“Hello. This is the IRS calling.”: A case study on scams, extortion, impersonation, and phone spoofing

Abstract

Fraud has existed long before the advent of modern technology; however, we can increasingly observe how this profit-driven enterprise is entering the cyberspace. Our paper focuses on a case study of two scam schemes targeting international students at Penn State. The scams have been perpetrated in either a physical (i.e., phone scam) or online (i.e., Craigslist scam) form. However, this dichotomy becomes blurry when examining the phone scams more closely since they often employ cyber elements (e.g., phone spoofing, requests of electronic payment) to mask the scammer's tracks and identity. Our study aims to better understand the nature of the scams and how international students contextualize their scam experiences. We place particular emphasis on investigating what students' decision-making processes are behind filing a report about their scam experiences. We also explore the predominantly used reporting avenues by those international students who filed reports. In the first part of our study, we present a qualitative analysis of Penn State campus police reports of scam incidents covering three years of data (2014–2016). Aside from being able to understand the prevalence and details of the experienced scams, the analysis of the data also helps to unpack the motivations behind why international students file reports to entities like campus police particularly in the event that an inchoate crime was experienced. Furthermore, working with the data lays the groundwork for the second half of our study, a 16-person in-depth interview series with international students who experienced a scam while studying at Penn State. The results of our case study will show the fundamental impact of increased awareness in preventing international students from falling victim to the scams they encountered. However, opportunities still remain in terms of effectively increasing knowledge about how such incidents can be officially reported to law enforcement and how currently existing cybercrime reporting mechanisms can be improved to further bolster cybercrime reporting to take place.