Consider this scenario. Someone lists a bicycle for sale on Facebook Marketplace, and a buyer messages the seller with what seems like a reasonable request: "Hey, we both know this place is full of scams, so let me send you a code to your phone number to confirm you're a real person."
The seller agrees, receives the code by SMS, and reads it back to the buyer. Then the buyer disappears. What the seller didn't know is that the code was actually a Google Voice verification code, and their phone number is now attached to a Voice over Internet Protocol (VoIP) account belonging to someone else. The buyer was never interested in the bike. It was just a pretext to engage with the seller.
What interests me about this situation is that the seller's own scam awareness made the scam work. Because the the seller already knew about scams on buy-and-sell marketplaces, the buyer's request for identity verification made sense.
I've spent the last couple of years working on scam threat intelligence, and this pattern keeps surfacing: modern scams increasingly exploit victims' own security awareness.
The value of consumer scam intelligence for security teams
I'd like to make the case that studying how consumer fraud is carried out, particularly the social engineering behind it, is one of the best ways to get a full and accurate picture of the most exploitable human weaknesses. Scamming is, after all, a volume business, with cyber criminals reaching millions of potential victims and continually refining their techniques. Understanding these techniques, especially those that go beyond traditional urgency and fear, will improve your security training and awareness at the enterprise level.
To support this, we've been maintaining a structured catalog of consumer scams: the F‑Secure Scam Encyclopedia. And we're making it publicly available, free of charge, because I believe this collection has significant value for security teams.
What makes it particularly useful is that entries are tagged by psychological mechanism, not just scam type. You can query across the whole catalog for a manipulation pattern and see every scam family that uses it. I used this approach to identify techniques that scammers are increasingly using but that get relatively little attention in security training materials focused on social engineering, and three stood out.
Technique 1: Awareness Hijacking
Like the Facebook Marketplace scam described earlier, Awareness Hijacking exploits the target's knowledge of one scam to move them into a different scam. The scammer never has to manufacture fear, because public messaging already did it. What the scammer supplies is the remedy.
Another consumer example is a "protect your money" scam: someone impersonating your bank or law enforcement tells you that drug traffickers are moving money through your account and that you need to move your funds somewhere safe. Of course, "somewhere safe" turns out to be an account controlled by the scammer.
The scam works because the victim has heard of money laundering or drug trafficking but doesn't understand how banks actually operate. Their vague awareness of threat #1 (money laundering) primes them to be vulnerable to threat #2 (move your money to another account).
How Awareness Hijacking works in the workplace
The corporate version might look like this phone call:
Operator: I'm not going to ask you for your password. We never do that, and anyone who does is not from this company.
Employee: Okay.
Operator: So let's do it the other way round. I'll prove I have access to your company's system first. I'm sending a verification code to your account right now, and you should get it in a few seconds.
Employee: I've got the code. It's 482913.
The code is a real password reset verification code, triggered by the operator. The employee refused to give up a password, exactly as trained. But nobody taught her that a code meant to verify her identity could be misused by someone claiming it would verify theirs.
Her awareness of threat #1 ("I shouldn’t give out my password") makes her vulnerable to threat #2 ("reading back a code is better").
Technique 2: Complexity-as-Crucible
In a pattern I’m calling Complexity-as-Crucible, the scammer creates a situation too complicated for the target to understand, then offers to take the problem off their hands.
The underlying psychology is well established. Dan Sperber's "guru effect" describes how complex, obscure statements can be read as "profound." Similarly, the nonsense math effect shows that adding meaningless equations to a research paper makes readers judge it more favorably.
Many consumer scams rely on complexity to overwhelm and ultimately trick victims. Scams involving technology, finance, or legal issues are particularly well suited to this approach, and a combination of these factors is even better.
For example, in the Quantum AI Trading Bot scam, the scammer convinces the victim that they have exclusive knowledge of a new, complicated crypto trading scheme promising extremely high returns. The scheme is typically attributed to a professor or financial guru who supposedly uses quantum computing, artificial intelligence, or both to generate these returns. The scammer then positions themselves as a trusted guide who can help the victim navigate the complexity of investing.
