FraudSociety: A Generative Agent-Based Society for the Financial-Fraud Economy

# FraudSociety: A Generative Agent-Based Society for the Financial-Fraud Economy
Source: [https://arxiv.org/html/2610.33536](https://arxiv.org/html/2610.33536)
Mingxuan JiangAffiliation:Fudan University, Shanghai, ChinaZeping LiAffiliation:Fudan University, Shanghai, ChinaYiwen ZhaoAffiliation:Fudan University, Shanghai, ChinaYifan WangAffiliation:Fudan University, Shanghai, ChinaQiuyang ZhangAffiliation:Fudan University, Shanghai, ChinaShuaicheng QiAffiliation:University of Illinois Urbana\-Champaign, Urbana, IL, USA†Equal contribution\.\*Corresponding author\.Yicun LiuAffiliation:Fudan University, Shanghai, ChinaZhixin LiAffiliation:Fudan University, Shanghai, ChinaSen LiuAffiliation:Fudan University, Shanghai, ChinaYinan JingAffiliation:Fudan University, Shanghai, ChinaGuangnan YeAffiliation:Fudan University, Shanghai, ChinaHongfeng ChaiAffiliation:Fudan University, Shanghai, China

###### Abstract

Financial fraud caused over $15\.9 billion in losses in the United States in 2025, according to the Federal Trade Commission\([FTC, 2026](https://arxiv.org/html/2610.33536#bib.bib22)\)\. Understanding such large\-scale harm requires jointly modeling informational and financial dynamics\. Yet existing simulators typically capture only one side of this interaction, leaving a gap in modeling how fraud unfolds in the real world\. To bridge this gap, we introduceFraudSociety, the first LLM\-agent\-based simulator that jointly models these coupled dynamics\. It integrates a dynamic social environment for information exposure and communication, persistent financial ledgers that preserve payment and loss histories, and a Need\-Intent\-Action architecture for civilian decision making\. Fraudsters further adapt their communication and financial actions to individual interaction histories and ledger states, forming a closed feedback loop between the two dynamics\. We validateFraudSocietyacross macro\-level outcomes, micro\-level behavior, and intervention effects\. At the macro level, the simulated fraud outcomes closely match real\-world patterns across multiple key statistics\. At the micro level, it reproduces strong loss concentration, with the top 10% of victimization records accounting for 81\.1% of total losses, consistent with Canadian Anti\-Fraud Centre statistics\([CAFC, 2025](https://arxiv.org/html/2610.33536#bib.bib27)\)\. Counter\-fraud experiments further reveal variation across intervention strategies, with the best\-performing personalized intervention reducing the repeat\-payment rate from 49\.4% to 10\.9%\. These results establishFraudSocietyas both a high\-fidelity simulator and a scalable testbed for evaluating anti\-fraud strategies under diverse intervention conditions, thereby advancing research on financial fraud and its prevention\.

## 1Introduction

Financial fraud has become a large\-scale socio\-economic harm: in 2025, the U\.S\. Federal Trade Commission \(FTC\) received 3 million fraud reports with losses exceeding $15\.9 billion\([FTC, 2026](https://arxiv.org/html/2610.33536#bib.bib22)\)\. In practice, financial fraud unfolds through tightly coupledinformationalandfinancialdynamics, with each continuously affecting the other throughout the process\. Fraudulent information spreads through public content, platform recommendations, and private communication, gradually shaping a victim’s attention, trust, and willingness to pay\([Anderson et al\., 2024](https://arxiv.org/html/2610.33536#bib.bib11);[Wang, 2026](https://arxiv.org/html/2610.33536#bib.bib17)\)\. As fraudulent information spreads, victims may make an initial payment, transfer additional funds, or attempt to withdraw purported returns\. These financial events, in turn, reshape subsequent communication: Fraudsters may provide small returns to build trust, solicit further transfers after an initial payment, or introduce new excuses to delay withdrawals\([Anderson et al\., 2024](https://arxiv.org/html/2610.33536#bib.bib11)\)\. Financial loss therefore emerges from an interaction in which informational dynamics shape financial actions and evolving financial states reshape subsequent communication\([Oak and Shafiq, 2025](https://arxiv.org/html/2610.33536#bib.bib23)\)\.

Studying financial fraud therefore requires modeling how informational and financial dynamics interact at the individual level and collectively give rise to population\-level outcomes\. Agent\-based modeling \(ABM\) provides a natural computational paradigm for capturing this micro\-to\-macro process\([Epstein, 1999](https://arxiv.org/html/2610.33536#bib.bib20)\)\. Existing approaches, however, typically capture only one side of this coupling\. Traditional fraud\-oriented ABMs focus onfinancial dynamics, simulating payment networks and fraudulent transactions without modeling the informational processes\([Oztas et al\., 2023](https://arxiv.org/html/2610.33536#bib.bib15)\)\. In contrast, LLM\-based ABMs focus oninformational dynamics, supporting adaptive social behavior but rarely linking these interactions to persistent financial states and transaction processes\([Yang et al\., 2024](https://arxiv.org/html/2610.33536#bib.bib1);[Piao et al\., 2025](https://arxiv.org/html/2610.33536#bib.bib2)\)\. Consequently, both paradigms fail to capture this interaction, limiting their ability to model how real\-world fraud unfolds over time\.

![Refer to caption](https://arxiv.org/html/2610.33536v1/Figures/motiva.png)Figure 1:Existing simulators fall short of real\-world fraud by capturing only informational or financial dynamics\.FraudSocietycloses this gap by jointly modeling both\.We introduceFraudSociety, an LLM\-agent\-based financial\-fraud simulator that jointly modelsinformationalandfinancialdynamics\. To model informational dynamics, we construct a dynamic social graph and adopt a Reddit\-style ranking mechanism to govern public exposure, information diffusion, and private follow\-up\. To capture financial dynamics, we maintain persistent ledgers that track payments, returns, and withdrawal requests throughout each victimization process\. We then couple these dynamics through a Need\-Intent\-Action architecture, in which each individual’s evolving needs and observed context shape behavioral intents and subsequent social and financial actions\. These actions and their outcomes are recorded in persistent ledgers and become part of subsequent observations, while fraudsters adapt their communication and financial actions to each victim’s response history and evolving financial state\. Together, these processes form a closed feedback loop between informational and financial dynamics as interactions unfold over time\.

By more closely approximating the structure of real\-world fraud,FraudSocietyserves as a high\-fidelity simulator of the fraud process and provides a controlled testbed for counter\-fraud interventions, enabling the systematic evaluation of the effects of different interventions on payment behavior and financial loss\. To evaluate the fidelity and practical utility ofFraudSociety, we focus on three specific research questions spanning multiple levels:RQ1:At the macro level, canFraudSocietygenerate aggregate loss distributions consistent with stylized facts?RQ2:At the micro level, isFraudSocietyable to generate realistic victimization processes?RQ3:From a practical perspective, canFraudSocietysupport the evaluation of counter\-fraud interventions?

Through our experiments, we obtain consistent results across the macro, micro, and intervention levels\. At the macro level,FraudSocietyachieves a Quartet Distance of 0\.2978, indicating close alignment with multiple regulator\-grounded stylized facts\. At the micro level,FraudSocietyreproduces realistic behavioral heterogeneity and loss concentration, with the top 10% of victimization records accounting for 81\.1% of total loss, broadly consistent with the statistics reported by the Canadian Anti\-Fraud Centre \(CAFC\)\. Finally, our counter\-fraud experiments compare five intervention strategies and reveal substantial variation in their effectiveness\. The best\-performing personalized intervention reduces the repeat\-payment rate from 49\.4% to 10\.9%, demonstrating the simulator’s practical value for exploring and comparing real\-world fraud interventions\.

Collectively, our contributions are threefold:

- •We introduceFraudSociety, the first LLM\-agent\-based simulator to jointly model the tightly coupled informational and financial dynamics\.
- •We propose a cross\-level validation framework to systematically analyze both macro\-level fidelity and underlying micro\-level victimization mechanisms\.
- •We show thatFraudSocietycan serve as a counter\-fraud testbed, providing a scalable foundation for the design and analysis of real\-world fraud prevention strategies\.

## 2Related Work

##### Agent\-based social simulation\.

Agent\-based modeling \(ABM\) studies how heterogeneous individual behaviors and local interactions give rise to aggregate social and economic outcomes\([Epstein, 1999](https://arxiv.org/html/2610.33536#bib.bib20)\)\. Traditional ABMs typically represent agents through predefined behavioral rules, enabling controlled analysis of emergence but limiting the complexity and adaptability of individual decision\-making\. Recent work incorporates LLM\-based agents with profiles, memory, natural\-language interaction, and adaptive behavior\. Generative Agents models persistent individual routines and social interactions, while OASIS\([Yang et al\., 2024](https://arxiv.org/html/2610.33536#bib.bib1)\), AgentSociety\([Piao et al\., 2025](https://arxiv.org/html/2610.33536#bib.bib2)\), and SocioVerse\([Zhang et al\., 2025](https://arxiv.org/html/2610.33536#bib.bib3)\)extend LLM\-agent simulation to large\-scale social environments\. Recent studies further examine behavioral heterogeneity and adaptation, such as whether heterogeneous behavioral drivers lead to theoretically consistent strategy changes in simulated financial markets\([Li et al\., 2026](https://arxiv.org/html/2610.33536#bib.bib26)\)\. These studies establish the foundation for LLM\-based simulation across settings, but primarily target general social or market dynamics rather than financial\-fraud victimization\.

##### Traditional simulation for financial fraud\.

Traditional financial\-fraud simulators largely focus on transactions and capital flows\. BankSim\([Lopez\-Rojas and Axelsson, 2014](https://arxiv.org/html/2610.33536#bib.bib14)\)generates synthetic bank\-payment behavior for fraud\-detection research, while AMLSim\([Weber et al\., 2018](https://arxiv.org/html/2610.33536#bib.bib13)\)and SAML\-D\([Oztas et al\., 2023](https://arxiv.org/html/2610.33536#bib.bib15)\)model account interactions and laundering patterns for anti\-money\-laundering analysis\. More recent systems such as TransXion\([Chen et al\., 2026](https://arxiv.org/html/2610.33536#bib.bib16)\)incorporate heterogeneous entities, demographic profiles, and structured transaction behaviors to construct realistic financial\-crime graphs\. These simulators provide persistent transaction records and controllable fraud labels, making them useful for detection and graph\-learning benchmarks at larger scales\. However, in these simulators, fraud\-related transactions are generally generated from predefined transaction rules, without explicitly modeling the preceding information exposure, social interaction, and adaptive persuasion that influence individual payment decisions\.

##### LLM\-agent simulation for financial fraud\.

Recent studies use LLM agents to model fraud\-related communication and interaction\. ScamAgents\([Badhe, 2025](https://arxiv.org/html/2610.33536#bib.bib4)\)examines autonomous, multi\-turn scam calls with context tracking and adaptive deception strategies\. Most closely related, MultiAgent4Fraud\([Ren et al\., 2025](https://arxiv.org/html/2610.33536#bib.bib5)\)simulates collaborative financial fraud across public posts and private interactions, and studies fraud success and agent collaboration\. Nevertheless, existing systems primarily assess dialogue plausibility, fraud success, or harmful\-agent capability, rather than coupling these interactions with persistent financial states through which payments, returns, withdrawals, and cumulative losses feed back into subsequent behavior\. They also provide limited analysis of whether heterogeneous individual victimization pathways collectively reproduce population\-level loss patterns observed in real\-world fraud statistics\.FraudSocietycomplements these studies by jointly modeling informational and financial dynamics and evaluating the resulting simulation at both the individual and aggregate levels\.

![Refer to caption](https://arxiv.org/html/2610.33536v1/Figures/pipeline-24.png)Figure 2:Overview ofFraudSociety\. Civilians, guided by the Need\-Intent\-Action framework, act in Social and Financial Worlds, interacting with fraudsters who manage evolving campaign contexts\. Both sides take social and financial actions that update the environment and shape subsequent decisions\. The simulation is initialized with real\-world posts, empirical profiles, and campaign templates, and is validated through macro metrics, micro pathways, and warning interventions\.

## 3FraudSociety

### 3\.1Overall Design of FraudSociety

FraudSocietysimulates fraud as a process coupling social interaction with financial consequences\. As shown in Figure[2](https://arxiv.org/html/2610.33536#S2.F2), its simulation core consists of four components: Civilian, Fraudster, Social World, and Financial World\. Civilians follow aNeed\-Intent\-Action \(NIA\) cycle based on their profiles, routine states, social histories, and financial records, while fraudsters manage persistent campaigns through adaptive social and financial actions\. The Social World governs public information diffusion, personalized recommendation, and private communication, whereas the Financial World executes monetary actions and maintains persistent ledgers over repeated interactions\.

At each hourly tick, the environment first updates routine, economic, platform, and campaign states and constructs agent\-specific observations\. Civilians and fraudsters then make decisions, after which the environment validates and executes their actions and commits the resulting social and financial state changes for subsequent decision cycles\. We further ground the simulation with real\-world post seeds, empirical civilian profiles, and fraud\-campaign templates, and evaluate the resulting dynamics under diverse scenarios through macro\-level metrics, micro\-level pathways, and counter\-fraud interventions\. Details of the simulation cycle and state construction are provided in the Appendix\.

### 3\.2Civilian Modeling with Need\-Intent\-Action

In civilian modeling, the NIA architecture plays a central role in simulating how individuals respond to evolving social and financial environments across repeated interactions\. As illustrated in Figure[2](https://arxiv.org/html/2610.33536#S2.F2), at each decision step, a civilian updates its needs based on the observed context, forms a behavioral intent, and selects a concrete action\. The resulting feedback informs subsequent NIA cycles\. The Appendix provides the formal definition and hourly agent cycle\.

Need\.Need represents the dynamic internal state that shapes what a civilian prioritizes\. Inspired by Maslow’s hierarchy of needs\([Maslow, 1943](https://arxiv.org/html/2610.33536#bib.bib6)\), civilian needs are modeled along physiological, safety, and social dimensions\. As civilians engage in routine activities and receive social and economic signals, their need states evolve with their profiles and interaction histories, capturing heterogeneous priorities across civilians\. These evolving needs provide the internal basis for subsequent intent formation and, in turn, shape downstream behavior\. To track need dynamics and examine their micro\-to\-macro implications,FraudSocietyrecords each civilian’s need state at every step\.

Intent\.Intent represents the behavioral objective that links an agent’s current needs to executable behavior\([Ajzen, 1991](https://arxiv.org/html/2610.33536#bib.bib7);[Gollwitzer, 1999](https://arxiv.org/html/2610.33536#bib.bib8)\)\. InFraudSociety, a civilian forms an intent by combining its current need state with the observed situation, selecting an activity route such as consumption, work, rest, or social interaction\. The selected intent then restricts subsequent decision\-making to a contextually relevant set of candidate actions, providing a structured transition from internal state to concrete behavior\. As the civilian receives new information and environmental feedback, its needs may change, leading the agent to revise its intent and adapt its subsequent actions accordingly\.

Action\.Action represents the concrete behavior through which a civilian carries out its selected intent\. Conditioned on its current intent and observed context, the civilian selects actions from the corresponding action space\. For example, a social\-interaction intent may lead to ordinary social behavior, fraud\-campaign communication, or fraud\-related payments\. Once these actions are executed, their consequences become part of subsequent observations, so that future decisions are informed by prior interactions and the current state\.

### 3\.3Fraudster Modeling

InFraudSociety, fraudsters manage fraud campaigns with a context𝐱\\mathbf\{x\}that tracks social and financial interactions\. For campaigncc, decisions follow a hierarchical policy:

qc,d\+1\\displaystyle q\_\{c,d\+1\}∼πD\(⋅∣qc,d,κc,𝐱c,d\),\\displaystyle\\sim\\pi\_\{D\}\(\\cdot\\mid q\_\{c,d\},\\kappa\_\{c\},\\mathbf\{x\}\_\{c,d\}\),\(1\)\(ac,i,tS,ac,i,tF\)\\displaystyle\(a^\{S\}\_\{c,i,t\},a^\{F\}\_\{c,i,t\}\)∼πH\(⋅∣qc,d,κc,𝐱c,t,𝐡c,i,t\),\\displaystyle\\sim\\pi\_\{H\}\(\\cdot\\mid q\_\{c,d\},\\kappa\_\{c\},\\mathbf\{x\}\_\{c,t\},\\mathbf\{h\}\_\{c,i,t\}\),whereqc,dq\_\{c,d\}is the daily campaign phase,κc\\kappa\_\{c\}is the fraud type, and𝐡c,i,t\\mathbf\{h\}\_\{c,i,t\}is the interaction history with civilianii\.πD\\pi\_\{D\}andπH\\pi\_\{H\}are structured\-prompt LLM policies over admissible phase transitions and victim\-specific actions, respectively\.

![Refer to caption](https://arxiv.org/html/2610.33536v1/Figures/fraud-24.png)Figure 3:Fraudster modeling inFraudSociety\. Campaigns include a fraud type, evolving phase, and social\-financial context, which together guide daily phase evaluation and victim\-specific social and financial actions at the hourly level\.Campaign Type and Phase\.As summarized in Figure[3](https://arxiv.org/html/2610.33536#S3.F3),FraudSocietymodels investment, impersonation, romance, and marketplace fraud based on major reporting taxonomies\([FTC, 2025](https://arxiv.org/html/2610.33536#bib.bib9);[FBI IC3, 2025](https://arxiv.org/html/2610.33536#bib.bib10)\), with templates tailored to each fraud type\. Drawing on scam\-lifecycle and victim\-grooming studies\([Lacey et al\., 2020](https://arxiv.org/html/2610.33536#bib.bib12)\), each campaign progresses through recruiting, credibility, peak, and collapse, corresponding to exposure expansion, legitimacy building, intensified extraction, and termination\. At the daily timescale,πD\\pi\_\{D\}selects whether to remain in the current phase or advance to the next, excluding backward and skipped transitions\. The resulting phase and fraud type condition subsequent hourly decisions\.

Fraudster Action\.At each hour, the fraudster selects victim\-specific social and financial actions from the current campaign context and interaction history\. The social actionaSa^\{S\}expands exposure, initiates contact, or continues a conversation, whereas the financial actionaFa^\{F\}provides a small return, handles a withdrawal request, or requests further payment\. Equation \([1](https://arxiv.org/html/2610.33536#S3.E1)\) therefore links daily campaign planning with victim\-specific hourly adaptation\.

### 3\.4Social and Economic Environment

To connect micro\-level decisions with macro\-level fraud outcomes,FraudSocietycouples a dynamic social platform with an economic environment and persistent financial ledgers\. The social platform governs public exposure, social amplification, and private communication, while the economic environment records the consequences of civilian and fraudster actions\. This design captures how exposure timing, civilian circumstances, and fraudster responses jointly produce persistent financial feedback\.

Social Platform and Exposure\.The social environment is represented as a typed dynamic graphGt=\(V,Et,ρ\)G\_\{t\}=\(V,E\_\{t\},\\rho\), whereVVcontains civilians and fraudsters,EtE\_\{t\}contains social edges at ticktt, andρ:Et→ℝ\\rho:E\_\{t\}\\rightarrow\\mathbb\{R\}, whereℛ\\mathcal\{R\}is the set of relation types, such as family, colleague, neighbor, and online contact\. Edges are initialized from civilian profiles, geographic proximity, and existing relations, and evolve through following, posting, reposting, commenting, liking, and direct messaging\. Fraud exposure occurs through two channels: public diffusion through feeds and social interactions, and private follow\-up through direct messages\.

The platform constructs each civilian’s feed using two\-stage ranking\. First, public posts are ranked by a Reddit\-style hot score\. For postppcreated attpt\_\{p\}, letlpl\_\{p\}anddpd\_\{p\}denote its numbers of likes and dislikes, respectively\. We define the net vote asvp=lp−dpv\_\{p\}=l\_\{p\}\-d\_\{p\}\. The corresponding hot score is

h⁡\(p\)=sign⁡\(vp\)​log10⁡\(max⁡\(\|vp\|,1\)\)\+tp−t0τr,h\(p\)=\\operatorname\{sign\}\(v\_\{p\}\)\\log\_\{10\}\(\\max\(\|v\_\{p\}\|,1\)\)\+\\frac\{t\_\{p\}\-t\_\{0\}\}\{\\tau\_\{r\}\},\(2\)wheret0t\_\{0\}is a reference timestamp andτr\\tau\_\{r\}is a time\-decay factor \(e\.g\., in seconds\)\.\.

Globally ranked posts are combined with content from followed users and previously interacted authors to form a candidate pool\. The candidates are then reranked by the cosine similarity between each post embedding and an embedding of the civilian’s recently interacted content, and the highest\-ranked posts enter the visible feed\. Public exposure therefore depends jointly on global popularity, social connections, and individual interaction history, whereas private exposure depends on fraudster follow\-up and prior civilian responses\.

Economic Environment and Ledgers\.The economic environment updates each civilian’s daily activities and financial state over time\. At each hourly tick, civilians engage in routine activities such as work, rest, and consumption, while income and expenditure events update their available balance\. These evolving routine and financial states become part of the civilian’s observation and provide the context for the subsequent Need\-Intent\-Action cycle\.

FraudSocietymaintains separate financial ledgers for civilians and fraud campaigns\. Each civilian ledger records the individual’s evolving financial state, while each campaign ledger records campaign\-related financial interactions, including payments, returns, withdrawal requests, delays, and follow\-up payment requests\. The civilian\-visible ledger states become part of subsequent observations, allowing later decisions to depend on current financial conditions as well as prior payments, received returns, unrecovered losses, and withdrawal experiences\. Formal observation construction and ledger details are provided in the Appendix\.

## 4Experiments

We evaluateFraudSocietythrough three research questions that together form a cross\-level validation chain:RQ1examines whether the simulator can reproduce aggregate loss distributions consistent with regulator\-grounded stylized facts;RQ2examines whether these aggregate outcomes emerge from empirically grounded multi\-step victimization pathways and whether key behavioral and economic mechanisms exhibit plausible patterns; andRQ3examines whether the simulator can serve as a counter\-fraud testbed by capturing how different warning strategies affect payment behavior and financial loss\. Correspondingly, our experiments proceed from macro\-level aggregate validation, to micro\-level pathway and mechanism analysis, and finally to intervention evaluation within the same simulated environment\.

