What is scambaiting? And why you shouldn’t try it yourself

James Rowe: Scam calls are nothing new, but scambaiting is, and our scams expert has been trying it out for herself. Welcome to Which? Money.

James Rowe: It's James in the Which? studio and alongside me this week I have our scams and fraud expert Faye Lipson. Faye, hello.

Faye Lipson: Hi.

James Rowe: How are you?

Faye Lipson: I am good, thank you. How are you?

James Rowe: I am good, thank you. I do not know whether to believe you or not because for a story you have been writing for the latest issue of Which? Money magazine, you have not entirely been telling the truth. I guess for the research, not for the story. It is about scambaiting. Tell us a bit more.

Faye Lipson: That is right. This was one of the most popular topics last year in the Facebook scams group that Which? runs. The group was pretty much electrified by people talking about their experiences of trying to bait scammers or catch them out. So we decided to actually give it a go using advice and tips from the pros that do this for a living. We had some quite entertaining results out of it.

James Rowe: And we will hear some of those results from a call you actually made with a Scammer a little later on. But should we just start with scam calls to begin with? Because, as I said at the top, they are nothing new. They have been going for 20 years ago – scammers calling up the landline as it was at home then. But they are still going strong, right? Especially to our mobile phones.

Faye Lipson: Absolutely. There are call centres in different parts of the world that actually put in different shifts to target different countries. This is one of the things I learned during this research is that our particular shift in the UK is between about midday and about 4:00. Many people may notice that they get particular concentrations of these calls in the afternoon – even to their mobiles. In fact, primarily to mobiles these days. It is usually something like somebody pretending to be 3 Mobile or someone pretending to be from Amazon or one of a plethora of those kinds of things. It is really a fact of modern life now and people are so used to getting them, I think. But it is still very frustrating for people.

James Rowe: I am really surprised by that. So a lot of these call centres around the world will target specific countries at certain times of the day.

Faye Lipson: That is right. Yes. So one of the things I learned from one of the experts that does this for a living is that around about 4:00 they switch from targeting the UK to targeting the US when people are getting up there and starting their day.

James Rowe: So if you do notice between 12:00 and 4:00, it is because we are the target at those hours of the day. There are attempts and there have been attempts over years and years and years to rein scam calls in. That has been the case, hasn't it?

Faye Lipson: Yes, there is different kind of technology you can employ on your phone. There is kind of devices that can blacklist certain numbers, whitelist certain numbers. But, sometimes if you are receiving an unrecognized call where the number does not appear, it is not always a scam. That puts people in a difficult position, doesn't it? Because it could sometimes be the NHS uses withheld numbers and you kind of want to pick it up just in case it is something important and then you kind of have the annoyance of it is probably a scam and then it usually is. But you do not want to miss something important.

James Rowe: But one of the good things I see it a lot now, and I wonder if it is always between 12:00 and 4:00 in the afternoon, where somebody rings my mobile and it will have a display number on there, but it will also say suspected scam. That is a great development, isn't it? Because it gives you that forewarning before actually deciding whether or not to pick up the phone.

Faye Lipson: Absolutely. Even the display numbers can be false. We have talked about number spoofing in the past. So just because it looks like a recognised number, a UK number or a local UK number – or even the number of your bank – it does not mean it is. Fraudsters can just use many different numbers as a display number and then you would not be able to reach them by returning the call.

James Rowe: And so that is what number spoofing is. So they could be calling from a far-flung country where if they dialled via that number it would be pretty obvious it was from a different country, from a different part of the world, but they almost reroute the phone line effectively. So on your phone, it pops up as an 0800 number or something that looks like a British number and you would be more likely to trust it.

Faye Lipson: Absolutely. So they can just call you through the internet. They do not need a phone line, but then they can pick whatever number they like as the display number that shows up on your device. They can make it look like it is a call from Leeds or Hertfordshire or something and makes you more likely to pick up.

James Rowe: So we do have those instances where we can effectively choose to ignore a scam call, but there are people who are taking a bit of a different stand and taking it into their own hands. So this is called scambaiting. Give us a bit of a background about how this works.

Faye Lipson: Yes, so there is really a difference between people that do it in an ad-hoc way. They have received a scam call, they are really annoyed about it and they just try and toy with the Scammer in that moment. They were not planning to do it. Many, many people, millions of people probably do that.

