How to spot a scam syndicate
Organised fraud at scale. Hundreds of domains, dozens of wallets, coordinated playbooks.
What it is
A scam syndicate is a coordinated group of scam operators sharing infrastructure (hosting, domains, wallets), tools (phishing kits, bot networks), and playbooks (romance scripts, crypto pump schedules). One syndicate can run 50 or more active phishing domains, hundreds of social-media impersonator accounts, dozens of crypto wallets, and a steady pipeline of fresh victims.
What it looks like from where you're standing
You almost never see the whole network. What reaches you is one piece: a single message, one too-good investment, one familiar brand that feels slightly off. Watch for the same pitch turning up in more than one place, a "community" or following that feels manufactured, or a sudden wave of near-identical scams arriving close together. You do not need to untangle the operation behind it; if one piece feels wrong, treat the whole thing as suspect and check it before you act.
Why syndicates are harder to fight than lone scammers
Take down one of their domains, they have ten more. Block one wallet, the funds are already moving. Report one social account, the next one is spinning up. The right response is not playing whack-a-mole on individual entities; it is mapping the cluster and going after the shared infrastructure.
What to do
If you encounter what looks like a single scam, report it to AVA. The intelligence graph cross-references it against everything else AVA has seen. Often the single entity you reported is the visible tip of a much larger operation, and AVA can show the connections.
Practice spotting this in AVA Scam Hunter
The more you see, the faster you spot. Play AVA Scam Hunter — free, 3 minutes, no signup needed.
📚 Read the full lesson at AVA Academy
This page is a quick spotter card. The full plain-English lesson lives in the AVA Academy. Read the Scam Syndicate lesson → or browse all 9 lessons.