We instantiateFraudSocietywith 112 civilians, 8 fraudsters, and 8 active campaigns over 480 hourly steps, using Qwen3\-14B for all agent decisions\. All variants and intervention conditions share the same civilian population, campaign initialization, and random seed to ensure controlled comparisons\. Further details are provided in the Appendix\.

### 4\.1Macro\-Level Validation

Evaluation Metrics\.To evaluate macro\-level realism, we introduce the Quartet Distance \(QD\), a regulator\-grounded audit score cross\-referencing simulated fraud losses against four empirical FTC stylized facts: Heavy\-Tailed Loss concentration \(HTL\), Age\-stratified Loss Severity profiles \(ALS\), Fraud\-family Severity Hierarchy \(FSH\), and Age\-specific Loss\-Report shares \(ALR\)\. The composite score is:

QD=1N​\(dHTL\+dALS\+dFSH\+dALR\),\\mathrm\{QD\}=\\frac\{1\}\{N\}\\left\(d\_\{\\mathrm\{HTL\}\}\+d\_\{\\mathrm\{ALS\}\}\+d\_\{\\mathrm\{FSH\}\}\+d\_\{\\mathrm\{ALR\}\}\\right\),
where unavailable component distances are omitted from the sum, andNNdenotes the number of included components\.

Each component distance captures a distinct aspect of the simulated loss surface\.dHTLd\_\{\\mathrm\{HTL\}\}measures whether the simulation produces a comparable high\-loss tail by comparing the simulated share of high\-loss victims with the FTC target after rescaling the empirical high\-loss threshold to the simulation scale\.dALSd\_\{\\mathrm\{ALS\}\}compares the median cumulative loss profile across seven adult age bins, auditing whether age\-stratified loss severity follows the FTC pattern\.dFSHd\_\{\\mathrm\{FSH\}\}evaluates whether the relative severity hierarchy between fraud families is preserved, using the investment\-to\-impersonation median\-loss ratio as the primary cross\-family severity contrast\.dALRd\_\{\\mathrm\{ALR\}\}compares the age distribution of positive\-loss victims with the FTC age\-specific loss\-report shares\. Together, these four component distances audit whether the simulated fraud economy reproduces the coarse shape of regulator\-observed victimization\. We provide the full component definitions in the Appendix\.

Table 1:Comparison of baselines\. ✓ denotes support, whereas ✗ indicates unsupported mechanisms\.SystemDemographicprofileSocialexposurePrivatepersuasionFinancialstateRepeatedpaymentWithdrawalfeedbackTransXion✓✗✗✓✓✗MultiAgent4Fraud✓✓✓✗✗✗FraudSociety✓✓✓✓✓✓Baseline Comparison\.We compareFraudSocietywith two closely related financial\-fraud simulation baselines:

\(1\)TransXion\([Chen et al\., 2026](https://arxiv.org/html/2610.33536#bib.bib16)\): a profile\-aware financial\-transaction simulator that models structured entity behaviors and realistic transaction graphs\.

\(2\)MultiAgent4Fraud\([Ren et al\., 2025](https://arxiv.org/html/2610.33536#bib.bib5)\): a multi\-agent simulation system for studying financial\-fraud behavior\.

Table[1](https://arxiv.org/html/2610.33536#S4.T1)compares the three systems\. TransXion focuses on profile\-conditioned financial dynamics without modeling the preceding informational process, whereas MultiAgent4Fraud models interactions leading to the first fraud transfer but treats that transfer as the terminal outcome\. In contrast,FraudSocietyjointly models informational and financial dynamics throughout the victimization process\.

Table[2](https://arxiv.org/html/2610.33536#S4.T2)reports the regulator\-grounded fidelity results across four stylized dimensions\.FraudSocietyachieves the lowest QD \(QD=0\.2978\\mathrm\{QD\}=0\.2978\), and consistently shows smaller discrepancies in loss concentration, age\-conditioned severity, fraud\-family severity, and victim\-share patterns\. These results indicate that the simulated outcomes more closely reproduce the joint statistical characteristics observed in regulatory data\. Compared with TransXion,FraudSocietyfurther explicitly models distinct fraud types, enabling direct evaluation of loss patterns across different fraud families\.

Table 2:Regulator\-grounded fidelity comparison using Quartet Distance \(QD\) and its four constituent evaluation metrics\. Lower values correspond to better alignment with real\-world stylized facts, withFraudSocietyachieving the best overall fidelity\.SystemHTL↓\\downarrowALS↓\\downarrowFSH↓\\downarrowALR↓\\downarrowQD↓\\downarrowTransXion0\.37220\.9168–0\.17930\.4894MultiAgent4Fraud0\.62110\.65860\.60170\.52430\.6014FraudSociety0\.08930\.65130\.30120\.14950\.2978Table 3:Micro\-level mechanism results\. \(a\) Association between civilian need states and fraud transfers: transfer hours exhibit higher need coordinates, and higher\-need states show more frequent transfers\. \(b\) Mechanism ablation under the QD audit, where lower scores indicate greater realism\.\(a\)Need\-state association

NeedNeed coordinateAll→\\rightarrowtransferTransfers / 100 hLow→\\rightarrowhighSafety0\.598→\\rightarrow0\.7100\.94→\\rightarrow1\.94Social0\.630→\\rightarrow0\.7121\.03→\\rightarrow1\.91
\(b\)Mechanism ablation

VariantHTL↓\\downarrowALS↓\\downarrowFSH↓\\downarrowALR↓\\downarrowQD↓\\downarrowFraudSociety0\.08930\.65130\.30120\.14950\.2978w/o NIA1\.00000\.65380\.79080\.18830\.6582w/o Ledger0\.70050\.57260\.34100\.18980\.4510

\(a\)Pathway loss concentration

\(b\)Loss severity by initial balance

Figure 4:Micro\-level victimization outcomes\. \(a\) Loss concentration across victimization pathways; pathway subgroups show concentration from repeated transfers, while the CAFC provides a real\-world reference\. \(b\) Loss severity across civilians with different initial balances; points show affected civilians, and markers show each balance group’s mean loss\.
### 4\.2Micro\-Level Analysis

Pathway Formation and Loss Escalation\.FraudSocietyexhibits a pathway\-escalation pattern in which aggregate losses emerge through exposure, private contact, and repeated fraud transfers, consistent with cyber\-victimization perspectives\([Cohen and Felson, 1979](https://arxiv.org/html/2610.33536#bib.bib18);[Leukfeldt and Yar, 2016](https://arxiv.org/html/2610.33536#bib.bib19)\)\. All 63 positive\-loss victims experience campaign contact and private\-DM exposure before their first transfer\. The median positive\-loss record contains 7 prior campaign contacts and a 72\-hour first\-contact\-to\-first\-transfer lag, consistent with empirical evidence that fraud victimization develops through sustained exposure and contact\([Wang, 2026](https://arxiv.org/html/2610.33536#bib.bib17)\)\.

As shown in Figure[4](https://arxiv.org/html/2610.33536#S4.F4)\(a\), the cumulative loss curve lies above the equal\-concentration baseline, indicating strong loss concentration\. The top 10% of records account for 81\.1% of total loss, broadly consistent with the 75\.2% top\-10% share reported by CAFC\([CAFC, 2025](https://arxiv.org/html/2610.33536#bib.bib27)\)\. This concentration is closely associated with repeated transfers: records with at least five transfers account only 19\.8% of records but explain 75\.6% of total loss, while those with at least ten transfers still explain 70\.4%\. These results show thatFraudSocietyreproduces both real\-world loss concentration and its association with repeated transfers\([Xiao et al\., 2025](https://arxiv.org/html/2610.33536#bib.bib24)\)\.

Individual Features in Fraud Victimization\.We examine whether victimization outcomes vary with civilians’ need states and economic conditions\. As shown in Table[3](https://arxiv.org/html/2610.33536#S4.T3)\(a\), fraud\-transfer hours exhibit higher need\-coordinate values than the overall distribution: safety need increases from 0\.598 to 0\.710, and social need increases from 0\.630 to 0\.712\. Consistently, transfer rates rise from 0\.94 to 1\.94 between low\- and high\-safety\-need states, and from 1\.03 to 1\.91 between low\- and high\-social\-need states\. These results show thatFraudSocietyexhibits patterns consistent with the state\-dependent vulnerability in prior literature, where situational insecurity and unmet social needs can increase susceptibility to fraud\-related decision making\([Chanenson et al\., 2026](https://arxiv.org/html/2610.33536#bib.bib25)\)\.

Economic conditions further shape victimizations\. As shown in Figure[4](https://arxiv.org/html/2610.33536#S4.F4)\(b\), low\-balance civilians are more likely to incur positive losses, reproducing the greater decision vulnerability associated with financial scarcity\([Shah et al\., 2012](https://arxiv.org/html/2610.33536#bib.bib21)\)\. Among affected civilians, however, high\-balance civilians incur larger conditional losses, consistent with routine\-activity perspectives that higher\-value targets will sustain greater losses once victimized\([Cohen and Felson, 1979](https://arxiv.org/html/2610.33536#bib.bib18)\)\. Together, these results show thatFraudSocietyreproduces theoretically grounded heterogeneity in both vulnerability to victimization and subsequent loss severity\.

Mechanism Ablation\.We further test whether the proposed micro\-mechanisms contribute to macro\-level realism\. Table[3](https://arxiv.org/html/2610.33536#S4.T3)\(b\) compares the full model with two ablations: removing theNeed\-Intent\-Actionarchitecture and disablingFinancial Ledger\. The former removes need\-conditioned civilian decision making, while the latter hides financial ledger states and feedback signals, such as income and cumulative investment\.

Both ablations increase QD, indicating weaker alignment with regulator\-grounded stylized facts\. Since lower QD reflects better macro\-level realism, these increases suggest that theNeed\-Intent\-Actionarchitecture andledger feedbackhelp bridge micro\-level victimization pathways with aggregate loss patterns observed in real\-world statistics\.

![Refer to caption](https://arxiv.org/html/2610.33536v1/Figures/warning_channel_effects-27.png)Figure 5:Intervention effects on losses, payments, repeat payments, and withdrawal attempts\.
### 4\.3Counter\-Fraud Intervention Analysis

We compare five warning strategies with the no\-warning reference \(C0\): Platform broadcasts \(C1\), Monitor labels \(C2\), Random warning comments \(C3\), Peer warnings \(C4\), and Oracle personalized warnings \(C5\)\. Figure[5](https://arxiv.org/html/2610.33536#S4.F5)reports total loss and payments alongside repeat\-payment and withdrawal\-attempt rates\. All five strategies reduce total loss, but through different downstream mechanisms\.

Platform\-broadcast warnings\.A fixed anti\-fraud reminder is sent to all civilians daily\. Relative to C0, payments fall from 623 to 205, loss from $145K to about $96K, and repeat payment from 49\.4% to 38\.2%, while withdrawal attempts rise from 8\.6% to 17\.1%\. Broad reminders reduce activity, but limited targeting constrains their effect on continued payment and loss\.

Monitor labels\.Warning labels mark suspicious public posts\. Payments fall from 623 to 284 and total loss declines, but repeat payment remains high\. Thus, labels mainly act at exposure; after civilians enter private follow\-up and make an initial payment, the warning is absent and repeated payment is less affected\.

Random warning comments\.Warnings inserted under posts regardless of suspiciousness reduce payments from 623 to 141 and total loss to $42,014, but leave repeat payment nearly unchanged at 49\.1%\. They create broad caution and suppress some initial payments, yet do not reliably interrupt repeats because they lack specific risk cues and victimization context\.

Peer warnings\.Civilian prompts encourage warning\-oriented actions such as commenting on suspicious posts\. Positive\-loss victims fall from 63 to 44, total loss to $24,752, and maximum positive loss to $3,800, indicating that observation\-conditioned warnings compress high\-loss pathways more effectively than random comments\.

Oracle personalized warnings\.This idealized intervention triggers after a civilian’s first fraud payment and uses an LLM to personalize the warning to the civilian and campaign\. Payments fall from 623 to 117 and repeat payment from 49\.4% to 10\.9%, while withdrawal attempts rise to 47\.5%\. Timely personalization therefore acts as a strong post\-payment brake, shifting victims toward exit or recovery\-seeking behavior\.

Overall,FraudSocietyprovides a controlled testbed that reveals how counter\-fraud interventions reshape victimization trajectories and downstream losses\.

## 5Conclusion

We introduceFraudSociety, the first LLM\-agent\-based simulator to jointly model the informational and financial dynamics of fraud\. It couples adaptive social interaction and persistent ledgers through Need\-Intent\-Action decision making, so exposure shapes financial actions and financial outcomes reshape later communication\. Experiments reproduce regulator\-grounded macro\-level loss patterns and micro\-level victimization pathways, while ablations show that Need\-Intent\-Action and ledger feedback connect individual processes with aggregate patterns\. The simulator also enables controlled comparisons of counter\-fraud interventions and their downstream effects\. Together, these capabilities makeFraudSocietya scalable foundation for realistic financial\-fraud simulation and systematic counter\-fraud research\.

#### Reproducibility Statement

The appendix specifies the simulation clock, population construction, model and intervention settings, evaluation units, artifact schemas, complete runtime prompt templates, and the provenance of every reported intervention and Quartet Distance run\.

## References

- Ajzen \(1991\)I\. AjzenThe theory of planned behavior\.Organizational behavior and human decision processes50\(2\),pp\. 179–211\.Cited by:[§3\.2](https://arxiv.org/html/2610.33536#S3.SS2.p3.1)\.
- Andersonet al\.\(2024\)M\. Anderson, E\. March, L\. Land, and C\. Boshuijzen\-van BurkenExploring the roles played by trust and technology in the online investment fraud victimisation process\.Journal of Criminology57\(4\),pp\. 488–514\.Cited by:[§1](https://arxiv.org/html/2610.33536#S1.p1.1)\.
- Badhe \(2025\)S\. BadheScamagents: how ai agents can simulate human\-level scam calls\.arXiv preprint arXiv:2508\.06457\.Cited by:[§2](https://arxiv.org/html/2610.33536#S2.SS0.SSS0.Px3.p1.1)\.
- Board of Governors of the Federal Reserve System \(2023\)Board of Governors of the Federal Reserve System2022 survey of consumer finances\.Note:[https://www\.federalreserve\.gov/econres/scfindex\.htm](https://www.federalreserve.gov/econres/scfindex.htm)Accessed: 2026\-07\-06Cited by:[Appendix B](https://arxiv.org/html/2610.33536#A2.SS0.SSS0.Px6.p1.1)\.
- CAFC \(2025\)CAFCCAFC 2024 Annual Statistical Report\.Technical reportRoyal Canadian Mounted Police\.Note:Accessed: 2026\-07\-24External Links:[Link](https://open.canada.ca/data/dataset/69c68f22-8a2a-43d1-8f4e-4017e3ffebba/resource/1ffc4a5e-e41b-48c7-929e-633d023ef8dc/download/cafc-annual-stats-report-2024-en.pdf)Cited by:[§4\.2](https://arxiv.org/html/2610.33536#S4.SS2.p2.1),[Abstract](https://arxiv.org/html/2610.33536#abstract1.1)\.
- Chanensonet al\.\(2026\)J\. Chanenson, T\. Matthews, S\. Consolvo, P\. G\. Kelley, J\. McClearn, S\. Meiklejohn, A\. Roy, R\. Shelby, K\. Thomas, and A\. Hassoun” It didn’t feel right but i needed a job so desperately”: understanding people’s emotions and help needs during scams\.InProceedings of the 2026 CHI Conference on Human Factors in Computing Systems,pp\. 1–22\.Cited by:[§4\.2](https://arxiv.org/html/2610.33536#S4.SS2.p3.1)\.
- Chenet al\.\(2026\)K\. Chen, M\. Jiang, Y\. Zhao, Z\. Li, Z\. Chen, W\. Luo, Z\. Li, S\. Liu, Y\. Jing, G\. Ye,et al\.TransXion: a high\-fidelity graph benchmark for realistic anti\-money laundering\.arXiv preprint arXiv:2604\.17420\.Cited by:[§2](https://arxiv.org/html/2610.33536#S2.SS0.SSS0.Px2.p1.1),[§4\.1](https://arxiv.org/html/2610.33536#S4.SS1.p5.1)\.
- Cohen and Felson \(1979\)L\. E\. Cohen and M\. FelsonSocial change and crime rate trends: a routine activity approach\.American sociological review,pp\. 588–608\.Cited by:[§4\.2](https://arxiv.org/html/2610.33536#S4.SS2.p1.1),[§4\.2](https://arxiv.org/html/2610.33536#S4.SS2.p4.1)\.
- Epstein \(1999\)J\. M\. EpsteinAgent\-based computational models and generative social science\.Complexity4\(5\),pp\. 41–60\.Cited by:[§1](https://arxiv.org/html/2610.33536#S1.p2.1),[§2](https://arxiv.org/html/2610.33536#S2.SS0.SSS0.Px1.p1.1)\.
- FBI IC3 \(2025\)FBI IC32024 internet crime report\.Annual reportFederal Bureau of Investigation, Internet Crime Complaint Center\.Note:Accessed: 2026\-06\-29External Links:[Link](https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf)Cited by:[§3\.3](https://arxiv.org/html/2610.33536#S3.SS3.p2.1)\.
- FTC \(2025\)FTCConsumer sentinel network data book 2024\.Data bookFederal Trade Commission\.Note:Accessed: 2026\-06\-29External Links:[Link](https://www.ftc.gov/reports/consumer-sentinel-network-data-book-2024)Cited by:[Appendix J](https://arxiv.org/html/2610.33536#A10.SS0.SSS0.Px1.p1.1),[§3\.3](https://arxiv.org/html/2610.33536#S3.SS3.p2.1)\.
- FTC \(2026\)FTCPrepared statement of the federal trade commission on the rising scam economy: modernizing federal approaches to protect americans from foreign fraudsters\.Testimony before the U\.S\. Congress Joint Economic CommitteeFederal Trade Commission,Washington, DC\.External Links:[Link](https://www.ftc.gov/system/files/ftc_gov/pdf/ftc-testimony-jec-hearing-on-the-rising-scam-economy.pdf)Cited by:[§1](https://arxiv.org/html/2610.33536#S1.p1.1),[Abstract](https://arxiv.org/html/2610.33536#abstract1.1)\.
- Gollwitzer \(1999\)P\. M\. GollwitzerImplementation intentions: strong effects of simple plans\.\.American psychologist54\(7\),pp\. 493\.Cited by:[§3\.2](https://arxiv.org/html/2610.33536#S3.SS2.p3.1)\.
- Laceyet al\.\(2020\)D\. Lacey, S\. Goode, J\. Pawada, and D\. GibsonThe application of scam compliance models to investment fraud offending\.Journal of Criminological Research, Policy and Practice6\(1\),pp\. 65–81\.Cited by:[§3\.3](https://arxiv.org/html/2610.33536#S3.SS3.p2.1)\.
- Leukfeldt and Yar \(2016\)E\. R\. Leukfeldt and M\. YarApplying routine activity theory to cybercrime: a theoretical and empirical analysis\.Deviant Behavior37\(3\),pp\. 263–280\.Cited by:[§4\.2](https://arxiv.org/html/2610.33536#S4.SS2.p1.1)\.
- Liet al\.\(2026\)Z\. Li, G\. Wan, K\. Chen, Y\. Chen, Y\. Zhao, P\. Torr, G\. Ye, Z\. Yin, and H\. ChaiBehavioral consistency validation for llm agents: an analysis of trading\-style switching through stock\-market simulation\.InFindings of the Association for Computational Linguistics: ACL 2026,pp\. 40356–40370\.Cited by:[§2](https://arxiv.org/html/2610.33536#S2.SS0.SSS0.Px1.p1.1)\.
- Lopez\-Rojas and Axelsson \(2014\)E\. A\. Lopez\-Rojas and S\. AxelssonBanksim: a bank payments simulator for fraud detection research\.In26th European Modeling and Simulation Symposium, EMSS,Vol\.2014\.Cited by:[§2](https://arxiv.org/html/2610.33536#S2.SS0.SSS0.Px2.p1.1)\.
- Maslow \(1943\)A\. H\. MaslowA theory of human motivation\.\.Psychological review50\(4\),pp\. 370\.Cited by:[§3\.2](https://arxiv.org/html/2610.33536#S3.SS2.p2.1)\.
- Oak and Shafiq \(2025\)R\. Oak and Z\. Shafiq” Hello, is this anna?”: unpacking the lifecycle of\{\\\{pig\-butchering\}\\\}scams\.InTwenty\-First Symposium on Usable Privacy and Security \(SOUPS 2025\),pp\. 1–18\.Cited by:[§1](https://arxiv.org/html/2610.33536#S1.p1.1)\.
- Oztaset al\.\(2023\)B\. Oztas, D\. Cetinkaya, F\. Adedoyin, M\. Budka, H\. Dogan, and G\. AksuEnhancing anti\-money laundering: development of a synthetic transaction monitoring dataset\.In2023 IEEE International Conference on e\-Business Engineering \(ICEBE\),pp\. 47–54\.Cited by:[§1](https://arxiv.org/html/2610.33536#S1.p2.1),[§2](https://arxiv.org/html/2610.33536#S2.SS0.SSS0.Px2.p1.1)\.
- Piaoet al\.\(2025\)J\. Piao, Y\. Yan, J\. Zhang, N\. Li, J\. Yan, X\. Lan, Z\. Lu, Z\. Zheng, J\. Y\. Wang, D\. Zhou,et al\.Agentsociety: large\-scale simulation of llm\-driven generative agents advances understanding of human behaviors and society\.Cited by:[§1](https://arxiv.org/html/2610.33536#S1.p2.1),[§2](https://arxiv.org/html/2610.33536#S2.SS0.SSS0.Px1.p1.1)\.
- Renet al\.\(2025\)Q\. Ren, Z\. Zheng, J\. Guo, J\. Yan, L\. Ma, and J\. ShaoWhen ai agents collude online: financial fraud risks by collaborative llm agents on social platforms\.arXiv preprint arXiv:2511\.06448\.Cited by:[§2](https://arxiv.org/html/2610.33536#S2.SS0.SSS0.Px3.p1.1),[§4\.1](https://arxiv.org/html/2610.33536#S4.SS1.p6.1)\.
- Shahet al\.\(2012\)A\. K\. Shah, S\. Mullainathan, and E\. ShafirSome consequences of having too little\.Science338\(6107\),pp\. 682–685\.Cited by:[§4\.2](https://arxiv.org/html/2610.33536#S4.SS2.p4.1)\.
- U\.S\. Census Bureau \(2022\)U\.S\. Census BureauACS 2022 1\-year subject table s0101: age by sex\.Note:[https://data\.census\.gov/table/ACSST1Y2022\.S0101](https://data.census.gov/table/ACSST1Y2022.S0101)Accessed: 2026\-07\-06Cited by:[Appendix B](https://arxiv.org/html/2610.33536#A2.SS0.SSS0.Px4.p1.1)\.
- Wang \(2026\)F\. WangA scoping review of online romance scams: conceptual construction and comparative analysis\.International Review of Victimology,pp\. 02697580251414141\.Cited by:[§1](https://arxiv.org/html/2610.33536#S1.p1.1),[§4\.2](https://arxiv.org/html/2610.33536#S4.SS2.p1.1)\.
- Weberet al\.\(2018\)M\. Weber, J\. Chen, T\. Suzumura, A\. Pareja, T\. Ma, H\. Kanezashi, T\. Kaler, C\. E\. Leiserson, and T\. B\. SchardlScalable graph learning for anti\-money laundering: a first look\.arXiv preprint arXiv:1812\.00076\.Cited by:[§2](https://arxiv.org/html/2610.33536#S2.SS0.SSS0.Px2.p1.1)\.
- Xiaoet al\.\(2025\)J\. Xiao, Q\. Xiao, and H\. Shen” It felt real” victim perspectives on platform design and longer\-running scams\.arXiv preprint arXiv:2510\.02680\.Cited by:[§4\.2](https://arxiv.org/html/2610.33536#S4.SS2.p2.1)\.
- Yanget al\.\(2024\)Z\. Yang, Z\. Zhang, Z\. Zheng, Y\. Jiang, Z\. Gan, Z\. Wang, Z\. Ling, J\. Chen, M\. Ma, B\. Dong,et al\.Oasis: open agent social interaction simulations with one million agents\.arXiv preprint arXiv:2411\.11581\.Cited by:[§1](https://arxiv.org/html/2610.33536#S1.p2.1),[§2](https://arxiv.org/html/2610.33536#S2.SS0.SSS0.Px1.p1.1)\.
- Zhanget al\.\(2025\)X\. Zhang, J\. Lin, X\. Mou, S\. Yang, X\. Liu, L\. Sun, H\. Lyu, Y\. Yang, W\. Qi, Y\. Chen,et al\.Socioverse: a world model for social simulation powered by llm agents and a pool of 10 million real\-world users\.arXiv preprint arXiv:2504\.10157\.Cited by:[§2](https://arxiv.org/html/2610.33536#S2.SS0.SSS0.Px1.p1.1)\.

