Online scams have become a pervasive global threat, causing substantial financial, psychological, and operational harm. Scammers embed psychological techniques (PTs) within reusable operational schemes to scale scam campaigns with minimal adaptation. However, existing studies often analyze PTs as isolated features, overlooking the recurring scam scenarios in which they are systematically deployed. To address this gap, we first conduct a large-scale empirical study to jointly characterize scam scenarios and their associated PTs. Specifically, we develop a data-driven pipeline to derive a hierarchical taxonomy of scam scenarios, consisting of 18 fine-grained scenarios grouped into 6 high-level tactics based on their PT profiles. Furthermore, to transfer this scenario-level knowledge to practical defense, we design a conversation-aware scam scenario detection approach for financial-institution customer interactions, enabling timely warning and intervention. Our study on 102,054 real-world scam incident reports, spanning 2024-02-01 to 2025-10-31, reveals that PT usage is significantly associated with scam scenarios. We further show that scammers organize scenarios around different operational goals, such as broad victim exposure, high victim conversion, and high-value extraction, and reuse infrastructure, including IP addresses, domains, email addresses, and phone numbers, to launch coordinated campaigns at scale. Evaluation on

翻译：网络诈骗已成为一项全球性威胁，造成重大的经济、心理和操作损害。诈骗者将心理技术嵌入可复用的操作方案中，以最小适配实现诈骗活动规模化。然而，现有研究常将心理技术作为孤立特征分析，忽视了其系统性部署的重复性诈骗剧本。为填补这一空白，我们首先开展大规模实证研究，联合刻画诈骗剧本及其关联心理技术。具体而言，我们开发了一套数据驱动流水线，推导出诈骗剧本的层次化分类体系，包含18个细粒度剧本，根据其心理技术特征归纳为6类高级策略。此外，为将剧本级知识转化为实用防御手段，我们设计了一种面向金融机构客户互动的对话感知诈骗剧本检测方法，实现及时预警与干预。基于2024年2月1日至2025年10月31日间102,054份真实诈骗事件报告的研究表明，心理技术的使用与诈骗剧本显著关联。我们进一步揭示，诈骗者围绕不同操作目标组织剧本（如扩大受害者覆盖、提高转化率、追求高额榨取），并复用包括IP地址、域名、电子邮件地址和电话号码在内的基础设施，以大规模发动协同攻击。实验评估表明...