AI Is Building the Next Scam While Your Report Sits in a Queue.

For further context, see SPF Readiness Is an Operating Model Problem and From Scam Signal to Reasonable Steps Evidence.

Click to view full size

A customer reports an investment scam. The screenshot enters a case system. An analyst reviews it, another team receives an escalation, and a weekly report records one more threat handled. Somewhere else, a replacement advertisement reaches a new audience. The name has changed. The claimed celebrity endorsement has changed. Much of the operation may be familiar. This is the failure that an efficient reporting process can conceal: an organisation can become better at processing warnings without becoming much better at using them. Add AI to the attacker’s workflow and the gap becomes harder to tolerate. Generating another convincing variation becomes easier, while defenders can still spend hours finding the original screenshot, reconstructing the redirect and explaining the same pattern to the next team.

Australia recorded 481,523 combined scam reports and A$2.18 billion in combined reported losses in 2025. Report volume fell 2.7% while reported losses rose 7.8%. Investment scams alone accounted for A$837.7 million.^[1] Those figures do not tell us that reporting failed, or that more reports would automatically solve the problem. They show why report counts make a weak headline measure of protection. The operational test is what happened because a report arrived. Did it reveal a related campaign? Did another organisation receive evidence it could use? Did a customer receive a more specific warning? Did the next analyst start with more knowledge than the last one? An intelligence programme should leave a measurable improvement behind each investigation, including cases where no money has yet moved.

The SPF deadline is real. A bigger inbox will not meet it.

The regulatory timetable makes this a current operating problem. The ACCC says most Scams Prevention Framework obligations apply from 31 March 2027, with membership of the AFCA dispute resolution scheme required from 1 September 2026 for entities providing regulated services in the designated sectors. The framework covers prevention, detection, disruption, reporting and response across regulated banking, telecommunications and digital platform services.^[2] AFCA says its Australian Scams Ombudsman will begin handling eligible SPF-related complaints from 31 March 2027, including complaints involving multiple organisations.^[3] The practical implication is broader than having a submission form and a documented escalation route. A business needs to know what evidence it can retrieve, what decisions it can support and which external dependencies it can act on when a scam moves beyond its own systems.

That last point also changes how to think about geography. An offshore operator can still depend on services used by Australians, including advertising, communications and payment systems. A domestic complaint process does not itself dismantle an overseas call centre, but a foreign location does not make every supporting service unreachable. Investigators need to map the points where a verified finding can support an action by a platform, telecommunications provider, financial institution or law enforcement partner. The label “offshore scam” is too broad to guide that work. A useful case identifies the observable dependency, the organisation able to act and the evidence that organisation needs. There will be limits, and some requests will fail. Those failures should remain visible as unresolved dependencies rather than disappear when the originating ticket closes.

AI is moving from writing the pitch to running parts of the business

The most alarming AI development is the spread of operational capability across an entire fraud workflow. Microsoft’s 22 September 2026 account of EvilTokens describes a service that combined compromised email access with AI-assisted analysis of correspondence, financial conversations and organisational relationships. Microsoft linked it to more than 12,000 compromised inboxes across over 10,000 organisations. Its tools helped users identify potential impersonation targets and payment-related opportunities.^[4] The significance extends beyond better wording: access to an inbox could be converted into a working understanding of who trusted whom and where money moved. This was a business email compromise operation rather than the fake investment funnel described above, but it exposes the same pressure on defenders. A warning about one compromised component may be arriving while the operator is already using information from it elsewhere.

Anthropic’s September 2026 threat report provides a different example. It described a deceptive dating-app network with more than 20 apps and over 4,700 AI personas engaging at least 25,000 people during a two-week observation window in April. Real people handled selected authenticity checks while different AI models performed separate roles. Anthropic reported banning associated accounts and sharing findings with other model providers.^[5] This was a specific observed network, not a measure of all dating apps. What matters for scam prevention is the division of labour. A human interaction can coexist with automated persuasion, and disabling one provider’s access may leave other components available. A verification process that asks only whether a person appeared on a video call, or whether a message sounds machine-written, can miss the wider operation.

