The Process Model in One View

A conversational scam can now be seen through three connected layers: the exchange that actually occurs, the structured representation used to study it, and the detector’s inference about what may happen next. This checkpoint connects the Scam Kill Chain, psychological actions, victim responses, and the benchmark construction funnel so the reader can make one practical judgment: a prediction is only as meaningful as the evidence and representation beneath it.

One interaction, three layers of description

Start with the interaction itself. It produces a sequence of turns, but not necessarily a complete transcript. A person may report an identity claim, a move to another channel, a promise, a contradiction, a request, and a response. Some details will be quoted; others will be summarized after the fact. The first layer is therefore observed evidence: what the source makes available about who said what, in what order, and with what reported consequence.

The second layer is the process representation. PreScam organizes the available account into Initial Contact, Engagement, and Termination. Inside Engagement, it aligns scammer actions with victim responses, supporting spans, and psychological-technique labels. This organization makes a hidden sequence easier to inspect. It lets a researcher ask whether a partial history is approaching a decisive phase or whether a particular kind of move tends to follow another.

But the representation is not a second, cleaner reality. It is an interpretation of the first layer. A report may compress several exchanges into one paragraph; the structuralization process must decide how to separate them. A report may describe a threat without preserving the exact wording; the label may capture the technique while the evidence remains incomplete. A conversation may stop before a clear extraction attempt; the model may preserve that incompleteness, but it cannot infer the missing turns simply because the surrounding pattern looks familiar.

The third layer is inference. A detector receives a partial history or a structured prefix and estimates something: perhaps how close the interaction is to Termination, perhaps what future scammer action is likely, or perhaps whether a conversation should trigger a warning. That output is not an observation and not a ground-truth annotation. It is a claim about the future or about risk, made under incomplete information.

stateDiagram-v2 [*] --> OBS state "Partial observed turns" as OBS state "Initial Contact" as IC state "Engagement actions and responses" as EG state "Termination proximity" as TM state "Ambiguous or incomplete" as AM OBS --> IC: opening evidence is available OBS --> AM: chronology or intent remains unclear IC --> EG: interaction continues IC --> AM: exchange stops early EG --> EG: new action and response EG --> TM: extraction or decisive escalation EG --> AM: evidence ends before outcome TM --> [*] AM --> [*]

The layers form a dependency chain, but not a guarantee. If the first layer omits an important turn, the second cannot faithfully recover it.