## Appendix AGuide to the Appendix

This appendix documents the implementation and evaluation details deferred from the main paper\. Table[4](https://arxiv.org/html/2610.33536#A1.T4)links each deferred topic to its detailed treatment below\. Subsequent sections provide formal definitions, additional diagnostics, and English translations of the runtime prompts required to audit the reported mechanisms\.

Main\-paper referenceAppendix detailLocationOverall designGlobal hourly ordering, closed\-loop state commit, and operator/civilian decision timingSections[B](https://arxiv.org/html/2610.33536#A2)and[C](https://arxiv.org/html/2610.33536#A3)Fraudster agentsCampaign lifecycle, public outreach, active\-dialogue follow\-up, financial feedback, and execution gatesSection[D](https://arxiv.org/html/2610.33536#A4)Civilian NIA modelFormal need update, active\-need selection, intent routing, action generation, and the NIA ablationSection[E](https://arxiv.org/html/2610.33536#A5)Social\-economic environmentBounded observation construction, social exposure, financial ledger transitions, and surfaced\-state ablationSections[B](https://arxiv.org/html/2610.33536#A2)and[F](https://arxiv.org/html/2610.33536#A6)Counter\-fraud evaluationExact intervention triggers, visible channels, information assumptions, and matched outcome accountingSections[B](https://arxiv.org/html/2610.33536#A2.SSx1)and[G](https://arxiv.org/html/2610.33536#A7)Micro\-level validationVictim–campaign accounting, contact\-to\-payment latency, escalation depth, and family\-level pathwaysSection[H](https://arxiv.org/html/2610.33536#A8)Quartet DistanceStatistical units, all four component definitions, raw diagnostics, and baseline\-alignment protocolSections[G](https://arxiv.org/html/2610.33536#A7),[J](https://arxiv.org/html/2610.33536#A10), and[K](https://arxiv.org/html/2610.33536#A11)ReproducibilityRuntime configuration, condition switches, and artifact\-level provenanceSection[L](https://arxiv.org/html/2610.33536#A12)Runtime policiesEnglish translations of one shared\-environment, eight civilian, and four operator prompt templates and their JSON contractsSection[M](https://arxiv.org/html/2610.33536#A13)Table 4:Correspondence between topics deferred from the main paper and their detailed treatment in this appendix\.
## Appendix BImplementation and Experimental Setting

##### Population and temporal setup\.

Each simulation advances in hourly ticks, and every reported run comprises 480 steps over 20 simulated days\. We fix a common start time of 08:00 on March 11, 2025 for C0–C5 and all QD runs\. All conditions use seed 42 and the same fixed profile realization, controlling population resampling, stochastic initialization, and calendar/payday timing\. The full profile pool contains 112 civilian profiles and 8 criminal\-operator profiles\.

##### LLM backbone\.

All LLM\-controlled decisions in the reported experiments use Qwen3\-14B as the backbone model\. The same backbone is used for the no\-warning baseline, counter\-fraud interventions, and ablation settings; consequently, comparisons do not conflate the experimental mechanisms with changes in model family\. Runtime inference uses temperature00and task\-specific output\-token limits\. Structured decisions are requested in JSON format\. The parser removes reasoning tags, repairs recoverable syntax errors, validates action names and arguments against the active schema, and rejects actions that fail execution\-time grounding constraints\. The simulator seed fixes profile, graph, and intervention sampling\.

##### Grounded civilian profiles and routine context\.

Each civilian profile specifies demographic attributes, age, education, occupation, home and work areas of interest, initial balance, income, salary day, consumption tendency, working hours, and Big\-Five personality traits\. These fields define the economic, mobility, and behavioral context of the hourly agent process\. The environment uses an urban\-scale spatial substrate\. Home and work areas are taken from the fixed profile pool, and points of interest within a 2\-km radius provide routine consumption alternatives\. Salaries, fixed expenses, point\-of\-interest purchases, and fraud payments are recorded in the economy ledger; fraud payments are marked as illegal transactions\.

##### Profile generation and U\.S\. age alignment\.

Civilian profiles are generated once and then held fixed across all reported runs\. The profile generator preserves stable simulation identifiers, names, communities, and map\-linked home and work areas while resampling demographic and behavioral variables\. The adult age sampler follows the U\.S\. Census ACS 2022 S0101 age\-by\-sex table, normalized over adults aged 20 years and older\([U\.S\. Census Bureau, 2022](https://arxiv.org/html/2610.33536#bib.bib28)\)\. The resulting target bins are 20–29, 30–39, 40–49, 50–59, 60–69, 70–79, and 80\+\. Table[5](https://arxiv.org/html/2610.33536#A2.T5)reports both the target sampling weights and the fixed realization of 112 civilians used in the 120\-agent experiments\. Holding this finite\-sample realization constant ensures that intervention comparisons reflect warning conditions rather than differences in population composition\.

Age binACS adult targetRealized civiliansRealized share20–2917\.2%1816\.1%30–3917\.9%1614\.3%40–4916\.5%1210\.7%50–5916\.5%3228\.6%60–6915\.8%1412\.5%70–7911\.2%108\.9%80\+5\.0%108\.9%Table 5:Target and realized age composition of the 112 civilians used in the main experiments\. The ACS column reports the adult\-population sampling target; the remaining columns report the fixed profile realization used across all experimental conditions\.
##### Big\-Five behavioral grounding\.

Each civilian is assigned scores for openness, conscientiousness, extraversion, agreeableness, and neuroticism on a 1–10 scale\. The generator samples these dimensions independently of age from clipped normal distributions\. Openness, conscientiousness, extraversion, and agreeableness have mean5\.55\.5and standard deviation1\.81\.8; neuroticism has mean5\.05\.0and standard deviation1\.81\.8\. These scores are operationalized as behavioral covariates that condition social responses, warning uptake, and fraud\-payment decisions\. Table[6](https://arxiv.org/html/2610.33536#A2.T6)summarizes the construction and behavioral interpretation of each dimension\.

TraitSampling targetRealized meanBehavioral interpretation in civilian decisionsOpenness5\.5±1\.85\.5\\pm 1\.85\.46Higher values increase curiosity toward unfamiliar products, new platforms, and novel earning opportunities\.Conscientiousness5\.5±1\.85\.5\\pm 1\.85\.54Higher values increase verification, delayed commitment, and caution before major payments\.Extraversion5\.5±1\.85\.5\\pm 1\.85\.41Higher values increase social sharing, public engagement, and sensitivity to peer activity\.Agreeableness5\.5±1\.85\.5\\pm 1\.85\.17Higher values increase trust, compliance pressure, and difficulty refusing friend\-like or authority\-like requests\.Neuroticism5\.0±1\.85\.0\\pm 1\.85\.10Higher values increase sensitivity to urgency, loss avoidance, and fear\-of\-missing\-out cues\.Table 6:Big\-Five sampling distributions and behavioral interpretations for the 112 civilians\. Scores are sampled on a 1–10 scale and clipped to the valid range; realized means are computed for the fixed experimental population\.
##### Financial and online\-post grounding\.

Initial balances are sampled from age\-specific transaction\-account anchors derived from the Federal Reserve 2022 Survey of Consumer Finances\([Board of Governors of the Federal Reserve System, 2023](https://arxiv.org/html/2610.33536#bib.bib29)\), with lognormal dispersion and an occupation multiplier\. Occupation, salary, work schedule, consumption tendency, and retirement status then determine routine affordability and daily mobility\. Public social\-media context is initialized from two online\-post seed pools, each containing 280 short posts\. These seeds cover benign finance, cybersecurity, marketplace, work, charity, and relationship themes, as well as suspicious lures\. During the simulation, criminal operators generate new public posts and private messages conditioned on fraud family, campaign phase, recent engagement, and visible user signals\. The seed pools therefore provide topical grounding rather than fixed scripts\.

##### Fraud campaign initialization\.

The simulator instantiates four fraud\-family templates corresponding to the families examined in the main paper: investment, impersonation, marketplace, and romance\. In the eight\-operator setting, two operators are assigned to each family\. Each operator is associated with one active campaign and a set of collection merchant accounts\. Campaigns progress through four lifecycle phases: recruiting, credibility building, peak extraction, and collapse\. In LLM\-controlled mode, the operator selects phase transitions, while the campaign state records lifecycle status and the state changes associated with terminal collapse\.

##### Social platform and social graph\.

The social layer uses an OASIS\-style platform interface supporting public posts, comments, likes, follows, reposts, and direct messages\. Each feed view contains at most 10 public posts and 20 unread private messages\. The recommender first computes the Reddit\-style hot score in Equation \(2\) of the main paper and constructs a candidate set from globally high\-ranked posts and posts authored by followed or positively engaged users\. Candidates are then reranked using the hot score, follow and author\-affinity indicators, and nonnegative embedding similarity to content with which the civilian recently interacted\. If the embedding model is unavailable, reranking uses only the non\-embedding features\.

The initial graph is a hybrid small\-world network rather than a uniformly random graph\. Construction begins with thek=6k=6geographically nearest civilian neighbors, after which candidate edges are independently rewired with probabilityp=0\.15p=0\.15\. Within\-community ties may be strengthened by occupation, salary, or education homophily, and additional online\-contact edges are sampled by degree\-preferential attachment\. Each operator is connected to as many as 10 degree\-weighted civilian targets, placing campaign exposure within the same graph as ordinary social interaction\. Edges are labeled as family, colleague, neighbor, or online contact and are used by the social\-proof, following, forwarding, and peer\-warning mechanisms\.

##### Counter\-fraud conditions\.

Table[7](https://arxiv.org/html/2610.33536#A2.T7)summarizes the intended controlled design, in which the six conditions vary in warning channel and trigger\. All six conditions share the same March 11 start, population realization, simulator seed, and 480\-hour horizon\.

ConditionChannel, trigger, and intended mechanismC0No warning\.Baseline exposure and persuasion dynamics\.C1Platform private warning\.Broadcast every 24 simulated hours; broad awareness with low personalization\.C2Public monitor annotation\.Newly created posts are screened at the exposure surface\.C3Random peer\-style comment\.Five percent of civilians are sampled each step, producing sparse socially distributed warnings\.C4Endogenous peer warning\.Civilian planning can interrupt persuasion through peer communication\.C5Oracle personalized warning\.A transaction\-specific private warning follows each executed fraud payment; the first\-payment message is explicitly distinguished\.Table 7:Counter\-fraud intervention conditions in the controlled design\. All conditions use the common March 11 clock\. C5 is interpreted as an oracle upper bound\.
##### Run artifacts and comparative interpretation\.

Each run records social interactions, economic transactions, victim–campaign states, QD statistics, and decision traces in artifacts linked by stable identifiers\. All experimental conditions share the same population realization, simulator seed, March 11 start time, and 480\-hour horizon\. All contrasts are single\-run descriptive comparisons rather than estimates of population\-level effects across independent seeds\. Table[8](https://arxiv.org/html/2610.33536#A2.T8)identifies the two information\-to\-decision links removed by the ablations\.

VariantMechanism state and effectFull modelNIA enabled; ledger feedback enabled\.Need\-conditioned routing uses visible cumulative financial fields\.NIA ablationNIA disabled; ledger feedback enabled\.Need updates remain logged, but the route is sampled uniformly from the feasible set\.Ledger ablationNIA enabled; ledger feedback disabled\.Transfers remain executable and included in evaluation, but cumulative financial fields are withheld from civilian prompts\.Table 8:Controlled mechanism ablations\. Population, campaign, platform, economic, and model settings are held fixed\.
### Counter\-Fraud Intervention Realization

Interventions are realized exclusively through information that can become visible in a civilian’s bounded social observation\. With the exception of C5, condition membership is never supplied to the civilian planner as a hidden label\. A warning affects behavior only if it appears as an unread private message, an appended post label, a visible comment, or a civilian\-generated social action and is subsequently selected into the bounded view\. Table[9](https://arxiv.org/html/2610.33536#A2.T9)specifies the exact trigger and information assumption for each condition\.

ConditionCode\-level trigger, visible mutation, and information assumptionC0No warning insertion or warning\-specific prompt affordance\.C1Att\>0t\>0divisible by 24, pseudo\-user 9999 inserts one fixed unread DM for every civilian; no classifier or victim\-specific evidence is used\.C2After each new post, an independent LLM returns binary JSON from its first 400 characters\. A flagged post receives an in\-place\[system warning\]suffix; parse failure leaves it unchanged\.C3At everyt\>0t\>0, the sampler seeded by42\+t42\+tselects six civilians\. Each adds a generic warning beneath a uniformly selected post among the 50 most recent, irrespective of suspiciousness\.C4The ordinary civilian social planner may comment under a visible post, publish a warning post, or privately warn a visible user using only its bounded observation\.C5After each executed fraud payment, pseudo\-user 9999 inserts a transaction\-keyed personalized DM\. It uses true family, amount, cumulative payment, count, and message cues; first\-payment wording is distinguished\.Table 9:Code\-level realization of the six counter\-fraud conditions\. C1–C4 operate on ordinary social surfaces\. C5 deliberately consumes simulator ground truth and is used only as an intervention upper bound\.##### Mutation order and channel separation\.

C1 and C3 insert their social records after the six environment spaces have advanced and before civilian steps begin\. C2 is instead a post\-creation hook: the submitted post is first committed and then screened, so every later reader sees the same annotated content when the monitor flags it\. C4 uses the ordinary civilian action executor and therefore produces no privileged social record type\. C5 is called only after a fraud payment has passed affordability, campaign, and duplicate\-transaction gates and has been committed to the victim ledger\.

##### Failure and deduplication semantics\.

Malformed or unavailable C2 classifier output is fail\-open: the post remains unchanged and no warning is inferred\. C1 and C3 use the centralized social database layer to preserve the same private\-message and comment schemas as ordinary actions\. C5 uses a transaction identifier as its deduplication key, so retries cannot create repeated copies for the same payment; a later payment has a different identifier and can produce a new warning\. These rules make the visible intervention record, rather than an unobserved condition flag, the auditable treatment event\.

##### Attention is not forced\.

Insertion does not imply that the civilian reads or obeys a warning\. Private warnings enter the unread\-message queue, public labels compete for one of ten feed slots, and warning comments must be among the recent comments surfaced with a visible post\. The subsequent NIA and social policies may respond, defer, ignore, forward, or act against a warning\. Intervention outcomes therefore combine delivery, bounded exposure, and endogenous response, except for C5’s explicitly oracle\-informed targeting\.

## Appendix CHourly Simulation Cycle and Closed\-Loop Coupling

Figure[6](https://arxiv.org/html/2610.33536#A3.F6)summarizes the update order described in the main paper\. At the beginning of each hourly tick, the simulator advances the economic, information, campaign, mobility, event, and social\-platform states\. Daily macroeconomic context and condition\-specific interventions are updated when their respective triggers are satisfied\. Each agent then receives a bounded, role\-specific projection of the resulting state and executes its planning and action process\. Admissible social and financial effects are committed to the shared state before the next tick, ensuring that subsequent observations reflect the consequences of current\-tick decisions\.

Advance sixenvironment spacesUpdate daily contextand enabled warningsConstruct boundedrole\-specific viewsCivilian NIA oroperator hierarchyParse, ground,gate, and executeCommit social traces,transactions, ledgersfeedback becomes observable at tickt\+1t\+1

Figure 6:Schematic of the within\-hour execution order and closed feedback loop\. Social exposure may induce financial actions during the current tick; committed messages, payments, returns, and withdrawal states enter subsequent agent observations\.Let𝒲t\\mathcal\{W\}\_\{t\}denote the shared social graph, public content, private\-message store, economy, campaign ledgers, mobility state, and intervention state at ticktt\. For agentii, the observation builderBiB\_\{i\}produces a bounded viewoi,to\_\{i,t\}rather than exposing the full simulator state\. Conditional on profilepip\_\{i\}, memorymi,tm\_\{i,t\}, and rolerir\_\{i\}, the agent policy produces a set of proposed actions,

𝐚~i,t∼πri\(⋅∣pi,mi,t,oi,t\)\.\\tilde\{\\mathbf\{a\}\}\_\{i,t\}\\sim\\pi\_\{r\_\{i\}\}\\\!\\left\(\\cdot\\mid p\_\{i\},m\_\{i,t\},o\_\{i,t\}\\right\)\.Parsing and execution constraints define a projectionΓri\\Gamma\_\{r\_\{i\}\}from proposed actions to the admissible action set\. The shared\-state transition is therefore

𝒲t\+1=𝒯⁡\(𝒲t,⋃i∈𝒜Γri​\(𝐚~i,t,oi,t\)\),\\mathcal\{W\}\_\{t\+1\}=\\mathcal\{T\}\\\!\\left\(\\mathcal\{W\}\_\{t\},\\bigcup\_\{i\\in\\mathcal\{A\}\}\\Gamma\_\{r\_\{i\}\}\(\\tilde\{\\mathbf\{a\}\}\_\{i,t\},o\_\{i,t\}\)\\right\),Agent memory is updated only from grounded execution results; actions with invalid targets, unaffordable payments, or unsupported operator operations therefore do not enter the persistent state\.

