Linguistic Features of Phone Scams:

A Qualitative Survey

Judith L. TabronInformation Technology / The Institute for Forensic Linguistics, Threat Assessment, and Strategic Analysis at

Hofstra UniversityHempstead, NY 11549 USAjudith.tabron@hofstra.edu

Abstract The interactive human components of seriouscybersecurity breaches continue to be a problem for everyorganization. Helping people identify social engineering attemptsover the phone will be cheaper and more effective than yetanother technological implementation. At minimum it will addan important and necessary layer to defense in depth.

Forensic linguistics is the study of language as evidence forthe law. It is a relatively new field and has not previously beenapplied to cybersecurity. Linguistic analysis uncovers severalfeatures of language interaction in a limited data set (recordedIRS phone scammers) that begin to answer how forensiclinguistics could assist in cybersecurity defense.

This paper will briefly introduce and explain polar tagquestions, topic control, question deferral, and irregularnarrative constructions in IRS scam phone calls, and offer somestarting points for identifying such linguistic properties duringthe course of a phone call to help improve defense at the humanlevel.

Keywords social engineering; forensic linguistics;cybersecurity; securing the human; phone scam

I. FORENSIC LINGUISTICS: LANGUAGE AS EVIDENCE

To secure the human, perhaps our most vulnerable link inthe security chain, I suggest that we move the goalposts.Trying to train people not to be fooled by social engineeringattacks that are designed to fool them may have a limitedeffect. Forensic linguistics is the study of evidence provided bylanguage use we cannot disguise. This is a preliminaryinvestigation for a larger study we hope to carry out at HofstraUniversity applying forensic linguistics methodology to socialengineering to identify features of the interaction that the targetcan, if trained, identify and stop.

Forensic linguistics uses the science of linguistics toexamine language as evidence in civil or criminal cases. It isperhaps most frequently associated with author identification,such as was employed in the famous Unabomer case by JimFitzgerald, then with the FBI. Author identification has beenshown to be most reliable when determining between a smalluniverse of given possible authors, to answer whether a suicidenote was written by a daughter or her mother, or whether textmessages from a particular phone were written by a murder

letters, or to build a profile of the writer. It is fundamental to

forensic linguistics that our built-not something we can supersede. Evidence of our ownlanguage tendencies arise even when we are trying to hidethem, such as in a kidnap case worked on by the founder of thefield, Roger Shuy, where a writer attempting to disguisehimself misspelled several common words but correctly spelled

ord many native speakers of English still havetrouble spelling, and used a regionalism only found in theAkron, Ohio area.

All the sub-fields of linguistics can be brought into play forforensic work: phonology, morphology, semantics andpragmatics describe how language works from the smallestunit of sound up through words and phrases to sentences. How

through language, has been analyzed for decades by linguists,and is particularly important in the areas where a speech actcommits a crime, such as a bribe or a threat [2]. Andsociolinguistics help us understand how speech works ininteraction across social units such as divisions of gender,ethnicity, communities of practice (like all you securityprofessionals here today), and other groups. Robert Leonard,head of the Institute, who has worked with law enforcementand linguists all over the world, has written an article

[3].

Basic research in the area of forensic linguistics canimprove outcomes of justice, such as my own assistance with aproject by Prof. Eric Freedman of the Law School of HofstraUniversity to make clearer instructions to juries who mustconsider awarding the death penalty; the work of the InnocenceProject in identifying confessions that were not written by thesuspect who allegedly wrote them; or to help us understand thenature of language evidence in civil or criminal cases, such as

of threat letters incooperation with the FBI to better understand what types oflanguage actually appear in those threat letters rather thananalysts going by their personal experience of threat letters[4,5,6]. Research like this strongly helps inform lawenforcement.

II. APPLICABILITY TO SOCIAL ENGINEERING

To date, forensic linguistics has not been brought to bear oncybercrime. Like all of you I worry about identifyinganomalous network activity, making sure not to passcredentials in the clear, and encrypting data at rest and in

transit. But the more I learned about cybercrime the more Irealized that it often included a language element betweenhumans that was not being analyzed. The human is still themost vulnerable point of any system, as recent events in thenews have shown. Social engineering has long been studied bypsychologists, with a great deal of attention paid to the act ofdeception, but not to the linguistic features of phone hacking oreven phishing emails themselves, which are language acts.