James Rowe: I can say yes, I definitely do that.

Faye Lipson: Yes, I have probably done it in the past. But what I have learned is that we probably should not do it in that way. There is that kind of scambaiting and then you have the actual kind of vigilante professionals that do this in a really considered way. They have loads of kit to protect themselves. They change their voice, they change their phone number, they spend allocated periods of time targeting scammers in this way, finding scam numbers to call online. And then in really advanced cases, people like Jim Browning, for example – he is quite famous from the BBC show Scam Interceptors – he actually reverse engineers his way into scam call centres so he gets the footage of the scammers while they are making these scam calls to people. So it can get really, really advanced depending on your know-how and your technical ability and the kit that you have got.

James Rowe: So you mentioned a little earlier you started to come across this in one of the Facebook groups that we run here at Which?. Did you know much about it beforehand or was it quite a surprise to see so many people talking about this and taking it on themselves?

Faye Lipson: So I was always aware of the sorts of people that do this on a more professional basis, like Jim Browning, Nick Stapleton, both from Scam Interceptors. But I think what surprised me was the sheer scale of how many people were attempting this just in a kind of amateur, ad-hoc way. I know myself and the social team that run the group were actually a bit concerned by some of the practices that were being described. We were concerned primarily for the people that were doing them – that they might be putting themselves unnecessarily at risk for that kind of admittedly very satisfying "gotcha" moment of feeling like you have got one back on the Scammer.

James Rowe: And how would they be putting themselves at risk by doing that?

Faye Lipson: So whenever you actually respond to a Scammer that has contacted your genuine social media account or your genuine everyday phone number, if you respond to that, you are putting yourself at risk. Because you are showing that the line is active, the account is active, and you are putting yourself at risk of reprisals potentially, particularly if you are kind of quite hostile towards the Scammer. By talking to them, you may give them a sample of your voice which could somehow be used in voice cloning. And it is generally just not really to be recommended. Another thing that Becky Holmes – she runs quite a successful X account where she baits romance scammers – and when I spoke to her, she said another mistake people make with these kind of amateur, ad-hoc attempts is that they will unwittingly teach the scammers how to be better by kind of having that "gotcha" moment of saying, "Oh, British people do not speak like that," or, "I know you are from X country because you used a phrase."

James Rowe: So they are almost training the scammers.

Faye Lipson: That is right. So she warns, actually, that well-meaning but very flawed attempts at amateur scambaiting actually train – actually help these scammers to get better at what they do, which is really unfortunate.

James Rowe: And Becky is great. We had her on the podcast just over a year ago talking about her brilliant book and what she has done to try and expose scammers. We will pop a link in the show notes if you want to go back and listen to that one. But when you have been speaking to these experts and you have been reading some of the stories from real-life Which? members who have been doing this a bit more on a casual basis, is this what inspired you to want to almost give it a go yourself?

Faye Lipson: Yes, so I think I wanted to show the difference, the gulf between how the professionals do it with safeguards in place and how different that is from just doing it in an ad-hoc way using your own name and personal details being exposed. They are really, really different things. And that is why I kind of go on this journey of speaking to people that do this professionally and learning from them before I attempt anything.

James Rowe: So for your experience then, you wanted to speak to a Scammer and do what we call scambaiting. Let us talk about the logistics of it because this is what really interests me. Did you just have to sit there and wait for a Scammer to call you?

Faye Lipson: No. So although that is always quite likely any afternoon with I do not know about other people's phones, but my phone gets targeted a lot. No, so I didn't. So through speaking to professionals that do this, I learned of a particular forum online where people actually post scam websites that have just cropped up or that they have just spotted. And through monitoring this forum, I was able to find a scam website that was – it had a specific UK phone number as in it was a tech support scam that was targeting people in the UK. So it had a UK phone number that you could phone to get this fake tech support to set up your printer. And so I had – I changed my number, I changed my device, and I phoned this number on purpose posing as somebody that had stumbled upon this scam website and thought it was genuine and needed help with their printer.

James Rowe: So you had a different phone and a different number obviously to not expose your own mobile number and become a target for the future.