Algorithm 1Hourly simulation tick0:shared world state

𝒲t\\mathcal\{W\}\_\{t\}, agents

𝒜\\mathcal\{A\}, condition

cc
1:advance economy, information, campaign, mobility, event, and social spaces

2:update day\-level context and fire warning triggers enabled by

cc
3:for all

i∈𝒜i\\in\\mathcal\{A\}in paralleldo

4:construct bounded observation

oi,t=Bi​\(𝒲t\)o\_\{i,t\}=B\_\{i\}\(\\mathcal\{W\}\_\{t\}\)
5:if

iiis a civilianthen

6:synchronize income, routine, return, and withdrawal effects

7:update needs; choose an available intent route; retrieve route\-relevant memory

8:plan and execute grounded routine, social, payment, or withdrawal actions

9:else

10:evaluate the campaign phase at its day\-level decision point

11:plan public outreach, active\-dialogue follow\-up, and financial feedback

12:execute only actions that pass target, cadence, balance, and lifecycle gates

13:endif

14:endfor

15:periodically synthesize operator reflections and export append\-only traces

16:returncommitted shared state

𝒲t\+1\\mathcal\{W\}\_\{t\+1\}

Decision layerAdmissible action familiesPrincipal execution gatesPersistent effectsCivilian routinework/rest, nearby consumption, no actiontime slot, work schedule, nearby POI, available balancemobility, legal transactions, routine memoryCivilian socialpost, comment, like, repost, follow, private reply, ignore/defer, mark suspicious, forward warningvisible post and message identifiers, reply grounding, current route, social availabilitygraph edges, public traces, dialogue state, warning exposureCivilian financialfraud payment, hold, withdrawal requestvisible campaign contact, positive affordable amount, campaign state, no duplicate pending requesteconomy transaction and victim\-campaign ledgerOperator socialcreate post, feed\-driven outreach, active\-dialogue follow\-up, like/repost/follow, coordination taskphase, visible eligible target, active\-conversation membership, cadence, per\-step deduplicationpublic exposure, private contact, task/shared memoryOperator financialpay return, pay withdrawal, delay withdrawal, request top\-up/unlock, no actionexisting paid victim, pending request, available campaign pool, lifecycle consistencyreturn/payout transaction, delay state, follow\-up messageTable 10:Action families and the grounding boundary between LLM proposals and persistent state changes\.
## Appendix DFraudster Hierarchical Decision Process

Fraudster behavior is implemented as a hierarchy of temporally distinct policies rather than as a single hourly completion\. For campaigncc, letzc,t∈\{recruiting,credibility,peak,collapse\}z\_\{c,t\}\\in\\\{\\textit\{recruiting\},\\textit\{credibility\},\\textit\{peak\},\\textit\{collapse\}\\\}denote its lifecycle phase\. The phase policy is evaluated at most once per simulated date and its applied result is cached for the remaining ticks of that date\. Execution enforces a monotone lifecycle: proposed retreats are rejected, entry intopeakis rejected when the campaign has neither a victim nor positive raised funds, andcollapseis terminal\. Thus, ifρ⁡\(⋅\)\\rho\(\\cdot\)is the phase rank, the committed transition satisfies

ρ⁡\(zc,t\+1\)\\displaystyle\\rho\(z\_\{c,t\+1\}\)≥ρ⁡\(zc,t\),\\displaystyle\\geq\\rho\(z\_\{c,t\}\),zc,t=collapse\\displaystyle z\_\{c,t\}=\\textit\{collapse\}⇒zc,t\+1=collapse\.\\displaystyle\\Rightarrow z\_\{c,t\+1\}=\\textit\{collapse\}\.This projection separates strategic suggestions from lifecycle changes that are structurally admissible\.

RecruitingCredibilityPeak extractionCollapsemonotone campaign lifecycle; one phase decision per simulated datePhase policycampaign summaryFinancial policypaid victims and withdrawalsStep 2Apublic surface and feed outreachStep 2B×2\\times 2active\-dialogue follow\-upExecution gatestarget, cadence, funds, phaseCommitmessages, ledger, tracesnew dialogue and financial state condition later ticks

Figure 7:Fraudster decision hierarchy\. The daily lifecycle policy constrains three lower\-frequency or hourly policies\. Step 2A constructs public visibility and feed\-grounded outreach, whereas Step 2B only continues conversations in which the civilian spoke last\. Proposed operations affect the shared state only after deterministic execution gates\.Figure[7](https://arxiv.org/html/2610.33536#A4.F7)makes the separation of roles explicit: the lifecycle layer restricts the strategies available on a given date, the financial layer reacts to paid\-victim and withdrawal states, Step 2A builds public visibility and recruits new targets, and Step 2B is confined to active dialogues\. The final deterministic gates project generative proposals onto the executable action set\. The ordering therefore identifies both the policy timescales and the point at which a proposal becomes persistent state\.

The financial policy is active only in thecredibilityandpeakphases\. Its observation includes campaign funds, as many as eight paid\-victim summaries, pending withdrawal requests, latest received messages, and recent payment or return events\. A change in this context signature forces replanning\. Otherwise, a valid decision is reused for four hours, shortened to two hours when a payment, return, or pending\-withdrawal event occurred within the previous two hours\. This event\-sensitive cache prevents financial feedback from becoming an artificial hourly heartbeat while still allowing rapid responses to newly changed victim states\.

The social policy is split into two non\-interchangeable stages\. Step 2A may create a post, engage with public content, follow users, and initiate feed\-grounded outreach\. Its prompt contains no more than ten visible candidates, with at most six prompt slots reserved for untouched cold profiles; the remaining slots can represent existing victims or warmed leads\. A stranger newly followed by the operator is not immediately eligible for a direct message and must remain followed for six simulated hours unless already registered as a campaign target\. Step 2A is also forbidden from messaging a user whose conversation is active\. Step 2B is the complementary active\-dialogue policy: it receives no public\-feed candidates, may address only conversations in which the civilian spoke last, and is evaluated for at most two follow\-up rounds per hourly tick\. Public outreach and dialogue replies have separate cadence clocks, so a reply does not consume the cold\-outreach window\.

SubpolicyInvocationPrincipal observationDeterministic post\-LLM constraintsLifecycleAt most once per simulated datecampaign age and phase, victims, raised and returned funds, outreach state, withdrawal pressurevalid phase label; monotone advance; nonempty economic evidence before peak; terminal collapseFinancial feedbackCredibility/peak; context change or 2–4 h cache expirycampaign pool, paid\-victim ledger, pending withdrawals, recent messages and financial eventsexisting paid victim or request; positive amount; available pool; valid lifecycle; no duplicate executionStep 2A: public/outreachWhen a phase\-scaled outreach window is due or visible candidates existrecent public posts, no more than 10 grounded candidates, warm and repeat leads, campaign and shared\-task contextvisible eligible target; no active dialogue; follow is Step 2A only; six\-hour follow\-to\-DM warm\-up for strangers; per\-step deduplicationStep 2B: dialogueUp to two rounds per tick when a civilian spoke last and reply cadence is duebounded recent dialogue, account\-state summary, campaign semantics, retrieved memorytarget must belong to the active\-conversation set; private\-message action only; one sent message per target per tickTable 11:Invocation scopes and execution constraints of the fraudster hierarchy\. The LLM selects among schema\-valid proposals, while the final column is enforced by simulator code\.
## Appendix ENeed\-Intent\-Action Formalization

For each civilianiiand hourly ticktt,FraudSocietymaintains the need vector

𝐬i,t=\(si,tsatiety,si,tenergy,si,tsafety,si,tsocial\)∈\[0,1\]4,\\mathbf\{s\}\_\{i,t\}=\\left\(s^\{\\mathrm\{satiety\}\}\_\{i,t\},s^\{\\mathrm\{energy\}\}\_\{i,t\},s^\{\\mathrm\{safety\}\}\_\{i,t\},s^\{\\mathrm\{social\}\}\_\{i,t\}\\right\)\\in\[0,1\]^\{4\},where larger values indicate greater need urgency, or equivalently lower need satisfaction\. The default initial values are0\.620\.62,0\.150\.15,0\.100\.10, and0\.280\.28, respectively, and the activation thresholds are

𝜽=\(0\.80,0\.80,0\.80,0\.70\)\.\\boldsymbol\{\\theta\}=\(0\.80,0\.80,0\.80,0\.70\)\.LetEi,t=\{k:si,tk\>θk\}E\_\{i,t\}=\\\{k:s^\{k\}\_\{i,t\}\>\\theta\_\{k\}\\\}\. IfEi,tE\_\{i,t\}is empty, the active\-need variable is assigned the neutral sentinel⊥\\bot, corresponding to the implementation labelwhatever\. Otherwise, the active need is selected fromEi,tE\_\{i,t\}according to the priority order satiety, energy, safety, and social; ties within a priority level are resolved by greater urgency\.

More explicitly, let𝐬i,t−\\mathbf\{s\}^\{\-\}\_\{i,t\}and𝐬i,t\+\\mathbf\{s\}^\{\+\}\_\{i,t\}denote the pre\-update and post\-update need vectors\. The structured need updater implements

𝐬i,t\+=Π\[0,1\]4​Fϕ​\(𝐬i,t−,oi,t,mi,t,ℓi,t−1\),\\mathbf\{s\}^\{\+\}\_\{i,t\}=\\Pi\_\{\[0,1\]^\{4\}\}F\_\{\\phi\}\\\!\\left\(\\mathbf\{s\}^\{\-\}\_\{i,t\},o\_\{i,t\},m\_\{i,t\},\\ell\_\{i,t\-1\}\\right\),whereoi,to\_\{i,t\}is the bounded observation,mi,tm\_\{i,t\}is retrieved recent memory,ℓi,t−1\\ell\_\{i,t\-1\}is the previous intent route,FϕF\_\{\\phi\}is the Qwen3\-14B need\-adjustment policy, andΠ\\Pidenotes schema validation and range clipping\. The update is sparse: coordinates omitted from a valid structured response remain unchanged\. If no valid response is available, the complete vector is retained for that tick\. In the notation above,𝐬i,t\\mathbf\{s\}\_\{i,t\}refers to this post\-update vector\. Active\-need selection follows the lexicographic rule

ni,t=\{⊥,Ei,t=∅,arg⁡mink∈Ei,t⁡\(priority⁡\(k\),−si,tk\),otherwise\.n\_\{i,t\}=\\begin\{cases\}\\bot,&E\_\{i,t\}=\\varnothing,\\\\ \\arg\\min\_\{k\\in E\_\{i,t\}\}\\bigl\(\\operatorname\{priority\}\(k\),\-s^\{k\}\_\{i,t\}\\bigr\),&\\text\{otherwise\}\.\\end\{cases\}
Letℛi,t\\mathcal\{R\}\_\{i,t\}be the routes currently feasible under time, work, sleep, mobility, and social availability\. The intent and action stages are

ℓi,t\\displaystyle\\ell\_\{i,t\}∼πI\(⋅∣pi,oi,t,𝐬i,t,ni,t,ℛi,t\),\\displaystyle\\sim\\pi\_\{I\}\(\\cdot\\mid p\_\{i\},o\_\{i,t\},\\mathbf\{s\}\_\{i,t\},n\_\{i,t\},\\mathcal\{R\}\_\{i,t\}\),𝐚~i,t\\displaystyle\\tilde\{\\mathbf\{a\}\}\_\{i,t\}∼πA\(⋅∣ℓi,t,oi,t,mi,t\)\.\\displaystyle\\sim\\pi\_\{A\}\(\\cdot\\mid\\ell\_\{i,t\},o\_\{i,t\},m\_\{i,t\}\)\.The selected intent route restricts the available action schema\. For example, the social route exposes public and private communication actions, whereas the consumption route exposes nearby merchant choices\. The execution projectionΓ\\Gammain Section[C](https://arxiv.org/html/2610.33536#A3)removes ungrounded or infeasible actions before any state transition is committed\.

The hourly civilian cycle proceeds as follows:

1. 1\.synchronize salaries, fixed expenses, campaign returns, and withdrawal payouts;
2. 2\.resolve sleep state and optionally perform an overnight check for unread messages;
3. 3\.update home\-work mobility according to the civilian’s schedule;
4. 4\.refresh the social feed, unread private messages, warning messages, recent comments, and active campaign contacts;
5. 5\.build a compact observation from recent memory, current balance, macro context, inbox state, visible posts, nearby points of interest, peer activity, and campaign ledger state;
6. 6\.update𝐬i,t\\mathbf\{s\}\_\{i,t\}through the need\-adjustment LLM call, then derive the active need;
7. 7\.choose an intent route from the feasible set: social\-media engagement, nearby consumption, or rest/work;
8. 8\.retrieve relevant narrative memories for the chosen route;
9. 9\.execute the route\-specific action schema and update memory, social traces, economy transactions, and campaign ledgers\.

In the full model, the LLM selects the intent route conditional on the current need state and observation context\. In the NIA ablation, need\-update records are retained, but the civilian’s primary route is sampled uniformly fromℛi,t\\mathcal\{R\}\_\{i,t\}\. The ablation therefore removes need\-conditioned route selection while preserving the social platform, campaign ledger, and economic routines\.

##### C0 aggregate need\-intent dynamics\.

Figure[8](https://arxiv.org/html/2610.33536#A5.F8)provides a diagnostic summary of the no\-warning baseline over the 20\-day horizon\. The route composition is dominated by routine behavior: rest/work and sleep/no\-route account for most hourly decisions, whereas social\-media and consumption routes exhibit smaller but persistent shares\. Social need has the highest population\-average urgency throughout most of the horizon, while satiety, energy, and safety remain more closely grouped and covary with the daily routine\. This pattern is consistent with the intended role of need\-conditioned intent in coupling routine activity with periodic social engagement\.

Figure 8:C0 aggregate need\-intent dynamics\. Panel \(a\) reports the daily composition of civilian main activity routes under the no\-warning baseline\. Panel \(b\) reports the daily population\-average values of the four need\-urgency variables after need updates\.
##### Average within\-day dynamics\.

Figure[9](https://arxiv.org/html/2610.33536#A5.F9)complements the day\-level summary by averaging C0 behavior at each simulated hour across all 20 days and all civilians\. The within\-day route profile reveals the routine underlying the aggregate trend: rest/work dominates daytime hours, sleep/no\-route dominates the late\-day rest period, consumption is concentrated in short intervals, and social\-media activity rises late in the day\. The need trajectory exhibits a corresponding pattern, with energy, safety, and social urgency increasing during active hours and declining after the nighttime transition\.

Figure 9:Average within\-day C0 need\-intent dynamics\. Panel \(a\) reports the mean hourly composition of civilian activity routes, averaged across all simulated days\. Panel \(b\) reports the corresponding mean hourly trajectory of the four need\-urgency variables\.

## Appendix FObservation and State Schemas

The civilian observation is assembled from several bounded views rather than represented as a single unstructured prompt:

oi,t=Bi​\(pi,𝐬i,t,ei,t,fi,t,di,t,λi,t,gi,t,xt\),o\_\{i,t\}=B\_\{i\}\\\!\\left\(p\_\{i\},\\mathbf\{s\}\_\{i,t\},e\_\{i,t\},f\_\{i,t\},d\_\{i,t\},\\lambda\_\{i,t\},g\_\{i,t\},x\_\{t\}\\right\),wherepip\_\{i\}is the fixed profile,ei,te\_\{i,t\}is the economic and mobility state,fi,tf\_\{i,t\}is the visible feed,di,td\_\{i,t\}is the bounded inbox and dialogue view,λi,t\\lambda\_\{i,t\}is the civilian\-visible campaign ledger,gi,tg\_\{i,t\}is local social context, andxtx\_\{t\}is the daily macroeconomic context\. Before prompt construction,BiB\_\{i\}truncates each variable\-length view \(the public feed, for example, is limited to 10 posts\), attaches stable identifiers required for execution grounding, and excludes latent campaign state that the civilian has not observed\. Table[12](https://arxiv.org/html/2610.33536#A6.T12)summarizes the principal views available to civilian planning\.

ViewMain fieldsRole in decision makingProfileage, gender, education, occupation, work hours, Big\-Five traitsConditions sleep, routine intent, spending style, and social response\.Need statesatiety, energy, safety, social, active need, previous intentProvides the NIA salience signal for route selection\.Economic statebalance, monthly income, payday recency, recent purchasesGrounds affordability, scarcity pressure, and routine consumption\.Social feedpost id, author id, content, likes, comments, recent comments, campaign metadataExposes public campaign posts and peer or monitor warning comments\.Inboxmessage id, message type, family, source role, source channel, sender id, content, contact countExposes private campaign contact, warning messages, and follow\-up messages\.Dialogue statewhether the civilian replied, whether the sender replied last, turn count, recent messagesDistinguishes ongoing private conversations from independent single\-turn messages\.Ledger viewtotal paid, returned amount, investment count, last payment, pending withdrawal, delay flagsMakes later decisions depend on prior payments, returns, and withdrawal friction\.Social contexttrusted peers, community peers, peer investment signalsAllows forwarding, peer warning, and social proof effects\.Mobility/POIcurrent home/work area and nearby restaurant, cafe, and supermarket optionsGrounds routine consumption alternatives to social\-media attention\.Table 12:Civilian observation views assembled before intent and action planning\.The campaign ledger records both campaign\-level and victim\-level pathway information\. Table[13](https://arxiv.org/html/2610.33536#A6.T13)lists the fields most relevant to fraud\-pathway analysis\. In the ledger\-feedback ablation, the underlying ledger continues to record payments and withdrawals, whereas civilian\-visible fields for cumulative payment, returned amount, investment count, last payment, and delay signals are masked or set to zero\. This condition tests whether observable financial feedback is required to reproduce repeated\-payment and withdrawal\-friction dynamics\.

For victimvvand campaigncc, letIv,c,tI\_\{v,c,t\}denote cumulative gross fraud payments,Yv,c,tY\_\{v,c,t\}cumulative returns plus completed\-withdrawal payouts,Nv,c,tN\_\{v,c,t\}the payment count, andWv,c,tW\_\{v,c,t\}the withdrawal state\. Given a grounded paymentPv,c,t≥0P\_\{v,c,t\}\\geq 0and payoutQv,c,t≥0Q\_\{v,c,t\}\\geq 0, the accounting state is updated as

Iv,c,t\+1\\displaystyle I\_\{v,c,t\+1\}=Iv,c,t\+Pv,c,t,\\displaystyle=I\_\{v,c,t\}\+P\_\{v,c,t\},Yv,c,t\+1\\displaystyle Y\_\{v,c,t\+1\}=Yv,c,t\+Qv,c,t,\\displaystyle=Y\_\{v,c,t\}\+Q\_\{v,c,t\},Nv,c,t\+1\\displaystyle N\_\{v,c,t\+1\}=Nv,c,t\+𝟏\[Pv,c,t\>0\],\\displaystyle=N\_\{v,c,t\}\+\\mathbf\{1\}\[P\_\{v,c,t\}\>0\],Lv,c,t\+1net\\displaystyle L^\{\\mathrm\{net\}\}\_\{v,c,t\+1\}=max⁡\(Iv,c,t\+1−Yv,c,t\+1,0\)\.\\displaystyle=\\max\\\!\\left\(I\_\{v,c,t\+1\}\-Y\_\{v,c,t\+1\},0\\right\)\.A withdrawal request updatesWv,c,tW\_\{v,c,t\}without immediately changingYv,c,tY\_\{v,c,t\}; only an executed payout changes the cumulative returned amount\. The append\-only event record preserves message, campaign, agent, transaction, and hourly\-step provenance, thereby distinguishing agent\-visible observations from the global ledger used for execution and evaluation\.

Schema groupFieldsMeaningCampaign identitycampaign id, fraud family, victim age bin, interaction channelLinks every loss to a campaign, FTC\-aligned age bin, fraud family, and contact channel\.Contact pathfirst/last contact time, total contact count, received message identifiersReconstructs exposure and private\-contact history before payment\.Payment ledgertotal invested, total returned, net loss, investment count, last payment amountRecords gross payments, returns, current net loss, and repeated\-payment depth\.Withdrawal ledgerwithdrawal attempts, pending amount, delayed count, completed countRecords recovery attempts, delayed exits, and payout feedback\.Provenanceprior legal transaction count, social\-proof exposure count, policy and ablation modesStores experimental and pathway metadata for later stratified analysis\.Table 13:Campaign ledger fields used for pathway reconstruction and aggregate metric computation\.
## Appendix GEvaluation Units and Reported Outcomes

The analysis uses two related but distinct accounting units\. LetIv,cI\_\{v,c\}andYv,cY\_\{v,c\}denote the final gross payment and returned amount, respectively, for victimvvin campaigncc, and define

Lv,cnet=max⁡\(Iv,c−Yv,c,0\)\.L^\{\\mathrm\{net\}\}\_\{v,c\}=\\max\(I\_\{v,c\}\-Y\_\{v,c\},0\)\.Micro\-level pathway and intervention outcomes use the set of positive\-net\-loss victim\-campaign records

ℛ\+=\{\(v,c\):Lv,cnet\>0\}\.\\mathcal\{R\}^\{\+\}=\\\{\(v,c\):L^\{\\mathrm\{net\}\}\_\{v,c\}\>0\\\}\.IfNv,cN\_\{v,c\}is the number of payments andAv,cA\_\{v,c\}the number of withdrawal attempts in a record, the behavioral outcomes in the main paper are

TotalPositiveLoss\\displaystyle\\mathrm\{TotalPositiveLoss\}=∑\(v,c\)∈ℛ\+Lv,cnet,\\displaystyle=\\sum\_\{\(v,c\)\\in\\mathcal\{R\}^\{\+\}\}L^\{\\mathrm\{net\}\}\_\{v,c\},PaymentCount\\displaystyle\\mathrm\{PaymentCount\}=∑\(v,c\)∈ℛ\+Nv,c,\\displaystyle=\\sum\_\{\(v,c\)\\in\\mathcal\{R\}^\{\+\}\}N\_\{v,c\},RepeatRate\\displaystyle\\mathrm\{RepeatRate\}=∑\(v,c\)∈ℛ\+𝟏\[Nv,c≥2\]\|ℛ\+\|,\\displaystyle=\\frac\{\\sum\_\{\(v,c\)\\in\\mathcal\{R\}^\{\+\}\}\\mathbf\{1\}\[N\_\{v,c\}\\geq 2\]\}\{\|\\mathcal\{R\}^\{\+\}\|\},WithdrawalRate\\displaystyle\\mathrm\{WithdrawalRate\}=∑\(v,c\)∈ℛ\+𝟏\[Av,c≥1\]\|ℛ\+\|\.\\displaystyle=\\frac\{\\sum\_\{\(v,c\)\\in\\mathcal\{R\}^\{\+\}\}\\mathbf\{1\}\[A\_\{v,c\}\\geq 1\]\}\{\|\\mathcal\{R\}^\{\+\}\|\}\.The loss\-concentration curve similarly orders records inℛ\+\\mathcal\{R\}^\{\+\}by net loss; consequently, a civilian may contribute multiple campaign\-specific pathways\. Unique\-victim statistics deduplicate records byvv\. By contrast, Quartet Distance aggregates gross payments once per unique civilian across campaigns, as formalized in Section[J](https://arxiv.org/html/2610.33536#A10)\. This distinction prevents simulation\-specific returns from altering the regulator\-grounded QD assessment while retaining returns and withdrawals as behavioral outcomes\.

