The Ghost Delete Academy · Module 3

Anatomy of a scam call: what they already know about you, and where they got it

Free lesson · About 12 minutes · Ends with the free scan

The call, in three acts

A scam call is a piece of theatre with a research department. By the time the phone rings, the caller usually holds a page of facts about you, a script built to keep you on the line, and a payment method chosen because it cannot be undone.

This lesson takes the call apart in the order it happens. Act one is what they know. Act two is how they keep you talking. Act three is how the money leaves. Once you can see the structure, the call gets much easier to end, because you stop arguing with the story and start recognizing the machinery.

The framework in act two comes from the people who study these calls full time. Kitboga, the scam-baiting streamer who has spent years on the phone with scam call centers and later co-founded the anti-scam company Seraph Secure, describes the same three tactics in nearly every call he records: isolation, dependency, and urgency. His work is entertainment on the surface. Underneath, it is the best public record of how these calls actually run.

Act one: the knowledge

The caller opens with facts, because facts buy trust. Here is the standard set, and where each piece usually comes from.

Your name and phone number, together. This pairing is the basic product of the data broker business. People-search sites publish it, marketing lists carry it, and Lesson 1 of this academy covers how it gets there. A caller who greets you by name has not hacked anything. He has bought or found a listing.

Your home address, and your old addresses. Public records supply much of this: property sales, court filings, registrations. People-search pages then package it neatly, address history included, free for anyone who types in your name.

Your relatives. This is the detail that unsettles people most, and it is the most public of all. People-search sites list relatives by name as a standard feature. Social media confirms the relationships. Seraph Secure's scam investigations team describes the method directly: scammers dig through public records, use information from data breaches, and comb through social media to learn names, locations, hobbies, and enough family dynamics to build a targeted, believable attack.

Your bank, your accounts, your services. This layer usually comes from breaches. When a company's stored data is exposed, the record of what you use goes with it: which bank, which email provider, which subscriptions. That is how a caller claims to be from your bank specifically, instead of a bank in general.

Your voice, or your grandchild's. The newest layer. Voice cloning tools can now rebuild a voice from a very short sample. Seraph Secure cites research showing a recreation from as little as a 3-second sample. The samples are not stolen from anywhere exotic. They come from public videos, from social media posts, and from the voicemail greeting that says your name in your own voice.

None of this requires the caller to be skilled. It requires the information to be available, and it is, in bulk, much of it free.

Act two: the pressure system

Facts open the call. Pressure keeps it going. The three tactics below are the ones Kitboga names after thousands of baited calls, restated here in plain terms.

Isolation. You are told to tell no one. The reasons vary: the bank is investigating its own staff, the court has sealed the case, your family will panic, or your family will want a share. The reason never matters. The function does: a person who cannot check the story with anyone is a person the script fully controls. There is no legitimate situation in which a bank, a court, or a police service needs your silence about your own money.

Dependency. The caller becomes the only door. In tech support calls, he is the only one who can remove the virus. In bank calls, she is the only one who can stop the fraud. The clearest form is remote access: you are walked through installing software so the expert can fix things directly. Kitboga's rule for the public is absolute, and this academy adopts it: there is no reason to give a caller access to your device, and real tech support is something you start, never something that calls you. What happens behind the fix is documented in his calls. While the victim watches a frozen screen, the person inside the computer applies for loans, buys gift cards, opens crypto accounts, and reads the passwords saved in the browser.

Urgency. Everything is minutes from disaster. The account drains tonight, the warrant is issued today, the grandchild is in a cell until the money lands. Urgency is not a detail of the story. It is the lock on the door, because a person who stops to think is a person who hangs up. One exception proves the rule: investment scams and pig butchering play slow, building trust over weeks, because their lock is greed and affection instead of fear. The tell survives the change of pace. The slow scam still needs your secrecy.