Faye Lipson: Exactly. Yes. And I also kind of did checks of the website to make sure it really was a scam, it wasn't just a genuine tech support website. It definitely was. So it is quite involved to do it properly. I also had to kind of sit and monitor the forum for a few days before I found something that was suitable for the scambaiting attempt. So, yes, and then of course I had to be available for the initial kind of 15-minute fake triage call that I had to do and then available again for another half an hour when they actually called me back.

James Rowe: Well, let us start with that initial call. So as you say, you called them rather than waiting for the Scammer to call you, and you were calling up pretending to be a normal human who is struggling to set up their brand-new printer. This is what happened when Faye rang that scam number.

Scammer: Hello.

Faye Lipson: Hello.

Scammer: Yes please?

Faye Lipson: Hi. Is this HP support?

Scammer: Yes, this is the support department. How can I help you?

Faye Lipson: Thank you. I am trying to get a new printer set up on my laptop, and I have had a pop-up appear that just says "fatal error" or something like that. I can't...

Scammer: What printer are you using?

Faye Lipson: It is an... let me have a look. Let me just go and find the box. Bear with me one sec.

James Rowe: We heard you there. I mean first of all, I was lucky enough to hear the full phone call as well, but I think people will be able to tell there that you are definitely playing a character there, aren't you? You do not sound confident, you do not sound self-assured like you do now. So you are almost playing into their hands, aren't you? To sound confused and almost an obvious target for them.

Faye Lipson: Yes, so like many people I have had bewildering printer problems. I know what it is like.

James Rowe: I had some over the weekend, in fact.

Faye Lipson: They are the most unbelievably frustrating bits of tech. Even for someone like me that knows a little bit about this stuff, they are unbelievable. So I do not think it was too far out of character. But, yes, I think it is fair to say that I was trying to sound confused, trying to slow my speech down like somebody that is not really sure what information they are trying to find or – and it was definitely a role that I was playing.

James Rowe: And I guess though for a Scammer, if they hear somebody like that, they are going to think, "Okay, great, I have got a great target here, they are going to go along with everything I say here." But for you in that moment across that phone call, what were you feeling? Because you are playing a role, you know that Scammer is almost playing a role. What were you feeling at that time during that first call?

Faye Lipson: It is a very bizarre feeling. I suppose, yes, trying to be conscious of sounding natural whilst doing something that is anything but. And wondering what was going to be asked of me and whether I could react fast enough. So if they were to then at that point ask for my card details, what would I do in that moment? Because I was never going to provide them with genuine card details, for example. You kind of have to act very confused but think very quickly at the same time. It is really actually quite an unpleasant feeling listening to how professional, calm, and reassuring the Scammer sounded. Knowing full well that they are a Scammer, they are quite likely going to try and get my payment details or access to my device very shortly thereafter. It is horrible listening to them be so slick. It kind of leaves a bad taste in your mouth, really, knowing that most of the people they speak to perhaps might be genuine victims or future victims. It is a very strange sensation.

James Rowe: Yes, I bet. And in the magazine piece, a sentence of seven words long you say, "So please don't try this at home." And I guess at that time you are writing this in the piece because you are concerned about the risks for other people to do this. Are you also concerned about your own safety or maybe slipping up and giving away some real information that might out you as who you really are?

Faye Lipson: Yes, it is a difficult balance, isn't it? So I felt like I was playing a character, but it is easy to slip up, isn't it? I suppose the risks were lower because I was using a fake number, a throwaway number. But it is always possible to slip up and give something away. And there are cases where professional scambaiters have done it. I highlight one in my piece, in fact, where Jim Browning ended up engaging with a Scammer using his genuine Gumtree account, I think it was, and it went really badly. And was a quite good lesson for him on how important it is to always, always use fake details and accounts.

James Rowe: And for him, as you say, we might have seen him on TV on Scam Interceptors on the BBC. Jim Browning – not his real name. He disguises his voice and all sorts of things because he does it at such a professional level. Whereas for you, it is a bit different because you do it very casually for research purposes. The first call then – so you are pretending to look for your glasses, look for this model number of printer. Did you even have a printer, by the way?

Faye Lipson: No. It was all deception.

James Rowe: So at the end of that first call, how does it end? They say, "Okay, we are going to call you back." How does that first call end?