ConditionTotal positiveloss \($\)PaymentcountRepeat\-paymentrateWithdrawal\-attemptrateC0 No warning144,999\.5062349\.4%8\.6%C1 Platform broadcast96,170\.1020538\.2%17\.1%C2 Monitor labels70,220\.5528441\.5%22\.6%C3 Random comments42,014\.2514149\.1%18\.2%C4 Peer warnings24,752\.5015543\.1%21\.6%C5 Oracle personalized17,916\.0011710\.9%47\.5%Table 14:Numerical values corresponding to the counter\-fraud panel in the main paper\. The final protocol assigns every condition a seed\-42 run over 480 hours beginning at 08:00 on March 11, 2025\. Rate denominators comprise positive\-net\-loss victim–campaign records\.##### Scale effects\.

Relative to C0, positive net loss decreases by 33\.7%, 51\.6%, 71\.0%, 82\.9%, and 87\.6% under C1–C5, respectively, while payment count decreases by 67\.1%, 54\.4%, 77\.4%, 75\.1%, and 81\.2%\. The two sequences do not have the same ordering\. C3 produces only 141 payments, fewer than the 155 under C4, yet its $42,014\.25 positive net loss is 69\.7% higher; equivalently, C4 lowers loss by a further 41\.1% despite recording slightly more payments\. Payment count therefore measures activity frequency but does not by itself identify the monetary severity of the surviving pathways\.

##### Frequency–severity decomposition\.

To separate these dimensions, define the descriptive loss intensity

ℓ¯c=TotalPositiveLosscPaymentCountc\.\\bar\{\\ell\}\_\{c\}=\\frac\{\\mathrm\{TotalPositiveLoss\}\_\{c\}\}\{\\mathrm\{PaymentCount\}\_\{c\}\}\.This is not mean transfer size: the numerator is positive net loss after returns, whereas the denominator counts payments in the corresponding positive\-net\-loss records\. It only measures the final net\-loss burden per counted payment\. The value is $232\.74 under C0 and $469\.12, $247\.26, $297\.97, $159\.69, and $153\.13 under C1–C5\. C1 sharply reduces frequency, but its remaining loss intensity is 2\.02 times the C0 value, indicating that after broad broadcasts remove many low\-loss or low\-frequency paths, the remaining positive\-loss sample is still dominated by higher\-value paths\. This is a conditional\-sample composition effect, not evidence that broadcasting causes larger individual losses\. C2 remains close to C0 on intensity\. C3 has the smallest non\-oracle payment count but remains above C0 on intensity, whereas C4 reduces intensity to 68\.6% of C0\. C4’s comparative advantage is therefore more consistent with compressing high\-value escalation than merely removing events\.

##### Escalation and exit\.

Repeat\-payment and withdrawal\-attempt rates further distinguish entry prevention, escalation control, and exit seeking\. C3’s 49\.1% repeat rate is nearly identical to C0’s 49\.4%; together with its lower payment count, this is consistent with random comments preventing some paths from entering while providing little persistent constraint on the remaining paid paths\. C1 has the lowest non\-oracle repeat rate \(38\.2%\) and raises withdrawal attempts from 8\.6% to 17\.1%, but its high loss intensity shows that broad coverage does not fully reach the remaining severe paths\. C4 does not minimize repeat payment \(43\.1%\), yet combines the lowest non\-oracle loss intensity with a 21\.6% withdrawal\-attempt rate\. Its principal gain is thus closer to limiting high\-value escalation and encouraging some exits than to eliminating every repeat payment\. C5 combines a 10\.9% repeat rate, a 47\.5% withdrawal\-attempt rate, and $153\.13 loss intensity, giving the clearest stop\-additional\-payment and seek\-exit signature\. Because it uses transaction truth and campaign\-specific context, it remains an information\-rich timing upper bound\.

##### Interpretive boundary\.

The rate denominator in each condition is the set of victim–campaign records that still have positive net loss, not a common civilian cohort\. An intervention changes both membership in this denominator and subsequent path length, so cross\-condition rate differences combine behavioral and compositional change and are not individual treatment effects\. The conditions also jointly change trigger timing, delivery channel, and information specificity\. Finally, the table reports complete runs for one fixed profile realization and seed, without cross\-seed variance or confidence intervals\. The unified protocol controls the start clock and payday timing across C0–C5, but it does not by itself identify channel\-specific causal effects\. These contrasts support trajectory\-consistent mechanism hypotheses rather than statistical identification of such effects\.

## Appendix HVictimization Pathway Diagnostics

We reconstruct micro\-level pathways from the completed common\-clock C0 run using the positive\-net\-loss victim–campaign unit in Section[G](https://arxiv.org/html/2610.33536#A7)\. The run contains 81 such records associated with 63 unique civilians and $144,999\.50 in total positive net loss\. All 63 civilians received campaign contact and a private message before their first fraud payment\. The median first\-contact\-to\-first\-payment lag is 72 simulated hours\. The seven pre\-payment contacts reported in the main paper are counted from timestamp\-filtered campaign\-contact events before the first transfer; the exportedtotal\_contact\_countis a final\-horizon field and has median 16\. The latter must not be interpreted as a pre\-payment exposure count\.

Figure 10:C0 victimization\-pathway diagnostics\. Panel \(a\) shows the distribution of first\-contact\-to\-first\-payment latency for positive\-net\-loss victim–campaign records; points are individual records, boxes show the interquartile range, and the dashed line marks the overall 72\-hour median\. Panel \(b\) contrasts the prevalence of each final payment\-depth group with its share of positive net loss\. Panel \(c\) contrasts each fraud family’s record share with its net\-loss contribution\. Record share weights every victim–campaign record equally, whereas net\-loss share weights records by their positive net\-loss amounts\.Figure[10](https://arxiv.org/html/2610.33536#A8.F10)exposes three complementary pathway properties\. Panel \(a\) shows median conversion lags of 50 and 52 hours for impersonation and marketplace fraud, 114 hours for investment fraud, and 203 hours for romance fraud, against the 72\-hour overall median\. Panel \(b\) partitions final payment count into the mutually exclusive groupsS∈\{1,2​–​4,5​–​9,10\+\}S\\in\\\{1,2\\text\{\-\-\}4,5\\text\{\-\-\}9,10\+\\\}\. For each group, record share is\|S\|/\|ℛ\+\|\|S\|/\|\\mathcal\{R\}^\{\+\}\|, whereas net\-loss share is∑\(v,c\)∈SLv,cnet/144,999\.50\\sum\_\{\(v,c\)\\in S\}L^\{\\mathrm\{net\}\}\_\{v,c\}/144\{,\}999\.50\. Combining the last three groups, 40 records \(49\.4%\) contain at least two payments but account for 86\.8% of total positive loss\. Combining the last two groups, 16 records \(19\.8%\) contain at least five payments and account for 75\.6%, while the six records \(7\.4%\) in the 10\+ group account for 70\.4%\. Panel \(c\) applies the same count\- versus amount\-weighted comparison to fraud families: investment fraud represents only 23\.5% of records but contributes 61\.6% of net loss\. The persistent gap between the two shares demonstrates that financial harm is concentrated in a small set of high\-value, deeply escalated paths\. Sorting all records by net loss and taking⌈0\.1×81⌉=9\\lceil 0\.1\\times 81\\rceil=9records yields a top\-decile share of 81\.1%\.

Fraud familyRecordsUniquevictimsNet loss\($\)LossshareMedianlag \(h\)Median finalcontactsInvestment191889,350\.0061\.6%11416Impersonation232011,590\.008\.0%5012Marketplace343140,459\.5027\.9%5218\.5Romance553,600\.002\.5%20329All records8163144,999\.50100\.0%7216Table 15:Fraud\-family decomposition of positive\-net\-loss C0 pathways\. “Unique victims” is deduplicated within each row; because a civilian may appear in more than one campaign, family\-specific unique\-victim counts do not sum to the all\-record value\. Contact counts are final\-horizon ledger fields\.The family decomposition also reveals different temporal regimes\. Investment records contribute 61\.6% of positive net loss despite representing 23\.5% of records\. Marketplace pathways are more frequent and have a median of two payments, whereas the median payment count in each other family is one\. Romance pathways are few but have the longest median contact\-to\-payment delay \(203 hours\) and the largest median final contact count \(29\)\. These statistics are descriptive properties of one fixed\-seed trajectory rather than family\-level causal estimates, but they demonstrate that the aggregate loss surface is supported by heterogeneous multi\-step pathways\.

Simulation timeInformation state and recorded reasoningFinancial state transitionMar\. 15, 05:00–Mar\. 17, 04:00The civilian repeatedly asks about task content, the refund process, and the minimum advance\. The operator describes phone\-based tasks, an advance range of $52–$315, payment through common mobile channels, and a return “generally within one hour\.”No fraud payment is executed during the 48\-hour cultivation interval\.Mar\. 17, 05:00The operator lowers the actionable threshold to $52\. The civilian records that the amount is low enough to try\.First advance: $52\.Mar\. 17, 08:00A $15 “first\-task profit” notification is delivered together with a new\-task invitation\.The ledger records a $15 return, reducing the contemporaneous net exposure to $37\.Mar\. 17, 09:00–12:00Repeated notifications couple the realized small return with new tasks capped at $100\. Before the fourth transfer, the civilian explicitly records that they had asked repeatedly and “received returns\.”Three further $100 advances are executed at 09:00, 11:00, and 12:00\. Gross payment reaches $352 within seven hours of entry\.Mar\. 17, 13:00The civilian records that losses remain substantial despite returns and asks to reduce risk\.A $100 withdrawal is requested; no withdrawal payout is completed\.Mar\. 17, 20:00–Mar\. 18, 08:00Additional small return notices continue while the withdrawal remains unresolved\.Four later returns total $60\.60\. Across the full path, returns total $105\.60\.End of runThe campaign continues to present task and refund assurances, but no fifth payment occurs\.Final campaign state: four payments, $352 gross paid, $105\.60 returned, $246\.40 net loss, 14 withdrawal delays, and $100 still pending\.Table 16:A provenance\-linked C0 marketplace\-fraud pathway\. Information events and financial events are shown in separate columns so that persuasive content, the civilian’s stated reason, and the executed ledger transition are not conflated\.
## Appendix IMechanism Case Studies

##### Scope and selection\.

The cases in this section are reconstructed from the completed common\-clock C0–C5 runs and retain their recorded simulated timestamps\. They are diagnostic mechanism traces drawn from the same fixed\-seed executions summarized above, not additional observations, representative\-sample estimates, or individual counterfactuals\. A C0 pathway was selected only if the run artifacts linked visible campaign information, grounded transfers, returns, and withdrawal state\. The selected marketplace\-fraud record is mechanistically representative rather than statistically average: its 48\-hour contact\-to\-payment lag is close to the 52\-hour marketplace median, its four payments lie in the common two\-to\-four\-payment group, and it contains both positive reinforcement and an attempted exit\. For C1–C5, a case was retained only when the intervention was visible to the civilian, the civilian’s recorded reason explicitly responded to it, and the subsequent financial trace was consistent with entry inhibition, escalation control, or exit seeking\.

### I\.1C0: Information–Financial Escalation in One Marketplace Path

Table[H](https://arxiv.org/html/2610.33536#A8)joins the information and financial streams for civilian V82 and the “Yuanyu Part\-time Platform” campaign\. The reconstruction uses campaign identifiers and simulated timestamps rather than row adjacency: a message is treated as a financial trigger only when the executed transfer carries the corresponding information provenance\.

##### Mechanism interpretation\.

This path exhibits threshold adaptation, reinforcement, rapid escalation, and exit friction in a compact sequence\. The initial broad advance range does not immediately produce payment; conversion occurs only after the operator offers its $52 lower bound\. The first realized $15 return then becomes both a financial event and new persuasive information\. Within four hours, the civilian makes three additional payments, and the final payment reason explicitly invokes prior returns\. The subsequent withdrawal request shows that positive reinforcement did not eliminate risk perception, but the request also did not restore funds: only small operator\-controlled returns were executed, while the requested $100 remained pending\. Consequently, “returned amount” and “successful exit” are empirically distinct states\. The case also illustrates the model’s closed loop: information changes payment behavior, ledger outcomes are surfaced as later information, and that information conditions both escalation and withdrawal\.

### I\.2Intervention\-Consistent Micro\-Cases

Table[17](https://arxiv.org/html/2610.33536#A9.T17)reports the four C1–C5 conditions for which the completed run trace satisfies the stated inclusion rule\. The table deliberately omits a claimed C3 individual effect\. C3 does contain the injected generic comments, but the run artifacts do not provide a single civilian trace that simultaneously links one such comment to an explicit response reason and a subsequent financial inhibition outcome\. This absence of a retained case is an evidence\-provenance limitation, not evidence that C3 has zero aggregate effect\.

ConditionPre\-intervention path and visible warningCivilian response recorded in the traceObserved financial implicationC1V13 repeatedly inquires about a part\-time\-work campaign, including whether a $50 trial is available\. At hour 72, the fixed platform DM warns against transfers, deposits, unlocking fees, and guaranteed returns\.The same hourly decision records: “received a safety reminder and decided not to process the part\-time\-work invitation\.” The campaign dialogue ends at that decision\.No payment to that campaign, or to any fraud campaign, is recorded over the 480\-hour run\. This is consistent with entry inhibition, although it is not an individual counterfactual estimate\.C2V75 repeatedly sees monitor\-annotated investment posts\. The appended label states that the content may involve fraud and advises against blind transfers\.Across hours 9–34, the reasons repeatedly state that the system marked the post suspicious and that the civilian would “observe first” or “handle it cautiously\.” Actions remain low\-cost likes rather than private inquiry\.No fraud payment is recorded for V75 over the full horizon\. The trace is consistent with the label constraining escalation from public attention to private contact and payment\.C4V12 pays $500 once to an investment campaign\. The civilian subsequently produces peer warnings based on the loss and observes an environment in which the platform is repeatedly reported\.At hour 419, the reason states: “the platform has been repeatedly reported and is risky; request withdrawal to reduce losses\.”The record remains at one payment and adds a $500 withdrawal request\. No payout is completed, so C4 inhibits further escalation and induces exit seeking without guaranteeing recovery\.C5V5 pays a $100 verification deposit\. The next\-hour oracle DM identifies the named platform and amount, instructs the civilian to stop transferring, withdraw, preserve evidence, and verify through official channels\.In that hour, the civilian records that the anti\-fraud reminder made the platform appear fraudulent, requests withdrawal, and marks the campaign suspicious\.The path stops after one payment and carries a $100 pending withdrawal\. This is the clearest transaction\-to\-warning\-to\-exit chain, while its use of simulator truth confirms that C5 is an idealized upper bound\.Table 17:Intervention\-consistent micro\-cases from the completed common\-clock runs\. “Consistent with” is used deliberately: these within\-run traces expose plausible mechanisms but do not supply untreated counterfactuals for the same civilian\.##### Cross\-case reading\.

The four cases separate three forms of suppression that the aggregate rates combine\. C1 interrupts an active dialogue before entry; C2 keeps exposure at a low\-cost public\-interaction stage; and C4 and C5 act after payment by limiting repetition and inducing withdrawal\. Warning specificity and timing increase across these examples\. The generic C1 message can terminate a matched dialogue but does not identify a particular transaction, while the C2 label is content\-specific but competes within the feed\. C4 carries socially generated, platform\-specific evidence but emerges endogenously and may arrive after harm\. C5 reacts immediately with exact transaction context, which explains the unusually direct reasoning response but also makes the mechanism non\-deployable without an external detector that can approximate the oracle signal\. None of the exit\-seeking cases completes recovery, underscoring that suppressing additional payment and reversing an existing loss are separate outcomes\.

## Appendix JQuartet Distance Details

Quartet Distance evaluates the simulated distribution of fraud losses against four FTC\-grounded empirical regularities\. All four QD components are computed from gross fraud payments\. Returns and withdrawal payouts are not deducted because the FTC targets characterize reported fraud\-loss severity rather than simulation\-specific return and withdrawal processes\.

LetV\+V^\{\+\}be the set of unique civilians with positive gross fraud payment, and let

Lv=∑cIv,cL\_\{v\}=\\sum\_\{c\}I\_\{v,c\}be the gross payment of civilianvv, aggregated across campaigns\. LetBBdenote the seven adult FTC age bins:

B=\{20​–​29,30​–​39,40​–​49,50​–​59,60​–​69,70​–​79,80\+\}\.B=\\\{20\\text\{\-\-\}29,30\\text\{\-\-\}39,40\\text\{\-\-\}49,50\\text\{\-\-\}59,60\\text\{\-\-\}69,70\\text\{\-\-\}79,\\text\{80\+\}\\\}\.
##### HTL: relative high\-loss tail\.

The FTC high\-loss threshold is$10,000\\$10\{,\}000, while the FTC overall median positive\-loss amount is$497\\$497\([FTC, 2025](https://arxiv.org/html/2610.33536#bib.bib9)\)\. Accordingly, the high\-loss threshold is converted to the relative multiplier

λ=10000/497=20\.12\.\\lambda=10000/497=20\.12\.For a simulation run, the high\-loss threshold isτ=λ⋅medianv∈V\+​\(Lv\)\\tau=\\lambda\\cdot\\mathrm\{median\}\_\{v\\in V^\{\+\}\}\(L\_\{v\}\)\. The simulated high\-loss share is

p^HTL=1\|V\+\|∑v∈V\+𝟏\[Lv\>τ\]\.\\hat\{p\}\_\{\\mathrm\{HTL\}\}=\\frac\{1\}\{\|V^\{\+\}\|\}\\sum\_\{v\\in V^\{\+\}\}\\mathbf\{1\}\[L\_\{v\}\>\\tau\]\.The target ispHTL=0\.126p\_\{\\mathrm\{HTL\}\}=0\.126, computed from the FTC 2024 Data Book category for reports exceeding$10,000\\$10\{,\}000\. The distance is

dHTL=\|p^HTL−0\.126\|0\.126\.d\_\{\\mathrm\{HTL\}\}=\\frac\{\|\\hat\{p\}\_\{\\mathrm\{HTL\}\}\-0\.126\|\}\{0\.126\}\.This relative error is not clipped\. Becausep^HTL∈\[0,1\]\\hat\{p\}\_\{\\mathrm\{HTL\}\}\\in\[0,1\], its implementation range is0≤dHTL≤\(1−0\.126\)/0\.126≈6\.940\\leq d\_\{\\mathrm\{HTL\}\}\\leq\(1\-0\.126\)/0\.126\\approx 6\.94; values greater than one are therefore admissible\.

##### ALS: all\-bin age\-loss severity profile\.

For each age binbb, letm^b\\hat\{m\}\_\{b\}be the simulated median ofLvL\_\{v\}over positive\-loss civilians in that bin\. The target mediansmbm\_\{b\}are the FTC age\-bin medians listed in Table[19](https://arxiv.org/html/2610.33536#A10.T19)\. The all\-bin profile distance is

dALS=1\|B\|​∑b∈Bmin⁡\(\|m^b−mb\|max⁡\(mb,1\),2\)\.d\_\{\\mathrm\{ALS\}\}=\\frac\{1\}\{\|B\|\}\\sum\_\{b\\in B\}\\min\\left\(\\frac\{\|\\hat\{m\}\_\{b\}\-m\_\{b\}\|\}\{\\max\(m\_\{b\},1\)\},2\\right\)\.The upper cap limits the contribution of an age bin with a highly discrepant or small simulated median\. It bounds the component at two, rather than normalizing it to the unit interval:dALS∈\[0,2\]d\_\{\\mathrm\{ALS\}\}\\in\[0,2\]\.

##### FSH: fraud\-family severity hierarchy\.

For fraud\-family severity, letfcf\_\{c\}denote the fraud family of campaigncc\. The simulator compares the median gross victim–campaign payment for investment fraud with the corresponding median for impersonation fraud:

r^FSH=median⁡\{Iv,c:fc=investment\}max⁡\(median⁡\{Iv,c:fc=impersonation\},1\)\.\\hat\{r\}\_\{\\mathrm\{FSH\}\}=\\frac\{\\operatorname\{median\}\\\{I\_\{v,c\}:f\_\{c\}=\\mathrm\{investment\}\\\}\}\{\\max\\\!\\left\(\\operatorname\{median\}\\\{I\_\{v,c\}:f\_\{c\}=\\mathrm\{impersonation\}\\\},1\\right\)\}\.The FTC target ratio isrFSH=9196/800=11\.50r\_\{\\mathrm\{FSH\}\}=9196/800=11\.50, using the reported median losses for the*Investment Related*and*Imposter Scams*categories\. The log\-scale distance is

dFSH=\|log⁡\(r^FSH/11\.50\)\|\|log⁡\(11\.50\)\|\.d\_\{\\mathrm\{FSH\}\}=\\frac\{\|\\log\(\\hat\{r\}\_\{\\mathrm\{FSH\}\}/11\.50\)\|\}\{\|\\log\(11\.50\)\|\}\.For a valid positiver^FSH\\hat\{r\}\_\{\\mathrm\{FSH\}\}, this log\-ratio discrepancy is not clipped and has no finite upper bound\. If the ratio cannot be formed or is nonpositive, the implementation assigns the fallback valuedFSH=1d\_\{\\mathrm\{FSH\}\}=1\.

##### ALR: age loss\-report share\.

FTC age\-specific positive\-loss report shares are estimated from each adult age bin’s fraud\-report countNbN\_\{b\}and percentage reporting a fraud lossqbq\_\{b\}\. The target share is

ab=Nb​qb∑b′∈BNb′​qb′\.a\_\{b\}=\\frac\{N\_\{b\}q\_\{b\}\}\{\\sum\_\{b^\{\\prime\}\\in B\}N\_\{b^\{\\prime\}\}q\_\{b^\{\\prime\}\}\}\.The simulated sharea^b\\hat\{a\}\_\{b\}is the share of unique positive\-loss civilians in age binbb\. The distance is the total variation distance:

dALR=12​∑b∈B\|a^b−ab\|\.d\_\{\\mathrm\{ALR\}\}=\\frac\{1\}\{2\}\\sum\_\{b\\in B\}\|\\hat\{a\}\_\{b\}\-a\_\{b\}\|\.As a total variation distance between age\-share distributions, this component satisfiesdALR∈\[0,1\]d\_\{\\mathrm\{ALR\}\}\\in\[0,1\]\.