The same operating logic appears in a July 2026 ASIC warning about fake celebrity endorsements directing people into messaging groups for pump-and-dump schemes. The regulator described impersonated experts, supporting group members and stock recommendations that could involve genuine shares bought through legitimate brokerage accounts.^[6] Here the presence of a real financial asset does not establish that the recommendation is honest. For defenders, this is a reminder to preserve the origin of the persuasion alongside the destination of the payment. A suspicious account, domain or transaction may look less suspicious when separated from the story that caused the customer to use it. Intelligence has to carry that relationship across the handover, rather than reduce the case to a single indicator with a red risk score.

A report should carry evidence the next organisation can actually use

Start by separating a submitted claim from what an investigator has verified. A customer’s account can be an important warning without proving every allegation in it. Preserve the supplied material, record what was directly observed and distinguish it from the customer’s description of events. When a page disappears, the captured page, collection time and relevant redirect evidence may be the only practical way for a partner to assess the request. When the requested action concerns a beneficiary, the partner needs to know how that beneficiary became associated with the scam and how recently the relationship was observed. A bare label such as “malicious” makes the receiving analyst repeat the work. A reusable evidence package gives them a defensible starting point while preserving their ability to disagree.

The receiving organisation does not need every detail in the source case. A platform assessing an advertisement needs different material from a bank reviewing a payment destination. Keep one controlled source record, then produce a relevant evidence view for each recipient. This also avoids turning intelligence sharing into indiscriminate circulation of personal information. A report can contain useful infrastructure evidence mixed with a victim’s private correspondence and financial details. The workflow should separate what supports the action from what the recipient does not need. Include correction and expiry mechanisms as well. A relationship can be wrongly inferred, a number can be reassigned and an account’s circumstances can change. Once an indicator has travelled, a later correction needs a route to the people who received the original finding.

The next improvement is to describe the behaviour behind the report. “Facebook scam” identifies where somebody encountered it. A more useful description says that the advertisement impersonated a financial commentator, moved the user into an encrypted messaging group, built confidence with apparent peer endorsements and then encouraged a transaction. Those behaviours remain recognisable after the account name or website changes. This does not mean every reused template belongs to one operator: shared hosting, common page designs and widely copied scripts can produce misleading similarities. Retain the difference between a directly observed link and a hypothesis worth checking. The purpose of a campaign map is to improve the next decision, which includes showing where the evidence is still weak.

Click to view full size

The AFP impersonation case reported by ABC in June 2026 illustrates the importance of that behavioural view. Police disclosed a script recovered from a Cambodian scam compound, alongside a fake AFP setting used to make remote interactions appear official.^[7] The useful defensive knowledge includes the claimed authority, the pressure applied and the movement between communication channels. A new telephone number does not erase those features. At the same time, a scripted human operation should not be casually relabelled an autonomous AI operation. Good intelligence preserves the evidence of what happened and then asks which parts of the mechanism could recur. That makes the lesson transferable without adding an unsupported technological explanation.

An LLM can accelerate the investigation. It can also contaminate it.

Large language models are well suited to some of the work that makes reports expensive to reuse. They can extract proposed identifiers from text, compare differently worded narratives, translate a complaint and draft a structured account of the evidence. Multimodal models can help read screenshots that arrive without machine-readable text. Retrieval can bring previous observations into the current case, while tool-enabled agents can carry out a bounded sequence of enrichment tasks. The design question is where their output enters the decision process. An extracted account number should point back to its source. A suggested campaign connection should identify the observations supporting it. If the model cannot find a field, the field should remain empty. Fluency must never silently become an evidence standard.

Two errors deserve particular attention. The first is factual completion: a model fills a missing date, misreads a character in an identifier or turns a customer’s allegation into an established fact. The second is instruction confusion: hostile text inside a webpage or message attempts to redirect the system analysing it. Keep retrieved content in the role of evidence, restrict the tools an agent can use and validate the fields passed into an external action. A read-only extraction task should not inherit authority to submit a takedown, contact a victim or change a payment control. Where the consequences are material, require an authorised reviewer to approve the supported action. A model-generated confidence score cannot replace the source material or the organisation’s decision criteria.

Evaluate the system on whether the extracted evidence is faithful and useful. Test exact identifier accuracy, support for claimed relationships and the quality of decisions on ambiguous cases. Include incomplete screenshots, contradictory reports and benign examples that resemble known templates. Re-run those evaluations when models, prompts or tools change. A summariser that makes an analyst faster can still make the organisation less reliable if its mistakes propagate to partners. Measure how often reviewers must correct its output and how often the receiving team can use the evidence without asking for the same material again. These checks give AI a concrete role in reducing investigation effort while preserving accountability for actions taken in the organisation’s name.

