引言
今年早些时候，我们捣毁了一个位于柬埔寨的诈骗行动，该行动利用 ChatGPT 支持投资、婚恋、赌博和冒充执法人员的诈骗计划。我们是在收到同行 WhatsApp 提供的线索后开始调查此活动的，此后已与行业合作伙伴和相关当局分享了更多威胁信号。
该行动揭示了现代诈骗网络的一个重要现实：有组织的犯罪团伙很少将自己局限于单一类型的诈骗。相反，他们会投机性地采用他们认为最能有效欺骗受害者的任何话术、人设和策略。在我们的调查中，我们经常观察到行为者在不同诈骗类型之间切换，或在单一行动中结合多种诈骗手法。
该网络中的部分用户还生成了暗示与人口贩运和强迫犯罪有关的内容。这些观察结果与大量公开报道(在新窗口中打开)描述(在新窗口中打开)的东南亚有组织犯罪集团活动相符，这些犯罪集团以承诺合法就业为名招募工人，随后将其困在债务奴役和胁迫体系中。虽然我们无法独立确定每个涉案人员的具体情况，但该活动提醒我们，实施诈骗的人本身也可能是剥削的受害者。
行为者
该网络使用我们的模型来创建和支持虚假在线人设的运营、生成和翻译发送给诈骗目标的消息、为其欺诈计划创建推广内容，并协助日常运营。
与我们过去捣毁(在新窗口中打开)的诈骗网络一样，部分用户还将 ChatGPT 用于行政工作，包括起草内部公告、翻译员工之间的消息，以及记录看似与招聘、移民身份、工作条件和员工纪律相关的事项。
行为
该网络同时进行多种类型的诈骗，经常融合不同计划中的元素。例如，操作者使用婚恋人设建立信任，然后引入涉及加密货币和现货黄金交易的虚假投资机会。其他用户则使用虚构身份与目标进行长时间的浪漫对话，冒充在线赌博平台代表提供虚假奖金和赢利，或冒充执法机构告知目标需要为犯下严重刑事罪行支付罚款。
尽管话术各不相同，但该网络中的用户始终表现出相同的潜在欺骗行为模式。例如，他们创建和运营虚假婚恋档案、虚构投资专家和欺诈性执法人员人设。他们还生成了伪造文件的图像，包括护照、法律通知、股票购买确认书和赌博平台界面。
- 诱饵： 该网络使用 ChatGPT 在 WhatsApp 和 Telegram 等消息平台上翻译和生成与目标的对话。诈骗者还创建社交媒体内容并研究婚恋档案材料以支持其虚假人设。
- 钩子： 诈骗者的消息经常依赖情感压力和信任建立技巧。示例包括承诺保证回报和“无风险”投资、浪漫语言、指示保持对话保密，以及在虚构奖金到期前紧急要求采取行动。
- 收网： 诈骗者指示受害者存款以解锁所谓的奖励、支付激活费、结清虚构罚款，然后提供转账截图或账户信息作为付款证明。
网络中诈骗者使用 ChatGPT 创建的虚假加密货币交易界面。
网络中诈骗者创建的用于推广虚假投资计划的 AI 生成图像。
人口贩运指标
除诈骗外，部分用户生成的内容还暗示其参与了我们会检测和捣毁的其他违法活动，如人口贩运或强迫劳动。这包括创建社交媒体广告，为波贝的“聊天”工作提供航班、住宿、餐饮、签证和工作许可。
其他活动似乎与该行动内部对工人的管理有关。用户维护员工债务、工资扣除、纪律罚款和贷款偿还的记录，并翻译有关移民身份、工作许可、签证逾期和招聘激励的讨论。
一些对话还提及明显的拘留、逃跑企图，以及被贩运并被强迫在诈骗行动中工作的人可能面临的刑事责任。虽然这些对话无法让我们确定任何特定个人的情况，但它们与大量公开报道(在新窗口中打开)描述(在新窗口中打开)的东南亚有组织犯罪集团活动相符。
网络中诈骗者创建的用于在社交媒体上发布柬埔寨招聘广告的 AI 生成图像。删节部分由 OpenAI 添加。
影响
我们封禁了与该行动相关的 ChatGPT 账户，与行业合作伙伴和相关当局分享了相关指标，并采取措施使这些行为者更难重新获得对我们产品和服务的访问权限。
与该网络相关的财务损失规模尚不明确，但根据诈骗者自身的通讯记录，该行动可能已与多种诈骗类型中的数百名目标进行了互动。用户对话中提到个别受害者损失了数千美元，尽管我们无法独立核实这些说法。
更广泛地说，此案强化了两个趋势。首先，有组织的诈骗网络可能高度多元化，同时运营多种欺诈计划，而非局限于单一诈骗类型。其次，网络欺诈、有组织犯罪和人口贩卖之间的界限往往模糊不清。因此，有效的打击不仅需要针对面向受害者的诈骗活动，还需针对策划并从中获利的有组织犯罪集团。
Introduction
Earlier this year, we disrupted a Cambodia-based scam operation that used ChatGPT to support investment, romance, gambling, and law enforcement impersonation schemes. We began investigating this activity following a lead from our peers at WhatsApp and have since shared additional threat signals with industry partners and relevant authorities.
