Inside the world of vigilante scam-baiters
They claim to fight for victims, but are they just trying to go viral?
By Barclay Bram
Hello, is this Marta?”
The man on the phone had an accent that was hard to place, but his English was clear and direct.
He introduced himself as Nick.
As you might expect of someone in her 80s, Marta could be a bit shaky.
Had they met before?
She couldn’t remember.
No, Nick said.
He explained that he was calling because Marta had clicked on an advert online and registered her interest in an investment scheme.
“Is this the Elon Musk thing?” Marta asked.
Maybe you saw the same ads that she did last summer – seemingly showing Musk in an interview with the BBC or at a TED-talk-style event.
He was peddling a new investment opportunity, which he claimed had the potential to double your wealth.
In one video, Musk stared into the camera and promised that “the life you’ve long dreamed of – to build a house, to buy your dream car, to travel – it’s all possible.”
That’s right, Nick said – he was calling to give Marta access to Musk’s investment vehicle, which employs quantum AI software to guarantee massive returns.
Marta didn’t enquire as to what exactly quantum AI was, but why would she?
This was a scheme promoted by the richest man in the world, and she was just a retired teacher.
She confided in Nick that she wanted to get into investing because she was worried about her finances.
She had seen someone post on Facebook that the economy was going to collapse, so she thought now might be a good time to move her assets around.
It may be a cliché to say that you shouldn’t trust what you see on the internet – but, in this case, it was certainly justified.
Unsurprisingly, the deal Marta had signed up for was too good to be true: the adverts featuring Musk were in fact deepfakes seeded by scammers like Nick.
What was perhaps more surprising was that Marta, too, wasn’t who she claimed to be.
Over Zoom, I watched as the person pretending to be Marta changed his voice from her halting stutter back to his own brisk American accent with the click of a button.
This voice-modulation software allows Kitboga – the pseudonym of a man in his mid-30s – to become many characters, from “Tony”, an Italian-American baritone in late middle age, to “Nevaeh”, a valley girl who likes to make scammers sing along to Shakira.
He started calling scammers and soon discovered that reverse-engineering their scamming scripts offered the same satisfaction as correcting a software glitch
Kitboga is a scam-baiter – someone who targets online scammers and turns their tactics back on them in an act of vigilante justice.
The day I shadowed him, he was sitting in front of a green screen and wearing a pair of aviator sunglasses, which he uses to mask his face.
Some of the scammers he interacts with are members of organised-crime groups; if they managed to uncover a scam-baiter’s real identity, “they will completely ruin your life,” Kitboga told me.
The cold-hearted world of scamming is big business.
American consumers lost more than $12.5bn to cyber-fraud last year, estimates the FBI.
Globally, scammers rake in perhaps $500bn a year, more than illicit drug-dealers.
Investment scams, such as the Musk one, are said to have brought in nearly $5bn alone.
Although many imagine a typical scam victim to be an elderly, vulnerable person like “Marta”, the truth is that anyone – including so-called “digital natives” – can be scammed.
In a survey published in 2023 by Deloitte, a consulting firm, people from Gen Z (born between 1997 and 2012) were found to be more likely to get scammed than their boomer grandparents.
Kitboga, an affable, mild-mannered man, is an unlikely combatant in the war against this transnational crime wave.
Before he became a scam-baiter, he was a software engineer.
Nearly a decade ago, he heard about tech-support scams – when criminals impersonate a software provider and tell victims that their computers have been compromised by a virus, then offer to remove it for a hefty fee.
“And I thought, if I haven’t heard of this and I work in software, what about my mum?
Or my grandma?”
He started calling scammers who pretended that they could help take away viruses – and soon discovered that reverse-engineering their scamming scripts offered the same satisfaction as correcting a software glitch.
He began livestreaming his conversations with scammers on Twitch, a streaming platform, for his friends to watch; before long, he built up a fanbase of strangers too.
His pseudonym was derived from Kitbuqa, a Mongol general whom he first encountered as a character in the video game “Age of Empires”.
Kitboga was impressed by his namesake’s brute-force tactics – particularly his effective use of catapults.
It seemed like an apt metaphor for Kitboga’s own rough-and-tumble fights online.
For as long as people have had access to the internet, people have been sending scam emails.
Maybe, in the early days of the world wide web, you received a few of them yourself – poorly worded with bad grammar, yet dangling a handsome prize.
The most ludicrous archetype was the “Nigerian prince scam”, in which you would get an email out of the blue telling you that a prince worth millions needed your help.
If you could just wire him a few hundred dollars, he would get out of his bind and reward you with a life-changing figure.
