Fraud pattern analysis is usually a search for a practical way to connect scattered signals into usable actor-level patterns. For threat-intelligence and trust-and-safety analysts, that means finding relationships across wallets, bank details, phone numbers, messenger accounts, links, payment handles, gift cards, and file or photo hashes that recur across cases. This article explains the method, what shared indicators can and cannot tell you on their own, and how sustained scammer engagement can generate fresh input for indicator correlation. As one example approach, Active Defense uses AI decoy personas on Telegram and by e-mail and turns what scammers send into a customer-specific threat-intelligence feed. Every output remains for human review, so analysts keep control over conclusions.
What Fraud Pattern Analysis Means in Practice
Fraud pattern analysis in practice is the work of finding repeated structure across many fraud interactions, not just reading one report, one ticket, or one chat in isolation. The goal is to see how separate fragments line up into a repeatable operating pattern.
Analysts usually move from artifacts to clusters. One wallet, one phone number, or one account can be weak on its own. Reuse across multiple chats is what starts to matter. A contact point that appears again with the same payment destination, or the same media asset, suggests a more stable actor pattern than any single item can show alone.
It helps to separate indicators from patterns:
- An indicator is one observable, such as a URL, wallet, phone number, or IBAN.
- A pattern is the relationship among observables that recur together.
That distinction matters operationally. Shared indicators can cut duplicate investigations, support actor clustering, and improve prioritization when a case may need disruption or escalation. For analysts working with payment rails, wallet reuse and bank details can become important context; see crypto wallets and bank-account investigations.
Confidence matters because fraud data is noisy. A structurally valid item is not automatically useful, and a plausible-looking item may still be wrong in context. Disposable infrastructure is common, and some identifiers can be borrowed, forwarded, or impersonated.
So correlation is cumulative, not binary. The more overlaps you find across sessions, the stronger the analytic basis for linking them to one actor. For workflow detail, use this deeper explainer on correlation.
Which Shared Indicators Actually Reveal Fraud Patterns
The shared indicators that matter most are the ones fraud actors tend to reuse, even when the story, wording, or persona changes. Active Defense extracts these from scammer messages:
- crypto wallets across BTC, ETH, TRON, and SOL
- URLs
- e-mail addresses
- phone numbers
- messenger accounts
- bank details including IBAN and SWIFT
- gift cards
- payment handles
- file hashes
- photo hashes
Some of these are more useful for clustering than others. Payment destinations, contact accounts, and reused media often last longer than message text. A scammer may rewrite copy for each conversation, but still fall back to the same wallet, bank detail, handle, or image set.
That is why media evidence matters. Photos are kept with SHA-256 and also a perceptual hash, which helps spot reused or near-reused images even when the file itself changes. File and photo hashes can connect campaigns that look unrelated in text, especially when the same document, ID image, or promotional asset shows up again.
Forwarded accounts and reused photos can be just as useful as direct textual indicators. Fraud actors often recycle assets across personas, so a forwarded contact or repeated image may reveal continuity that the written chat does not.
Each extracted indicator receives a confidence score based on a structural check and an LLM. That gives analysts a practical way to sort stronger from weaker signals when reviewing scam indicator feeds, STIX 2.1 export workflows, weekly scam briefings, or monthly scam data reports.
The key point is that indicators are scored, not verified. They are evidence for analysis, not final proof. When chats share an indicator, a reused photo, or a forwarded account, they can be linked to one actor in the feed.
How Continuous Engagement Produces Better Pattern Data
Fraud pattern analysis gets stronger when there is enough interaction data to expose repetition. Many scam actors do not show their payment rails, fallback accounts, or secondary delivery methods at first contact. If a conversation ends too early, the analyst may only see the opening lure rather than the infrastructure behind it.
That is why Active Defense uses AI decoy personas to keep scammers talking on Telegram and by e-mail. As the exchange continues, more indicators can surface and become usable in customer-specific intelligence feeds.
The engagement process is controlled from the start. Each new chat is checked by a classifier at first contact. On messengers, if the classifier is unsure, the chat is left alone rather than forced into engagement.
When a reply is sent, the draft comes from the AI and is approved by a human operator before sending by default. That keeps human oversight in the loop during live engagement. Replies are sent with typing pauses and in short messages, which helps maintain a natural conversation flow.
Longer conversations can improve correlation because later turns often expose the pieces that matter most for clustering. Analysts may see, for example:
- backup wallets after an initial payment route fails
- alternate contact methods when one account stops responding
- substitute bank details
- new files, photos, or other delivery assets
Just as important, every message is stored event-sourced the moment it arrives. If a scammer later uses a delete-for-everyone action, that does not remove the received copy from the record.