We all instinctively know and recognize genres ofconversation that we engage in all the time: phone calls hometo Mom, making a date with a friend, taking a help desk callfrom a customer. Linguists have studied such interactions fordecades, especially those researchers who have followed in thefootsteps of J.R. Firth and Michael Halliday who developedsystemic functional linguistics [7]. In a very small way thispaper is a first gesture toward applying that methodology andbackground to social engineering in order to better understandhow it works, perhaps ideally to help train people to defendagainst it.

This qualitative study begins to gather information on thefeatures of phone scams that could be pursued in a quantitativestudy with a larger data set and control set.

III. DATA: RECORDINGS OF IRS SCAM CALLS

I begin with an analysis of publicly available IRS phonescam recordings. While not ideal data, as such recordings aremade by people who know that they are scams and such peoplemay not participate in the conversations just as an unsuspectingtarget would, even a small set of such recordings allow us tobegin to develop a theory of their operation that could inform alarger study with better data. This study is a qualitative study,following the grounded theory approach commonly used insocial sciences since the 1970s [8,9,10] in which one searchesfor what is atypical as well as what is typical in order to fill outa theoretical understanding of the data and to develop areas ofinquiry I hope to pursue with a larger data set.

The IRS phone scam posted on YouTube athttps://www.youtube.com/watch?v=Jb9ilimPWyw,

paper to provide examples. Additional samples were gatheredfor the the genre analysis as well as to expand upon the otheranalyses for this paper. The samples were all collected asvideos from YouTube.com, the audio extracted andtranscribed.

These IRS scams have risen dramatically in the recent yearor two in the United States; the Treasury Inspector General forTax Administration has reported receiving at least 650,000reports of them this year, between 9,000 and 12,000 per week[11,12], and that incurs tremendous overhead costs forinvestigation, even before one considers the thousands ofvictims who have succumbed to the scam and who have lostmillions of dollars. As the calls tend to take similar forms [13],they may form a recognizable genre of their own and as suchbe subject to the type of analysis linguists are familiar with

Genre Analysis [14] and subsequent worksbuilding upon it.

of a phone call in which there are three participants. The personrecording the call is the target of the scam; would-be scammershave robo-called her phone and left an alarming message andinstructions to call them back. Knowing that this is a scam, thewould-be target records the entire call from the beginning. Thatthe target is not fooled is a feature of the samples I was able tocollect, because people do not record scam phone calls to sharewith others unless they know before the call occurs or close toits beginning that it is a scam. This dual-deception nature of thephone call samples on YouTube - that the scammers are tryingto fool the call recipient into thinking that they are in trouble,and that the call recipient is trying to fool the scammers intothinking that they can be duped - is a peculiarity of this genrethat complicates understanding the operation of the calls asactual attempts at crime.

The scam is simulating a business phone call, a genre thathas been studied by systemic functional linguists such asFairclough [15] and Ventola [16]. All language interactions aresocial in nature, including service interactions such as phonecalls from bureaucratic offices such as the IRS. Though inthese calls, both sides (or the various callers, as the illustrativesample included 3 conversants) are aware that the serviceinteraction here is being simulated, the sides still participate init as if it were the interaction it purports to be.

Data from the sample have been put in table form, turns arenumbered and the time of the turn onset is noted. Latching -starting one turn directly at the end of another with no pause -is indicated with //, and single / indicates a rough phoneticinscription such as in Wha/du/ I do. :: indicates an extendedsound, (.) indicates a pause briefer than one second, and (#)indicates roughly how many seconds a pause extends.

TABLE I. TURN-TAKING IN THE ILLUSTRATIVE SAMPLE, PART 1

Speaker A Speaker B

1:58 21 Oh my go::d//

1:59 22 //If you are //

2:00 23 // Wha/du/ I do::?

2:01 24 I (3) Sorry?

2:04 25 What/du/ I do about it?

2:06 26(2) Miss - at thistime?

2:12 27

2:14 28my hand.(1)

2:21 29 OK //

2:22 30// If you want, if you have a really good intention of resolvingthis matter, then I have to talk to my senior supervisor if he cangive you a chance, //

2:30 31 // OK! //

2:31 32 //but I cannot assure you on this.

2:32 33 //OK?// // OK::

2:33 34If you can get me your seniorsupervisor that would be great.

2:36 35(2) -, assuring you that he willgonna give you a chance I have to talk to him about this first.

2:44 36 OK, thank you.