How Complexity-as-Crucible works in the workplace
In an enterprise setting, this technique can take a different form. Consider how a targeted employee might react to the prospect of tedious paperwork:
Operator: Hey, I'm calling about the true-up, and how your team shows a discrepancy. My entitlement count says 42 seats. Deployment records say 47. Some of that's the per-device versus per-user thing, which never lines up cleanly.
Employee: Do you need me to count something?
Operator: No. You don't need to sort any of this out. I'll do the reconciliation, that's my job. I just need two things confirmed so I'm not guessing. What's the name on the provisioning account, and what version of VPN is it using?
This ruse works because software license reconciliations (or 'true-ups') are real and genuinely tedious. (No shade to my compliance colleagues, but you know I'm speaking truth!)
The employee dreads the prospect of a long, drawn-out reconciliation exercise. So the operator steps in like a superhero, offering to remove the complexity ("I'll do the reconciliation, that's my job"). With the employee relieved of that burden, the operator can move to the next phase: persuading them to reveal sensitive information about the company's systems.
Technique 3: First Win
In a technique I'm calling First Win, the scammer creates a pattern where the victim believes they're always winning, even when they're losing.
This works particularly well in investment scams, where the scammer lets the victim withdraw a small amount of money to "prove" their earnings are real. In job scams, the operator might let the victim cash out their first few hours' worth of earnings. In both cases, the skeptical victim receives a little real money upfront so they believe they're winning and that everything is legitimate. The scammer then moves them to the next phase, where much larger sums are involved.
How First Win works in the workplace
The corporate version of First Win uses "being right" as the currency, rather than money:
Operator: Hi, is this John? It's Kate from the service desk, calling about your ticket. The mailbox sync one?
Employee: I didn't open a ticket.
Operator: You didn't? Hang on. Can you confirm your extension?
Employee: 4412.
Operator: That's not it, this one's for 4421. Oh, for heaven's sake, it says John Braun. That's not you. I'm sorry, that's my fault. Thank you for catching it.
Employee: It happens all the time. Braun is in marketing, I'm Brown in accounting.
Operator: Well, it looks like your records are tangled up with his all over the place! What a mess. I bet you're not even on the same VPN client. This ticket has you on Global Connect 6.2 and Authenticator, which can't be right.
Employee: Yeah, we're on 7.1 and no MFA. Everyone got moved over in the spring.
The operator creates a pattern in which the employee gets to correct her again and again. To him, this feels like "winning" because he's showing his expertise. What he doesn't realize is that he's revealing sensitive information — his virtual private network (VPN) client version and the fact that his team has no multi-factor authentication (MFA) — under the guise of correcting or educating the operator.
Incidentally, being deliberately wrong to draw out a correction is nothing new in social engineering; the FBI's public elicitation brochure lists "deliberate false statements" as a standard technique. What's new here is the scammer using a series of real wins to create a false sense of security, so the target doesn't notice when they've stopped winning and started giving away secrets.
What this means for your security training
Traditional security awareness training teaches employees about what to be afraid of. These newer social engineering techniques take advantage of that, and some work better on employees who have had a little security training. The employee in the last example did everything he was trained to do. He challenged an unsolicited caller, and he was right. But being right is what ended his suspicion and set him up to have his brain mined for secrets.
If your security training program can't account for that, it isn't complete. That's not an argument against training; it's a reminder that your program was probably built to address a different set of issues, rather than the psychology of how people get talked into doing things they shouldn't.
So consider this a plea to dip a toe into the wide world of consumer scams and fraud data. Despite representing a very large body of intelligence on psychological manipulation, consumer scams are an area that few enterprise security teams explore in detail. I'd like to change that.
The F‑Secure Scam Encyclopedia is now publicly available, and we'd love to hear your thoughts.