Act three: the exit

Every script ends at the same small set of payment rails: gift cards with the codes read aloud, a wire transfer, cryptocurrency, cash handed to a courier. These are not chosen for convenience. They are chosen because they do not reverse. Seraph Secure's support guidance states it without decoration: once money is sent by wire transfer, cryptocurrency, or gift cards, it becomes extremely difficult, and often impossible, to trace and recover.

So the whole call can be graded by its ending. A caller who steers you to any of those rails, under any story, has shown you what the call is. The story is costume. The rail is the fact.

The counter-moves

Four habits break the structure, and all four are free.

Hang up and call back yourself. Take the reference number if one is offered, end the call, and dial the number printed on the back of your card or shown on the official website. That is Kitboga's stated routine when a call might be real, and it works because you choose the number. Caller ID can be faked. The number you dial cannot be rerouted by the person who called you.

Never call the number on the screen. The virus pop-up with a support number is a standard opening for tech support scams. Close the page. If the computer has a real problem, take it to a store, or start from the company's own website, typed in yourself.

Ask for the family code word. Agree one with your family today. A caller claiming to be a relative in trouble who cannot produce it gets a hang-up, whatever the voice sounds like. Then call the real relative on the number you already have.

Buy time on purpose. Say you will handle it tomorrow. A real institution survives the delay. A script built on urgency does not, and the pressure that follows the request is itself the answer.

And if a call ever works on someone you love: no blame. Kitboga's second rule, after the tactics, is to stop shaming victims, because shame keeps losses secret and secrecy is the scammer's first tool. The family hears about it the same day, and then the reporting steps on our report fraud page apply.

Checklist: before the next call comes

Agree a family code word tonight, and tell every relative the rule: no word, no money, no conversation.
Write the callback rule where the phone lives: hang up, dial the number on the card. Not the number on the screen, not the number the caller gives.
Set unknown callers to voicemail on your phone, and put a PIN on the voicemail itself.
Decide the remote access rule as a household: nobody gets into the computer on the strength of a phone call, ever.
Search your own name and city, and your phone number, in quotes. Note the people-search sites listing you and your relatives. That page is act one of your call, written in advance.
Run the free scan to see whether your email has appeared in a breach. Breach appearances are the source of the bank and account details that make a call specific.

The honest limits of removal

This academy sells removal, so this part is written carefully.

Removing your listings from data brokers and people-search sites shrinks the raw material. It takes your name, address, phone number, and relatives off the public shelf where callers and their research teams shop. That makes the generic call harder to aim and the targeted call harder to build.

It does not make anyone scam proof, and three limits deserve plain statement. Removal does not reach copies of breach data already circulating, which no service can recall. It does not stop spoofed numbers, pop-ups, or calls placed to random numbers, some of which need nothing about you at all. And it does not replace the habits in this lesson: a rehearsed household hangs up on the call that a listing made possible. Removal lowers what they know. The habits decide what happens with the rest.

Check what they can already see

Start with the layer you can measure. The free scan checks your email against known breaches and shows you what a caller could be holding before he dials.

Then decide about the listings themselves, with Lesson 1's map of where they come from and Module 2's removal walkthrough in front of you.

Be a Ghost.

Lesson sources: Kitboga's tactics framework and remote access account, Unit21, "Tales of a Scam Baiter: Tips and Tricks of the Trade", June 2026. His callback routine and skepticism advice, Global Cyber Alliance, "Global Voices with Kitboga", February 2026. The research trail (public records, breaches, social media), voice cloning, the family code word, and the recovery warning on sent money, Seraph Secure, "Imposters in the Family Tree", June 2025, and the Seraph Secure scam support page. The four tech support patterns and his device access advice, Anonyome, "8 Things Scam Baiter Kitboga Shares About Call Center Scams". Kitboga is credited here as a research source. He has no connection to Ghost Delete, and nothing in this lesson suggests otherwise. We teach recognition only: never engage a scam caller, never try to bait one. Hang up.