What Is Scam Detection? Public Signals, Detection Methods and Human Review

Scam detection means finding suspicious signals in content, accounts, ads and links before a scam causes losses, and passing them to people to verify and act on. This guide explains how scam detection differs from transaction-side fraud detection, the signals a scam leaves at each stage, common detection methods and how to evaluate them, where human review belongs, and what banks, e-commerce platforms, telecom operators and regulators each need.

How does scam detection differ from transaction-side fraud detection?

The two terms are often used interchangeably, but they deal with different situations. The UK Home Office describes unauthorised fraud as transactions made without the victim's knowledge or consent, in contrast to fraud where the victim is deceived into making the transaction; the UK Payment Systems Regulator (PSR) likewise explains that authorised push payment (APP) fraud is being tricked into sending money to a fraudster by bank transfer, which is different from unauthorised fraud such as someone stealing your card to make payments. This is not a fixed split between the two words, but it helps clarify what each kind of detection looks at.

The two complement each other: transaction monitoring can also help catch payments made by deceived victims, scam leads from public content can alert the transaction side to specific scripts or payment patterns, and anomalies on the transaction side can feed new keywords back into monitoring.

Why is scam detection getting more attention?

Take the published official figures: in congressional testimony on 25 March 2026, the US Federal Trade Commission (FTC) said consumers submitted about 3 million fraud reports to its Consumer Sentinel Network in 2025 and reported losing $15.9 billion; investment scams had the highest reported losses at over $7.9 billion, and imposter scams, the most frequently reported fraud since 2020, drew over 1 million reports and over $3.5 billion in reported losses in 2025. According to the FBI Internet Crime Complaint Center (IC3) 2025 report, the center received 1,008,597 complaints with $20.877 billion in reported losses, about $8.65 billion of it in the investment category.

These are figures people chose to report, not total losses, and the two agencies count differently, so they should not be added together. They show that investment and imposter scams account for substantial reported losses, but they cannot be used to measure how well any detection method works.

What signals does a scam leave at each stage?

Most scams go through several stages. Public content monitoring usually sees only the first stage, contact and lure; the later private messages, closed groups and money flows have to be handled by platforms, telecom operators or financial institutions within their own remit.

Common scam signals in public content

None of these signals is enough on its own; usually several appear together, and people still need to verify them:

• Content signals：Guaranteed profits, no-risk returns, limited places, or requests to add a LINE account, send a private message or download an unknown app.
• Identity signals：A name one character off from the official one, a stolen organization logo or celebrity photo, an account claiming to be customer service that is not official.
• Account signals：Newly created accounts, recent name changes, followers clearly out of line with engagement.
• Coordination signals：Several accounts posting near-identical content in a short time, or clustering in the comments under the same kind of post.
• Link signals：Short links, domains that resemble the official one, newly registered websites.

Genuine investment discussion, endorsed partnerships and ordinary retail promotions can use similar wording, which can easily cause false positives. For reading account-level signals, see How to spot fake accounts: four layers of signals and common false positives.

Common scam detection methods

These are general methods widely used in the industry. In practice they are usually combined, and each has strengths and limits:

How do you evaluate scam detection?

• Look at precision and recall together：Measured against predefined, human-reviewed labels, precision is the share of flagged content that truly belongs to the target category, and recall is the share of all target-category content that the system finds. Looking at only one makes it easy to produce a flattering number by moving the threshold.
• The cost of errors：Flagging a legitimate seller or ordinary discussion as a scam can lead to wrongful reports; missing a scam leaves people exposed. The two errors cost different things, so thresholds should be set for the use case.
• When scams are a small share of content：When scams make up a small share of the monitored data, even a low-looking false positive rate can produce more false alarms than real scams. Estimate the reviewer workload along with accuracy.
• Changing scripts and deliberate evasion：Scammers use homophones, split characters and put text into images or video, so evaluation data needs new examples on a regular basis.
• Published numbers need conditions：When reporting detection results publicly, also state where the test data came from and the period it covers, the model version, and how each metric is defined and calculated; otherwise different numbers cannot be compared.

