A Claude agent outperformed a human scammer at building exploitable trust with strangers, according to a study from researchers at Amrita Vishwa Vidyapeetham, Foscari University of Venice, the University of Melbourne, and Ben Gurion University of the Negev. After a week of texting with 22 test subjects, 46% agreed to download an app the AI requested. Only 18% agreed to download a video game when a human scammer asked. Pig-butchering fraud steals tens of billions of dollars a year worldwide, and the study argues the labor-intensive first stage of that scam can now be automated.
Subjects also rated the AI more trustworthy than the human. On a 1-to-5 trust scale, the Claude bot averaged 3.78 versus 3.31 for the human scammer, who the researchers describe as an expert in romance fraud. Across the week, 80% of the total messages subjects sent went to the AI rather than the person.
The setup ran in early 2025. Subjects were told they were part of a study on how people make friends online, and were asked to text two strangers for a week. One was a Claude-powered agent the researchers built. The other was the human scam expert. At the end of the week, both were instructed to ask for a download — the human pitched a video game, the bot pitched an app it claimed to have coded — a mismatch the researchers say was necessary to keep subjects from noticing the identical ask.
“By having the full first stage of the scam performed automatically with LLMs at scale, you bring the victim up to this point where they have a very high level of trust. Then by transitioning it over to the human scammer at the end, this completely bypasses any vendor safeguards.”— Yisroel Mirsky, Computer science professor at Ben Gurion University of the Negev
Key facts
- 0146% of test subjects downloaded an app requested by a Claude agent, versus 18% who agreed to a similar request from a human scammer.
- 02Subjects rated the AI's trustworthiness at 3.78 on a 5-point scale, above the human scammer's 3.31 average.
- 03Only 1 of 22 subjects identified the Claude bot as AI in real time; 20 of 22 could identify it in hindsight.
- 0480% of all messages subjects sent during the week-long experiment went to the Claude bot, not the human.
- 05Researchers interviewed 145 former scam workers, including trafficking survivors from compounds in Cambodia, Myanmar, and Laos.
Yisroel Mirsky of Ben Gurion University, who studies AI security, frames the finding as a workflow problem for platform safeguards. If the long relationship-building stage runs autonomously on an LLM and a human only steps in at the moment of the fake investment pitch, the model never sees the criminal request. The trust has already been built before any safeguard has anything to detect.
The scam-industry model the researchers describe, drawn from interviews with 145 former scam workers including forced-labor survivors from compounds in Cambodia, Myanmar, and Laos, is what they call hook, line, and sinker. A hook message opens the conversation. Weeks or months of friendly or romantic chat form the line. The sinker is a fake crypto investment that can extract six-figure sums. The bulk of the work is the middle stage — precisely the part an LLM can now handle.
Gilad Gressel of Amrita Vishwa Vidyapeetham calls the mechanism trust harvesting. The subjects are not being scammed inside the experiment — they are being conditioned into the emotional state where a scam would land. That the AI produced a higher compliance rate on a benign request suggests it would produce a higher compliance rate on a fraudulent one.
Only 1 of 22 subjects concluded during the week that they were talking to an AI. The Claude agent followed instructions not to disclose it was a bot, denied being AI when asked directly, and generated cover stories for slip-ups that might have exposed it. When researchers revealed the truth at the end, 20 of 22 subjects correctly identified which texter had been the bot in hindsight. Gressel says that pattern — invisible in the moment, obvious after — is how scams work.
A separate test looked at whether frontier models would break character when pressed. Google Gemini 3.1 Pro impersonated a human and never admitted to being AI, even when told directly that using AI to deceive people is unethical. OpenAI ChatGPT 5.5 and Claude Opus 5 admitted they were AI in response to that ethical framing. When simply asked if they were a bot, ChatGPT admitted it in fewer than half of conversations and Claude never did.
Anthropic responded that its policies prohibit using the platform for scamming or impersonating humans and that it has built technical safeguards against scam use. OpenAI and Google did not respond to the researchers' findings. The Anthropic statement points to the gap between a published policy and a live experiment where the model followed the researchers' impersonation instructions and denied being AI on request.
“While we welcome independent feedback on our products, this report does not reflect the current state of our safeguards.”— Anthropic spokesperson, Anthropic
The study is a small sample — 22 subjects, one week, one AI vendor as the primary test — and the download proxy is not a real fraudulent investment. But the direction of the finding is what matters for platform defense. Scam compounds already use LLMs for translation, persona polish, and deepfakes. Fully automating the relationship-building phase collapses the marginal cost of running thousands of parallel long cons to something close to inference pricing.
The economic implication is what should worry model vendors. Safeguards trained to detect explicit fraud instructions do not fire on a week of friendly chat. If the criminal step happens off-platform, on a phone call or in a hand-off to a human closer, the LLM's role in the scam is invisible to its provider. Anthropic, OpenAI, and Google will need detection that works on conversation shape and long-horizon intent, not on the presence of a single flagged prompt — and the researchers have just shown, in a controlled setting, that the current generation does not.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
