[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-84272-en":3,"doc-seo-84272-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},84272,1374391974564,"Clementine","https://ap-avatar.wpscdn.com/avatar/14000253aa45c000a9e?x-image-process=image/resize,m_fixed,w_180,h_180&k=1779874745381141002",8,"Research & Report","Forensic Schema for Psychological Manipulation in Cyber Fraud LLM-Driven Victim Reports Analysis","Cyber fraud classification schemas typically record contact metadata and financial transactions, yet overlook the psychological manipulation techniques used by perpetrators. A forensic schema is introduced with four evidence categories, 35 forensic questions, 11 manipulation indicators, and cryptocurrency evidence fields. Applied to 10,994 victim reports via LLM-driven annotation and validated against two human annotators, results show distinct manipulation profiles for major fraud types. A rationale-based audit reveals a forensic detail gap: manipulation detection is reliable, but actionable narrative evidence varies, and blockchain identifiers are nearly absent. Findings support AI-assisted victim intake with schema-informed follow-up questions.","Forensic Schema for Psychological Manipulation in Cyber Fraud: LLM-Driven Victim Reports Analysis  \nZikai Alex Wen†, Corrazon Ogot†, Juan Li‡, Yan Bai†  \n† School of Engineering and Technology  \nUniversity of Washington Tacoma, United States {zkwen, cogot12, [yanb](yanb}@uw.edu)[}](yanb}@uw.edu)[@uw.edu](yanb}@uw.edu)  \n‡ Department of Computer Science  \nNorth Dakota State University Fargo, United States [j.li@ndsu.edu](j.li@ndsu.edu)  \narXiv :2607 .0775 1v 1 [ cs .CR] 8 Jul 2026  \nAbstract—Existing cybercrime classification schemas capture contact metadata and financial transactions but omit the psychological manipulation techniques perpetrators employ. We present a forensic schema (four categories, 35 questions) adding 11 manipulation indicators and cryptocurrency evidence fields to established forensic foundations. Applied to 10,994 victim reports via large language model (LLM)-driven annotation and validated against two human annotators (mean LLM-human κ = 0 .69, matching inter-annotator κ = 0 .68), the schema revealed a statistically distinct manipulation profile for each major fraud type (Cramr’s V up to 0.790). A rationale-based evidence audit nonetheless exposed a forensic detail gap: detection of manipulation techniques was reliable, but victim narratives varied widely in the actionable detail supporting each Yes answer, and blockchain-specific identifiers were nearly absent. These findings point to AI-assisted victim intake with schema-informed followup questions as the most direct way to close the gap. The tiered annotation strategy also provides a reusable template for LLMbased extraction from other forensic text domains.  \nIndex Terms—digital forensics, cyber fraud, psychological manipulation, cryptocurrency evidence, LLM for analysis  \nI. INTRODUCTION  \nCyber fraud has evolved from opportunistic individual schemes into industrialized operations [1] . Organized syndicates such as the Prince (Taizi) Group operate sprawling scam compounds across countries, training trafficked workers with shared scripts to execute psychologically sophisticated fraud at scale [2] . The industrialized nature of these operations suggests that they produce recurring behavioral signatures, also known as modus operandi patterns. If these patterns can be systematically captured, investigators could link seemingly independent complaints to a single syndicate, an approach known as cross-case linkage [3] .  \nExisting cybercrime classification schemas have not kept pace with this evolution. Current frameworks [4], [5] capture contact metadata and financial transactions but do not categorize the psychological manipulation techniques perpetrators employ, leaving modus operandi elements buried in narratives. Meanwhile, the persuasion and natural language processing community has produced taxonomies for exactly these manipulation tactics. For example, Cialdini’s six principles of persuasion [6] describe how authority impersonation and scarcity pressure exploit cognitive biases, and PsyScam [7] benchmarked nine such techniques in real scam reports. However, these taxonomies remain disconnected from forensic  \napplications. They identify what perpetrators do but not how that maps to evidence dimensions, investigative workflows, or prosecution needs. Since no existing framework bridges these perspectives, we ask the following two research questions:  \n• RQ1 (Forensic Associations): What forensic associations exist between psychological manipulation profiles and fraud typology in victim reports?  \n• RQ2 (Forensic Information Bottlenecks): What information bottlenecks in victim reports limit the forensic utility of LLM-extracted manipulation indicators?  \nTo answer these questions, we designed a forensic schema of 4 categories and 35 questions. Categories 1–2 establish the forensic foundation drawn from existing schemas [4], [5] . Category 3 (11 questions) breaks down the modus operandi into specific psychological manipulation tactics, each grounded in","cbCaik7WPfzzycM6","https://ap.wps.com/l/cbCaik7WPfzzycM6","pdf",301711,1,10,"English","en",105,"# Introduction\n# Related Work\n# Forensic Schema and Methodology\n# Evaluation and Validation\n# Results: Fraud Typology and Information Bottlenecks\n# Contributions and Implications","[{\"question\":\"What problem does the proposed forensic schema address in existing cyber-fraud classification?\",\"answer\":\"Existing schemas mainly capture contact metadata and financial transactions but do not categorize psychological manipulation techniques, leaving modus operandi buried in narratives. The schema adds structured questions for manipulation indicators and evidence dimensions, including cryptocurrency-related fields.\"},{\"question\":\"How is the schema applied and validated in the study?\",\"answer\":\"The schema is applied to 10,994 victim reports using an LLM-driven hybrid annotation approach, where each question is matched to an extraction method based on its reasoning demands. Annotation quality is validated through structured-field cross-validation and human evaluation on a stratified subset.\"},{\"question\":\"What is the key finding about manipulation indicators versus narrative evidence detail?\",\"answer\":\"Manipulation techniques are detected reliably enough to distinguish fraud types, but victim narratives vary substantially in actionable forensic detail that supports each “Yes” answer. Additionally, blockchain-specific identifiers are nearly absent, creating a bottleneck for cryptocurrency fraud investigations.\"}]",1784194517,25,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"forensic-schema-for-psychological-manipulation-in-cyber-fraud-llm-driven-victim-reports-analysis","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/forensic-schema-for-psychological-manipulation-in-cyber-fraud-llm-driven-victim-reports-analysis/84272/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does the proposed forensic schema address in existing cyber-fraud classification?","Question",{"text":75,"@type":76},"Existing schemas mainly capture contact metadata and financial transactions but do not categorize psychological manipulation techniques, leaving modus operandi buried in narratives. The schema adds structured questions for manipulation indicators and evidence dimensions, including cryptocurrency-related fields.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How is the schema applied and validated in the study?",{"text":80,"@type":76},"The schema is applied to 10,994 victim reports using an LLM-driven hybrid annotation approach, where each question is matched to an extraction method based on its reasoning demands. Annotation quality is validated through structured-field cross-validation and human evaluation on a stratified subset.",{"name":82,"@type":73,"acceptedAnswer":83},"What is the key finding about manipulation indicators versus narrative evidence detail?",{"text":84,"@type":76},"Manipulation techniques are detected reliably enough to distinguish fraud types, but victim narratives vary substantially in actionable forensic detail that supports each “Yes” answer. Additionally, blockchain-specific identifiers are nearly absent, creating a bottleneck for cryptocurrency fraud investigations.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,134],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":45,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":21,"doc_module":4,"doc_module_name":45,"category_name":132,"show_sort_weight":21,"slug":133},"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":45,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]