The missing capability is organisational memory that changes the next response

A warning needs to remain useful after the visible page disappears. The 2025 ACM Web Conference study 7 Days Later examined 286,237 phishing URLs and reported a median observed lifespan of 5.46 hours. In that dataset, Google Safe Browsing detected 18.4% of the phishing sites, with an average detection delay of 4.5 days.^[8] Those measurements concern a particular service and research dataset, rather than every blocklist or today’s entire scam environment. The operating lesson is the mismatch between short-lived infrastructure and delayed recognition. A historical match may arrive after the original destination has vanished. Teams need to preserve enough context to recognise a successor and enough fresh evidence to determine whether it is active. A clean reputation lookup is therefore an observation about available detection data, not a certificate of legitimacy.

There is an economic reason to build that memory. If each fresh report forces a full investigation from scratch, replacing a cheap identifier imposes expensive work on the defender. Retaining verified behavioural context and supported infrastructure relationships can reduce that repeated effort. It can also help an organisation identify where a previous intervention failed: perhaps the advertisement disappeared but the intake endpoint remained, or the takedown request lacked evidence the host required. The learning step is to change the monitoring, evidence template or escalation path accordingly. Simply storing another PDF does not achieve this. The next report must retrieve and use what was learned, while allowing an analyst to reject an old connection when current evidence no longer supports it.

Outcome checking also needs a separate category for “unknown”. A domain resolving to an error may reflect disruption, a temporary outage or a change in how the operator serves content. A provider’s acceptance notice may precede the actual removal. Record the observation time and what was tested, and keep uncertainty out of the confirmed success count. The same discipline applies to harm claims: a removal can reduce a route of exposure without proving a specific amount of money was saved. Where actual losses are unavailable, report observable changes such as active exposure time, surviving channels and repeat appearances within a defined monitoring window. This produces a more useful management view than treating every closed request as an equal unit of prevention.

The EvilTokens operation offers a recent example of intelligence travelling into action. Microsoft described coordinated legal and operational work that seized 50 websites and disabled more than 150 supporting domains, involving industry partners and law enforcement.^[4] The details differ from an Australian consumer scam complaint, but the response principle transfers: investigators connected evidence to organisations with different powers, acted on supporting dependencies and shared findings for further defence. The fact that an operation has multiple components makes coordination more valuable, while also making claims of complete eradication harder to substantiate. A mature response records the capability affected and the dependencies still being watched.

The next 90 days should make the next report more useful

Begin with a narrow set of recurring scam types and examine the reports already coming in. During the first month, agree what a qualifying observation looks like, which evidence fields must survive a handover and who can authorise each external action. In the second month, connect the chosen intake paths to a common investigation record, test the evidence packages with actual recipients and review the reasons requests fail. In the third month, trace a sample from first report through intervention and follow-up. Record whether a later related case benefited from earlier work. There is no need to wait for a perfect intelligence platform to discover that a screenshot loses its collection time, an escalation reaches an unmonitored inbox or a model-generated summary drops the only identifier the bank needs.

This is also where verification, digital risk protection and payment intelligence should meet. Cyberoo’s Scams.Report addresses explainable scam verification and reporting; NothingPhishy focuses on infrastructure disruption; MuleHunt focuses on evidence-supported intelligence about scam-linked payment destinations before a transfer.^[9] Their relevance to an SPF operating model lies in the handovers between those functions. A bank should be able to retain its existing payment controls while receiving better external context. A disruption team should receive evidence it can act on. A public report should become more useful once verified and linked to previous observations. For any provider or internal team, the question is whether those connections work in practice.

Take a report that arrived last week and ask the responsible teams to reconstruct its effect. Find the original material, the verified findings and the decisions that followed. Check which partners received usable evidence, what capability changed and whether the outcome altered a control or monitoring rule. Then open a related report that arrived later. If the second analyst still has to rediscover the same operation from scratch, the organisation has found a problem worth fixing before March 2027. The next victim does not benefit from a beautifully completed form sitting inside the wrong system. What did the last report teach your organisation that it can use before the next person pays?

FAQ