The Scam Economy Has a Hiring Process

Fraudulent phone calls have become a daily reality for millions of people worldwide. From fake law enforcement officials to bank representatives and impersonated tech support agents, victims are increasingly targeted through direct, real-time conversations designed to create urgency accompanied by high psychological pressure to extract sensitive information or money theft.

Reports show that this type of cybercrime significantly impacts society both financially and emotionally. According to the FBI, US elderly citizens (60+) lost $3.4B in 2023. Another report shows that vishing increased by 449% in 2025 and the average loss per scam call is $3,690.

In this article, we shine a light on what can be described as “Caller-as-a-Service”, which is an under-explored yet rapidly evolving facet of modern cybercrime. We examine how, much like legitimate sales organizations, threat actors have adopted structured, business-like operating models, complete with specialization, scalability, and performance-driven execution.

These ecosystems are no longer ad hoc. They are composed of distinct roles and functions, with different actors focusing on specific stages of the attack lifecycle: from infrastructure and tooling to social engineering execution.

We explore how these networks operate, including their recruitment strategies, defined roles and responsibilities, and even tailored compensation models—all of which closely mirror legitimate market dynamics.

The result is a highly organized, service-driven economy that professionalizes fraud at scale, lowering the barrier to entry while increasing both efficiency and impact.

A Structured Organized Market

The scam call ecosystem has become highly professionalized and segmented, mirroring legitimate business operations. Distinct roles now exist across the value chain, including malware developers, distributors, phishing kit builders, infrastructure operators, log sellers, data analysts, victim list traders, and finally, scam callers who execute the attacks.

This division of labor allows each participant to specialize. For callers, who are solely focused on interacting with victims, the emphasis shifts toward recruitment quality and operational professionalism rather than technical capability.

As a result, the barrier to entry is significantly lowered. Individuals no longer need to develop malware or manage infrastructure, and they can focus on refining communication skills, persuasion techniques, and social engineering tactics.

Recruitment posts reflect this specialization. They typically outline clear requirements such as native English proficiency, familiarity with operational security (OPSEC), and prior fraud experience. Notably, some roles require participants to remain on screen share during live calls.

This requirement is particularly revealing. It indicates that operators are not simply outsourcing tasks, but actively supervising performance in real time. This introduces a level of quality control and operational oversight more commonly associated with legitimate call centers than with traditional cybercrime.

Such supervision serves multiple purposes: ensuring adherence to scripts, improving conversion rates, and preventing internal fraud or data leakage. Ultimately, this layered and controlled model highlights how modern fraud operations are managed with the same logic, structure, and efficiency as legitimate businesses.

Underground Recruitment Tactics

When legitimate companies want to attract potential employees, they illustrate strong financial backbone, customer testimonials, and even satisfied employees pictures.

In the underground, a screenshot of a high balance of the company’s cryptocurrency wallet is enough. A balance of approximately $475,000 serves as a recruitment aid designed to attract recruitments. Such “proof-of-profit” visuals are commonly used in underground communities to establish credibility and demonstrate potential earnings. Whether authentic or fabricated, their purpose is to reduce skepticism and encourage participation.

This tactic reflects broader trends in cybercriminal ecosystems, where reputation and perceived success play a significant role in recruitment and collaboration.

Scam Callers Compensation Models

Flare’s analysis indicates that various compensation models exist including fixed payments, success-based payments and a hybrid approach that combines both fixed payments and success-based payments.

In one model, callers receive a percentage of extracted funds, with higher percentages awarded for larger payouts. In another model, operators offer a fixed payment of $1,000 per successful call, supplemented by an additional percentage.

Conversations between threat actors provide insights about the compensation model. One operator explains that successful social engineering does not always translate into immediate monetization, thus the compensation is also delayed or conditioned.

This distinction is important. It indicates that the fraud process extends beyond the initial call, involving additional steps to convert access or information into financial gain. As a result, operators compensate callers for successful engagement while retaining control over downstream monetization processes.

Participants don’t simply accept terms. They ask questions, compare offers, and weigh compensation before committing. It’s a dynamic indistinguishable from any legitimate job market.

Scam Callers Job Requirements, Roles and Responsibilities

Much like job postings on LinkedIn, underground operators craft well-defined and highly targeted recruitment ads. These postings are far from generic, and they clearly outline the required traits, responsibilities, and experience for each role, reflecting a level of maturity typically associated with legitimate organizations.

For scam callers, the emphasis goes beyond technical capability. Candidates are expected to demonstrate strong soft skills, including clear communication, emotional intelligence, and advanced psychological manipulation techniques. At their core, these roles revolve around the ability to build trust, create urgency, and persuade victims into actions that lead to financial loss or account compromise.

A notable pattern is the preference for native English speakers, indicating deliberate targeting of specific geographic regions. This highlights the importance placed on cultural alignment and linguistic fluency to maximize success rates.

When combined with real-time supervision and performance feedback, these operations resemble structured sales floors, where social engineering is not only executed, but continuously refined and optimized for higher conversion.

Shift Toward Industrialized Social Engineering

The convergence of recruitment, supervision, structured incentives, and modular workflows reflects a broader shift toward industrialized fraud operations. This model mirrors developments seen in ransomware-as-a-service (RaaS) and initial access brokerage, where specialization and division of labor drive efficiency.

However, in this case, the primary attack vector is human interaction, making it both accessible and difficult to detect.

Implications for Defenders and Individuals

These threats reflect a clear shift toward structured, scalable fraud operations, posing growing challenges for both organizations and individuals.

The decentralized nature of these ecosystems makes disruption inherently difficult. Removing individual callers has limited impact, as critical components (victim data, operators, and monetization channels) are distributed and resilient.

At the same time, the reliance on compromised data sources reinforces a key reality: upstream breaches directly fuel downstream fraud.

Compounding this is the increasing level of professionalism. With elements such as real-time supervision, defined workflows, and structured compensation models, these operations are becoming more consistent, efficient, and harder to detect.

To counter this, defenders should prioritize:

• Stronger identity verification mechanisms
• Behavioral anomaly detection
• User awareness focused on real-time social engineering scenarios

For individuals, it’s important to understand that fraudulent calls are rarely random, they are often part of coordinated, data-driven campaigns.

Be cautious of unsolicited calls that:

• Create a sense of urgency
• Request sensitive or financial information
• Pressure you into immediate action

Even if a caller appears credible, never share passwords, verification codes, or financial details over the phone.

If something feels off, the safest approach is simple: hang up and contact the organization directly through official channels.

Finally, enabling multi-factor authentication (MFA) can significantly reduce the impact of compromised credentials, adding a critical layer of protection against account takeover.

How Flare Can Help

Flare provides early visibility into fraud operations before they reach victims. By monitoring underground forums, Telegram channels, and marketplaces, Flare detects leaked data, victim lists, and recruitment activity tied to Caller-as-a-Service campaigns.

This allows organizations to proactively respond (reset credentials, alert users, and strengthen defenses) before attackers strike, reducing both risk and impact.

Learn more by signing up for our free trial.

Sponsored and written by Flare.