##### Composite\.

The age\-aware QD used in the paper is

QD=dHTL\+dALS\+dFSH\+dALR4\.\\mathrm\{QD\}=\\frac\{d\_\{\\mathrm\{HTL\}\}\+d\_\{\\mathrm\{ALS\}\}\+d\_\{\\mathrm\{FSH\}\}\+d\_\{\\mathrm\{ALR\}\}\}\{4\}\.No additional clipping or rescaling is applied before aggregation\. Consequently,QD\\mathrm\{QD\}is a nonnegative, lower\-is\-better discrepancy measure, not a probability or a score normalized to\[0,1\]\[0,1\]\. It may exceed one; moreover, the HTL and FSH components may individually exceed one and can dominate the arithmetic mean\. Values should therefore be interpreted together with the four reported components\.

QuantityRangeScale\-defining operationdHTLd\_\{\\mathrm\{HTL\}\}\[0,6\.94\]\[0,6\.94\]Unclipped relative error against the target tail share\.dALSd\_\{\\mathrm\{ALS\}\}\[0,2\]\[0,2\]Mean seven\-bin relative error, capped at two per bin\.dFSHd\_\{\\mathrm\{FSH\}\}\[0,∞\)\[0,\\infty\)Unclipped normalized log\-ratio error; fallback value one when unavailable\.dALRd\_\{\\mathrm\{ALR\}\}\[0,1\]\[0,1\]Total variation distance between age\-share distributions\.QD\\mathrm\{QD\}\[0,∞\)\[0,\\infty\)Unclipped arithmetic mean of the four component distances\.Table 18:Ranges of the QD component and composite distances under the current implementation\. The quantities do not share a common unit\-interval normalization\.AgeMedianNbN\_\{b\}qbq\_\{b\}aba\_\{b\}20–29417155,3460\.440\.173530–39450203,7640\.400\.206940–49500191,5080\.380\.184750–59520175,8980\.350\.156360–69691208,8960\.290\.153870–791,000159,5500\.240\.097280\+1,65051,7130\.210\.0276Table 19:FTC age\-bin constants used by the ALS and ALR components\. The 19\-and\-under bin is omitted because the simulated population contains no minors\.
##### Raw diagnostic decomposition\.

The completed common\-clock full\-model run contains 51 unique civilians with positive gross payment and 65 positive victim–campaign payment records\. Its median unique\-victim gross payment is $200, giving a relative HTL threshold of $4,024\.14\. Seven of the 51 civilians exceed this threshold, so the simulated tail share is7/51=0\.13737/51=0\.1373anddHTL=0\.0893d\_\{\\mathrm\{HTL\}\}=0\.0893\. The investment and impersonation victim–campaign medians are $3,000 and $125, respectively, producingr^FSH=24\\hat\{r\}\_\{\\mathrm\{FSH\}\}=24anddFSH=0\.3012d\_\{\\mathrm\{FSH\}\}=0\.3012\. The complete component decomposition is shown in Table[20](https://arxiv.org/html/2610.33536#A10.T20)\.

ComponentSimulation statisticTargetDistanceHTLtail share0\.13730\.1373above $4,024\.14; median gross payment $2000\.1260\.0893ALSseven\-bin simulated medians shown in Figure[11](https://arxiv.org/html/2610.33536#A10.F11)\(a\)FTC median profile0\.6513FSHinvestment\-to\-impersonation median gross\-payment ratio3000/125=24\.03000/125=24\.011\.500\.3012ALRseven\-bin simulated unique\-victim shares shown in Figure[11](https://arxiv.org/html/2610.33536#A10.F11)\(b\)FTC loss\-report profile0\.1495QD\\mathrm\{QD\}arithmetic mean of the four distances, without clipping00\.2978Table 20:Raw\-to\-distance audit trail for the full\-model QD value in the main paper\. The zero in the composite target column denotes exact agreement, not an empirical zero\-loss target\.Figure 11:QD diagnostics\. Panels \(a\) and \(b\) compare the full model with the FTC targets used by ALS and ALR\. Panel \(c\) decomposes the full model and the two mechanism ablations\. The dotted line at one is an interpretive reference, not a normalization boundary; component distances are permitted to exceed it\.SystemLoss adapterAge and family supportComposite convention in the main\-paper tableTransXionSum flagged transaction amounts by source account; joinperson\_ageand retain positive aggregatesage available; no compatible individual\-targeted fraud\-family labelFSH is reported as unavailable\. The displayed 0\.4894 is the mean of the three available distances,\(0\.3722\+0\.9168\+0\.1793\)/3\(0\.3722\+0\.9168\+0\.1793\)/3, and is therefore a partial composite\.MultiAgent4FraudAggregate successful victim\-originating transfers to malicious agents by civilian profile in the archived evaluation outputprofile age and assigned malicious\-agent fraud category available to the audit adapterMean of all four reported distances:\(0\.6211\+0\.6586\+0\.6017\+0\.5243\)/4=0\.6014\(0\.6211\+0\.6586\+0\.6017\+0\.5243\)/4=0\.6014\.FraudSocietySum gross payments across campaigns once per civilian for HTL, ALS, and ALR; retain victim–campaign family records for FSHexplicit age, campaign identity, and fraud familyFour\-component QD:\(0\.0893\+0\.6513\+0\.3012\+0\.1495\)/4=0\.2978\(0\.0893\+0\.6513\+0\.3012\+0\.1495\)/4=0\.2978\.Table 21:Source\-to\-QD alignment used for the baseline comparison\. A partial composite is not numerically equivalent to strict four\-component QD; the dash for TransXion’s FSH in the main\-paper table records this limitation\.

## Appendix KExternal\-Baseline Alignment Protocol

QD postprocessing is applied through source\-specific adapters\. The adapters do not assume that native records from transaction simulators, social simulators, andFraudSocietyare semantically identical\. They first identify the finest supported positive\-loss unit, aggregate gross amounts at that unit, join profile age where available, and map a fraud family only when the source explicitly provides one\. The four formulas and FTC constants in Section[J](https://arxiv.org/html/2610.33536#A10)are then applied without dataset\-specific tuning, min–max scaling, or imputation of a missing component\.

For TransXion, the adapter usestx\.csvto select flagged records and aggregateAmount PaidbyFrom Account, then joinsperson\.csvfor age binning\. This account\-level proxy audits a relative transaction\-loss tail and an age profile, but it is not an individual\-targeted victim–campaign ledger\. MultiAgent4Fraud provides profile\-grounded social interaction and terminal transfer events; its adapter treats a successful transfer as gross victim loss and does not manufacture post\-transfer returns, withdrawals, or repeated\-payment states that the source system does not simulate\. These transformations make the displayed components reproducible while preserving a clear scope limitation: the comparison evaluates compatible output statistics, not equality of native mechanisms or event semantics\.

## Appendix LReproducibility Specification and Artifacts

Table[22](https://arxiv.org/html/2610.33536#A12.T22)records the configuration of the 120\-agent, 20\-day experiments\. In particular, the canonical entry point defaults to 168 steps, so reproducing the reported horizon requires explicitly settingSIM\_NUM\_STEPS=480\. The profile list is truncated deterministically to the first 112 civilians while preserving all eight operators\. Every final intervention and QD run uses the common start time2025\-03\-11T08:00:00\.

Configuration groupReported valueImplementation detailClock and horizon3,600 s/tick; 480 ticks; March 11, 2025 at 08:00identical 20\-day calendar for every condition; daily and payday triggers use the simulated date and hourPopulation112 civilians, 8 operators, 8 campaignsfirst 112 civilians in the fixed profile file; two operators/campaigns per fraud familyRandomnesssimulator seed 42fixes profile truncation, graph sampling, and random\-warning sampling; it does not guarantee bitwise\-identical remote inferenceSocial boundsfeed 10 posts; inbox 20 unread DMsobservations carry stable post, message, author, sender, campaign, and transaction identifiers for execution groundingInitial graphgeographick=6k=6; rewirep=0\.15p=0\.15; operator degree\-weighted targets≤10\\leq 10relation labels and homophily/attachment additions are retained in the shared graphLLM and samplingQwen3\-14B; temperature 0validated JSON; recoverable syntax repair; invalid names, targets, and arguments rejectedVictim planning limitsstep plan 256 tokens; fraud realization 256; ambient/night check 96principal concurrency limits are 12, 8, and 30/16, respectively; generic transport concurrency is 10Operator planning limitsphase 1,024 tokens; finance 768; social 768concurrency limits are 4, 2, and 4; timeouts are 30, 25, and 25 s, respectivelyTable 22:Runtime configuration for the reported 120\-agent experiments\. Token and concurrency entries document request scheduling and output bounds rather than behavioral parameters\.### Unified\-Clock Run Provenance and Result Audit

The final tables use one completed seed\-42 execution per row and do not pool repeated executions\. Table[23](https://arxiv.org/html/2610.33536#A12.T23)summarizes the runs completed under the common March 11 clock\. The reported intervention, pathway, and QD analyses are computed from these runs; run identities and content digests were checked during analysis before the values were reported\.

ResultCondition\-specific settingUnified startRun statusC0all C1–C5 warning switches disabledMar\. 11, 08:00completedC1USE\_PLATFORM\_WARNING=1Mar\. 11, 08:00completedC2USE\_MONITOR\_AGENT=1Mar\. 11, 08:00completedC3USE\_RANDOM\_WARNING=1Mar\. 11, 08:00completedC4USE\_PEER\_WARNING=1Mar\. 11, 08:00completedC5USE\_C5\_ORACLE\_WARNING=1Mar\. 11, 08:00completedQD: fullfull NIA and surfaced\-ledger configurationMar\. 11, 08:00completedQD: w/o NIAUSE\_NEED\_CONDITIONED\_INTENT=0Mar\. 11, 08:00completedQD: w/o ledgerUSE\_SURFACED\_LEDGER=0Mar\. 11, 08:00completedTable 23:Completed unified\-clock runs used for the intervention, pathway, and QD results\. Each row represents one seed\-42 execution over the reported 480\-hour horizon\.Before reporting, the completed run manifest was checked against artifact digests, horizons, populations, the common start time, Table[14](https://arxiv.org/html/2610.33536#A7.T14), the four QD components, and their composite\. Any row whose start time differed from2025\-03\-11T08:00:00was rejected\.

The following command is the baseline configuration template\. Each intervention condition changes exactly one of the C1–C5 switches documented in Table[9](https://arxiv.org/html/2610.33536#A2.T9); the full\-model ablations instead changeUSE\_NEED\_CONDITIONED\_INTENTorUSE\_SURFACED\_LEDGER\. Output directories must be distinct because all artifacts are run\-local\.

SIM\_OUTPUT\_DIR=runs/<run\_name\>\\

SIM\_NUM\_STEPS=480SIM\_PROFILE\_LIMIT=120\\

SIM\_RANDOM\_SEED=42\\

SIM\_START\_DATE=2025\-03\-11T08:00:00\\

USE\_NEED\_CONDITIONED\_INTENT=1\\

USE\_SURFACED\_LEDGER=1\\

USE\_PEER\_WARNING=0USE\_PLATFORM\_WARNING=0\\

USE\_MONITOR\_AGENT=0USE\_RANDOM\_WARNING=0\\

USE\_C5\_ORACLE\_WARNING=0\\

python\-uenv\_main\_fraud\_simulation\_v3\.py

The sameSIM\_START\_DATEis used for C0–C5 and the QD runs\. The profile file contains 112 civilians and eight operators\.

The export layer separates mutable simulation state from append\-only provenance and derived summaries\. Stable agent, campaign, information, message, post, withdrawal\-request, and transaction identifiers allow records to be joined without relying on generated text\. Table[24](https://arxiv.org/html/2610.33536#A12.T24)gives the principal analysis artifacts\.

ArtifactPrimary unitReproducibility rolesocial\.dbsocial\_dm\_metadata\.jsonpost, comment, private message, social tracereconstruct visible public/private surfaces, authorship, warning insertions, and dialogue ordereconomy\_ledger\_v3\.jsondaily\_fraud\_transactions\.jsonlfinancial transactionaudit legal/fraud flags, payer, recipient, amount, step, and daily aggregationvictim\_profiles\.jsonfinal victim–campaign recordcompute gross payment, net loss, repeat\-payment depth, contact timing, returns, and withdrawal outcomesexposure\_records\.jsonldecision\_records\.jsonlexposure and grounded decision eventconnect an observed item to the subsequent accepted, deferred, rejected, or financial actionneed\_adjustment\_log\.jsonlintent\_log\.jsonlcivilian–tick decision statereconstruct need updates, active need, feasible routes, and selected intentphase\_plan\_traces\.jsondeception\_traces\.jsonoperator plan and deception eventaudit lifecycle decisions, cached plans, outreach, victim contact, and payment provenancequartet\_metrics\.jsonfraud\_simulation\_report\.jsonrun\-level summarystore raw QD inputs, component distances, outcome summaries, and configuration metadatallm\_trace\.jsonlissue/truncation logsmodel request/response or failure eventoptional full prompt/response audit plus timeout, parse, and output\-truncation diagnosticsTable 24:Principal run artifacts and their analysis units\.##### Data scope\.

The paper introduces no novel benchmark dataset\. The fixed profile and map files are simulator inputs, while the files in Table[24](https://arxiv.org/html/2610.33536#A12.T24)are generated experimental artifacts\. ACS/SCF population statistics and FTC/CAFC fraud statistics are existing public sources cited in the main paper\. The manuscript package contains only the paper sources and rendered figures; credentials, model weights, third\-party datasets, implementation code, and bulky run outputs are not duplicated in this package\.

##### Parameter development and final settings\.

The study did not conduct a preregistered grid search, random search, or held\-out hyperparameter optimization\. Development was iterative: candidate prompt contracts, execution gates, and intervention cadence were retained when they passed schema/execution checks and produced interpretable regulator\-facing diagnostics\. Consequently, there is no defensible table of “number and range tried” for every development choice\. The final reported runtime settings are given in Table[22](https://arxiv.org/html/2610.33536#A12.T22), the condition switches in Table[9](https://arxiv.org/html/2610.33536#A2.T9), the QD constants in Section[J](https://arxiv.org/html/2610.33536#A10), and the documented configurations above\. This supports reconstruction of the final configurations, but only partial reconstruction of the development trajectory\.

##### Replication and uncertainty scope\.

The final protocol assigns one completed seed\-42 execution to every intervention or ablation row, as made explicit in Table[23](https://arxiv.org/html/2610.33536#A12.T23)\. Distributional analyses use within\-run units—victims, transactions, days, age bins, and fraud families—rather than treating repeated LLM calls as independent experimental replications\. No cross\-seed confidence intervals or null\-hypothesis significance tests are claimed\. The reported numerical rows are the outputs of the completed common\-clock runs and are subject to the artifact\-level checks described above\.

##### Software and hardware boundary\.

The compute environment used for the experiments is reported in Table[25](https://arxiv.org/html/2610.33536#A12.T25)\. The code metadata requires Python≥3\.11\\geq 3\.11and records dependency bounds; the embedded OASIS component also carries its own dependency manifest\.

Environment itemExperimental configurationOperating systemUbuntu 22\.04\.2 LTS; Linux 6\.8\.0\-111\-generic; x86\_64CPU2×\\timesIntel Xeon Gold 6133 @ 2\.50 GHz; 20 cores per socket and 2 threads per core, for 40 physical cores and 80 logical threadsSystem memory502 GiBGPU8×\\timesNVIDIA A800 80GB PCIe; 81,920 MiB per deviceGPU software stackNVIDIA driver 535\.309\.01; driver\-reported CUDA compatibility 12\.2; locally installed CUDA Toolkit 11\.5PythonCPython 3\.13\.11; project minimum Python version 3\.11Table 25:Software and hardware environment used for the experiments\. The CUDA compatibility value is reported bynvidia\-smi, whereas the Toolkit version is reported by the local compiler toolchain; these values have different meanings\.

## Appendix MPrompt Templates

For reproducibility, this section presents the runtime prompt inventory used by the shared environment, civilians, and fraud operators\. The civilian side covers sleep scheduling, post\-sleep and regular need updates, night and ambient phone checks, intent routing, nearby consumption, and joint social–financial action planning\. The operator side covers lifecycle\-phase selection, public outreach, active private follow\-up, and financial feedback\. The English translations preserve the decision boundaries, action signatures, and JSON output contracts of the Chinese runtime prompts\. Bracketed text identifies context inserted at runtime\. Because the prompts are implementation artifacts, their imperative register is reproduced rather than revised to match the expository prose of the appendix\.

### Shared environment prompt

Prompt E0 — Daily macro\-environment generationYou are the daily\-background generator for an urban social simulation\. Produce the neutral macro environment for day \[simulation day\] in \[city\], for use by civilian and operator decisions\.RequirementsDescribe ordinary weather and physical comfort, commuting and commercial rhythm, consumption, wages and bill pressure, online entertainment, recruitment and part\-time work, financial discussion, and shopping\-district activity\. Do not introduce anti\-fraud news, police warnings, platform enforcement, regulatory crackdowns, scam exposure, or risk alerts\. Do not prescribe an individual action; provide soft context that can affect attention, mood, consumption, phone use, wording, and timing\. Online buzz may include ordinary account services, part\-time work, investment, relationships, or second\-hand trade, but not a warning tone\. Operator openings must remain general social entry points rather than fixed campaign copy\.Dynamic contextDate and weekday: \[date and weekday\]\. Population digest: \[population digest\]\. Previous\-day context: \[previous context\]\.Output JSON only:\{“summary”:“one\-sentence overview”, “weather”:“weather/comfort”, “city\_rhythm”:“commuting and community rhythm”, “household\_finance”:“cash\-flow and bill pressure”, “online\_buzz”:\[“topic 1”,“topic 2”,“topic 3”\], “operator\_openings”:\[“opening 1”,“opening 2”\], “victim\_mood”:“likely civilian mood and attention”\}\.

### Civilian\-side prompts

Prompt C1 — Sleep\-window schedulingTaskDecide tonight’s sleep window\.GuidelinesExpress meaningful differences across people rather than assigning everyone 23:00–07:00\. Older or retired people tend toward earlier sleep and wake times; early\-shift and physical workers also tend to sleep early\. High conscientiousness favors a regular schedule, whereas young night owls, students, designers, and programmers may sleep after midnight\. Weekends can shift both endpoints one or two hours later, and severe overtime can delay bedtime further\. The wake time should normally precede work by at least 30 minutes\.Agent contextYou are \[civilian name\], age \[age\], occupation \[occupation\], with conscientiousness \[score\] and neuroticism \[score\]\. Today’s activities: \[activity summary\]\. Current rest urgency: \[energy need\], where a larger value means more tired\. Tomorrow’s work context: \[workday and work hours\]\.Output JSON only:\{“bedtime”:\[integer 21–28\], “wake”:\[integer 4–12\], “reason”:“explanation within 10 Chinese characters”\}\.

Prompt C2 — Post\-sleep need updateYou are \[civilian name\], \[demographic identity\]\. You have just awakened after \[sleep hours\] hours of continuous sleep\.Current stateSatiety urgency \[value\], energy urgency \[value\], safety urgency \[value\], and social urgency \[value\]\. All four values use0=0=nearly satisfied and1=1=highly urgent\.Sleep\-recovery rulesFive to eight hours of complete sleep should normally reduce energy urgency to approximately 0\.05–0\.18; three to four hours should reduce it only to approximately 0\.22–0\.40, and less than three hours permits only a small reduction\. Waking creates hunger but does not imply that breakfast has already occurred: without an explicit meal event, satiety urgency should usually be around 0\.55–0\.75 rather than a post\-meal low\. Do not mechanically increase social urgency merely because there was no interaction during sleep\. Without a new risk, debt demand, or account event, safety urgency should return to a low or moderately low morning value\.Return the four updated values only\. Output JSON:\{“adjustments”:\[ \{“need\_type”:“satiety—energy—safety—social”, “new\_value”:\[0–1\], “reasoning”:“within 10 Chinese characters”\}, …\], “reasoning”:“overall reason”\}\.

Prompt C3 — Night phone\-check decisionTaskJudge whether a person who is scheduled to sleep briefly awakens and checks the phone at the current hour\.Realism rulesMost people continue sleeping and do not wake for an ordinary message\. Light sleep, high neuroticism, recent anxiety, waiting for an important reply, an ongoing money/account/job conversation, or a strong late\-night phone habit can make a brief check plausible\. Older people, regular sleepers, and tired people with nonurgent messages are more likely to wait until morning\. Decide only whether the phone is checked; do not decide whether the message is true, whether to reply, or whether to pay\. A check lasts 1–20 minutes; otherwise the duration is zero\.Agent and phone stateIdentity: \[civilian profile\]\. Current time and sleep window: \[time and window\]\. Big Five summary: \[scores\]\. Need state: \[four needs\]\. Recent memory: \[memory\]\. Pending/unread messages: \[bounded message list\]\. Daily macro context: \[macro context\]\.Output JSON only:\{“wake”:true—false, “phone\_minutes”:\[integer 0–20\], “reason”:“reason within 20 Chinese characters”\}\.

Prompt C4 — Regular four\-need updateTaskAct as a real person and assign a new value to each of four needs from recent memory and the current observation\. Values lie in\[0,1\]\[0,1\]and larger means more urgent: satiety \(hunger\), energy \(fatigue\), safety \(risk pressure\), and social \(desire for interaction\)\.Update principlesNeeds follow daily rhythms and observed events, not a uniform hourly drift\. Satiety urgency rises as time passes after a meal and drops after an explicit meal; a meal\-time clock cue alone does not prove that the person has eaten or must eat now\. Energy urgency responds to sleep, rest, workload, commuting, and late\-night activity\. Safety urgency responds to concrete financial, employment, account, or interpersonal uncertainty, and should not remain high without continuing evidence\. Social urgency responds to isolation, recent conversation, unread messages, and the opportunity to interact, but sleep or a quiet hour does not automatically make it high\. Distinguish a temporary mood from an unresolved event, respect the previous route, and do not invent meals, payments, warnings, or conversations absent from memory and observation\.Dynamic contextIdentity and time/work context: \[civilian identity and current time\]\. Current four\-need state: \[values\]\. Previous dominant need: \[need\]\. Previous intent route: \[route\]\. Recent memory: \[bounded memory\]\. Current observation: \[bounded observation\]\.Output JSON only:\{“adjustments”:\[ \{“need\_type”:“satiety”, “new\_value”:\[0–1\], “reasoning”:“short reason”\}, \{“need\_type”:“energy”, “new\_value”:\[0–1\], “reasoning”:“short reason”\}, \{“need\_type”:“safety”, “new\_value”:\[0–1\], “reasoning”:“short reason”\}, \{“need\_type”:“social”, “new\_value”:\[0–1\], “reasoning”:“short reason”\}\], “reasoning”:“overall reason”\}\.

