How Manipulation Accumulates Across Turns
This chapter explains how conversational scams change from first contact to sustained engagement and, sometimes, an attempted extraction. Its focus is the three-stage Scam Kill Chain and the psychological actions attached to it, so the reader can trace a conversation without mistaking a useful analytical model for a fixed script.
Three phases, different objectives
A process model is useful only if its states mean something. In PreScam, the Scam Kill Chain divides a conversational scam into Initial Contact, Engagement, and Termination. These names are not a claim that every scam follows three clean steps. They are a way to ask what the scammer is trying to accomplish at a particular point, what evidence makes that objective visible, and what changes when the conversation crosses a boundary.
Initial Contact is the opening of the relationship or channel. The scammer may appear as a stranger who has made a mistake, a potential romantic connection, a professional contact, or a representative of a plausible situation. At this point, the conversation can remain ambiguous. The important event is not necessarily a demand. It is that the scammer has created a setting in which further interaction seems reasonable. The recipient may answer, ask a question, or move the exchange to another place. Those responses create the conditions for what follows.
Engagement is the sustained middle of the process. Here, the scammer maintains attention and shapes the recipient’s interpretation of the relationship. A persona may offer personal details, demonstrate apparent knowledge, establish shared interests, make promises about a future benefit, or introduce a problem that invites help. The moves can be small. Their cumulative effect is to make the scammer’s story feel more familiar and the recipient’s previous choices feel like reasons to continue.
Termination is the phase in which the interaction approaches a decisive outcome. The outcome may involve a request for payment, credentials, access, secrecy, or another form of compliance. In a victim report, it may also be the point at which the victim recognizes the deception, loses access to an account, or describes what happened after the scammer disappeared. The phase is best understood as the point at which the conversation’s accumulated work is converted into an attempt at extraction or a clear end state. It does not mean that every conversation reaches a successful transfer.
The phases differ by objective, not by word count. A short exchange can move quickly from an introduction to a demand. A much longer exchange can remain socially plausible for a long time before its purpose becomes visible. What persists across a transition is the record of the relationship: the identity that was claimed, the expectations that were created, the requests already accepted, and the recipient’s reaction. What changes is the function of the next move.
Consider a simplified trajectory. A new contact begins with an ordinary explanation for why the two people are speaking. The contact encourages a private channel and gradually presents a coherent persona. Later, the persona introduces an opportunity or emergency. The recipient responds with questions or a small act of cooperation. The scammer uses that response to press for a larger commitment. If the exchange ends before the request, the evidence may show a troubling direction without a visible termination event. If the request arrives, the earlier turns explain why it may seem credible to the recipient even though it would sound implausible on its own.
The lifecycle view makes an important distinction between a transition and a verdict. Moving from Initial Contact into Engagement does not prove malicious intent. It means the interaction has acquired enough continuity for the scammer to use prior context. Moving toward Termination does not prove that the recipient will comply. It means the risk of an irreversible request or outcome has become more relevant. A detector can use these transitions to raise attention without pretending that a phase label settles the case.
The transition from contact to engagement is especially important because it changes what can be remembered. At first, the detector may know only how the contact began and which identity or situation was presented. Once the exchange continues, it can preserve the speaker’s claims, the recipient’s questions, the channel change, and the first signs of reciprocity or pressure. Those details are not equally suspicious on their own. They become useful because they establish a baseline against which later turns can be compared. If the claimed identity changes, if an earlier promise is quietly revised, or if a new request conflicts with the original reason for contact, the earlier state supplies the reference point.
Engagement is not a single state in which nothing changes. It is a sequence of smaller updates. One round may add a personal detail; another may answer a doubt; another may introduce a benefit or problem. The scammer’s objective can remain stable while the method changes, or the method can remain familiar while the pressure increases. Representing Engagement as a sequence of actions prevents a detector from treating the entire middle of a conversation as equally informative. It can ask which move changed the risk and whether the recipient’s response made the next move more consequential.
The transition toward Termination is similarly about function, not just vocabulary. A request for money, access, credentials, or secrecy may be the first unmistakable extraction attempt, but the surrounding state determines how it should be interpreted. A detector should preserve why the request appeared now, what earlier expectations it invokes, and whether the sender has provided a way to verify the claim independently. The resulting alert can be early and cautious: the system may say that the trajectory is becoming dangerous before it can establish every fact about the person behind the account.
These boundaries also explain why a benchmark needs both summaries and action-level evidence. A summary can preserve the direction of the interaction, but a concrete action and its supporting span show what caused the direction to change. A phase label without its underlying move is too coarse for analysis; a list of moves without their phase and order is too fragmented to reveal progression. The useful representation connects the two. It records where the conversation is, what was done, how the recipient responded, and what evidence supports that description.
