These are patterns of behaviour, not personality types or diagnoses of people. Scenarios are hypothetical learning examples, not real incidents. Research and source-review limits are preserved from the dated Hebrew original.
What happens
Several actors, such as a representative, courier and manager, follow one script while someone directs them behind the scenes.
Warning sign
Different people answering in the same words, or an offer of "easy money" for moving funds or packages.
Safer action
Ask each person something the shared script does not cover, and record numbers, names and times.
Hypothetical illustration: three people, one voice
First a "representative" calls. Then a courier collects a package or documents. That evening a "manager" confirms everything is handled. Three people, three numbers, and one thing in common: they answer the same questions in the same words. Behind the scenes is someone who never spoke to the victim, but wrote the script, recruited the actors and assigned their roles.
How the pattern works
The Operator divides work: approaching the victim, collection, moving money and sometimes laundering it. The Police Foundation report identified coordinating cores with peripheral service providers and money movers. In some cases, those involved acted separately. The report does not describe a fixed hierarchy [2].
From an investigator's perspective
The Utica study also recorded a role of "directing the activities of others" in groups [3]. Map who gave instructions, when contact began and where money went. Do not assume a peripheral person does not know the operator or understand what they are doing.
Possible explanations for the behaviour
This is a possible interpretation, not a diagnosis of a person. Where there is no evidence of thought or intent, these remain hypotheses.
Distance from a victim may help someone minimise their own responsibility. That is an investigative hypothesis, not a finding about every operator. Neutralisation techniques concern justifications such as denying responsibility or harm [8]. The fraud diamond offers a way to think about capability to recruit and direct others [7], but does not prove how a particular person experiences their role.
What research shows
- Fraud can be teamwork: 42.4% of the 517 Utica identity-theft cases, 219 cases, involved two or more offenders, ranging from 2 to 45. The report calls this organised group activity [3].
- Division of roles: 25 serious UK fraud investigations identified 104 people. Twelve investigations identified two or more associates; nine more involved suspected associates. Many had defined roles, including sales, couriers and money laundering [2].
- Peripheral roles: the report describes money mules as more easily replaceable front-line links, alongside coordinators and professional service providers [2]. This does not mean every front-line worker is equally replaceable.
What the research cannot tell us
Most Utica cases, 57.6%, still involved a single offender [3]. Not every scam is an organisation. These samples use detected cases, and groups may be easier or harder to catch; there is no neutral measurement. Not every peripheral actor is innocent: some knew, some suspected and some were exploited. It is a factual distinction, case by case.
What to do
- Several people, such as a representative, courier and manager, are a signal to ask each a question the shared script does not cover.
- An offer of "easy money" for moving funds or receiving packages recruits you to the peripheral role: the one that can be replaced and bears the cost.
- Record numbers, names and times. The actors change; the pattern repeats.