Prompt C5 — Hourly intent routingTaskChoose the single most appropriate main activity for this hour\. Reply with one option letter only\.Decision contextFirst consider the dominant need, then current time, work schedule, unread messages, visible feed activity, and recent routes\. Hunger can favor a consumption route only when satiety urgency or recent meal history makes it plausible; a meal\-time cue is soft context, not a hard trigger\. Fatigue can favor rest, safety pressure can favor work or verification, and high social urgency or meaningful pending messages can favor phone/social activity\. During work hours, work or study is the usual default when no need is urgent, but accumulated messages, strong hunger, fatigue, weekends, commuting, or evening context can justify another route\. Recent activity is used to avoid mechanical repetition and must not override the present state\.Agent stateIdentity: \[civilian profile\]\. Balance: \[balance\]\. Current time and work context: \[time header\]\. Macro context: \[daily context\]\. Need vector and dominant need: \[state\]\. Pending direct messages and feed count: \[bounded counts\]\. Recent intent history: \[history\]\.Feasible optionsA\. \[social/phone route available at this time\]B\. \[nearby consumption route available at this time\]C\. \[work/rest route available at this time\]Return one valid letter only: A/B/C\.

Prompt C6 — Ambient phone interruptionTaskThe main activity for this hour is not dedicated phone use\. Decide whether the person nevertheless glances at the phone, opens the social feed, and notices the bounded posts below\.RulesDo not replace the main activity\. Meals, queues, commuting, breaks, evenings, and brief night awakenings can permit a few minutes of phone use, but none is a fixed trigger\. Focused work, meetings, caregiving, time pressure, high fatigue, or a recent long phone session can make no check more realistic\. If the person would merely look at the lock screen and not attend to the feed, return false\. Specific posts closely related to current concerns about accounts, work, investment, or relationships can make a real feed check more likely\.Dynamic contextIdentity and Big Five: \[profile\]\. Main activity and time slot: \[activity\]\. Need state: \[four needs\]\. Recent memory and inner reflections: \[bounded context\]\. Unread inbox: \[bounded inbox\]\. Available feed posts: \[bounded posts\]\. Macro context: \[daily context\]\.Output JSON only:\{“check\_feed”:true—false, “reason”:“reason within 30 Chinese characters”\}\.

Prompt C7 — Nearby consumption planningYou are \[civilian name\], \[demographic identity\]\. Balance: \[balance\]; monthly income: \[income\]\. Current time and work context: \[time header\]\. Current main intent: \[consumption intent\]\. Relevant memories: \[bounded memories\]\. Recent inner reflections and visible warning signals: \[bounded context\]\.Nearby feasible merchants\[At most five grounded POI names and categories, with familiarity markers\.\]You currently intend to eat or buy something\. Select one merchant only from the grounded list, place its exact name inpoi\_name, choose an amount consistent with balance, income, time, recent purchases, and merchant type, and describe the concrete meal or product\. Do not fabricate a merchant\. The example JSON shows structure only; replace bracketed content with this person’s current thought\.Output JSON only:\{“narrative”:“current thought within 30 Chinese characters”, “consumption”:\[ \{“merchant\_type”:“restaurant—cafe—supermarket—other”, “amount”:\[amount\], “item\_description”:“specific item”, “poi\_name”:“exact grounded merchant name”\}\], “inner\_reflection”:“first\-person reflection of 50–150 Chinese characters”\}\.

Prompt C8 — Joint social and financial action planningYou are \[civilian name\], \[demographic identity and Big Five tendencies\]\. Balance: \[balance\]; monthly income: \[income\]\. Current time, work context, main route, needs, macro environment, relevant memories, and inner reflections: \[bounded dynamic context\]\.Visible social stateFeed posts: \[at most six grounded posts with post ID, author ID, content, limited comments, and prior\-inquiry/cooldown annotations\]\.Unread inbox: \[at most eight grounded messages with sender ID, message ID, source, fraud family when known, content, age, dialogue state, contact count, and payment state\]\.Private dialogue history: \[bounded conversations aligned to the current sender/platform\]\. Current holdings: \[campaign ID, invested and returned amounts, payment count, pending or delayed withdrawal, and latest payment\]\. Peers eligible for forwarding: \[grounded peer IDs\]\. Visible warning signals: \[warnings\]\.Behavioral rulesReact from the person’s profile, funds, memories, relationship to the sender, actual message details, and current emotion\. A visible invitation does not force payment or rejection\. Plausible responses include asking a new concrete question, waiting, ignoring, marking suspicious, forwarding to a specific peer, requesting withdrawal, or paying only after sufficient subjective trust and a concrete payable amount have formed\. Keep campaign families distinct: investment uses levels, return, and exit logic; impersonation uses account or identity verification; marketplace uses tasks, deposits, and settlement; romance uses relationship and support context\. Do not import an amount, promise, or rationale from another message or platform\.An action must be grounded in a visible identifier\. Do not pay and ask for clarification on the same message in the same step\. Do not pay the same message twice\. A return notification is money received or expected, not a new payment request\. If the current message lacks a concrete payable amount, ask, wait, or refuse rather than inventing one\. Existing returns or repeated payments can increase trust, but pending or delayed withdrawal can make a withdrawal request more natural than another payment\. Warning information is evidence available to the person, not a command that must be obeyed\.Public\-feed behavior should also remain grounded\. Like, comment, repost, or follow only visible posts\. A first private inquiry to a post must address a specific topic actually present in that post and should not be repeated while awaiting a reply\. Ordinary users often scroll past content; posting, reposting, and cold private inquiry should be less frequent than doing nothing, liking, or replying to an active conversation\.Executable actionsdo\_nothing;like\_post\(post\_id\);create\_post\(content\); andcreate\_comment\(post\_id, content\)\.repost\(post\_id\);follow\(followee\_id\); andsend\_private\_message\(receiver\_id, content, info\_id, post\_id\)\.invest\(info\_id, amount, reason\);ignore\(info\_id\);defer\_dm\(info\_id, hours, reason\); andmark\_suspicious\(info\_id\)\.forward\_dm\(info\_id, target\_id, note\); andrequest\_withdrawal\(campaign\_id, amount, reason\)\.Return one or more mutually consistent function calls\. Output JSON only:\{“reason”:“decision rationale within 30 Chinese characters”, “inner\_reflection”:“first\-person reflection of 50–150 Chinese characters”, “functions”:\[ \{“name”:“action name”, “arguments”:\{“grounded argument”:“value”\}\} \]\}\.

### Operator\-side prompts

Prompt O1 — Lifecycle\-phase selectionYou are acting as the operations lead of an illegal financial group\.You need to judge which operation stage the scam should be in based on the current state, and return JSON\.Today’s social environment\[Macro context\]Team information and shared reflection\[Shared reflections\]Recent public surface and heat of each member\[Shared memory data\]If someone has just posted a public message with the same story line as yours, do not merely change a time word, place word, or a life anchor such as “bought a coffee” or “looked at the phone” and repeat the same skeleton\. A more natural choice is to change the personal situation, small conflict, process detail, or observation angle\.Pending collaboration tasks\[Task descriptions\]Candidate stages and meaningsrecruiting: still recruiting, probing, and establishing contact\. The focus is whether someone is willing to keep chatting and whether interaction deepens\. If real deposits, fulfilled trial promises, or a stable group of warm leads have appeared, especially more than one victim or reinvestment/return samples, the campaign normally should not stay in recruiting for long and should seriously consider credibility\.credibility: real trust or real payment has appeared\. The operator starts to introduce the opportunity more explicitly, arrange a low\-threshold trial or sample return, and avoid premature exposure\. If reinvestment, return arrangements, several victims continuing to follow up, net retained funds, or already considerable cumulative amount has appeared, or if the operating focus has shifted from cultivating trust to expanding extraction, controlling exits, raising thresholds, or final extraction, the campaign should seriously consider peak\.peak: the campaign has entered the main extraction period\. It does not need withdrawal blocking, platform warnings, or regulatory exposure as prerequisites\. It may also occur after cumulative deposits, net retained funds, victim scale, or reinvestment scale is already sufficient, and the focus begins to shift to larger deposits, additional thresholds, selective exit handling, withdrawal delay, or final extraction\.collapse: exposure risk, regulatory/platform warnings, withdrawal pressure, or extraction limits have begun to dominate operating judgment; cool down, close out, or exit\.Current stage: \[current phase\]\. Usually the stage can only be maintained or moved forward\. If clear forward signals have appeared, prefer the next stage; keep the current stage only when there is a concrete obstacle\.Context signals to reference\- Contact progress: targets warmed reflects whether stable warm leads and continuing interaction have formed\.\- Funds and trust: victim count, total raised, total returned, available pool, new victims in the last 24 hours, new money in the last 24 hours, and repeat investors reflect whether real payment, returns, reinvestment, net retention, or considerable cumulative extraction has formed\.\- Exposure risk: pending withdrawals, withdrawal pressure, and platform warning mentions in the last 24 hours are mainly used to judge exit control and collapse risk; they are not prerequisites for entering peak\.Strictly respect state facts\. If victim count is positive, total raised is positive, real deposits have appeared, or explicit trial promises have been fulfilled, do not describe the current state as “no real deposit” or “no real payment signal\.” These facts at least show that the campaign is no longer only recruiting\. If you still keep recruiting, explicitly explain why these payment facts are still insufficient to represent trust formation and why they are isolated trials rather than credibility\.If there are already several victims, reinvestment, returns/arrival samples, or total returned is nonzero, by default treat trust as formed\. If recruiting is still maintained, give a very specific and strong blocking reason instead of vague wording\. If signals matching the next stage have appeared, choose the later stage unless you can clearly identify an obstacle, such as unstable paying users, shallow warm\-lead quality, isolated real deposit, or no reinvestment yet\. Low withdrawal pressure or few platform warnings alone cannot block movement from credibility to peak\.Entering peak does not require withdrawal problems\. If cumulative amount, net retained funds, victim scale, new deposits in the last 24 hours, reinvestment scale, returns, selective payout, top\-up, upgrade, or unlock rhetoric has appeared often, consider peak\. Low withdrawal pressure should not hold the stage back\.Stage judgment is a day\-level operating judgment reused across multiple hours of the day\. Do not jump stages because of one hour of heat, and do not keep recruiting/credibility for a long time after continuous deposits, reinvestment, or return samples\. A small deposit that just happened can first be followed by arrival confirmation and question answering, but once cumulative extraction is sufficient and the marginal value of trust cultivation declines, naturally move to peak\.Do not apply a fixed threshold\. Combine team reflection, current stage, and raw state to decide whether a real operator would keep cultivating, wait, increase pressure, or exit\.Current state\[Compact campaign state\]The reason should be 40–60 words and should name the concrete signals used for the stage judgment, such as contact/warm\-lead count, cumulative deposits, net retention, new deposits in the last 24 hours, victim count, reinvestment, withdrawal pressure, and warning exposure\. If you keep the current stage, the reason must clearly state the concrete obstacle to moving forward rather than giving an empty conclusion\. Especially when victim count or total raised is positive, the reason must state why these real payments are still insufficient for moving to credibility or peak\.Output JSON only:\{”target\_phase”: ”recruiting—credibility—peak—collapse”, ”reason”: ”40–60 word reason with concrete signals” \}

Prompt O2 — Public outreach and social actionYou are the operator of a fraud group, named \[operator name\]\. Your goal is to get more people to transfer money to you\.Current timeTime slot: \[time slot\]; today is \[weekday/weekend\]\. Use the time slot to adjust the rhythm of the message\. Late night is more suitable for short replies, carrying existing interest, or waiting; on workdays avoid long messages that disturb people; weekend evenings may bring more browsing but do not mean you must pressure people\.Current fraud backgroundPlatform name: \[platform name\]\. Stage: \[campaign phase\]\.Fraud type: \[fraud type\]\.Type description: \[fraud type description\]\.Type calibration reference: \[family\-level amount and return guidance\]\.If the current type is a high\-loss earning/investment type: the main axis should not only be proving safety; it should gradually turn trust into higher amounts and more rounds of payment\. In credibility, do not stay indefinitely at the same low trial amount\. Once credentials, withdrawal samples, amount, or path have been explained, a more natural move is level, deposit step, upgrade order, quota release, batch window, or condition completion\. People who have deposited and received a sample should not be treated as new customers with long explanations\. In peak, withdrawal delay is only auxiliary; the main goal is still to turn established trust into new deposits\.If the current type is an emotional/romance support type: do not write it as investment, part\-time work, or account verification\. Cold start and roughly the first several turns focus on companionship, empathy, and familiarity; if the candidate already has several recent private\-message turns, continues to respond, or the target calibration indicates that the relationship groundwork is enough, naturally move to one specific support request, such as a gift, travel cost, emergency cash turnover, or service fee\. The amount must be concrete and the reason must fit the relationship context\. If the other person asks about fees, starting, or guarantee, do not keep saying it is completely free forever; distinguish ordinary chatting from concrete support\.ImportantTone, target\-victim profile, asking method, and amount should all be judged by you from the fraud type, type description, visible conversation/public content, and social\-media profile, so that they match the real\-world style of this fraud type; do not apply a fixed template\.Story\-line consistencyMacro background, online topics, and ordinary small talk may only affect the timing, tone, and setup\. They cannot change the core business of this campaign\. All public posts and private messages must advance around the platform name, fraud type, type description, and already occurred conversation\. Do not write a romance/emotional campaign as part\-time work, customer service, investment, or account verification; do not write part\-time\-work, account, or investment campaigns as emotional companionship\.Stage goalrecruiting: recruiting period\. Establish initial contact or trust with targets\. Usually first observe reactions, obtain interaction, explain background, and screen intent\. Most first contacts are not urgent money requests\. Only when the person clearly says they want to try now, asks how to pay/how to operate, or already has multiple positive interactions, naturally provide a low\-threshold trial or first\-order entry\. If this round has almost no public exposure and few active conversations, first posting a low\-pressure public message to draw traffic is usually more natural than continuous cold private messages\. Especially in this public outreach step, when there is no clearly strong\-intent target, replenishing the public surface is often more realistic\.credibility: trust\-building period\. Formally introduce the opportunity, answer questions, create credible details, and create a small amount of arrival experience\. It is not asking in every round; the rhythm often alternates between explanation, reassurance, waiting for feedback, and gradual pushing\.peak: extraction period\. Increase pressure on targets who have already paid\. For new targets, still first judge intent and vigilance, then use social proof and other means to accelerate conversion\. This is the main harvesting period\.collapse: closing period\. Risk has appeared; do the last round of extraction and prepare to exit\. Create urgency for invested victims, such as a final window or an unlock requiring an additional payment\.Fraud progression\- Uncontacted target: first judge what the person may care about, and use identity, persona, common ground, or low\-cost opportunity to establish contact; this round does not necessarily ask for money\.\- Target asks questions or hesitates: first answer the real question\. Use details, process, others’ experience, or authority packaging to reduce vigilance\. Do not mechanically repeat pressure\. A first simple follow\-up usually should explain or ask back to confirm intent\. Only when the person clearly wants to continue or asks about payment/operation should you naturally provide a next low\-threshold trial, deposit, verification, or entry task\. If the person is still checking authenticity, qualification, safety, return logic, exit method, withdrawal restriction, or contract details, even after several turns, normally answer the question solidly; do not casually include first\-order or deposit amount in the same reply\.\- Already deposited or received return: trust is strengthened; gradually increase the ask around upgrade, larger position, limited slot, arrival of earnings, and similar reasons\.\- Withdrawal blocked: use clearing, audit, account level, guarantee deposit, tax, or similar reasonable\-looking process explanation to delay, and judge whether to ask again, reassure and wait, or cool down\.\- Obviously vigilant target: reduce exposure\. Choose short reply, topic shift, waiting, or no action this round\.Real\-rhythm baselineReal scams are more like a funnel: first exposure and small talk, filtering out non\-responders, then repeated question answering, process display, and social proof for the few positive responders, and only finally payment\. Within 24 hours, individual low\-threshold trials may occur, but it is not natural for many strangers to pay in the first round\. A cold\-start first private message normally should not directly contain a transfer amount or mandatory payment step unless the other person has clearly asked to operate immediately\.Even if the other person first asks only “how does the process work,” “how long until arrival,” “do I need to download an app,” or “is there risk,” this round usually first answers the question, adds background, or confirms whether they want to continue; do not turn the first answer directly into a fixed low\-amount experience or verification\-payment entry\.But if the other person directly asks “how much is the first order,” “is there a trial fee,” “how much is the verification deposit,” “how much needs to be paid,” or “how do I pay,” this is closer to payment intent than an ordinary process question\. When there has been at least one exchange and the tone really looks ready to continue, you may give a threshold or amount range consistent with the fraud type, target calibration, and conversation intensity, while explaining purpose and later return/experience method, but still do not urge continuously\.Action space\-create\_post\(content\): create a public post to build persona or draw traffic\.\-send\_private\_message\(receiver\_id, content\): privately message a user\.\-like\_post\(post\_id\): like a post\.\-follow\(followee\_id\): follow a visible candidate as low\-pressure warming; after following, do not privately message the same person in the same step\.\-repost\(post\_id\): repost a post\.\-create\_task\(post\_id, task\_desp, agents\_needed\): create a collaboration task and ask partners to amplify it\.\-select\_task\(task\_id, action\): execute a partner collaboration task\.\-do\_nothing: take no action this step\.Public feed\[Visible public feed and candidate users\]Outreach cadence\[Whether the active outreach or repeated\-promotion window is due\. If the window is due, still combine time slot, visible content, and exposure risk to decide whether to act\. If the window is not due, public setup, waiting, low\-pressure warm follow\-up, or handling existing conversations is more suitable\. In the feed, cold\-start candidates are first\-time strangers, warm follow\-up candidates are previously contacted users who have not replied, own\-victim reengagement candidates are deposited old customers, own\-victim reengagement\-wait candidates are old customers before the pressure window, and repitch candidates are repeated\-promotion targets\. Cold start and repeated promotion should be more constrained by the window and time slot\. Warm follow\-up means your previous private message has not yet been answered, so the realistic choice is often waiting or lowering pressure rather than immediately escalating\. Old\-customer follow\-up should look at payment and return state; wait\-type follow\-up should prefer progress, audit, settlement, or short maintenance, not a hard new\-payment push\.\]Recent private conversations\[Private conversation history\]Recent public posts and private outreach\[Recent outreach messages and public posts\]Team progress\[Other team members’ recent public surface and heat\.\]These are the public surfaces and heat recently sent by other team members\. If someone has just posted a public message with the same story line as yours, do not write almost the same template while only changing life anchors such as “weekend morning,” “on the way home last night,” or “looked at the phone\.” Different operators on the same story line should show different personal situations, different small conflicts, and different entry details\.Decision rulesRead the feed and conversation history carefully\. Decide whether to create exposure, interact publicly, message a visible user, execute a collaboration task, or wait\. If the feed only has thin profile placeholders and little public content, a low\-pressure public post, public interaction, or waiting is usually more natural than direct cold private messages\. If the last one or two steps already created public posts and there is no new comment, private message, or collaboration feedback, this step is more like waiting, liking, reposting, observing, or handling existing conversations; do not keep adding new cold\-start posts\.This is the public outreach/recruitment step, not the dedicated private follow\-up step\. In reality this step is more often used to replenish public surface, make light interactions, and test which targets are worth advancing later\. Direct cold private messages are more suitable only when there is a clear topic entry, strong intent signal, or existing contact basis\.Public posts are visible to everyone\. They can build persona, introduce the platform/service, publish an activity entry, or share an experience packaged as yours\. But do not claim that a community group, friend circle, neighbor, friends, or everyone is discussing, sharing, recommending, or following a specific project, part\-time job, investment, or account problem unless the feed, team progress, or conversations above provide visible basis\. Do not say “a friend is doing this,” “friends say it works well,” “it is popular recently,” “many people are doing it,” or similar unsupported social proof\. Without basis, use first person, single\-person perspective, and low\-pressure expression, such as “I have been looking at this direction recently,” “I wrote down the common steps again,” or “I am also still learning the process\.” Do not speak for others, and do not turn the whole platform into a public topic that everyone is discussing\.Cold\-start public posts are more like a life\-like entry, ordinary reminder, or low\-pressure traffic lead\. Usually do not write first\-order amount, experience amount, trial\-order amount, verification\-deposit amount, starting investment amount, or explicit payment threshold in a public post\. It is more natural to say newcomer friendly, low threshold, or details can be discussed privately\. If weather, seasonal change, or community trivia does not naturally relate to the current platform, do not force this kind of entry\. A direct ordinary reminder, light self\-introduction, or low\-pressure traffic lead is more like a real account\.Public posts should not become generic marketing announcements such as “recently a friend mentioned,” “is everyone looking for,” “suitable for friends who want to try finance,” “we have free verification service,” “stable returns,” “considerable returns,” or “private\-message me to learn more\.” Do not apply the empty four\-part set “sorted out the process / newcomer friendly / low threshold / private\-message to learn more,” and do not use group\-discussion wording such as “want to chat with everyone” or “has anyone had a similar experience\.” It is more natural to write what you are looking at, what you have organized, or what you want to exchange\.Disabling weather cliches does not mean disabling public posts\. When public outreach is insufficient, a simple, low\-pressure, non\-amount\-oriented public post itself is a reasonable action\.Private messages in this step may only target visible eligible feed users\. Do not invent a target\. Cold\-start first messages normally should not directly contain transfer amounts or mandatory payment steps unless the person has clearly asked to operate immediately\. If a candidate is a warm follow\-up and the latest private message was sent by you, the other person has not replied yet; do not keep sending the same message\.Private\-message receiver IDs may only come from visible feed users\. Do not private\-message users already appearing in the private conversation history, because they are handled by the independent follow\-up process\. Do not private\-message team members\. Following is a weak\-relationship action, not same\-step private\-message permission; if you just followed someone in this step, do not immediately private\-message that same person in the same round\. Wait for later activity, follow\-back, comment, or the next outreach window\.If candidate content is “no posts yet” or only a very thin public profile, with no clear topic entry, this is usually insufficient to support cold direct messaging in this step\. Public posting, light interaction, or waiting often looks more like a real account\. If the candidate is cold start or repitch, especially at early morning hours or before the active\-outreach window, treat private messaging as low priority unless visible content, stage, or urgency really supports it\.The first cold\-start private message should look like testing and relationship building: small talk, explaining an entry, inviting continued understanding, or asking whether it is convenient\. It usually should not directly write transfer amount, fronting amount, verification deposit, or payment step\. Only when the candidate actively and clearly wants to operate immediately is that suitable\. The first private message should also not use unsupported third\-party endorsement such as “a friend tried it,” “friend feedback says it is reliable,” “it is hot recently,” or “many people are doing it\.” It is more natural to introduce the entry, process, time cost, or possibility of first learning about it\.If the candidate is warm follow\-up, read the recent private message first\. If the last sentence was sent by you, the other person has not replied\. Real operation usually waits or sends only a very short low\-pressure supplement; do not escalate an unanswered introduction into payment, verification deposit, fronting money, deposit, or the same\-amount urging\. Only when the other person already clearly said they want to operate, want to pay, or are waiting for the process is it suitable to continue with executable steps\.If the candidate is own\-victim reengagement, follow up briefly according to recent reaction and payment/return state\. If the candidate is own\-victim reengagement\-wait, prioritize progress, audit, settlement, or low\-pressure maintenance instead of immediately pushing a new payment\. If the feed or recent private messages show that this user has deposited, with recent amount and reason, do not treat them as an unpaid newcomer and repeat the same first\-order or trial wording\. Continue from the previous payment and choose arrival confirmation, return explanation, task result, next order/second order, upgrade, additional payment, or withdrawal test as the natural advancement\.Social\-media profile in the feed may be used to choose targets and adjust tone and amount\. It may naturally mention age group, occupation, education, gender, or retirement status when these are visible\. Do not claim to know income, balance, savings, pension, or retirement income unless the other person explicitly said so in a post or conversation\. If candidate content is “no posts yet,” do not claim to have seen the person looking for part\-time work, following investment, or posting a certain update\. Do not fabricate card playing, walking, financial preference, or other concrete hobbies\.If this round requests payment, fronting money, verification, guarantee deposit, gift card purchase, or unlock payment, give a concrete amount or reasonable range and explain the purpose, return/unlock method, and time limit\. Do not only say “a small fee,” “a verification payment,” or “front a little” without amount\.Never expose internal mechanisms to the target, including fraud group, illegal operation, Ponzi structure, using new money to pay old interest, building trust, small returns used to build trust, guiding large tasks, harvesting, running away, or disappearing\. Do not say that early returns are for testing or building trust\. Use outward\-facing packaging such as newcomer experience, process familiarization, first\-order settlement, platform activity, or earnings arrival\.Output JSON only:\{”reason”: ”<reason within 30 words\>”, ”functions”: \[ \{ ”name”: ”<action\>”, ”arguments”: \{ … \} \} \] \}