Where should human review sit?

Systems suit large-scale collection, first-pass screening and ranking. The following decisions should be made by people:

• Deciding whether to flag a piece of content or an account as a suspected scam lead, and recording the basis
• Deciding whether to report to a platform, notify the impersonated organization or pass it to law enforcement
• When content involves a specific individual or could affect someone's reputation
• When the model has low confidence, or a tactic appears that has not been seen before

Reviewers should keep verifiable records such as the URL, screenshots and capture time, because scam content is often deleted or renamed quickly. It is best to record the system's result and the reviewer's conclusion in separate fields, so a machine flag is not mistaken for a human judgment.

What do banks, e-commerce, telecom and regulators each need?

• Banks and financial services：Watch for posts and ads that misuse the organization's name, executives or products, and for fake customer service under official posts; these public leads can be cross-referenced with transaction monitoring. For a worked approach, see Financial Impersonation Account Monitoring.
• E-commerce platforms：Fake shops, impersonated customer service and phishing links borrow the platform's name to draw people in. Article 36 of Taiwan's Fraud Crime Hazard Prevention Act requires e-commerce operators to exercise the care of a good administrator to prevent their services being abused for fraud and, once notified by the judicial police or the competent authority that their service may be involved in fraud, to cooperate and suspend the user accounts involved for a reasonable period; Article 37 covers record keeping and responding to data requests.
• Telecom operators：Article 14 of the same Act requires telecom operators to take reasonable measures to prevent their services being abused for fraud, and Articles 15 to 23 cover identity checks at sign-up, re-verification of numbers suspected of fraud, and restricting or suspending service. Telecom-side signals are mostly not public; what public content monitoring adds is the scripts and impersonation circulating outside the network.
• Regulators and research organizations：Track new tactics and scripts and which organizations and public figures are being impersonated, as input to awareness campaigns and policy review; for identifying and reviewing non-compliant ads, see What Is AI Ad Compliance.

What do regulations require of businesses?

The following summarizes only the parts relevant to this guide and is not a complete list of obligations. The official texts in each jurisdiction prevail; consult your legal team or a lawyer on specific cases. This guide is not legal advice.

• Taiwan：Taiwan's Fraud Crime Hazard Prevention Act was enacted and promulgated on 31 July 2024, with some articles amended on 21 January 2026. Chapter 2, on preventing fraud at the source, has three sections covering financial services, telecom and the digital economy; the digital economy section covers online advertising platforms, third-party payment providers, e-commerce and online game operators. The commencement date of some provisions is to be set by the Executive Yuan. The provisions on online advertising platforms are summarized in the financial impersonation monitoring guide.
• United Kingdom：Since 7 October 2024, in-scope APP scams made by UK bank transfer over Faster Payments or CHAPS have been subject to mandatory reimbursement, up to £85,000 per claim (firms may choose to reimburse more), and firms on the receiving end are included in the arrangements.
• Australia：The Scams Prevention Framework Act 2025 sets up a framework that initially applies to businesses in the banking, telecommunications and digital platform sectors that provide designated services, requiring governance arrangements and action to prevent, detect, disrupt, respond to and report scams; according to the Australian Securities and Investments Commission (ASIC), most obligations commence on 31 March 2027.

Limits of detecting scams in public content

• Private messages, closed groups and one-to-one calls are not visible, so what happens after people are drawn off public platforms cannot be followed.
• Collection can have gaps when platforms change, restrict access or content is deleted.
• Detection results can only point to suspicious content and accounts. They cannot establish who is behind them or whether anything is illegal; suspected crimes are investigated by the competent authorities under the law.
• Being publicly visible does not mean content can be collected or used freely; handling posters' personal data still has to comply with personal data protection rules.