The Scam Killchain
How modern, AI-enabled scams unfold — from choosing a target to laundering the proceeds. Pick a stage to see the tactics and techniques scammers actually use, with an analysis of where AI changes the economics for attackers and defenders.
Stage 0
Reconnaissance & Target Acquisition
Choose and qualify targets by demographics and data availability, then build profiles through reconnaissance and surveillance.
Through one real scam
Case study: Pig Butchering
Pig butchering is industrialized investment fraud: romance-scam rapport welded to a fake crypto trading platform. It isn’t a single incident but an archetype, run at industrial scale — much of it from scam compounds staffed by trafficked, forced labor working from scripts. Here is how that archetype walks the six stages of the killchain.
- 0
Target Selection & Recon
Targeting is wide-net rather than researched. “Wrong number” texts and attractive dating profiles go out at volume; anyone who replies becomes a target. The reply itself is the selection mechanism — it signals someone willing to chat with a stranger, the only qualification the next stages need.
- 1
Build Infrastructure
The crew stands up the back-end the scheme runs on: a convincing fake brokerage with live-looking dashboards and fabricated returns, plus the bank and crypto wallet infrastructure that will receive and move funds. Much of this is bought as a kit and operated by compound staff rather than built from scratch.
- 2
Craft Assets
Onto that infrastructure they layer the bait: a persona — an attractive, successful investor assembled from stolen photos — and a polished investment lure. The victim is never asked to “send money to a stranger”; they’re invited to open an account on what looks like a real exchange.
- 3
Engage Target
The classic opener is an innocuous “wrong number” SMS that turns friendly when the victim replies. What follows is the defining feature of the scheme: weeks or months of daily, no-ask conversation. Trust is fully established before money is ever mentioned — this is the “fattening.”
- 4
Execute & Monetize
Once the victim invests, the platform takes over: fabricated profits appear and small early withdrawals succeed, “proving” it works, before surprise “taxes” and “fees” freeze the account and deepen the sunk cost. The victim transfers entirely voluntarily — buying real crypto on a legitimate exchange and sending it to the fake platform’s wallet — after which the funds are chain-hopped and pushed through mixers, making recovery effectively impossible.
- 5
Evade & Recycle
When the victim is tapped out, the operators go quiet, the persona and chat history are scrubbed, and the playbook recycles — sometimes pivoting to the victim’s own contacts, or selling the “sucker list” of proven-responsive marks so the chain re-enters at the bait stage against fresh targets.
Pig butchering is what scam industrialization looks like before heavy AI involvement: scripts, compounds, and coerced human labor substituting for automation. The bottleneck is the months of convincing, personalized, daily conversation per victim — precisely the work language models are good at. That is why we treat this archetype as a leading indicator for AI uplift.
Analysis
AI uplift analysis
The question isn’t where AI uplift is strong — it’s where strong uplift removes a human bottleneck. There, and only there, the threat scales.
Hot zones — human bottleneck × strong AI uplift
- Stage 0Reconnaissance & Target Acquisition — Researching each target by hand used to cap how many victims a crew could profile.
- Stage 2Prepare Digital Assets & Bait — Producing fluent, native-quality lures and believable sites required skilled (often bilingual) labor.
- Stage 3Engage — One-to-one engagement was the scam industry’s biggest labor cost — the reason scam compounds employ thousands.
The bottlenecks AI does not solve (build infrastructure, execute & monetize, evade & recycle) remain the chain’s most durable choke points for disruption.