Scams of this genre were conducted in an almost artisanal fashion.
Small groups of individuals with a reasonable grasp of English operated out of countries with patchy internet connections.
In Nigeria, a cottage industry of “yahoo boys” – named after the free email service they typically used – sent out scam emails from internet cafés.
For the vast majority of recipients these emails were simply a nuisance, yet people did fall victim to them: as recently as 2019 Americans were still losing more than $700,000 a year to fake royals.
But as the internet has grown more sophisticated, so too have those trying to separate people from their money.
Scamming is now done on an industrial scale and is structured more like an underground service industry.
The pandemic was a catalyst for this change.
Global lockdowns forced many people to begin working exclusively online – including organised criminals, who turned towards scamming as a lucrative and lower-risk alternative to selling drugs, running illegal casinos or sex trafficking.
The United States Institute for Peace, a think-tank, estimates that scammers in Cambodia bring in over $12bn a year – a sum equivalent to half of the country’s GDP.
To staff this booming industry, criminal gangs have turned to human-trafficking – luring people from around the world with promises of sales jobs, only to seize their documents on arrival.
Across South-East Asia, which has become a hub for scamming gangs, it’s estimated that there are hundreds of thousands of people trapped in scam-call centres, a form of modern slavery.
There are credible reports of assault, rape, torture and, in some cases, even deaths, as gangsters coerce workers to bring in ever-greater sums of money.
New technologies are also changing scamming.
Artificial intelligence has made scams far more credible – from enabling deepfakes (like the Musk one) to improving translation and editing tools, which allow scammers to avoid the telltale sloppy grammar of the past.
The astronomical success of cryptocurrencies over the past two decades has made people less sceptical of promises of ludicrously high returns; crypto also allows scammers to funnel funds into anonymous wallets and launder their earnings transnationally with little friction.
Despite the prevalence of scamming today, there’s often very little recourse available for victims.
As Jack Whittaker, who recently finished a PhD on the ethics of internet vigilantism at the University of Surrey, told me, “most fraud is simply not investigated.”
In Britain, where he lives, victims are triaged through a number of agencies depending on the type of crime and the amount of money that has been lost.
“It’s basically the world’s biggest game of [whack-a-mole],” he said, noting that most end up little better off than when they initiated the process.
In America the thresholds for investigating cyber-fraud can be extremely high (sometimes over $1m, depending on the jurisdiction), meaning people can lose their entire life savings yet still not have their case qualify as worthy of investigation.
This is where scam-baiters believe they come in.
Jim Browning is an elder statesman of the scam-baiting community (as with Kitboga, this isn’t his real name, and the entire time we spoke he kept his camera off).
He believes that the inefficacy of the police justifies scam-baiters’ interventions.
“That’s what’s really sad,” he told me.
“There will be nobody fighting your case to try and get your money back because it is just not big enough for the authorities to really take notice.”
Like Kitboga, Browning was a software engineer before he became a scam-baiter.
His speciality is infiltrating scammers’ computer systems to reveal the inner workings of their schemes, as well as taking over the CCTV cameras of scam-call centres, which bosses install because they don’t trust their employees (“there’s no honour among thieves,” Browning told me).
Once he is in the network of a centre, he can work out the scammers’ real identities.
He loves calling out their names and seeing them squirm in their seats.
“You’d be amazed at what you can find,” he said.
One time, he watched as a guy ordered a takeaway on his computer – inadvertently revealing the centre’s exact address.
A few years ago, Browning, too, was scammed.
He received an email alleging that he had a duplicate of the monetisation tool that YouTube uses, which led him to delete his account.
“It’s a bit embarrassing obviously, given my line of work,” he chuckled.
But he chose to publicise his story; the resulting video has been seen by over 3m people on YouTube.
For Browning, raising awareness about scams is an essential part of his role: “I do not mind shining a light into those dark areas because I’m absolutely convinced that the only way to guard against scams is to expose them in a lot of detail.”
I asked him if he would show me the inner workings of a scam.
Sharing his screen with me, Browning took me to an investment-scam website.
It looked just like a crypto-trading platform.
There were graphs of various assets (unsurprisingly all trending upwards).
At the top of the screen a banner read: “Unlocking the Future of Smart Investments”.
It was easy to see how someone guided to the website could believe it was real.
The next step would be for a scammer to convince the victim to deposit money into a digital wallet offered by the site.
“You’d see the money enter your account here,” said Browning, moving his cursor over the wallet’s balance.
“And then when you’d check back a few days later you’d notice that your money has increased in value – but it’s not real.
The scammers have already taken your money.
