The Anatomy of a Modern Scam: Six Stages, $40B in Profits, One Playbook

When most people picture a scam they picture a single bad actor at a screen. The real thing looks more like a global outsourced industry. The UN Office on Drugs and Crime now estimates that scam compounds in Southeast Asia alone generate close to $40 billion in annual profits, run by transnational syndicates that buy leads, license software, employ trafficked labor, and cash out through a network that would make a legitimate fintech blush. In the US, the FBI’s Internet Crime Complaint Center logged $20.9 billion in losses for 2025, a 26 percent jump in twelve months. The FTC believes the true total, after you account for underreporting, could exceed $150 billion a year.

Most coverage treats each scam type as its own thing — pig butchering, business email compromise, romance, smishing, deepfake CEO calls. What they share is the assembly line that produces them. Every modern scam moves through the same six stages, and every stage has its own vendors, its own pricing, and its own conversion rates. Once you see the spine, the individual scams stop feeling random.

Stage 1 — Targeting

The opening move of any scam is buying a list. Breached email files, leaked phone numbers from telco resellers, scraped LinkedIn data, and “fullz” packages (the underground term for a complete identity record) all trade openly on Telegram channels for somewhere between fractions of a cent and a few dollars per record, depending on freshness and credit-line history. The FTC found that roughly 30 percent of US consumers who lost money in 2025 said the scam started on social media; half of those started in a direct message, the rest in an ad.

Modern targeting is not random. A pig-butchering operator wants a 40-year-old with disposable income and a recent crypto search history. A BEC operator wants the controller at a 200-person firm three days into a CEO’s international trip. Both are achievable from public data plus a Telegram subscription. AI has compressed the cost of segmentation to almost zero, and the rest is volume. Our writeup of social engineering against SMBs covers what the B2B version of this looks like up close.

Stage 2 — Pretext

Once a list exists, scammers need a believable cover. The economics of looking real have collapsed. The simplest phishing kits — convincing fake login pages for Microsoft 365, Coinbase, Chase, FedEx, your local toll authority — sell on dark-web forums and Telegram for under $25. Subscription “Phishing-as-a-Service” platforms like Tycoon 2FA, Mamba 2FA, and Sneaky 2FA charge $200–$350 a month and ship with multi-factor-authentication bypass built in. A scammer with $300 and a Telegram account now has tooling that would have required a small development team two years ago.

The other side of pretext is live impersonation. Voice cloning needs as little as three seconds of clean audio for an 85 percent match. Industry estimates put 40 percent of business email compromise attacks as AI-generated in 2025, up from less than 5 percent in 2023. Average loss per AI-augmented BEC incident: $4.1 million, more than triple the $1.3 million average of a traditional one. The fake CEO call, covered in our neo-phishing writeup, is no longer the most sophisticated thing in the catalog. It’s the floor.

Stage 3 — Grooming

This is the stage that turns the funnel from a crime into an industry, because grooming requires labor. A pig-butchering script can run for weeks or months. A romance scam can run for over a year. Somebody has to type those messages — in fluent English, in fluent Mandarin, in fluent Tagalog, at all hours of the day. Most of that labor now happens inside industrial-scale compounds in Cambodia, Myanmar, Laos, the Philippines, and (increasingly) parts of Africa and the Middle East. INTERPOL estimates that 74 percent of known scam-compound trafficking victims between 2020 and 2025 were brought to Southeast Asia, often after being lured by fake job postings on legitimate platforms. UN experts have called the situation a humanitarian and human-rights crisis.

These compounds run on quotas. A worker is expected to keep a victim “warm” across dozens of chat windows simultaneously, escalating in scripted increments: first the wrong-number text, then casual chitchat, then a photo, dinner plans, and weeks later the first mention of an investment “the family handles.” Workers who miss quotas get fined or worse. Workers who exceed quotas get a cut. The economic logic is straightforward: every additional week of grooming raises the eventual ask, and the labor cost is functionally zero. Our deep dive on pig butchering and the family-side romance-scam guide walk through what the conversations actually look like at this stage.

