The Outlier Lab

Scam Victim Indicators

Behavioral, transactional and conversational cues that a legitimate customer is being manipulated into moving money. These signals still work when identity, device and login all look clean.

What it measures

In a scam, the genuine customer sends money willingly from their own device with their own credentials, so the signals that matter are about intent shaped by someone else:

CategoryIndicators (category level)
Transaction patternFirst-ever wire, crypto purchase, crypto-kiosk-related cash withdrawal or large gift card purchase; early closure of CDs or savings products regardless of penalty; HELOC or loan proceeds immediately sent out; dormant high-balance account suddenly active; multiple payments described as taxes, fees or penalties; small "test" sends followed by an abrupt jump to large payments
PayeeNew payee; payee at a crypto exchange or virtual asset service provider; payee with high fan-in from unrelated senders; beneficiary name mismatch; payee type unusual for the customer (Payee and Counterparty Risk)
Session behaviorHesitation, long pauses on warning screens, repeated attempts after a decline, unusual copy-paste of account details; remote-access software active during the session; an active phone call during the banking session where the device can detect it (Remote Access Tool Detection, Session Behavior Anomalies)
InteractionCustomer requests limit increases or hold removal urgently; insists on secrecy; gives explanations that don't fit their history; appears to read from a script; a third party is present or on the line (Customer Contact Signals)
Stated purposePayment purpose or memo matching scam typologies, such as "safe account", "investment", "tech support", "government fee", "release funds", "unlock earnings"
Inbound precursorsSmall inbound crypto or P2P credits (fake "returns" that build trust); refunds or "overpayments" received from unknown parties shortly before an outbound request

Why it matters

Scams now dominate reported consumer fraud losses. The FTC reported $15.9 billion in 2025 consumer fraud losses, with investment scams over $7.9 billion and imposter scams over $3.5 billion; bank payments and cryptocurrency were the top loss methods. Among adults 60+, reports of $10,000-plus losses to business and government impostor scams more than quadrupled between 2020 and 2024, and victims were frequently told to move money "to protect it" by bank transfer, crypto via kiosks, cash or even gold. Task-style job scams, in which victims are told to deposit crypto before they can withdraw fictitious earnings, rose from about 5,000 reports in all of 2023 to about 20,000 in the first half of 2024. FinCEN's elder exploitation trend analysis found scams made up about 80% of roughly $27 billion in reported suspicious activity over one year.

Regulators have published the indicators: FinCEN's pig butchering alert (FIN-2023-Alert005) and elder exploitation advisory (FIN-2022-A002) list behavioral red flags (distress, rushing, taking direction by phone, describing an online contact's investment tip) and financial red flags (first-ever crypto, early CD closure, wires labeled as fees or taxes). Shifting liability strengthens the business case for detecting scams before the money leaves, as with the UK's mandatory reimbursement regime and US disputes over P2P scam losses (Case Study - UK APP Scam Reimbursement Rules (2024), Case Study - Zelle Scam Liability Disputes (2024-2025)).

The pattern looks different by industry. At Neobanks and Consumer Fintech and in Payments and P2P, it's instant transfers to new payees. In Brokerage and Investing, it's liquidations to fund external "investments" and ACATS transfers out to unfamiliar firms. In Retail and Ecommerce, it's high-value gift card purchases. On Online Marketplaces, sellers receive fake payment confirmations or overpayments. In Cashback, Coupons and Rewards, task-style scams recruit victims to complete "missions" through reward apps, and some victims are recruited as unwitting Money Mules.

How to collect it

  • Transaction and payee features from your scoring pipeline (Transaction Pattern Anomalies, Payee and Counterparty Risk).
  • In-session telemetry: mobile SDKs can detect certain remote-access and screen-sharing conditions and, on some platforms, an active call; web telemetry shows hesitation, copy-paste and warning-screen behavior. Vendors sell scam-specific behavioral models; disclosure and consent obligations apply.
  • Purpose capture: structured "what is this payment for?" prompts at high-risk payments. The answer is a signal (and a liability record), and a dynamic follow-up question can break a script.
  • Contact center dispositions and complaint data, tagged consistently with scam typologies (FraudClassifier and ScamClassifier models help).
  • External intelligence: scam-reported payees and fresh typologies (External Intelligence Feeds).