Faye Lipson: Yes, so that first fake call is that call is like a fake triage process where they are gathering data. They are pretending to be a genuine tech support service so they want to know the model of my printer, they want to know the error code that is coming up. And I am simply making it up or looking up model numbers off the cuff making it up. And then they say, "Right, we will call you back in," I think 15 minutes or half an hour. And at that point we just ended the call and you are kind of hoping weirdly enough that they do phone you back even though you know it is going to be a scam. You want them to phone you back so you can understand how the scam proceeds.

James Rowe: And in this instance you are working from home, I guess. You are trying to do other things that you normally do for work and then but also just watching that phone and praying and hoping that it will ring soon so you can execute the rest of your scambait, right?

Faye Lipson: Yes. You do not want to go for a wee or anything. We made the conscious decision to do this at home because there is a risk, I suppose, if you are doing it in the office that officey sounds in the background will be more suspicious to the Scammer.

James Rowe: So they do call you back. And again, they are looking for that model number again and you are playing the part of going, "Oh, I can't find it," and then you are playing this character who has never had a printer before, you often go to the library to use a printer. You have turned your computer off, you say, to waste a bit more time. Where did you get these tactics from? Is this from analysing the ways other people do this kind of thing?

Faye Lipson: Yes, I listened to lots of calls from people that do this professionally. I watched videos on YouTube of people like Jim Browning, Kitboga. And got lots of tips on how to kind of slow things down, waste time. And some of them were just off the cuff really, I suppose, in response to what the fraudster was saying. But, yes, I think saying that I had turned my computer off in frustration was just to buy a bit of time while I rebooted it, which I wasn't really doing. So, yes, it was just an attempt to waste time in the most kind of plausible, not far-fetched sounding way that I could.

James Rowe: And then we get to the point, and I guess this is the crux of the scam, isn't it? This is the meat on the bone of what they are trying to do. They ask you to download a program called AnyDesk. What is that? What were they trying to do?

Faye Lipson: Yes, so this is a big red flag. This is a classic tech support scam red flag. This is a program that gives them access to your device. And that is really dangerous. I mean in some contexts, like for example in a workplace, your own genuine IT department might use it to remote into your device.

James Rowe: Because it is a legitimate program, isn't it?

Faye Lipson: Exactly. In the hands of genuine people, it is a genuine tool to help people with tech support issues. But when it is a number off the internet and it is somebody pretending to be HP, and they are trying to remote into your device – that is bad news. So, yes, it is a program and if you give them – if you download it and give them the unique code that is shown on your screen, it gives them access to your device and then that kind of opens the floodgates for all sorts of horrible things like them accessing your bank account and installing tracking programs to pick up your passwords and things like that. It is very bad news.

James Rowe: So you give them the code – if you ended up following it through, you would give them the code, they type the code in on their computer, and then it gives them this remote access to your computer. They could be thousands of miles away, but they could control your computer. They could click on anything they want, they could find your details and in the click of a finger, you have got no money left. That is the worst-case scenario, isn't it?

Faye Lipson: Exactly. They could sort of get you to log into your online banking, then they can see everything you are inputting and then they are in and they can show you a false screen while behind the false screen they are actually in your bank account transferring money out. It can be disaster. And the way you can deal with this as a scambaiter kind of varies. So the really sophisticated way that, for example, Jim Browning might deal with it is by having something called a virtual machine. So it is like a virtual clone of his genuine machine, but they can't reach anything genuine on it and he might let them in – actually let them in on purpose to that. But what I did in this case was just generate random numbers of the right length of an AnyDesk code and just give them and just change them slightly each time sounding confused and perhaps like I couldn't see the screen very well.

James Rowe: So you didn't download AnyDesk at all. You said you did in the call, didn't you? You said, "Yes, I've downloaded it," but you didn't actually download it.

Faye Lipson: No, I didn't download it.

James Rowe: Well, let us listen to that. So here is a clip from one of those scam calls that Faye was on one end of and the Scammer has just asked Faye for that AnyDesk code to access her computer.

Faye Lipson: It is 606 – I hope this is the right one – 606 481 824.

Scammer: No, ma'am, you are giving the wrong number. Is it 1606?

Faye Lipson: Bear with me.

Scammer: On the AnyDesk it will give you your address. You have to give me that.

Faye Lipson: Address. Sorry.

Scammer: Ma'am, I am asking like when you double-click on the orange and white icon, what it says after that? Like you were saying it is on your computer screen, in your computer. Once you click on download now, something downloaded on the top-right corner.

