Explore Research Products in the PAR
It may take a few hours for recently added research products to appear in PAR search results.


Title: Give and Take: An End-To-End Investigation of Giveaway Scam Conversion Rates
The Internet's combination of low communication cost, global reach, and functional anonymity has allowed fraudulent scam volumes to reach new heights. Designing effective interventions requires first understanding the context: how scammers reach potential victims, the earnings they make, and any potential bottlenecks for durable interventions. In this short paper, we focus on these questions in the context of cryptocurrency giveaway scams, where victims are tricked into irreversibly transferring funds to scammers under the pretense of even greater returns. Combining data from Twitter (also known as X), YouTube and Twitch livestreams, landing pages, and cryptocurrency blockchains, we measure how giveaway scams operate at scale. We find that 1 in 1000 scam tweets, and 4 in 100,000 livestream views, net a victim, and that scammers managed to extract nearly $4.62 million from just hundreds of victims during our measurement window.  more » « less
Award ID(s):
2152644
PAR ID:
10594318
Author(s) / Creator(s):
; ; ; ; ; ; ; ;
Publisher / Repository:
Proceedings of the 2024 ACM Internet Measurement Conference
Date Published:
ISBN:
9798400705922
Page Range / eLocation ID:
704 to 712
Format(s):
Medium: X
Location:
Madrid Spain
Sponsoring Org:
National Science Foundation
More Like this
  1. ; ; (, Socio-Technical Aspects in Security and Trust)
    Gross, Thomas; Vigano, Luca (Ed.)
    We present the results of a research study in which participants were subjected to social engineering attacks via telephone, telephone scams, in order to determine the features of scams which peopleare most susceptible to. The study has involved 186 university participants who were attacked with one of 27 different attack scripts which span different independent variables including the pretext used and the method of elicitation. In order to ensure informed consent, each participant was warned that they would receive a scam phone call within 3 months. One independent variable used is the time between the warning and launching the scam. In spite of this warning, a large fraction of participants were still deceived by the scam. A limitation to research in the study of telephone scams is the lack of a dataset of real phone scams for examination. Each phone call in our study was recorded and we present the dataset of these recordings, and their transcripts. To our knowledge, there is no similar publicly-available dataset or phone scams. We hope that our dataset will support future research in phone scams and their detection. 
    more » « less
  2. ; ; ; ; ; (, Proceedings of the International AAAI Conference on Web and Social Media)
    The rapid growth in popularity and hype surrounding digital assets such as art, video, and music in the form of non-fungible tokens (NFTs) has made them a lucrative investment opportunity, with NFT-based sales surpassing $25B in 2021 alone. However, the volatility and general lack of technical understanding of the NFT ecosystem have led to the spread of various scams. The success of an NFT heavily depends on its online virality. As a result, creators use dedicated promotion services to drive engagement to their projects on social media websites, such as Twitter. However, these services are also utilized by scammers to promote fraudulent projects that attempt to steal users' cryptocurrency assets, thus posing a major threat to the ecosystem of NFT sales. In this paper, we conduct a longitudinal study of 439 promotion services (accounts) on Twitter that have collectively promoted 823 unique NFT projects through giveaway competitions over a period of two months. Our findings reveal that more than 36% of these projects were fraudulent, comprising of phishing, rug pull, and pre-mint scams. We also found that a majority of accounts engaging with these promotions (including those for fraudulent NFT projects) are bots that artificially inflate the popularity of the fraudulent NFT collections by increasing their likes, followers, and retweet counts. This manipulation results in significant engagement from real users, who then invest in these scams. We also identify several shortcomings in existing anti-scam measures, such as blocklists, browser protection tools, and domain hosting services, in detecting NFT-based scams. We utilize our findings to develop and open-source a machine learning classifier tool that was able to proactively detect 382 new fraudulent NFT projects on Twitter. 
    more » « less
  3. ; ; ; ; (, Proceedings of the ACM on Human-Computer Interaction)
    Online dating romance scams involve coercing online daters out of their personal property. Money is almost always framed as the target of such scams, however this may be a consequence of prior work's focus on victims from Western countries and scammers from Africa. There is relatively little knowledge of online dating romance scams that occur entirely within non-Western cultures. To address this we conducted an interview study with 20 victims of online dating romance scams in Iran. Findings show that romance scams were seldom motivated by money, but rather sexual access to a woman's body through feigning intent to get married (''body scams''). Body scammers were abetted by cultural rules that justify murder and legal punishment of women for premarital sex, thus forcing them into silence. The paper concludes with calls for more expansive definitions of online dating romance scams and the foregrounding of local cultural dynamics in their perpetuation. Content Warning: This paper discusses sexual violence. 
    more » « less
  4. ; ; (, New Media & Society)
    Good jobs that allow remote work have enabled white-collar professionals to stay home during COVID-19, but for precarious workers, online advertisements for work-from-home employment are often scams. In this article, based on in-depth interviews conducted between April and July 2020 with nearly 200 precarious workers, we find that precarious workers regularly encountered fraudulent job advertisements via digital media. Drawing on Swidler’s concepts of the cultural tool kit and cultural logic, we find that in this time of uncertainty, workers defaulted to the focus on personal responsibility that is inherent in insecurity culture. Following the cultural logic of personal responsibility, job seekers did not place blame on job search websites for allowing the scams to be posted, but normalized the situation, deploying a scam detection repertoire in response. In addition, the discovery that advertised “good jobs” are often scams affecting workers’ desire to continue job hunting and perceptions of potential future success. 
    more » « less
  5. ; (, Electronics)
    Phishing email attacks are among the most common and most harmful cybersecurity attacks. With the emergence of generative AI, phishing attacks can be based on emails generated automatically, making it more difficult to detect them. That is, instead of a single email format sent to a large number of recipients, generative AI can be used to send each potential victim a different email, making it more difficult for cybersecurity systems to identify the scam email before it reaches the recipient. Here, we describe a corpus of AI-generated phishing emails. We also use different machine learning tools to test the ability of automatic text analysis to identify AI-generated phishing emails. The results are encouraging, and show that machine learning tools can identify an AI-generated phishing email with high accuracy compared to regular emails or human-generated scam emails. By applying descriptive analytics, the specific differences between AI-generated emails and manually crafted scam emails are profiled and show that AI-generated emails are different in their style from human-generated phishing email scams. Therefore, automatic identification tools can be used as a warning for the user. The paper also describes the corpus of AI-generated phishing emails that are made open to the public and can be used for consequent studies. While the ability of machine learning to detect AI-generated phishing emails is encouraging, AI-generated phishing emails are different from regular phishing emails, and therefore, it is important to train machine learning systems also with AI-generated emails in order to repel future phishing attacks that are powered by generative AI. 
    more » « less
  • Citation Formats
  • MLA
  • APA
  • Chicago
  • BibTeX
  • Text Encoded Conversion
  • XML
  • Save / Share this Record
  • Send to Email