Study classifies global scam operations into five categories - inspired by fantasy fiction creatures - to better understand how fraudsters organise and operate
Large scam networks of up to 200 people now work like real businesses, with support from corrupt officials, money launderers and web designers
The study shows that scams evolve to outsmart law enforcement and tech, calling for stronger international efforts
New University of Portsmouth led research uncovers how scammers operate worldwide, dividing them into five "monstrous" categories.
Published in the International Journal of Law, Crime and Justice and funded by ITAD from the UK Government Home Office, the study explores how the size of scam groups, specialised roles, and involvement of corrupt actors help scams work more effectively.
Fraud and scams are on the rise, with more than 3.31 million confirmed cases in 2024 according to the UK Finance Annual Fraud Report 2025, making it crucial to understand how scammers operate like businesses to adapt and succeed.
A team of criminologists and fraud experts, including researchers from the University of Portsmouth's School of Criminology and Criminal Justice, reviewed existing data, examined public cases and created a database of 97 fraudsters from Nigeria, Ghana and India.
The study examines how scams are designed to be more effective and convincing, often using supporting actors to carry them out. It builds on previous research into West African cybercrime , which aimed to help reduce the risk of people falling victim to online and telephone scams.
Fraudsters operate in many ways - and the scale of the problem varies dramatically. Some work alone, targeting victims locally or abroad, while others form small groups for scams like romance fraud. The research emphasises large-scale operations with call centres of 10 to 200 people, showing just how big the problem has become.
The researchers used mythical creatures of various sizes to organise and describe their findings:
Demons (sole traders) - independent actors who make quick decisions with little risk of betrayal and, despite limited resources, can target multiple victims.
Gorgons (micro enterprises) - small groups use their combined skills to work more efficiently - these groups often form among friends or couples.
Ogres (small and medium enterprises) - larger groups allow members to specialise, helping them grow operations with clear roles.
Behemoths and Mega Behemoths (large enterprises) - they operate like companies, with call centres and global networks, showing how organised their scams are.
This classification makes it easier to understand how different types of scammers work, adapt, and react to things like law enforcement, new technology and competition, which can help guide better actions and international efforts to fight fraud.
Lead author, Professor Mark Button , from the School of Criminology and Criminal Justice and Director of the Centre for Cybercrime and Economic Crime at the University of Portsmouth, said: "This research builds on my previous work in West Africa and India by looking at the whole infrastructure behind scams, including the size and type of operations involved. What's new here is the focus on large-scale scams.
"Some of these operations run like big businesses, generating hundreds of millions of pounds and employing hundreds of people. And it's not just about the scammers themselves - there's a whole network of people including corrupt individuals, website designers and money launderers who make these scams possible.
"We decided to use mythological monster names to get across the point that while the scale of these operations sound like the stuff of fiction, this is a very real threat."
Dr Branislav Hock from the University of Portsmouth's Faculty of Humanities and Social Sciences , said: "The study also introduces the idea of 'scamvolution,' where scams evolve much like species do - only the ones that adapt survive. Scammers tweak their methods to stay ahead of law enforcement, sometimes even using AI.
"Big operations often copy how real businesses are run and certain regions become hotspots for cybercrime because of local social, economic or cultural factors."
The research further examines scams carried out by external actors against individuals and organisations, mostly online, including phishing, romance scams, and consumer fraud. It highlights the need for targeted law enforcement, coordinated action by the anti-scam community and investment in technology to help detect and prevent these scams.
Professor Button added: "Our study highlights the need for more research on how these individuals work together. Understanding these roles could help law enforcement target critical points in scam networks."