2:46 37(1) Miss Barrett, if he gives you chance do you have this kind ofamount to, come with

2:53 38 (2) What? (abruptly, surprised)

2:54 39 If he gives you chance, do you have this kind of amount //

2:57 40 // Oh, ye::s! //

2:58 41 // Or this many

2:59 42

3:02 43 please hold the line.

Later on speaker C, the purported supervisor of speaker A, comes on the line; speaker A never appears again in the conversationand the rest of the call is between speaker B, the target, and speaker C, looking something like this:

TABLE II. TURN-TAKING IN THE ILLUSTRATIVE SAMPLE, PART 2

3:25 50

3:30 51 OK.

3:31 52-, they just only

accept the cash, so you have to go to your bank first, need to withdraw themoney, and then you have to go to the store, to purchase this tax payvouchers. Allright?

3:47 53OK great an who do I send them to

address so I can, write this //

54 // (.) //

3:51 55 //down

56 // get that information to you step by step

3:53 57 OK

3:53 58it will take a step at a time, you will be getting all those information step bystep, all right? //

3:58 59 // OK.

3:59 60So now, you have to leave right away, so that I can go in, once you leaveyour home, I can go in, send a email to the detective, to go to put a hold on

4:11 61 // Oh, thank y- // // All right? //

4:12 62

// Thank you so much, and now, if, once I

give me, um, your address so I can sendthe tax voucher to because,//

4:19 63 // um //

IV. FINDINGS

A. Polar tag questions

The use of a polar tag question is when someone ends aconversational turn (not a sentence, but a turn) with a yes/noquestion. As it turns out, research has been done on polar tagquestions: answers are preferred over no answer, agreement ispreferred over disagreement, and answers that accept the termsof the question are preferred over answers that resist 1 .

1 From

are preferred over non-answer responses (Clayman, 2002; Stivers andRobinson, 2006); confirmations are preferred over disconfirmations (Heritage,1984); answers which accept the terms of the question, and accept reducedagency over them, are preferred over those that resist either of thesedimensions (Raymond, 2003; Heritage, forthcoming; Stivers, forthcoming;

normal process of language to respond that way. Phonescammers use noticeably more polar tag questions than mostconversation. This may also be a feature of any coercive

this occurs in the sample.

When the target, speaker B, asks questions, she is askingprimarily informational questions.

Stivers and Hayashi, 2010). All of these more fitted responses are typically

quickly than the alternative, without mitigation and without accounts(Heritage, 1984; Pomerantz,

TABLE III. TYPES OF QUESTIONS OVERALL FROM SPEAKER B

Tag questions 2

Informational questions 21

Falling rather than rising intonation statement,yet phrased as a question 1

Rhetorical questions 0

Asdifferent modes of questioning indicate the relationship thatexists between the questioner and the respondent (intimacy,

supplicant, begging for information.

Speaker C, on the other hand, primarily seeks agreementthrough his questions:

TABLE IV. TYPES OF QUESTIONS OVERALL FROM SPEAKER C

Tag questions 7

Informational questions 5

Falling rather than rising intonation statement,

yet phrased as a question 3

Rhetorical questions 1

Other samples gathered use polar tag questions to garner

terms of the question. This sample had fewer polar tagquestions than any of the others I gathered. Other samplesshowed scammers using anywhere from 9 to 33 polar tagquestions during the conversation.

indicates that he is seeking 1) responses, 2) affirmativeresponses, and 3) responses that accept the terms of hisstatements.

In this way he is drawing speaker B into the terms of thesituation in which she now purportedly finds herself. Theconversational pressure is on her to agree, and to agreeaccepting his statements. Anything else introduces discord intoa situation which critical discourse analysis illustrates has beenset up as socially disadvantageous for her: he is representing apowerful government office and she has a serious legalproblem.

for it. Rhetorical quesinformation channel and stress the social relationships

opposite of informational questions. I would argue that speakermarily as rhetorical,

creating an obligation in speaker B to respond positively if at

used as much to keep the floor as to elicit response.Athanasiadou adds that in the other two types of questions,interrogation and exam questions, the stress again is on the

while constantly requiring response and agreement.

B. Topic control

Controlling the topic and the floor - what is said and whogets to talk - is a classic power play identified byconversational discourse analysis.