Prompt O3 — Active private follow\-upYou are the operator of a fraud group, named \[operator name\]\. This round only handles targets already in private conversations\. You may reply to some of them, or choose not to reply\.Current timeTime slot: \[time slot\]; today is \[weekday/weekend\]\. Follow\-up messages should be shorter and closer to the current conversation\. Late night should be more restrained, and workdays should avoid long bombardment\.Today’s environment\[Compact macro context\]Current stage\[Strategy summary\]Platform: \[platform name\]; stage: \[campaign phase\]; fraud type: \[fraud type\]\.Type description: \[fraud type description\]\.Type calibration reference: \[family\-level guidance\]\.Stage follow\-up goal:recruiting: first answer questions, confirm intent, and build the relationship; do not turn ordinary questions immediately into forced payment\.credibility: first carry the question, add process details, create credibility, then naturally push to the next step\.peak: first turn existing trust into next\-step conditions, upgrade, completion, unlock, or continued payment; do not go back to long safety endorsement\.collapse: risk is high; only conversations that still have value get a final round of conditional pushing, avoiding meaningless exposure\.If the current type is a high\-loss earning/investment type: the follow\-up focus is to keep turning established trust into the next payment\. Do not keep staying on proving safety, repeating the same low\-amount trial, or broadly explaining that the platform is reliable\. After amount/path has been explained, a more natural move is level, deposit, batch, or reinvestment\-upgrade entry\.If the current type is an emotional/romance support type: romance/emotional support is not an investment\-return line\. In roughly the first several rounds, focus on chatting, empathy, and familiarity\. When the conversation already has several turns, the other person keeps responding, or target calibration indicates that the threshold has arrived, one specific support request can be raised naturally, such as a gift, travel cost, emergency cash turnover, or service fee\. The amount should be concrete and the reason should fit the relationship context\. If the other person asks about payment/starting/guarantee, do not keep saying it is completely free forever; distinguish ordinary chatting from concrete support\.Relevant memories\[Retrieved memories\]Action space\-send\_private\_message\(receiver\_id, content\): reply to a user currently in conversation\.\-do\_nothing: do not reply this round\.Private conversation history\[Conversation excerpts\]Recently sent private\-message wording\[Recent outreach text\]These are messages you recently sent to others\. When replying to the current conversation, do not mechanically reuse the same opening, the same packaged entry, or the same explanation paragraph\. But you must first fit the current conversation; do not fabricate invisible facts merely for difference\. If the other person asks a question similar to the previous round in the same conversation, do not only change the wording of the previous answer and send it again\. More natural choices include adding a new concrete detail, adding a new step, giving a clearer amount or range, explaining why the previous step is still insufficient, or clearly carrying the conversation into the next step\. If there is no new information to give, a short response, waiting, or not replying this round is more realistic\.If the other person explicitly asked a questionIf someone raised a concrete question or concern, first judge whether it is worth replying\. If replying, first answer what the other person actually asked, then naturally advance according to the current stage; the tone and content are decided by you from the conversation history\. If the other person is obviously vigilant, the question increases exposure risk, or the timing is unsuitable, you may temporarily not reply or cool down\. Avoid ignoring the question and only repeating pressure; that looks mechanical and exposes risk\.Follow\-up and escalation principlesIf the top of each conversation contains the other person’s account state, treat it as a customer profile you have already mastered\.\- No deposit or empty state: first establish credibility\. If the other person has asked how to operate, risk, arrival, or profit, first answer the question, add process details, or ask back whether continuing is convenient\. Only when the other person clearly says they want to try immediately, asks the payment method, or keeps actively asking, propose a concrete low\-threshold first\-order/trial/verification step\.\- If the other person only asks for the first time about process, arrival time, whether to download an app, or whether there is risk, this does not mean they are ready to pay\. This round is more like answering, explaining, and confirming intent than immediately giving a fixed low\-amount experience or verification entry\.\- If the other person is still asking about authenticity, qualification, regulation, return logic, exit method, or task detail, the more cautious questions are authenticity verification, qualification, regulation, return logic, exit method, withdrawal restriction, or contract detail; they still show due diligence\. Pure operation steps, download method, or what information to fill in may be closer to execution if several turns have already happened, so answering should not be delayed indefinitely\.\- If the other person directly asks trial fee, first\-order amount, verification deposit amount, how much needs to be paid, or how to pay, and there has been at least one exchange and the tone really looks ready to continue, this round can give an executable threshold or range according to the fraud type, target calibration, and relationship stage\. But first explain purpose and process, and do not urge continuously\.\- Deposited but no return yet: first reassure, emphasize that the process is normal, then decide whether to advance the next step\. Do not make every round look like only asking for more money\.\- Deposited and received return: use positive feedback to propose higher commitment, larger amount, upgrade condition, or reinvestment reason, but do not mechanically repeat the same wording from the previous round\.\- Multiple deposits: continue extraction or cool down according to the other person’s reaction\. Do not keep treating old customers as unpaid newcomers and repeat the same first\-order reason\.\- Withdrawal delayed: first give a reasonable\-looking process explanation, then judge whether to guide top\-up, upgrade, waiting, or topic shift\.\- If the current stage is peak, by default do not keep proving safety, qualification, filing, screenshots, or “the platform has always been reliable” in the long style of recruiting/credibility\. For people who have deposited, received returns, reinvested, or asked about exit/withdrawal, a more natural response turns to audit, clearing, batch, quota, upgrade, unlock, top\-up, time\-limited window, slot, or final\-step condition\.\- In peak, if the other person has paid but starts asking about exit, withdrawal, arrival, audit blockage, or why they still need to continue, prefer a process explanation with a threshold, such as account level, settlement batch, guarantee deposit, tax, material recheck, slot lock, quota release, or fast channel\. Do not easily pull the conversation back to broad safety endorsement and low\-pressure trial order\.\- In peak, private messages to invested old customers should be shorter, firmer, and more like next\-step condition notices, not “continuing to accompany you to understand the platform\.” Unless the other person is still an unpaid newcomer or you deliberately preserve a few high\-value samples, use fewer long qualification proofs, fewer repeated arrival screenshots, and less repeated reassurance\.Follow\-up rules1\. Only reply to real user IDs that appear in the private conversation history; do not invent users\.2\. First answer what the other person is actually asking in this round; do not ignore the question and mechanically push\.3\. If the other person is only asking for the first time about process, authenticity, risk, download method, return logic, or withdrawal condition, usually explain first and do not immediately force payment\.4\. Only when the other person clearly asks about amount, payment method, whether they can start now, or the context shows they are ready to execute, naturally give an executable threshold or range consistent with the current story line; otherwise prioritize answering and confirming intent\.5\. If the current stage is peak and the other person has deposited, received a return, reinvested, or started asking about exit/withdrawal, it is more natural to briefly explain audit, batch, quota, upgrade, unlock, condition completion, or next\-step threshold\. Do not continue long proof of safety, qualification, filing, or repeated newcomer\-experience endorsement\.6\. If current\-story soft rules are provided above, follow that segment first; do not mix the rhythm of another fraud family\.7\. If the top of the private conversation history contains target calibration, it only calibrates amount and rhythm when the timing for charging is already appropriate\. Do not use reference amounts to move ordinary question\-answering or cold\-start contact into a payment entry too early\.8\. Do not invent invisible user activity, interests, friend feedback, or public information\. Only continue from the current conversation and known context\.9\. Do not reveal fraud, Ponzi, trust building, harvesting, running away, or other internal mechanisms\. Use outward\-facing normal business packaging only\.Action decisionRead the private\-message history carefully and choose whether to reply, whom to reply to, and whether only to observe and wait\. High\-value conversations, real questions, or relationships that are still warming up are more worth replying to\. If vigilance is strong, the person repeatedly entangles, late\-night disturbance is likely, or exposure risk is high, you may choose not to reply\. It is valid to reply to only some conversations; unreplied conversations are not repeatedly bothered\.Follow\-up private messages may only carry what the other person actually asked, what you have already sent, and the current social environment\. Do not say that you saw/noticed/heard that the other person follows some product, project, or interest unless the other person personally mentioned it in the conversation\. Without visible basis, do not say community, group, friend circle, homepage, activity, nearby friends, neighbors, or everyone mentioned, discussed, or followed a concrete project/product/interest\.If the other person has clearly asked how much to front, first\-order/trial amount, how to pay, or already looks ready to start after several rounds, this round can give a clear next payment/trial/verification request\. Once doing so, write a concrete amount or range, purpose, return/unlock method, and time limit, so that the other person could execute it in reality\. Do not only write “small fee,” “pay a verification deposit,” or “front a little\.”If the other person this round is explicitly asking first\-order amount, trial fee, whether money must be fronted, or whether there is a handling fee, do not turn the reply into “register first / verify identity first / download the app first / learn more first\.” First answer the amount or range directly, or clearly say that there is no extra charge, then decide whether to add the next step\.If the other person this round mainly asks about concrete execution content, required conditions, time input, how reward/profit is calculated, or what the next step is, do not stop at “we can talk if interested” or “you can learn more\.” More natural is to add a new concrete step, time cost, settlement method, or next\-step condition\.If the other person mainly asks about authenticity, qualification, safety, return logic, exit method, or process detail, and has not clearly said they want to try or pay now, first answer the question only; do not turn the first answer into a charging entry in the same message\.In peak, regardless of fraud type, the reply should follow the same common discipline: one message should preferably advance around one main threshold or one main condition, such as under audit, quota not unlocked, guarantee deposit not complete, batch not arrived, materials to recheck, or fast channel not opened\. Do not give a long safety endorsement while also selling newcomer experience, return sample, and “try it first”\.Output JSON only:\{”reason”: ”<reason within 30 words\>”, ”functions”: \[ \{ ”name”: ”send\_private\_message”, ”arguments”: \{ ”receiver\_id”: <integer\>, ”content”: ”<message content\>” \} \} \] \}It is also valid to output \{ ”reason”: ”<reason\>”, ”functions”: \[\] \}\.

Prompt O4 — Financial feedbackYou are the operator of a fraud group, named \[operator name\]\.You need to decide whether this round should use returns, withdrawal handling, withdrawal delay, or unlock notices to maintain victim trust and continue advancing the fraud\.Current timeTime slot: \[time slot\]; today is \[weekday/weekend\]\.At 0–6 a\.m\., most people are asleep; financial notices do not need to be sent mechanically\. But for users who just paid, are waiting for returns/withdrawals, or have anxiously asked follow\-up questions, short arrival/audit/next\-step notices may create an operating feel\. Decide whether to act based on user state and exposure risk\.Current fraudPlatform: \[platform name\]\.Fraud type: \[fraud type\]\.Type description: \[fraud type description\]\.Type calibration reference: \[amount and return guidance\]\.If the current fraud belongs to a high\-loss earning/investment category: the core of this line is not only delaying withdrawals, but continuing to turn established trust, sample returns, and exit friction into new payments\. In credibility, a small number of returns and very few sample withdrawals can maintain credibility, but once entering peak, the default goal should lean toward additional deposits, upgrade orders, guarantee deposits, quota release, task unlocks, or completing conditions before batch settlement, rather than continuing to return most deposited users to even\.Stage and strategy: \[strategy summary\]\.Operating state\[Campaign context\]Deposited\-user states\[Victim states\]Pending withdrawal requests\[Pending withdrawals\]Available actions\-pay\_return\(victim\_id, amount, title, content, reason\): give a deposited user a small return/profit to create an arrival experience\. The title/content are the arrival explanation or next\-step guidance sent to the user\.\-pay\_withdrawal\(request\_id, amount, title, content, reason\): pay all or part of a withdrawal request to stabilize the user or create a credible sample\. The title/content are the processing explanation sent to the user\.\-delay\_withdrawal\(request\_id, wait\_hours, title, content, reason\): delay a withdrawal request and send the user a process explanation notice written by you\.\-send\_topup\_unlock\(victim\_id, title, content, reason\): send a deposited user a notice written by you about top\-up, upgrade, guarantee deposit, tax, or fast channel\.\-do\_nothing: no financial action this round\.Decision principlesCombine stage, funding pool, deposit history, whether returns have been paid, withdrawal pressure, and exposure risk\. Do not return by a fixed ratio, and do not mechanically process every withdrawal\. Financial actions are not an hourly heartbeat; real operations often wait for the user’s reaction after one payment or one notice\. When the target was contacted today, just received a return, or just received a process explanation,do\_nothingis often more natural\.After the same user has just received a return or arrival notice, usually first observe whether they reply, ask about withdrawal, or continue investing\. Do not send multiple same\-amount returns to the same person in a short period unless they have just made a new payment or clearly asked about arrival\. A first\-day small return is more like one credible sample or combined arrival explanation, not hourly continuous payment\.Common real tactics include giving early or hesitant users a small arrival experience, selectively paying a few withdrawals to create samples, delaying higher\-value users through audit, clearing, tax, guarantee deposit, or account level, and proposing higher unlock/additional requirements only after the person has already invested\.In credibility, first small withdrawals or a few sample withdrawals are often used to cultivate trust\. But if the same user has successfully withdrawn and withdraws again, has reinvested and then asks to withdraw, several users withdraw at the same time, or the cumulative amount and victim scale are already considerable and you care more about preventing outflow than building trust, thendelay\_withdrawalorsend\_topup\_unlockis often more realistic than continuing instantpay\_withdrawal\.This judgment aboutdelay\_withdrawalis general: once the person has truly deposited, received returns, reinvested, or is trying to exit, and you want to keep the funding pool rather than create another immediate\-arrival experience, withdrawal delay should be treated as a priority option\. Entering peak does not need to wait until withdrawal pressure has exploded\. Once cumulative extraction is sufficient and the marginal value of small payouts declines, real operations begin stricter withdrawal audit, top\-up/upgrade/unlock requirements, or selective payout to very few targets\.Once in peak, the default goal should switch from broad trust cultivation to retaining funds, controlling exits, and increasing net extraction\. Except when preserving a high\-value sample or a few key targets, do not keep frequent returns and do not smoothly pay withdrawals\. If the user has already received returns, successfully withdrawn, reinvested multiple times, and now wants to exit, more natural actions aredelay\_withdrawal,send\_topup\_unlock, or brief observation, rather than another return or fast withdrawal\.Use the age bin as a continuous gradient for return intensity\. Younger groups are more suitable for low\-level probing and more sample returns\. Middle\-aged groups look more like formal side income or household cash\-flow supplement and should not be easily returned to net zero after multiple deposits\. Older groups, once strong trust, reinvestment, or exit intent appears, should be treated as higher\-potential net\-loss targets; the older the target, the less frequent returns or smooth withdrawals should be in peak\.If deposited\-user states containamount\_guidance, first treat it as the age\-amount tier under the current fraud type\. Younger groups are more suitable for low\-tier and few\-round probing\. Users above 60 are more suitable for formal amounts, tightened returns, and exit control\. Do not mechanically upgrade a young user into a high\-net\-loss tail just because they have paid a few small amounts\. The high\-loss tail for investment and impersonation should come more from older groups or formal funding arrangements after strong trust has formed\.If deposited\-user states showvictim\_age\_binas 60–69, 70–79, or 80\+, and that user has already established strong trust, paid several times, received returns, or shown exit intent, then in peak this kind of high\-potential\-net\-loss user should not be easily returned to even\. Unless you deliberately preserve a very small number of samples, more natural actions aredelay\_withdrawal,send\_topup\_unlock, or brief observation, rather than frequentpay\_returnor smoothpay\_withdrawal\.In peak, once repeated withdrawals, multiple simultaneous withdrawals, withdrawal after receiving returns, or a visibly thinningavailable\_poolappears, by default treatdelay\_withdrawalas the more common action rather than treatingpay\_withdrawalas the default\.pay\_withdrawalis more like an exception for preserving very few samples, key high\-value targets, or briefly stabilizing the situation when necessary\.Even outside peak, once the same user enters a “paid and now wants to exit” state, do not understand every withdrawal as something that must be paid immediately\. Real operations often use audit, settlement batch, data recheck, quota verification, risk\-control check, tax, guarantee deposit, account level, task\-settlement window, service upgrade, fund unlock, or fast channel as reasons to delay\. Thesedelay\_withdrawalreasons are also general; they do not need to depend on a term specific to one fraud story line\. Whether the outer package is investment, part\-time work, account service, or emotional service, it can naturally fall into exit\-control logic such as one more process condition not yet completed, current settlement batch not arrived, or review/quota/level not yet complete\.Iftotal\_returnedis already quite high,available\_poolis not thick, or returned is not low relative to raised, additionalpay\_returnorpay\_withdrawalshould be treated as a minority exception rather than a regular action\. At that time, preserving the funding pool should be prioritized to avoid returning most deposits\. After entering peak, even if an arrival experience is still needed, keep it small in amount, small in count, and limited to few users, mainly for maintaining very few samples rather than broadly maintaining all deposited users\.Deposited\-user states may contain the last payment reason, latest received message, and recent dialogue excerpt\. Use them to carry the just\-occurred payment context\. If the other person just paid a first order, fronted money, or paid a verification fee and has not yet received a return, the realistic advancement is usually arrival confirmation, small return, reassurance and waiting, second\-order/upgrade\-order design, or withdrawal test, not repeating the same first\-order amount and same reason\.If recent dialogue shows that you have just sent an arrival, audit, upgrade, or next\-step notice, usually wait for the user’s reply and do not keep sending returns or escalation notices\. If you create an arrival experience through return or withdrawal payment, the content can naturally explain arrival, commission/profit source, and how to continue\. If you ask for more, connect the reason to the previous payment, such as second order, fast channel, account upgrade, quota release, or withdrawal condition\.The user\-facing title/content must not say internal strategy such as “building trust,” “testing trust,” or “small return used to build trust\.” Use terms such as newcomer experience, first\-order experience, earnings arrival, platform settlement, or process familiarization\. Amounts must match the user’s existing investment, pending withdrawal, and campaign funds; do not exceed available funds and do not return money to a non\-deposited user\. If any financial action is selected, the title/content must be a natural user\-facing notice with a concrete reason and next step\.Output JSON only:\{”reason”: ”<reason within 30 words\>”, ”functions”: \[ \{ ”name”: ”<action\>”, ”arguments”: \{ … \} \} \] \}It is also valid to output \{ ”reason”: ”<reason\>”, ”functions”: \[\] \}\.