Scammer call workshops. Lessons learned.

[Wayne]

Despite having done many many scammer calls in my time, I've only ever done them as a workshop twice, once at BSides Bristol and once at BSides Newcastler. They have however taught me a few things. I'm hoping to do more in the future, so here's what I plan for them.

Things you need:
A computer.
An extra monitor.
Skype and a way to record them.
Speaker.
Microphone.
Whiteboard.

First up, keep the setup simple. A computer with dual screens is essential as I've discovered. You need one for the Skype call and one to be able to see the list of numbers to call. Keep the speaker away from the mic, but in a place that the audience can hear it. You don't want too much feedback from the speaker bleeding back into the mic. You'll still get some, but this can be fixed after the fact. I use a soundbar and a Blue Yeti mic, though I'm thinking of investing in a small guitar practice amp for the sound. You can put that on the floor so it's more out of the way, plus it'll be louder than the soundbar I use. As you can hear the sound from the speaker, there's no need for headphones.

Next up, agree in advance who'd like to take part in the calls and who wants to just listen. Not everyone is going to be comfortable having a go and you need to respect their wishes. What I'm thinking here is giving everyone a sticker they can wear if they want to join in. As time goes on, some will likely remove their sticker or put one on. The sticker is a great way to keep track in real time of who wants what.

You're going to want to record the calls. I use MP3 Skype Recorder as I've always found it both cheap and reliable. There are of course other options out there. It'll automatically record all the calls, then to deal with the inevitable feedback issue you can run the recorded call through Audacity (a brilliant free bit of software) or equivalent to make the stereo track into a mono one. Doing it in mono from the start is an option, but you may end up with issues doing so. Sometimes the scammer side can be quieter, so you can alter the tracks so they match volume before merging them.

The whiteboard is an essential piece of kit. Because it's difficult to talk to people while the call is going on in case the scammer hears it, having a place you can write thoughts, questions and ideas down works a treat. Bristol had a huge whiteboard in the room, but Newcastle didn't so I'm glad I brought one with me. It doesn't need to be big, just big enough to clearly write things down for people to see. Nothing fancy needed, in fact the one I used was from the local supermarket and cost me about a fiver.

Other things to make sure you have are an extension lead and a HDMI cable, just in case. Every room is going to be different, so this makes for easy placement of the equipment or connecting to a projector if they have one. And that's it. There's options to extend it of course. If someone has a laptop and a headset you could bring them into the call via Skype itself. Maybe also bring another system into the group to make a backup copy of the calls too, in case there's any kind of technical issue with the main one.

Getting numbers ready for easy access definitely makes it simpler. With our call style we call up a scammer and only have the number and the name they're using to hand. We did this last time by having BA put them all in a single thread on the forum, so huge thanks to him for that one. Also getting people into the mindset beforehand that they can say anything they want is important. Within reason of course, and by that I mean put in some ground rules. Don't jump into the weird stuff right away, no insulting the scammer based on his race or location, no correcting a scammer if he makes mistakes and definitely no telling the scammer you're baiting him. Other than that you can say anything. We've had a call that devolved into a fistfight and one where we asked the scammer to find a hitman then accused him of being the hitman. All this happened "on the fly", happening as the ideas came to us. In fact one cool moment in the last one was when the person in the call started doing something as I was writing it down on the whiteboard, without seeing it!

Rename the files so they don't get lost in the mix. That's usually pretty simple as the good calls are going to be the longest one, so list them from largest to smallest.

Last thing I'd say is to get some instant feedback while the session is still fresh in everyone's minds. A quick anonymous survey after would be great for that. Also make the calls made available ASAP for them to listen to/download with easy to find links. Fix the audio, upload it and share the links .

It's a simple setup that requires very little preparation. It can also be a complete blast when you get a "live one". So then, next time around I'm going to learn from my own mistakes and hopefully make it an even bigger, better and crazier event.