SCRIPTMIND: Crime Script Inference and Cognitive Evaluation for LLM-based Social Engineering Scam Detection System

TL;DR

ScriptMind addresses evolving social engineering scams by fusing crime-script inference with cognitive evaluation of user responses during scam interactions. It introduces CSIT for scam reasoning, CSID for fine-tuning smaller LLMs, and CSED for cognitive impact assessment, using 571 Korean prosecutor-impersonation phone scams to produce 22,712 training instances. Finetuned 11B models achieve up to 0.98 scam detection accuracy and outperform GPT-4o by about 13%, while cognitive simulations show that real-time, script-aware warnings elevate and sustain user suspicion. The framework advances cognitively adaptive, user-centered scam defenses and suggests practical, on-device implementations with ethical safeguards.

Abstract

Social engineering scams increasingly employ personalized, multi-turn deception, exposing the limits of traditional detection methods. While Large Language Models (LLMs) show promise in identifying deception, their cognitive assistance potential remains underexplored. We propose ScriptMind, an integrated framework for LLM-based scam detection that bridges automated reasoning and human cognition. It comprises three components: the Crime Script Inference Task (CSIT) for scam reasoning, the Crime Script-Aware Inference Dataset (CSID) for fine-tuning small LLMs, and the Cognitive Simulation-based Evaluation of Social Engineering Defense (CSED) for assessing real-time cognitive impact. Using 571 Korean phone scam cases, we built 22,712 structured scammer-sequence training instances. Experimental results show that the 11B small LLM fine-tuned with ScriptMind outperformed GPT-4o by 13%, achieving superior performance over commercial models in detection accuracy, false-positive reduction, scammer utterance prediction, and rationale quality. Moreover, in phone scam simulation experiments, it significantly enhanced and sustained users' suspicion levels, improving their cognitive awareness of scams. ScriptMind represents a step toward human-centered, cognitively adaptive LLMs for scam defense.

Figures (11)

• Figure 1: Scam alerts provide accurate detection and explanations but can be neutralized by new tactics. ScriptMind overcomes these limits through a crime script inference and simulation-based evaluation, enabling cognitively effective scam defense.
• Figure 2: The uniqueness of ScriptMind lies in modeling and evaluating tasks that elicit and reinforce users’ suspicion throughout scam interactions. Unlike prior studies that evaluate models primarily based on accuracykoide2024chatspamdetectorlee2024multimodalshen2025warned, we design a framework that trains LLMs to predict scammers’ next scripted actions and assess whether such predictions meaningfully enhance user suspicion in realistic scam contexts.
• Figure 3: Changes in Suspicion Levels by Script Stage.
• Figure 4: User Consent Interface and Real-Time Transcription Workflow of ScriptMind
• Figure 5: LLM-Based Scam Recognition and Next-Utterance Prediction Display.