This is a number they can toggle at will.”
These scammers were based in Georgia, in eastern Europe.
Browning had managed to get into the back-end of their system, so he was already familiar with their operations.
He pulled up a spreadsheet that showed the profits and losses of the team members, hovering over one name in particular: Nina.
She was the team leader; beneath her were the scammers she managed.
They all had figures next to their names, representing the amount of money they were supposed to bring in each month: $20,000 for the experienced scammers and $10,000 for entry-level employees.
They were paid a base salary of $1,000, with commissions based on how much more they solicited.
The most successful of Nina’s team had secured over $150,000 in scams the previous month.
With commission he was taking home $6,000 a month – a decent wage anywhere, but especially good in Georgia, where the average salary is around $750 a month.
There was a tab on the spreadsheet that showed the gang’s monthly outgoings.
They spent $5,000 on the call-centre’s rent, while another $800 went towards the server that hosted their website.
They also paid out a few thousand dollars a month to prospective victims – small amounts to convince them their money was safe, and to encourage them to invest even greater sums.
From these documents Browning estimated the scam was turning over $1m or so a quarter.
“And they pay tax on that,” he said, lingering over a line in the spreadsheet.
I was surprised by this, but Browning told me I was being naive: “By paying tax they attract less scrutiny from the government.”
Scams tend to proliferate in countries with weak rule of law – where cash-strapped governments are willing to turn a blind eye to revenue-generating companies whose victims are far away.
Browning is keen to work with local law enforcement and turn over information about the most egregious scammers he encounters, but in places with high levels of corruption such as India his efforts often amount to nothing.
In one series of videos, which were also broadcast by the BBC in its documentary series “Panorama”, Browning managed to catch a scamming call-centre boss named Amit Chauhan red-handed.
He handed over CCTV footage to the police, as well as evidence of scam earnings entering Chauhan’s bank accounts.
But soon after his arrest, Chauhan was released from prison; a year later the case against him was quietly dropped.
In another case in India, Browning had reported a call centre to the police, who told him that they were going to investigate.
On the day of the raid Browning logged onto the scam centre’s CCTV cameras – only to watch in disgust as the employees calmly switched off their computers and walked out of the building.
Someone had tipped them off.
For some scam-baiters, raising awareness about scams or alerting the police to particularly successful ones isn’t going far enough – rather, they want to humiliate scammers.
This form of revenge has been an impulse since the early days of online scamming, when the first scam-baiters responded to Nigerian prince emails for a laugh.
On online forums they would egg each other on, trying to make the scammers do ever more ridiculous things in their quest for cash.
One forum called 419eater – after section 419 of the Nigerian penal code, which bans fraud – features a “trophy room”, where people post the embarrassing photos they make scammers take: of them holding up signs shouting out the forum, or standing in surreal poses, like with a brick on their head.
But some of the pranks pulled on scammers can actually be dangerous – such as a game called “safari”, in which scam-baiters see how far they can make a scammer go to collect their earnings.
In one case they convinced a scammer to travel thousands of kilometres from Nigeria to near Darfur in Sudan, where a genocide was taking place.
Over time scam-baiting became a popular form of content on platforms like YouTube and Twitch, offering its most daring practitioners opportunities to profit.
Kitboga is one of a handful of scam-baiters who have turned the pursuit of scammers into a full-time business: he has nearly a dozen people on his team, including a manager, videographers and software developers who help him build anti-scam tools that he sells to the public.
He wouldn’t tell me how much money he makes, but with over 700m views on his YouTube channel, a conservative estimate would be that he’s made $1m on that platform alone.
In recent years, increased competition between scam-baiters for viewers – and the money that comes with them – has upped the ante, causing scam-baiting content to become more and more extreme.
“You need a big ego and a lot of confidence to get criminals to do silly things,” noted one former scam-baiter.
These antics often tap into uncomfortable racial undercurrents: the supposed “good guys” tend to be middle-class white people in America or Europe, and the criminals are usually people of colour in the developing world – many of whom have been coerced into their jobs.
And while content creators stand to become enriched by their baits, they rarely succeed in securing any tangible justice for scamming victims.
Jack Whittaker, the academic studying internet vigilantism, is demoralised by this turn in scam-baiting.
“Right now I’m ready to go and slash my wrists after spending four years of learning what victims go through and then learning that the good guys that do this aren’t doing it for altruistic reasons, but because they want to make money off YouTube channels,” he told me.
This time the men on the other side of the video call did not hide their identities.
They were sitting in giant gaming chairs; the Zoom background behind them made it look like they were hurtling through space.