How to use it

Diagram: Payment initiated, Session looks like the owner?, ATO path: step-up, block, Scam indicators present?, Allow, contextual warning, Dynamic friction: purpose questions, delay, Hold and human outreach, trusted contact
  • Separate scams from ATO early. Clean identity + anomalous payment points to a scam. The response has to persuade or protect the customer, because re-authentication does nothing when the victim is the one logging in.
  • Targeted, specific warnings outperform generic ones: name the scam type that matches the payee and purpose (Customer Education and Scam Warnings).
  • Friction that interrupts the script: short delays on first payments to high-risk payees, call-backs from a known number, conversations with trained specialists who ask open questions (Payee Confirmation and Payment Friction).
  • Holds where permitted: FINRA Rule 2165 allows temporary holds on disbursements and securities transactions for specified adults (15 business days, extendable by 10 and, after reporting to a state agency or court, a further 30); bank holds should follow state law and disclosures (Trusted Contact and Senior Investor Holds).
  • Account-level vigilance after a first scam: victims are frequently re-targeted (including by "recovery" scams), so keep sensitivity raised for months afterward.
  • Report: SARs with FinCEN key terms (e.g., FIN-2023-PIGBUTCHERING, EFE FIN-2022-A002) and referrals to law enforcement or Adult Protective Services as appropriate.

Strengths and limitations

Strengths: the only signal family that works when the customer authenticates themselves; supports early intervention while money can still be stopped; directly addresses the largest category of consumer losses.

Limitations: scammers coach victims to lie about purpose, to dismiss warnings and to avoid in-person staff, and they adapt scripts quickly, so individual indicators can be degraded and no single answer or behavior is reliable. Interventions must persuade a person who believes they are doing the right thing; many victims proceed anyway or move to another institution. Session telemetry varies by platform. False positives carry real autonomy and dignity costs.

False positives and fairness

  • Legitimate first-time crypto investors and people paying for genuine international services.
  • Customers making large, urgent, legitimate payments (house closings, medical bills, bail, tuition, family emergencies).
  • Older adults exercising their right to make unusual financial decisions; age alone must never drive intervention, and the Equal Credit Opportunity Act and elder-protection guidance caution against age discrimination.
  • People who use remote access legitimately (IT support at work, family helping a relative).
  • Small business owners paying new suppliers.

Track intervention outcomes (prevented loss vs. customer friction) and offer clear escalation paths.

Privacy and compliance considerations

In-session detection of calls or remote-access tools touches device permissions and platform policies; disclose clearly. Holds must follow FINRA rules for broker-dealers, state law and disclosures for banks, and Reg E timelines for error claims. The December 2024 interagency statement on elder financial exploitation describes trusted contacts, holds, training and reporting as practices regulators expect institutions to consider. See Regulation E and Unauthorized Transfers and BSA-AML and SAR Filing.

Mechanisms it helps detect

Authorized Push Payment (APP) Scams · Impersonation Scams · Investment Scams (Pig Butchering) · Elder Financial Exploitation · Gift Card Fraud · Seller-Targeted Scams (Fake Payment and Overpayment) · Real-Time Payment Rail Fraud · Money Mules (unwitting) · Generative AI and Deepfake Fraud

Transaction Pattern Anomalies · Payee and Counterparty Risk · Customer Contact Signals · Remote Access Tool Detection · Customer Tenure and History · Payee Confirmation and Payment Friction · Customer Education and Scam Warnings · Trusted Contact and Senior Investor Holds · Playbook - Scam Intervention Members · Playbook - Elder Exploitation Response Members

Sources and further reading