The next topic, question deferral, is related to topic controland you saw it in the sample above between Speaker B andSpeaker C. Speaker B wishes to move ahead just one step inthe narrative - to know how to address the payment she mustsend - but Speaker C refuses to give that information andrefuses to let her move ahead in the series of future steps thatshe must follow. Critical discourse analysis highlights Speaker

be answered - all answers are deferred to some future momentwhich has not happened yet, and the deferment is controlled bySpeaker C. In this way Speaker C will not permit Speaker B totake control of the topic or the floor. One can see through thisseries of turns that Speaker B attempts not only to askquestions, and thereby control the topic, but even to speak. Sheand Speaker C are wrestling for control of the floor throughoutthis section, interrupting each other throughout.

For a closer analysis look at turn 60. Speaker C issues

interrupted her affirmative response looking for an affirmativeresponse, speaker B attempts a topic redirect, starting with a

effectively latching on to her own turn so as to retain the floorwhen she adds

63.

Speaker A, the first speaker, had a topic that was, in asense, built in. She answered the phone when the target calledher and informed the target that she had a legal problembecause of her taxes. If you look at the first sample above, younotice that Speaker A actually leaves rather long silences, up totwo seconds or even more. She is leaving topic gaps waitingfor Speaker B, the target, to introduce a new topic, like perhapspaying the bill.

Speaker C never leaves a gap. His part of the conversationis filled with much more latching, and absolute topic control.

C. Question deferral

Perhaps a more unique signature of phonehacking/scamming attempts is the deferral of answeringquestions. In this sample we can see one of the speakers(speaker C) refuses to answer any questions and repeatedlydefers answering them until some future time. Or he may justignore the question. Deferring answering questions is not afeature of everyday conversation and may be one of the keyways one can tell that one is being manipulated. As discussed

above, a question creates requirements in a conversation, at thevery least some sort of expectation of response. Speaker C doesnot answer questions. Research indicates that it is difficult toquantitatively differentiate between different types ofinstitutional conversations, but one can do so based onqualitative assessment such as noting distinctive turn-takingsystems - even institutional language rarely has distinctiveturn-taking [19]. It is rare that questions are deferred and itoccurs only in situations like a formal meeting, where there arerules regarding when questions may be submitted or ignored.

TABLE V. SPEAKER B INFORMATIONAL QUESTIONS ANDSPEAKER C RESPONSES

who do I send them to deflected to future deflected to future

um, your address deflected to futureso can you interruptedcan you let me know what I do deflectedshould I just come home and call you deflectedwho to send this to would you deflected to futurewhere do I mail this deflected to futuredo I mail it to the IRS deflected to futureAre you ready? responds with a questionare you ready? [2nd occurrence] responds with a questiondo you want me to put you

deflected to futurewhich Winn Dixie do you want me to go to? deflected to future

? ignoredAre you gonna hold? Answe

formative text on social discourse where he points out(following the work of Elliot Mishler on medical interviewing)that in fact questions have THREE parts: the question, theanswer, and the (often implied) acceptance of the answer. Notonly does Speaker C deny Speaker B answers, by simplydeflecting her questions to some future moment or ignoringthem, he does not allow her the opportunity to reject or accepthis answers. In this way he disallows the implied third part of aquestion and cuts it short.

Does this happen to you in everyday conversation? Would

social connection between doctors who did not appropriatelyprovide acceptance of an answer from a patient, as well as, ofcourse, the alienating effect of a doctor not answering aquestion from a patient. It is illustrative of the coercive natureof the phone call that one can easily see here that it is no longereven attempting to simulate a service call such as one mightfind in any bureaucratic situation, but instead is simply aconversational trap with no way out for the target.

D. Violations of narrative structure

I will end by quickly mentioning that narrative analysisidentifies in any story multiple phases that follow in a

predictable order. William Labov [20] in 19672 defined a well-formed narrative sequence as follows:

1. Abstract: What is the story about?

2. Orientation: Who, when where, how?

3. Complicating action: Delays resolution, adds suspense...

4. Evaluation: Who's the hero? Who's the bad guy?

5. Result / Resolution: What happened in the end?

6. Coda "And that's why I can never go back there again."

Witness statements and confessions can be analyzed asfollowing or breaking this sequence, which often revealsinteresting places to focus investigation.

In the samples discussed here, the flow switches from an

straight into an emergency that is happe

sense of urgency in the target.

The shift can occur together with a shift in speaker, andseveral of the calls include at least two scamming speakers.The first speaker sets up an odd narrative, if you think about it:

leave topic space open, though, for the target to introduce anew topic such as paying the bill.

Once the topic of paying is introduced the target is usuallyshifted to another scammer who has an entirely different

past, as the first caller indicated, it would be over. Thescamme -tense

now, and can be resolved right now but only if the targetfollows all the instructions.