Faye Lipson: Top-right corner. I can see there is like a rectangle, it popped up and it has like a long number on it.

Scammer: What is the number?

Faye Lipson: 7498 67471.

Scammer: Did you close the website or the website is open still?

Faye Lipson: Which website, sorry?

Scammer: The anydesk.com.

Faye Lipson: Yes.

Scammer: I'm sorry, is it closed or is it open?

Faye Lipson: It is open.

Scammer: And what do you see in the middle of the computer screen? Anything is shown? Is it saying something?

Faye Lipson: In the middle of my screen?

Scammer: Yes, what do you see right now?

Faye Lipson: It has the AnyDesk box and the background, the desktop.

Scammer: What is written? Can you tell me what is written over there?

Faye Lipson: Yes, it is the number, the number...

Scammer: And what else? Apart from the number, what else do you see?

James Rowe: We will leave that there. It was a bit of a lengthy clip, but I thought it was really interesting to hear a big chunk of that of you just wasting their time, just deceiving them as much as they were trying to deceive you. At the end of that clip, you then just said, "Bear with me," as you were going to find something or other. And you just go silent for the best part of a minute. I mean, did you feel awkward at all? Because I feel like I might feel a bit awkward just sort of leaving them hanging for a bit.

Faye Lipson: Yes, you know, I was wondering how far can I – you really do not want to blow the cover. You do not want to make it so implausible that they just hang up on you because you really the aim is to waste as much of their time as possible. So you actually have to appear really plausible. So it would have been tempting to go away for five minutes, make a cup of tea, but then they would have just got wind of what was happening and hung up, wouldn't they? So it is a fine line, really.

James Rowe: Talk to us about how the call ended then, because clearly they didn't manage to access your computer. Did they just give up or what did they say?

Faye Lipson: Yes, so I kept – I looked up the right length of what an AnyDesk code would be and just kept generating random ones and then changing them ever so slightly every time that he frustratingly asked me to read it out again, I would just change it slightly. And after a while, he just sounded really baffled and said, "I think there must just be an issue, I think a technical issue." I do not know if he meant with AnyDesk. And he said, "We will call you back in half an hour."

James Rowe: And did they?

Faye Lipson: No.

James Rowe: Do you think at that point they caught wind of what was going on or do you think they just thought, "We are not going to get anywhere any time soon with this individual, let us move on to somebody else"?

Faye Lipson: Yes, I think they might have been suspicious. They didn't sound suspicious. I think they maybe just thought perhaps this is somebody that is really quite incompetent and we won't get anywhere with them. But the thing that makes me wonder if they did suspect was that the website, the actual scam fake HP support website itself where I had got the number from went down quite shortly afterwards, just I think a few minutes later, perhaps half an hour later. I found that it had gone down already. So I do not know. It is also possible that at the same time I was doing this, because I had found it on that scambaiting forum, there may have been other scambaiters targeting them at the same time. So they – that call centre may have kind of got wind of the fact that we are having a lot of time-wasting calls right now, we have probably been exposed, let us shut down and restart on a different number and web address.

James Rowe: Because that is the thing, isn't it? The website could well be closed down, but this scam call centre, wherever it may be, will just make a new website, change the number it looks like they are calling from or the number you would call them on and they could be going again the following day, the same day even, because they probably have another website going somewhere else.

Faye Lipson: Absolutely. I think these guys can set up again and again and again and they perhaps kind of expect to be rumbled and to have to set up again. So, yes, it is this is what I think people really need to understand – it is a lot of equipment, it is a lot of know-how, it is a lot of time on your part just to waste a small amount of their time and they probably will crop up again shortly afterwards. So it is I think it is something that is not worth the risk and it is probably not worthwhile for amateur attempts.

James Rowe: Yes. And one thing I saw in the piece which really struck me is that obviously for every minute of a Scammer's time you waste, you are also wasting the exact same amount of your own time. It doesn't seem that time effective, does it?

Faye Lipson: No. So it is not very efficient. It I mean some people do it, so there is as I say, communities of people that do it. But increasingly, I think you will see people using AI voice agents instead so that they are not using their own time to do this. And that is what a YouTuber scambaiter called Kitboga does quite effectively – he will send voice agents to kind of clog up a whole scam call centre and it is not him doing it. But then he does, I suppose, spend hours listening back to it all afterwards. So it is really quite labour intensive to do. And the risks of doing it on your own details without the kind of technical know-how are not worth it.

