Scam Anatomy: The Six-Stage Blueprint Behind Every Fraud, From the First Message to the Vanishing Act

In Fuquay-Varina, North Carolina, someone lost over $750,000 to a cryptocurrency investment scam. The person who took it had spent six months building a friendship first. Not six days. Six months. No request for money in the first conversation, or the second, or the twentieth. The financial ask came only after trust had been constructed so carefully that parting with large sums felt like a reasonable thing to do.

That is not an exceptional case. It is a textbook one. And the assumption that it could never happen to you (that a fraud victim must be unusually credulous, or elderly, or financially illiterate) is itself one of the most useful things a scammer has going for them. It keeps victims silent out of shame, and it keeps everyone else off guard.

This guide does not catalogue scam types. Plenty of those lists exist. What it does instead is pull back further: the six stages that any fraud must pass through, why those stages work on human brains, and what the machinery looks like once you can see it from the outside.

The scale, in figures

Reported losses to fraud and internet crime have roughly tripled over the past five years, in every geography where governments collect the data. The table below draws on three primary sources: the US Federal Trade Commission’s Consumer Sentinel Network, the FBI’s Internet Crime Complaint Center, and India’s Ministry of Home Affairs statement to the Lok Sabha in 2025.

A few things stand out. First, the India number nearly tripled in a single year: a pace that reflects both growing digital financial penetration and improving complaint infrastructure rather than a sudden epidemic of new scammers. Second, the FBI and FTC US figures are not double-counting: they collect through different channels with different inclusion criteria. Third, the FTC flagged something structurally alarming in its 2024 data: the share of reporters who actually lost money jumped from 27% to 38% in one year. More people who were targeted got taken, not just more people targeted.

These are still only the reported numbers. Fraud researchers consistently estimate that reported figures capture a small fraction of actual losses, for reasons explored later in this guide.

The six-stage blueprint inside every scam

Fraud is not improvised. Whether it runs for six minutes or six months, whether it targets a retiree’s savings or a company’s payroll, every scam passes through the same six operational stages. The stages differ in duration and in disguise. They do not differ in sequence.

Simpler scams (a fake KYC text, a lottery prize notification, a parcel-fee message) compress this into minutes. Stages 3 and 4 collapse into a single interaction. But the logic is identical: establish legitimacy, create desire or fear, extract payment, leave. The duration changes. The architecture does not.

Why these six stages work on people who know about them

This is the part most awareness campaigns skip, because it is uncomfortable. Understanding the psychology is not the same as being immune to it. Researchers at Oxford identified seven psychological frameworks that scammers systematically apply. You do not need to know all seven. The three that matter most are these.

Sunk-cost pressure. Once someone has made three successful small withdrawals from a platform, they have a profit record. When a withdrawal is blocked and a fee is demanded, paying the fee to recover everything feels rational against the cost of walking away from an already-proven balance. The scammer did not create this logic. They created the prior wins that the logic now runs on.

Authority and urgency combined. Impersonation scams work because our brains are trained to act when authority speaks with urgency. A phone call from someone claiming to be your bank’s fraud team, speaking quickly and telling you your account is at risk, is not triggering stupidity. It is triggering the correct response to a genuine bank fraud alert: just on false premises. The scenario has been engineered to activate a rational decision-making shortcut, then redirect it.

Commitment and consistency. Scammers ask for small steps of compliance long before asking for money. Can I call you again tomorrow? Will you share this article I found interesting? Can I show you one more trade? Each yes makes the next yes slightly more likely. By the time a large financial request arrives, you have already said yes dozens of times, and "no" requires overturning a pattern you have been building for weeks. This is not a character flaw. It is how trust is normally built between people, and scammers simply reverse-engineer it.

The other four frameworks (social penetration, attachment theory, Maslow’s needs hierarchy, and interdependence theory) are operating alongside these three. Together they explain why the average pig-butchering victim is not someone who responded to a Nigerian prince email. They are someone who had a six-month friendship that felt entirely real, because the work that went into constructing it was extensive and methodical.

The five scam types that account for most of the money lost

The six-stage blueprint runs underneath all of them. What differs is the disguise, the channel, and how much of Stage 3 they invest in.

Investment and crypto fraud is the single costliest category globally. The FBI logged $6.57 billion in investment fraud losses in 2024; the FTC counted $5.7 billion from the same category. Pig butchering (romance-first, investment-pitch-second) is its dominant variant. The fake trading platform is the vehicle; the relationship is the engine. These take weeks to months. They are also the hardest to detect mid-run because the platform renders genuine-looking charts and account statements.

