within":[20],"reusable":[21],"schemes":[23],"to":[24,62,77,101,106,136,182],"scale":[25],"scam":[26,43,65,83,113,131,146],"campaigns":[27,185],"with":[28,145],"minimal":[29],"adaptation.":[30],"However,":[31],"existing":[32],"studies":[33],"often":[34],"analyze":[35],"PTs":[36],"as":[37,160],"isolated":[38],"features,":[39],"overlooking":[40],"the":[41],"recurring":[42],"scenarios":[44,66,89,154],"in":[45],"which":[46],"they":[47],"are":[48],"systematically":[49],"deployed.":[50],"To":[51],"address":[52],"this":[53,103],"gap,":[54],"we":[55,72,109],"first":[56],"conduct":[57],"large-scale":[59],"empirical":[60],"study":[61,127],"jointly":[63],"characterize":[64],"their":[68,97],"associated":[69,144],"PTs.":[70],"Specifically,":[71],"develop":[73],"data-driven":[75],"pipeline":[76],"derive":[78],"hierarchical":[80],"taxonomy":[81],"of":[82,86],"scenarios,":[84],"consisting":[85],"18":[87],"fine-grained":[88],"grouped":[90],"into":[91],"6":[92],"high-level":[93],"tactics":[94],"based":[95],"on":[96,128,189],"PT":[98,140],"profiles.":[99],"Furthermore,":[100],"transfer":[102],"scenario-level":[104],"knowledge":[105],"practical":[107],"defense,":[108],"design":[110],"conversation-aware":[112],"scenario":[114],"detection":[115],"approach":[116],"for":[117],"financial-institution":[118],"customer":[119],"interactions,":[120],"enabling":[121],"timely":[122],"warning":[123],"intervention.":[125],"Our":[126],"102,054":[129],"real-world":[130],"incident":[132],"reports,":[133],"spanning":[134],"2024-02-01":[135],"2025-10-31,":[137],"reveals":[138],"that":[139,151],"usage":[141],"is":[142],"significantly":[143],"scenarios.":[147],"We":[148],"further":[149],"show":[150],"scammers":[152],"organize":[153],"around":[155],"different":[156],"goals,":[158],"such":[159],"broad":[161],"victim":[162,165],"exposure,":[163],"high":[164],"conversion,":[166],"high-value":[168],"extraction,":[169],"reuse":[171],"infrastructure,":[172],"including":[173],"IP":[174],"addresses,":[175,178],"domains,":[176],"email":[177],"phone":[180],"numbers,":[181],"launch":[183],"coordinated":[184],"at":[186],"scale.":[187],"Evaluation":[188]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-06-17T00:00:00"}