There are no instructions in a narrative sequence (except. A narrative is a

demand for an extremely long conversational turn where thespeaker narrates and the listener listens. These calls are all set

have occurred in the past. You did not pay your taxes correctly.A warrant has been issued for your arrest. You did not receive

The narrative structuresimply stops. Only a statement about what will happen in the

timeframes are given, like within the next ten to thirty minutes.Lo

malformed narrative.

Bureaucratic interactions need not involve narrative, ofcourse; but when they do they are complete narratives. Imaginea conversation where you are trying to return a purchase but

2 Many scholars since have followed and refined his work, perhaps mostnotably C. Kohler Riessman [21].

orientareceipt. (Further complicating action) I know I had it in my

thoug

to return

expect to carry out the interaction as a dialogue. You may offerthe narrative as part of the conversation. You will not offer justthe first

If our staff were oriented to this type of question, they

narrative that is malformed. They could also be trained, aspolice have been trained, to ask questions that fill in the

notifying me of a tax mistake to issuing a warrant for myarrest. How do the IRS and the police

whole, and ask the person to tell the whole story again from the

done and there is nothing I can do abou

receive. You can easily imagine that the coercive nature of thescam requires whatever emergency situation is being simulatedto be the result of actions that are over and unchangeable, butto have an effect that is immediate and present. Having targetsstop and think about whether the story makes sense may beenough to simply derail the conversation, as the effect of phonescams often require that the target not feel that they have timeto stop and think. (At a CISO conference in April we heard aphone sca , this

V. CONCLUSION

Humans are unreliable detectors of deception but theyrepresent too large an attack surface for us to simply give up onsecuring the human. I suggest that new forms of securitytraining could orient members of our various organizationalcommunities to the language features of phone scams and helpthem detect when an attack is occurring. Forensic linguistics,widely used in courts and law enforcement for the last thirtyyears for many purposes, can identify language features thatcannot be simply discarded by an attacker because languagerequires certain operational mechanisms in order to work theway that we expect. We cannot simply arbitrarily change therules of language to suit our purposes. Polar tag questions,

question deferral, topic control, and malformed narrativesequences seem to be features of coercive phone scams worthfurther statistical investigation; but they are also worth thefocus of training efforts to help members of our organizationresist interactive phone hacking and reinforce cybersecurity.

REFERENCES

[1] tiveness in theJournal of Law & Policy, vol. 21, no.

2, pp. 467 494, Mar. 2013.

[2] R. W. Shuy, Language crimes: the use and abuse of language evidencein the courtroom, Repr. Oxford: Blackwell, 1996.

[3] inguistics: Applying the Scientific Principles

Humanities, vol. 3, no. 7, 2006.

[4] TheEncyclopedia of Applied Linguistics, 2012.

[5]46, 2011.

[6]approach to stance in threateningJournal of Speech Language and the Law, vol. 17, no. 2, pp. 299 302,2010.

[7] M. A. K. Halliday, Language as social semiotic. London: Arnold, 1978.

[8] B. G. Glaser, Emergence vs forcing: Basics of grounded theory analysis.Sociology Press, 1992.

[9] B. G. Glaser and A. L. Strauss, The discovery of grounded theory:Strategies for qualitative research. Transaction Publishers, 2009.

[10] K. Charmaz, Constructing grounded theory. Sage, 2014.

[11] WSJBlogs - Total Return, 17-Mar-2015.

[12]Forbes, 18-Oct-2015.

[13] -Oct-2013. [Online].Available: https://www.irs.gov/uac/Newsroom/IRS-Warns-of-Pervasive-Telephone-Scam.

[14] J. M. Swales, Genre analysis: English in academic and researchsettings, 13. printing. Cambridge: Cambridge Univ. Press, 1990.

[15] N. Fairclough, Discourse and Social Change. Polity Press, 1992.

[16] E. Ventola, The structure of social interaction: A systemic approach tothe semiotics of service encounters. Pinter Pub Ltd, 1987.

[17] response system in AmericanJournal of Pragmatics, vol. 42, no. 10, pp. 2772

2781, Oct. 2010.

[18] Pragmatics,vol. 1, no. 1, pp. 107 122, 1991.

[19] Handbookof language and social interaction, K. L. Fitch and R. E. Sanders, Eds.New York: Psychology Press, 2014.

[20]

[21] C. K. Riessman, Narrative analysis. Newbury Park, CA: SagePublications, 1993.