Impersonation scams cover anything from a call claiming to be your bank’s fraud department to a text pretending to be a government tax authority or a courier company holding a parcel. In India, KYC expiry texts, FASTag fraud messages, and electricity disconnection warnings all fall here. The FTC counted $2.95 billion in losses from imposter scams in 2024. These run fast: the goal is to provoke action before the target has time to verify. The key marker: genuine urgency, combined with a request to pay via an unusual method (gift cards, UPI to a personal account, cryptocurrency).

Job offer fraud has accelerated as AI tools lower the cost of faking recruiter correspondence. A realistic-looking offer letter, a request for an upfront fee for onboarding or equipment, and a starting salary 50% above market are its tells. The FTC’s 2024 data showed business and job-opportunity reports generating $750.6 million in losses: up roughly $250 million from 2023. These scams often run through LinkedIn, WhatsApp, or free email accounts rather than corporate addresses.

Advance-fee and lottery fraud are the oldest category and still operational because the margins on mass contact are low enough that even a low conversion rate is profitable. You have won a prize, an inheritance, a legal settlement. To release it, a fee must be paid. The fee grows with each payment. Nobody ever receives a prize because the prize does not exist. These scams disproportionately target people who have recently searched for money-related terms online, and scammers acquire their contact lists accordingly.

Tech-support scams are among the most effective against older computer users: a realistic-looking pop-up declaring a virus infection, a phone number to call, a remote-access session that confirms the "problem", and a fee to fix it. The FBI noted tech-support fraud generated $1.46 billion in losses in 2024. The damage compounds when scammers use the remote-access session to install software that enables subsequent account access.

The silence trap: why most of this goes unreported

The reason fraud statistics are almost certainly undercounts is not simply that victims cannot be bothered to file a complaint. Research from the FINRA Foundation and multiple peer-reviewed studies consistently identifies the same barrier: shame, and the fear of being blamed.

Victims frequently hide fraud from family and colleagues because they anticipate the response will be "how could you fall for that?" The scammers know this. In long-running investment scams, targets are often told early in the relationship, framed as a confidence, not to mention the investment to family members, who "might not understand." That instruction is not about protecting a financial secret. It is about severing the support network most likely to raise an objection or seek outside verification.

The psychological harm from fraud, documented in the NIH’s Public Medical Commons, is comparable to bereavement. Victims report anxiety, self-blame, and social withdrawal that persists long after the financial loss itself. The prevailing culture of treating fraud as a personal failing rather than a designed attack makes this worse. Fraud is not primarily a story about greed or naivety. It is a story about operational expertise applied to human psychology.

In India, where ₹22,845 crore was lost in 2024 and nearly ₹5,500 crore was recovered through early intervention, the gap between complaints filed and money recovered hints at how much is never reported at all. Under-reporting is not a victim problem. It is a design outcome: engineered, like every other part of the fraud.

Three questions that slow the machinery down

The six stages require the target to act before they reflect. Almost every scam, at some point, creates artificial momentum: a deadline, a one-time opportunity, a crisis that cannot wait. That urgency is not incidental to the fraud. It is structural. Slowing down is the intervention.

These questions work not because they reveal the scam directly, but because they create a gap. That gap is what scam architecture is designed to prevent. Using it is not paranoia. Nothing else works as well.

If the money has already left

Speed is what determines whether recovery is possible. Once cryptocurrency has moved or a UPI transfer has settled, the technical window for reversal closes quickly.

In India: call the national helpline 1930 (Cyber Crime Helpline, operational 24/7) as soon as possible. File a complaint at the National Cyber Crime Reporting Portal at cybercrime.gov.in. The faster a complaint is registered, the higher the probability that funds frozen in mule accounts can be held for investigation. India’s I4C flagged 24 lakh mule accounts in 2024 and prevented an estimated ₹4,631 crore from clearing: that prevention only works on money in transit, not money already gone. If your own account has been frozen as part of a cyber-fraud investigation, that is a separate process with its own procedures.

In the US: file at reportfraud.ftc.gov and at ic3.gov(the FBI’s complaint portal). Contact your bank immediately even if the transfer has completed: banks have internal dispute processes and in some cases can initiate a recall. For investment fraud involving cryptocurrency, the FBI’s IC3 has a Virtual Asset Unit specifically for these cases.

Tell someone. Not because they can fix it, but because isolation after fraud compounds the harm, and because a second person can help verify next steps and prevent follow-on scams: many fraud victims are re-targeted by "recovery" scammers who pose as legal or technical services that can retrieve lost funds, for an upfront fee.