James Rowe: And also one thing I never really considered this before, but again you wrote in your piece about how for a lot of scammers, it is not necessarily their choice to be a Scammer because of where in the world they might be living and calling from. They might be in poverty and this could be possibly one of the easiest and quickest ways for them to make some sort of living.

Faye Lipson: Yes, there is all sorts of factors. There is poverty, there is coercion in some cases. In really horrible cases that have been exposed in documentary series, for example, there are kind of compounds where people are held in modern slavery. So, yes, I think we are really keen that even when people engage for real in a professional way with safeguards in place, we wouldn't necessarily encourage people to be vindictive. And some of the things that people talk about doing like blowing whistles down the phone and stuff are actually really unethical. It can cause allegedly cause hearing damage. It is very unpleasant for people on the other end and you do not know what situation they are in. So, yes, there is just so many reasons why it is just not a good idea, including kind of alerting scammers and educating them unwittingly.

James Rowe: Yes, and you mentioned a lot of those risks already over the last half hour or so. And I guess you would reiterate those again to people who are listening going, "Oh, that sounds really interesting, I want to give it a go." You would want to say to people, "You don't want to do this."

Faye Lipson: No. There is I mean first of all, there are people doing it very effectively with high level of safeguards already – people with very large followings. Secondly, you need a lot of know-how yourself to be able to do it safely and even then the professionals like Jim Browning can slip up occasionally. He ended up being exposing his partial postcode and being sent like quite horrible adverts for undertakers in the region. So that is basically a death threat, isn't it? Other scambaiters have had death threats. So, yes, even on the professional side, I do not feel there is a need for people to set up with this. But certainly on the amateur side, people should not be just doing this in response to scam calls, emails or social media messages they receive. The risks are just too high.

James Rowe: What would you say to people then to do instead? I guess it is just a case of if you come across a scam in any context – email, a call – report it? Is that the best thing to do?

Faye Lipson: Absolutely. Report it and talk to people you know, your loved ones, your friends, about the scam attempts that you are seeing, about the methods that you are seeing scammers use. Because raising the consciousness of people is going to be more effective than kind of like wasting one Scammer's time and your own time in the process.

James Rowe: It is interesting. It is an interesting story to tell people as well, isn't it? You go, "Oh, you will never guess what happened to me. I think I was almost scammed," and then you educate other people at the same time.

Faye Lipson: Exactly.

James Rowe: And for reporting scams, what is the best process? It is different depending on where you are in the country as well, in some cases, right?

Faye Lipson: Yes, so I think in England, Wales and Northern Ireland, you use a service called Action Fraud which is like a police cybercrime reporting centre centralised. In Scotland, you contact Police Scotland. And then if you find, for example, a scam website, you can report it to the National Cyber Security Centre and they can do takedown requests. If you see scam content on social media platforms, for example, there is usually like a drop-down in one corner where you can report it as fraud or spam or whatever it may be, fake news. And just by relentlessly doing that, you will kind of put these sorts of sites and numbers onto the radars of the people that can take enforcement action.

James Rowe: And of course our scam alert newsletter.

Faye Lipson: Of course.

James Rowe: Well worth signing up for that. We have got about half a million people who are already subscribed to that and that email comes to them every Thursday with all the latest scams we have seen to help you keep ahead of those as well. But for now, Faye, thank you very much.

Faye Lipson: Thank you.

James Rowe: Thanks for listening to this podcast from Which?, the UK's consumer champion. You can find plenty more advice about what we discussed today in the show notes. There you will also find a link to become a Which? member for 50% off the usual price, an offer exclusively available to you, our podcast listeners. Joining Which? will not only give you access to all of our product reviews, our app, one-to-one personalised buying advice and every issue of Which? magazine across the year, but you will also be helping us to make life simpler, fairer and safer for everyone. Don't forget to head subscribe wherever you are listening. That way you will be notified whenever we release a new episode of Which? Money, Which? Shorts or another podcast that we make for you. And if you want to get in touch with us, then follow us on social media. We are at WhichUK or you can drop us an email to podcasts@which.co.uk. See you next time.