The operation illustrates an important reality about modern scam networks: organized criminal groups rarely restrict themselves to a single type of scam. Instead, they opportunistically employ whatever narratives, personas, and tactics they think will be most effective to deceive victims. In our investigations we routinely observe actors moving between scam types, or combining multiple scam techniques within a single operation.
Some users in the network also generated content suggesting links to human trafficking and forced criminality. These observations are consistent with extensive public reporting(opens in a new window)describing(opens in a new window) organized crime groups in Southeast Asia that recruit workers with promises of legitimate employment before trapping them in systems of debt bondage and coercion. While we cannot independently determine the circumstances of every individual involved, the activity serves as a reminder that the people conducting scams can themselves be victims of exploitation.
Actor
The network used our models to create and support the operation of fake online personas, generate and translate messages sent to scam targets, create promotional content for their fraudulent schemes, and assist with day-to-day operations.
As with past(opens in a new window) scam networks we have disrupted, a subset of users also employed ChatGPT for administrative work, including drafting internal announcements, translating messages between staff, and documenting matters that appeared related to recruitment, immigration status, working conditions, and employee discipline.
Behavior
The network simultaneously conducted multiple types of scams, often blending elements from different schemes. For instance, operators used dating personas to build trust before introducing fraudulent investment opportunities involving cryptocurrencies and spot gold trading. Other users engaged in lengthy romantic conversations with targets using fictitious identities, posed as representatives of online gambling platforms offering fake bonuses and winnings, or impersonated law enforcement agencies to tell targets they needed to pay fines for committing serious criminal offenses.
Although the narratives varied, users across the network consistently displayed the same underlying pattern of deceptive behavior. For example, they created and operated fake dating profiles, fictitious investment experts, and fraudulent law enforcement personas. They also generated images of forged documents, including passports, legal notices, stock-purchase confirmations, and gambling platform interfaces.
- The ping: The network used ChatGPT to translate and generate conversations with targets on messaging platforms such as WhatsApp and Telegram. Scammers also created social media content and researched dating profile material to support their fake personas.
- The zing: Scammer messages frequently relied on emotional pressure and trust-building techniques. Examples included promises of guaranteed returns and “risk-free” investments, romantic language, instructions to keep conversations secret, and urgent requests for action before fictional bonuses expired.
- The sting: The scammers instructed victims to make deposits to unlock purported rewards, pay activation fees, settle fictitious fines, and then provide screenshots of transfers or account information as proof of payment.
A fake cryptocurrency trading interface created using ChatGPT by a scammer in the network.
An AI-generated image created by a scammer in the network to promote a bogus investment scheme.
Human Trafficking Indicators
In addition to scams, some users generated content suggesting involvement in other violative activities that we detect and disrupt, such as human trafficking or forced labor. This included creating social-media advertisements for “chatter” jobs in Poipet that promised flights, accommodation, meals, visas, and work permits.
Other activity appeared to relate to the administration of workers inside the operation. Users maintained records of employee debts, salary deductions, disciplinary fines, and loan repayments, and translated discussions about immigration status, work permits, visa overstays, and recruitment incentives.
Some conversations also referenced apparent detention, escape attempts, and potential criminal liability for people who had been trafficked and forced to work in scam operations. While these conversations do not allow us to determine the circumstances of any particular individual, they are consistent with extensive public reporting(opens in a new window)describing(opens in a new window) the activities of organized crime groups in Southeast Asia.
AI-generated images created by scammers in the network to advertise jobs in Cambodia on social media. Redactions added by OpenAI.
Impact
We banned the ChatGPT accounts associated with this operation, shared relevant indicators with industry partners and relevant authorities, and took steps to make it harder for these actors to regain access to our products and services.
The full scale of financial losses associated with the network is unknown, but based on the scammers’ own communications, the operation may have interacted with hundreds of targets across multiple scam types. User conversations referenced individual victims losing thousands of dollars, although we are unable to independently verify those claims.
More broadly, this case reinforces two trends. First, organized scam networks can be highly diversified, operating multiple fraud schemes simultaneously rather than narrowly adhering to a single scam type. Second, the boundaries between online fraud, organized crime, and human trafficking are often blurred. Effective disruption therefore requires targeting not just the victim-facing scam activity, but also the criminal organizations that orchestrate and profit from it.
本文内容采集自官方网站，排版和翻译可能与原页面存在差异。
阅读官方全文