Inside the Mind of a Cyber Criminal: How Scammers Think and Adapt

Laura Kankaala, Head of Threat Intelligence, F-Secure Cyber criminals have made scamming a trillion-dollar business. As technology and the internet evolve, so do scams, making them the biggest threat consumers face every time they go online or use their phone. While organizations have been trying to keep up with scammers by employing different types of cybersecurity approaches and frameworks, that same focus has been missing in consumer cybersecurity - until now. The cybersecurity industry often focuses on specific instances of scams, like someone pretending to be Brad Pitt on a dating app, or a user accidentally clicking on a malicious social media ad. We also seem to focus a lot on the psychological aspects of a scam, like certain manipulation tricks that are employed. But putting too much focus on individual circumstances of scams can make the problem seem like whack-a-mole, with endless scenarios and unclear solutions. In reality, scams share common tactics—using similar techniques and tools to achieve their goals within a very distinct framework. This framework can be applied to make sense of the threat landscape for everyday internet users. Originating from the military, the term ‘kill chain’ has been historically applied to cyber security. Now, given the threat level scams pose to consumer safety, it’s only fitting to extend it to cover scams targeting consumers too. While there’s no way to completely prevent cyber crime, applying this framework can offer a valuable way of understanding and mitigating the risks. It emphasizes the importance of understanding how these scammers operate, so that preventative measures can be developed and implemented across the industry. Ultimately, you’ll find that there are eight distinct tactics that digital con artists use to choose, approach, and ultimately attack their victims within this kill chain. Beyond the tactics—or goals—it is clear there are techniques that scammers use to accomplish them. Here’s the framework that systematically breaks down tactics and corresponding techniques: Reconnaissance: A collection of techniques scammers use to identify potential targets. Think profiling, phishing, social media scraping, purchasing private data on the dark web, etc. Development: Techniques and tools available to develop the attack before contacting the victim. With AI and other tools now available to the public, scammers have become highly efficient and precise in using this tactic. Gone are the days when only the most technically proficient cyber criminals could pull this off—now, anyone with bad intentions and an internet connection can do it. Contact: Techniques and the variety of digital tools available to establish contact with potential victims. Scammers contact potential victims more often than they realize, whether via text, email, phone calls, dating apps, call spoofing, or other methods. Persistence: Techniques used to keep the scam going, such as using psychological manipulation tricks. Persistence is key when it comes to scammers gaining a victim’s trust and, ultimately, their money or personal data. Access: Techniques to gain access to data or accounts. Sometimes, the victim unknowingly shares their information by misplacing their trust; other times, the scammer steals it with malware. In some cases, there may be no direct interaction at all—data is stolen through breaches or SIM swapping. Exfiltrate: Techniques used to steal data from the victim. This includes C2 (command-and-control) servers, or direct control to the victim’s account through screen-sharing software or email forwarders. Lateral Movement: Techniques and ways scams can spread further, for instance, to the victim’s contacts. The scammer will often try to ‘infect’ other victims by spreading the scam via text, email, social media, or another method. They may also compromise the initial victim’s other online accounts through Password Reset or Single Sign-On features. Monetization: How the threat actors profit from accomplishing all or a subset of the previous tactics. This includes direct bank transfers, cryptocurrency, investment and Ponzi schemes, and selling their victims’ data. This is just a brief overview of the extensive anti-scam knowledge detailed in the scam kill chain framework. By analyzing the framework, patterns in scams that may seem very different on the surface can be identified. For example, investment scams and romance scams often use similar techniques to get victims to invest in fake opportunities. Sharing information about the scam kill chain aims to support the anti-scam industry in its fight against digital fraud, because detailed research is crucial for developing effective defenses.

May 15, 2025 - 18:10

Inside the Mind of a Cyber Criminal: How Scammers Think and Adapt

Laura Kankaala, Head of Threat Intelligence, F-Secure

Cyber criminals have made scamming a trillion-dollar business. As technology and the internet evolve, so do scams, making them the biggest threat consumers face every time they go online or use their phone. While organizations have been trying to keep up with scammers by employing different types of cybersecurity approaches and frameworks, that same focus has been missing in consumer cybersecurity - until now.

The cybersecurity industry often focuses on specific instances of scams, like someone pretending to be Brad Pitt on a dating app, or a user accidentally clicking on a malicious social media ad. We also seem to focus a lot on the psychological aspects of a scam, like certain manipulation tricks that are employed. But putting too much focus on individual circumstances of scams can make the problem seem like whack-a-mole, with endless scenarios and unclear solutions. In reality, scams share common tactics—using similar techniques and tools to achieve their goals within a very distinct framework.

This framework can be applied to make sense of the threat landscape for everyday internet users. Originating from the military, the term ‘kill chain’ has been historically applied to cyber security. Now, given the threat level scams pose to consumer safety, it’s only fitting to extend it to cover scams targeting consumers too. While there’s no way to completely prevent cyber crime, applying this framework can offer a valuable way of understanding and mitigating the risks. It emphasizes the importance of understanding how these scammers operate, so that preventative measures can be developed and implemented across the industry.

Ultimately, you’ll find that there are eight distinct tactics that digital con artists use to choose, approach, and ultimately attack their victims within this kill chain. Beyond the tactics—or goals—it is clear there are techniques that scammers use to accomplish them. Here’s the framework that systematically breaks down tactics and corresponding techniques:

Reconnaissance: A collection of techniques scammers use to identify potential targets. Think profiling, phishing, social media scraping, purchasing private data on the dark web, etc.

Development: Techniques and tools available to develop the attack before contacting the victim. With AI and other tools now available to the public, scammers have become highly efficient and precise in using this tactic. Gone are the days when only the most technically proficient cyber criminals could pull this off—now, anyone with bad intentions and an internet connection can do it.

Contact: Techniques and the variety of digital tools available to establish contact with potential victims. Scammers contact potential victims more often than they realize, whether via text, email, phone calls, dating apps, call spoofing, or other methods.

Persistence: Techniques used to keep the scam going, such as using psychological manipulation tricks. Persistence is key when it comes to scammers gaining a victim’s trust and, ultimately, their money or personal data.

Access: Techniques to gain access to data or accounts. Sometimes, the victim unknowingly shares their information by misplacing their trust; other times, the scammer steals it with malware. In some cases, there may be no direct interaction at all—data is stolen through breaches or SIM swapping.

Exfiltrate: Techniques used to steal data from the victim. This includes C2 (command-and-control) servers, or direct control to the victim’s account through screen-sharing software or email forwarders.

Lateral Movement: Techniques and ways scams can spread further, for instance, to the victim’s contacts. The scammer will often try to ‘infect’ other victims by spreading the scam via text, email, social media, or another method. They may also compromise the initial victim’s other online accounts through Password Reset or Single Sign-On features.

Monetization: How the threat actors profit from accomplishing all or a subset of the previous tactics. This includes direct bank transfers, cryptocurrency, investment and Ponzi schemes, and selling their victims’ data. This is just a brief overview of the extensive anti-scam knowledge detailed in the scam kill chain framework. By analyzing the framework, patterns in scams that may seem very different on the surface can be identified. For example, investment scams and romance scams often use similar techniques to get victims to invest in fake opportunities. Sharing information about the scam kill chain aims to support the anti-scam industry in its fight against digital fraud, because detailed research is crucial for developing effective defenses.