The diagram includes an ambiguous or incomplete path because real evidence often stops before the story reaches a decisive conclusion. A phase model that allows an interaction to end without a clean termination is more honest than one that fills the gap automatically. It also reflects a practical detection problem: the most valuable warning may need to arrive while the conversation is still in Engagement, when the evidence is suggestive but not conclusive.
Actions make psychology observable
A phase tells us where the interaction is in its broader lifecycle. It does not tell us what the scammer is doing inside that phase. PreScam therefore attaches psychological techniques, or PTs, to concrete scammer actions. A PT is not a permanent personality trait and not a diagnosis of either participant. It is a label for the persuasive function of a particular move in context.
For example, an action may use Pretext and Trust by supplying a story that makes the speaker seem credible. It may invoke Authority by presenting the speaker as someone whose status should be obeyed. It may use Urgency and Scarcity to narrow the time available for reflection, or Fear and Intimidation to make delay feel dangerous. Phantom Riches points in the opposite emotional direction: an attractive promised gain can make an unlikely opportunity feel worth the risk. These labels matter only when attached to an action that the source material supports. “The scammer used urgency” is an interpretation; “the scammer said the account would be suspended unless the recipient acted immediately” is the kind of concrete move from which the interpretation can be grounded.
This is why the benchmark requires an engagement action to be tied to evidence in the report and paired with at least one technique label. The requirement does two things at once. It constrains invention: a model should not create a persuasive round that the victim never described. It also makes the representation useful for analysis: a later system can ask not only whether a conversation is risky, but which kind of move appears to be advancing it. The constraint is not perfect. If an action does not fit the available taxonomy, the process of forcing it into a labeled round may hide ambiguity. Grounding improves reliability without removing judgment.
The distinction between an action and a technique is especially important when the same words can serve different purposes. A statement about money may be a casual discussion, a promise of profit, a fee demand, or a test of willingness to pay. The technique label depends on the action’s role in the surrounding exchange. Likewise, a request to keep something private can be affectionate in one setting, protective in another, or a method of isolating the recipient from outside advice. The label is not a keyword match. It is a claim about what the move is doing at that point in the trajectory.
Victim responses complete the mechanism. A scammer’s action is not an isolated stimulus with a predetermined effect. The recipient may comply, question the story, delay, disclose more information, or refuse. The next scammer move can then respond to that behavior. If the recipient shows doubt, the scammer may offer reassurance or additional proof. If the recipient accepts a small request, the scammer can treat that decision as evidence that a larger request may succeed. The model does not need to blame the recipient to represent this feedback loop. It needs to preserve the fact that the interaction changes after each response.
This also explains why the process cannot be reduced to a list of psychological labels. A list would say that a conversation contains trust, urgency, or authority. A process model asks when each technique appeared, what it followed, what response it produced, and whether it moved the exchange closer to an irreversible request. The order is part of the evidence. Trust-building before a financial request may be more informative than either phrase alone; urgency after a long period of intimacy may be more consequential than urgency in a single obvious lure.
Where the model breaks
The Scam Kill Chain is a scaffold for organizing evidence, not a universal law of deception. Real reports may be retrospective, incomplete, emotionally written, or too brief to separate roles and rounds cleanly. A victim may summarize several exchanges in one paragraph. A scammer may return to an earlier technique after a new problem appears. Initial Contact and Engagement can overlap, and the Termination stage may be described only through its aftermath. Treating the phases as perfectly discrete would add certainty that the source does not contain.
There is a second boundary: a conversation can be suspicious without reaching an explicit extraction attempt. A wrong-number exchange may stop after a setup. A person may become uneasy and leave before a request is made. From a defensive perspective, that is not a reason to ignore the early trajectory. From an evaluation perspective, it is a reason to distinguish “the model recognized a dangerous direction” from “the model predicted a documented termination event.” The two claims require different evidence.
A third boundary concerns variation across scam types. An investment-oriented conversation, a romance scam, an employment lure, and a technical-support impersonation may use overlapping techniques but arrange them differently. The phase model can provide a common vocabulary while leaving the concrete actions open. It should help the reader compare trajectories, not erase their differences.
The value of the lifecycle is therefore conditional. It makes a hidden sequence visible, gives a detector something more meaningful than isolated text to track, and creates a basis for measuring whether risk rises before the final request. But it must preserve uncertainty at the points where the report is silent or the interaction changes direction. The next challenge is methodological: if real conversations are often unavailable as clean transcripts, how can researchers build a benchmark that keeps chronology and evidence without pretending that reconstruction is observation?