Immediate storage matters for analysis because it preserves message order, keeps the full history rebuildable, and lets analysts reconstruct how a pattern appeared over time. Instead of working from a partial transcript, they can review the sequence in which wallets, accounts, media, and payment details emerged.
From Raw Conversations to a Usable Intelligence Feed
For analysts, the useful output is not a pile of chat transcripts. It is a structured intelligence feed that can be searched, compared across cases, exported into other systems, and rebuilt from stored history when a team needs to review how a finding was formed.
Each customer gets their own feed. That matters because fraud pattern analysis usually sits inside an organization’s own case mix, review process, and tolerance for weak or strong signals. A shared indicator may matter differently depending on the team using it and the action they are considering.
The feed can be exported in STIX 2.1. That makes it easier to move scored scam indicators into existing intelligence tooling and downstream workflows instead of treating scam conversations as separate, manual research.
Because the underlying message history is stored as events from the moment each message arrives, the feed can be rebuilt from that history. That gives analysts traceability from an extracted wallet, bank detail, account, link, or hash back to the conversation events that produced it.
A customer-specific feed also supports different teams in different ways:
- trust-and-safety teams may use it for account or content actions
- threat-intelligence teams may use it for clustering, monitoring, and external sharing
Feed form also changes how analysts work. Once separate chats are linked through shared indicators, reused photos, or forwarded accounts, the investigation can move from session-by-session review to actor-level groupings.
For teams that care where the service is operated, the console and API run on Azure in Germany.
How Analysts Can Apply Shared-Indicator Patterns
Shared-indicator patterns are most useful when they change analyst decisions, not just dashboards. For threat-intelligence teams, that usually means using overlap across chats to cluster related scam activity, watch how payment infrastructure changes over time, and notice when one actor drops a phone number or account but keeps using the same wallet, bank detail, photo, or file.
For trust-and-safety teams, the same method helps in more immediate review work:
- identify related accounts faster
- review repeated media assets across separate cases
- escalate cases where several weak signals combine into a stronger pattern
This also makes shared-indicator analysis a triage tool. It helps separate one-off noise from behavior that looks repeated enough to deserve deeper review. Instead of treating each report as isolated, teams can ask whether the case fits an existing actor pattern.
Bank details can be especially important in some investigations. They can help analysts understand recipient infrastructure and possible mule-account usage in general investigative terms, especially when other contact points keep changing.
In practice, it is better to combine three things:
- structural confidence
- conversational context
- linkage evidence across chats
No single score should carry the whole conclusion. It also helps to record why chats were linked, such as a shared wallet, a shared photo, a forwarded account, or several overlaps together, so later reviewers can see the analytic basis.
Questions analysts ask
What does fraud pattern analysis add beyond collecting indicators?
Fraud pattern analysis asks how separate observables relate across cases. Collection records what appeared in one interaction. Analysis tests whether the same wallet, bank detail, phone number, messenger account, payment handle, gift card, link, file hash, or photo hash shows up in combinations that suggest one operating pattern.
That shift matters because analysts usually act on relationships, not on isolated items. Useful questions include:
- which indicators recur together
- which items change from chat to chat
- which assets stay stable across different scam stories
When is one shared indicator enough to review a link?
A single overlap can justify review, but not every overlap carries the same weight. Analysts usually look at three things together: the indicator itself, the role it played in the conversation, and whether other evidence points the same way.
Examples that may deserve a closer look:
- one payment destination reused across separate chats
- one photo appearing again under a different persona
- one forwarded account connecting otherwise different sessions
The point is not to hit a fixed count. It is to decide whether the overlap is specific enough to support an actor-level working hypothesis.
What makes scam pattern analysis operational instead of academic?
It becomes operational when analysts can move from conversation evidence to a usable feed. Active Defense turns scammer messages from Telegram and e-mail into a customer-specific feed with scored indicators and STIX 2.1 export. Because each message is stored when it arrives, later deletions do not remove the record analysts review.
Qualified teams can request a free feed sample or a 90-day pilot for up to 1,000 sessions at a fixed price.
Turning Shared Indicators Into Action
For analysts, fraud pattern analysis matters when it produces a feed they can use in daily work. Active Defense delivers a customer-specific threat-intelligence feed with scored indicators and STIX 2.1 export, built from scammer engagement on Telegram and by e-mail.
Teams can:
- review a free feed sample if qualified
- start a 90-day pilot for up to 1,000 sessions at a fixed price