Scatterguns versus Snipers: How Scammers Choose Their Targets
New research shows that scammers do not rely on one approach. They run a range of strategies, and understanding the difference matters for how we build protection against them.
The findings come from Rethinking Scam Prevention: Large-Scale, AI-powered Analysis for a Safeguarding Approach, produced by Oxford Information Labs Research (OXIL Research) with support from Google.org. The study analysed 28.6 million domain-based signals collected through the Global Signal Exchange (GSE) to understand not just who scammers target, but how they go about choosing them.
The Scattergun Approach
The general population is the largest target group in the data, making up 34% of total weighted relevance across all signals. This is the high-volume end of scamming: fake dental practices, fraudulent restaurant sites, and generic shopping scams.
Examples of scattergun signals include “salvatore-pizzas.shop” and “roofing-repairs-6827.shop”.
None of it is designed with a particular person in mind, because it doesn't need to be. This is a numbers game. The goal is reach, not relevance. If enough people see the message, some will click, and the economics work out regardless of who those people actually are.
The Sniper Approach
A smaller, more malicious pattern in the data tells a different story. Groups with protected characteristics, including people with physical and mental health conditions, make up only 2.73% of weighted relevance. But the way they are targeted looks nothing like the scattergun material.
The research found evidence of dual targeting, where scammers go after both the individual and the people around them, such as family members or carers, at the same time.
Examples of these sniper rifle signals include, “tardive-dyskinesia-treatment-40937.bond”, “free-hearing-aid-7185223.live”, “inpatientrehabtexas.com”, and “newyorkcerebralpalsyattorney.de”.
This is not opportunistic. It relies on scammers understanding how support networks are structured around a person, and using that structure as a second way in rather than treating it as a barrier.
Why This Distinction Matters
These two tactics call for different responses. The scattergun problem is largely one of filtering: disrupting infrastructure at scale, taking down domains, and running broad public awareness campaigns.
The sniper problem is a safeguarding problem. It requires understanding specific communities and the relationships of trust that scammers are learning to exploit.
Treating both threats in the same way risks leaving the groups who are least able to absorb harm without adequate protection. This is part of the report's wider argument for moving away from a model built around individual awareness - essentially telling people to be more careful - and towards a collective, safeguarding approach around the networks people actually rely on.
That kind of distinction is only visible because of the scale of data behind it, the sort the GSE was built to bring together across partners so researchers can see not just that scams are happening, but who they are designed for.
Read the full findings, including how situational vulnerability and age affect scammer targeting, in the full OXIL Research Report.