Stage 4 — The Ask

Eventually the chat has to convert. This is the moment of truth in the funnel, and the conversion rates are uglier than people assume — uglier in the scammer’s favor, that is. Verizon’s 2025 Data Breach Investigations Report pegs the average email phishing click rate at 2.7 percent; SMS-based smishing runs five to twelve times higher, between 19 and 36 percent depending on the lure. Median time from delivery to click: 21 seconds. Median time to report the message to IT: 28 minutes. The gap between those two numbers is the entire game.

For non-email scams the math is different but the principle is the same. The ask in pig butchering is a deposit on a fake exchange. In BEC it’s a wire to a freshly opened account. In voice scams it’s a Venmo, a gift card, or cash to a courier in a parking lot. The unifying tell is friction-free urgency: a payment method the victim hasn’t used in months, a clock that prevents a call-back, and a story that punishes hesitation. Our AI voice-cloning guide covers the “hang up and call back” reflex that breaks this stage on its own.

Stage 5 — Extraction

This is where the money actually leaves. In a pig-butchering case it moves to a self-custody crypto wallet the victim sets up at the scammer’s direction. In BEC it’s a domestic ACH or wire to a “vendor” account. In imposter scams it’s a gift-card balance or a stack of cash handed to a stranger in a parking lot. Whatever the channel, the goal is the same: get the funds into a form the downstream laundering desk can handle, before the victim or their bank notices.

The dollar figures here are the only reason the industry exists. The FBI IC3 noted that complaints involving digital assets reached almost 150,000 in 2024, with $9.3 billion in associated losses — a 66 percent year-over-year increase. Chainalysis’s 2026 Crypto Scam Report put total crypto-related scam losses at $17 billion globally for 2025, with AI-influenced impersonation up 1,400 percent year-over-year. From the syndicate’s perspective, extraction is when invoices get paid. From the victim’s perspective, it’s the moment when, in retrospect, everything they trusted about the conversation flips.

Stage 6 — Laundering

You’d think the cash-out is where modern law enforcement would have the upper hand. Sometimes it does. Mostly it doesn’t. Money mules — people who let funds pass through their personal bank accounts in exchange for a small cut, or who think they’ve found a “payment processor” side hustle on Instagram — are still the most common cash-out rail. The UK’s Financial Conduct Authority reported 226,957 suspected mule accounts closed by 37 of its largest banks in the year ending August 2025, a 23 percent year-over-year increase. India’s regulators logged about 38,000 mule cases in the first quarter of 2025 alone.

For crypto proceeds, the dominant route is USDT on the TRON network — fast, cheap, and liquid enough to absorb millions per minute without slippage. TRM Labs research found that 75 percent of pig-butchering wallets show clear on-chain laundering behavior, often splitting a single victim’s funds across more than ten exchanges. Counterpressure is real but selective. In August 2025, Tether froze roughly $50 million in USDT linked to a single Southeast Asian pig-butchering ring. The FBI’s Recovery Asset Team froze $561 million in 2024 using its Financial Fraud Kill Chain process, with a 66 percent success rate on flagged cases. Encouraging numbers in isolation. Held against the $20.9 billion that left victims’ accounts, they’re a rounding error.

What this changes

Most defensive thinking treats scams as discrete events. The lifecycle view treats them as a pipeline, and a pipeline is something you interrupt. The stages where the scammer’s economics are weakest — and therefore where ordinary defensive habits punch above their weight — are the first and the fourth.

Stage one is interrupted when targeted leads stop being valuable. That means less public personal data in places that get scraped, fewer SIM-card recycles tied to your real identity, and a healthy paranoia about giving a phone number to anything that isn’t a doctor, an employer, or a bank. Stage four is interrupted by the single hardest habit to learn and the single most effective: refuse to act on any unsolicited request that uses a new payment channel, in a new direction, on a clock you didn’t set. Adding 60 seconds of friction breaks the funnel.

Everything else is downstream of those two moves. If you want a thirty-minute test of where your household or team is most exposed, our scammed family recovery guide covers the playbook from the victim side, and the business incident-response guide covers the equivalent for organizations. The May 2026 scam-trends roundup tracks which specific lures the funnel is shipping this month.

The industry on the other side of the screen has gotten very good at this work. The encouraging news is that the spine of its playbook hasn’t actually changed in fifteen years. Only the cost of running it has.