mtjikuzu/llm-financial-honeypot-intelligence

LLM-Powered Financial Honeypots for Scam Intelligence Collection

Engagement Quality and Indicator Extraction from Financial Fraud Conversations

 ![Track]()

🎯 Overview

This research introduces LLM-powered financial honeypots — AI systems that simulate convincing victim personas to engage financial scam actors and extract actionable intelligence indicators (wallet addresses, bank accounts, phone numbers, domains, payment links) from their communications.

Unlike traditional network honeypots (SSH, web), financial honeypots operate in the conversation domain, engaging with advance fee fraud, romance scams, pig butchering, tech support fraud, and money mule recruitment.

🔑 Key Contributions

1. 1.Novel application domain: First application of LLM honeypot technology to financial fraud intelligence collection
2. 2.Indicator extraction pipeline: Regex + heuristic NER system achieving 82.1% F1 on financial crime indicators
3. 3.Policy guardrail engine: Ensures honeypot never exposes real funds, identities, or takes illegal actions
4. 4.Multi-strategy comparison: Rule-based vs. template-based vs. LLM-simulated engagement
5. 5.5 fraud type coverage: Advance fee, romance, tech support, pig butchering, mule recruitment

📊 Prototype Results

Note: In this offline prototype, indicator extraction is identical because we process the same scammer messages. The differentiation emerges in live deployment where better engagement → longer conversations → more indicators disclosed. The full paper will include simulated conversation extension experiments.

📁 Repository Structure

├── README.md
├── experiment.py          # Complete working prototype
├── paper_draft.tex        # Springer ACSAR paper draft
├── requirements.txt
├── figures/
│   ├── fig1_strategy_comparison.png
│   ├── fig2_by_fraud_type.png
│   ├── fig3_indicators_by_type.png
│   └── fig4_cumulative_yield.png
└── results/
    └── strategy_comparison.csv

🚀 Quick Start

pip install numpy pandas matplotlib
python experiment.py

🔬 Methodology

Scam Scenarios (Ground Truth)

5 realistic multi-turn scam conversations (7 turns each) based on:

• —Public scam-bait archives (419eater.com, r/scambait)
• —FTC/ACCC consumer complaint patterns
• —TeleAntiFraud-28k dataset patterns (arxiv 2503.24115)
• —Fraud-R1 benchmark (ACL Findings 2025)

Indicator Types Extracted

Policy Guardrails

• —❌ No real funds movement
• —❌ No real identity disclosure
• —❌ No illegal actions
• —❌ No autonomous escalation
• —✅ All interactions auditable

📚 Key References

1. 1.LLMHoney: SSH Honeypot with LLM (arxiv 2509.01463)
2. 2.shelLM: Generative Shell Honeypots (arxiv 2309.00155, TNR=0.90)
3. 3.AI-in-the-Loop: Privacy-Preserving Scam Detection (arxiv 2509.05362)
4. 4.TeleAntiFraud-28k: Telecom Fraud Dataset (arxiv 2503.24115)
5. 5.Fraud-R1: Multi-Round LLM Fraud Benchmark (ACL 2025)
6. 6.SPADE: GenAI for Adaptive Cyber Deception (arxiv 2501.00940)
7. 7.VelLMes: AI-based Deception Framework (arxiv 2510.06975)

🏗️ Full Paper Extension Plan

The prototype demonstrates the extraction pipeline. The full paper adds:

1. 1.Live LLM integration (GPT-4/Llama-3 API calls for dynamic responses)
2. 2.Conversation extension simulation (model how engagement quality → longer conversations → more indicators)
3. 3.Human evaluation (analysts rate response realism and intelligence value)
4. 4.Comparison with human scam-baiters (archived conversations from 419eater)
5. 5.Cross-validation with TeleAntiFraud-28k dataset

📝 Conference

• —Conference: ICISET 2026 — Namibia University of Science and Technology
• —Tracks: Sustainable Finance and Fintech / Cybersecurity and Sustainability
• —Sustainability angle: Protecting financial system integrity prevents economic harm to vulnerable populations and enables sustainable digital finance
• —Deadline: July 27, 2026

<!-- ml-intern-provenance -->

Generated by ML Intern

This model repository was generated by ML Intern, an agent for machine learning research and development on the Hugging Face Hub.

• —Try ML Intern: https://smolagents-ml-intern.hf.space
• —Source code: https://github.com/huggingface/ml-intern

Usage

from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "mtjikuzu/llm-financial-honeypot-intelligence"
tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(model_id)

For non-causal architectures, replace AutoModelForCausalLM with the appropriate AutoModel class.