Ashton Bingham was wearing thin-rimmed glasses and had soft, boyish features.
In the seat next to him was Art Kulik, a former pro-basketball player from Belarus; when he gestured you could see muscles ripple through his tight T-shirt.
Together Bingham and Kulik make scam-baiting videos under the banner of Trilogy Media.
They’re an unlikely pair.
They became roommates after independently coming to Los Angeles in the early 2010s in search of fame.
Bingham was working as a magician, and Kulik was trying to land roles as an action-movie heartthrob.
It wasn’t going particularly well for either of them.
In 2016, while killing time around the house, Bingham decided to record himself winding up a scammer who had called pretending to be the IRS.
Bingham messed him around sufficiently that the scammer flew into a rage and claimed that his father was Osama bin Laden.
The video of the encounter went viral on Facebook – and the Trilogy guys knew they were onto something.
“We’re like, okay, so if we’re going to do this and we’re going to be these impractical jokers online, but this specific niche as scam-baiters, what can we do that separates us from others?” Kulik told me, leaning forward in his chair.
“A lot of scam-baiters wear glasses or never show their face” – an implicit dig at people like Kitboga and Browning.
Trilogy decided to go the other way: to lean into their fun-house Batman and Robin personae, with Bingham providing the brains and Kulik the brawn.
They also wanted to go beyond simply wasting scammers’ time and actually confront them on their home turf.
“Look, we’ve always been risk-takers,” said Kulik.
“That’s what brought us to Hollywood in the first place.”
For their first attempt, in 2020, they enlisted the help of Browning and another famous scam-baiter called Mark Rober.
Browning hacked into the CCTV cameras of a call centre in Kolkata, and Rober created glitter bombs as well as devices that would release cockroaches and rats.
These were smuggled into the centre by former scammers whom Trilogy had spent months cultivating as informants.
In the resulting YouTube video you can see Kulik, Bingham and their crew members gathered in a luxury hotel suite in Kolkata.
Kulik and Bingham are sitting on top of the king-sized bed, watching on the flat-screen TV opposite them as the devices explode and the call centre collapses into chaos: workers scatter and huddle in corners of the room, some screaming.
The Trilogy team whoops and cheers.
But it was a gamble.
The next day, scammers from the call centre sent messages on a Telegram channel to colleagues throughout the city saying that they were looking for Kulik and Bingham.
“They came here to fuck all of us and they are still trying.
I’m gonna kill those motherfuckers from my own hands,” read one message.
Another implored fellow scammers to search the luxury hotels in Kolkata, but Kulik and Bingham managed to slip out of the city, living to scam-bait another day.
The mission’s success – to date it has garnered over 120m views across the men’s various channels – transformed Kulik and Bingham into full-on internet vigilantes.
In addition to confronting scammers across the globe, they’ve branched into targeting suspected paedophiles, entrapping them by having a female colleague pose as a 13-year-old girl.
It’s a modern version of NBC Dateline’s “To Catch a Predator” – a show from the 2000s in which the network worked with vigilante groups to track down possible paedophiles and confront them on prime-time TV.
In one video Kulik confronts a man in a shower (Kulik’s massive size makes him well-suited to instigating these potentially fraught encounters) and forces him to sit naked on a sofa in hopes of spurring him to confess to his crimes; the police then troop in to arrest him.
With such content in their arsenal, Bingham and Kulik now have their own streaming platform, Trilogy+, which charges $49.99 for an annual subscription (they wouldn’t tell me how many people have subscribed).
Bingham believes his team’s confrontational form of scam-baiting allows them to do things that other scam-baiters, and even the police, can’t.
“They have red tape, they have bureaucracy, they have procedures.
They work very slowly compared to us.
We’re not cops.
We don’t need warrants.”
But such extrajudicial interventions can have tragic consequences.
NBC Dateline’s show was cancelled after a suspected paedophile took his own life, and in recent years predator-catching groups have ended up in violent confrontations.
The Trilogy guys bristled when I asked whether they felt they ever crossed a line, and whether they were uncomfortable being called vigilantes.
“A lot of people might see that as controversial,” Bingham said.
“I don’t.”
In the polarised world of the perpetually online, some people paint critics of scam-baiting’s excesses as being pro-scammer; doxxing is not uncommon.
Whittaker, the academic, told me that just two days before we spoke he’d received a threatening message.
“It gets very deeply personal,” he told me.
“It’s a minefield to navigate.”
Even so, some scam-baiters have disavowed their past work. One is a man known as Mike Hogan.
He, too, wanted his real name kept secret – but because he feared backlash from his former colleagues, rather than from the scammers he had baited.
Hogan got his start in scam-baiting 20 years ago when a bicycle accident left him bedridden.
As a lark, he started a conversation with someone trying to scam him over email.
Curious to learn about how to do it effectively, he sought out forums dedicated to fighting scammers, like 419eater.
Hogan had been impressed by the sense of community: “They told you what to do and what not to do, what information you absolutely could not share with the scammers, what it was appropriate to do or not to the person on the other end of the line.”
Hogan considered himself to be a “straight-baiter.”
He didn’t go in for pranks – he wanted to help.
“My speciality was cold-calling victims, getting them to trust me and telling them, look, you’re being scammed.”
In one case someone reached out to Hogan via the forum, asking him to help pull his relative out of a scam; Hogan called the man just before he handed over €26,000 ($28,300).
But despite the successes, it was emotionally challenging work.
Visibly grimacing over our video call, Hogan told me about two victims he’d been unable to help who’d gone on to kill themselves.
“But on [419eater] we had psychologists helping us…there was a lot of structure in the past.
It isn’t there anymore.”
Over the years Hogan felt 419eater was becoming less about trying to understand and disrupt scams and more of a competition over who could push the scammers the furthest.
Once members started making scammers get permanent tattoos as part of their scam-baits, he quit the forum.
“I just looked at that and thought, this isn’t my church.”
Hogan, who now works in cyber-security, is reflective about his time as a scam-baiter.
At one point I asked him whether he’d ever considered the lives of the scammers themselves.
“Oh of course,” he told me.
He was careful not to justify what the scammers were doing.
But he could understand how they ended up in that position.
“You know, I think if I was born and raised poor in Nigeria I would be a scammer.
Look, I’m technically minded…I think given the circumstances I’d probably have followed that path, too.”
It reminded me of something I had thought while watching Browning and Kitboga do their scam-baiting.
They, too, scrolled through different marks, hoping to find the right person on the other end to take their bait.
The skills they used were not that different from those that make a successful scammer.
Had they found themselves in a different context, with a different set of personal circumstances but the same affinity for computers, would they have found themselves on the other side?
When I put this to the team at Trilogy Media, Kulik, as someone who had made it from Belarus to Hollywood, didn’t have a huge amount of empathy for the people who ended up scamming for a living.
“When I was growing up the USSR collapsed.
There were gangs everywhere.
They wanted me to join them and I said no.”
Such a perspective ignores the more complex realities of scamming and fits the narrative arc of many Trilogy media videos, which firmly entrench them as the “good guys”.
The team has made a series of videos about one scammer, named Ban Tei, who claims to have been coerced into such work.
Trilogy played a role in getting him out of his situation – but only after Tei himself reached out to them, repented of his actions, and helped them infiltrate scam centres.
(Using equipment given to him by Bingham and Kulik, Tei now works as a travel blogger whose videos are streamed on Trilogy+.)
Kitboga’s response was less virulent.
Most of the time, he argued, he wasn’t targeting the type of large-scale, long-term scams run by organised criminals, whose employees are often trafficked into the position; instead, he goes after tech-support scammers, who typically have a different business model.
He believes he can spot scammers who have been coerced, and doesn’t engage with them.
“Of course I don’t want to spend 15 hours talking to someone on the phone and basically torturing them, just for it to turn out that it’s someone who’s being forced against their will to talk to me,” he told me.
But regardless of the scammers’ circumstances, Kitboga is convinced that they need to be held in check somehow – “they’re trying to take everything you have.”
The growing sophistication of AI tools may soon open up new possibilities for scam-baiting.
On his shared screen, Kitboga navigated over to an application he had built, which he called “lab rats”.
Scammers would call a certain phone number (circulated by Kitboga on scamming forums) in the hopes of extracting a serious crypto payout from a prospective victim.
But instead of speaking to Kitboga in the guise of one of his characters, they’d speak to a chatbot that he had created by running many hours of his content through large-language models.
The result was an app that was essentially an AI maze.
As the scammer would stick to their script, trying to lure in an old woman or a gullible teen, Kitboga’s chatbot could fluently respond as the target character and tie up the scammer for hours.
Such a tool will allow Kitboga to do scam-baiting at scale – but scammers are building similar ones to do away with much of the human labour they currently require.
As I watched Kitboga’s chatbot in action I felt like I was staring into a strange future, in which scammers and scam-baiters have been made obsolete by AI, and in which scamming is simply two algorithms locked in an absurd duel of robo-calls.
Until then, the battle will continue person-to-person; there is money to be made.
0 comments:
Publicar un comentario