John Sabo
Plain-English guide · 2026

How the phone scams work.

A scam call is not one person. It is a supply chain. Someone sells a list, someone dials, someone answers, someone closes, someone takes the payment. The person who called you is usually the cheapest part of the whole thing.

5 scam types 8 roles 7 steps from call to cash every claim cited
01 / The cast

Eight roles. One machine.

Most people think a scam is a criminal and a phone. It is more like a company with contractors. Each role is paid a slice, and each slice is a place where a lawyer or a regulator can pull the thread.[S1]

Role 01

The lead seller

Sells a list of phone numbers, or sells a live call from a person who is already on the line. Public price sheets put debt-relief live transfers at $35 to $130, and LeadsRefer advertises $41.25 for a qualified debt-relief call.[S2]

Role 02

The dialer

A machine that calls thousands of numbers an hour. It plays a recorded or AI voice, or waits for a person to answer. The dialer is the part that makes the call illegal under the TCPA when there is no consent.[S18]

Role 03

The carrier

The pipe that connects the call. For a toll-free number, the called party pays the carrier, usually by the minute. The carrier is paid for the traffic, not for the scam.[S6]

Role 04

The storefront

The 1-8xx callback number in the message. It looks like a business line. In the campaign we studied, the callback often never answers. It is a display or tracking number, not a working front desk.[S18]

Role 05

The call center

The people who answer when someone calls back or presses a key. They read a script, qualify the victim, and hand the call to a closer. The center can be in Karachi, Noida, Bengaluru, Manila or anywhere with English speakers and cheap phone lines.[S1]

Role 06

The closer

The person who gets the card number, the bank details or the crypto transfer. The closer is often paid on commission, and the commission is the largest slice of the victim's money.[S3]

Role 07

The payment rail

The merchant account, processor or crypto wallet that takes the money. A processor that ignores what its merchant is selling can be reached under the FTC's substantial-assistance rule. Nuvei paid $4.85 million in 2026 over exactly that.[S21]

Role 08

The owner

The person or family behind the brands, the shell companies and the bank accounts. This is the hardest role to name from the outside, and the one a subpoena is for.[S1]

02 / The chain

How a call becomes money.

Read this once and the rest of the report is easier. The same seven steps run under every scam type. Only the script and the price change.[S1][S5]

01
A listNumbers bought, scraped or generated.
02
A dialerThousands of calls an hour.
03
A fake IDThe call looks local or toll-free.
04
A messageA recorded or AI voice leaves a hook.
05
A callbackThe victim calls the 1-8xx number.
06
A transferThe call center sells the live call.
07
A paymentThe closer takes the money.

The order can vary. Some operations transfer the call on the outbound leg, before the victim ever dials the callback. The callback is often a storefront, not the front door.[S18]

03 / The playbooks

Five scams, five scripts, one supply chain.

Each playbook below uses the same structure: what you hear, the pieces required, how the money moves, what the public record shows, and what evidence to keep. The illustrations are original editorial artwork, not screenshots.[S1]

Editorial illustration of a tech-support scam: a fake virus warning, a phone line to a call center, and a card payment.
Playbook 1. Tech support. Illustration, not a real screenshot.
Playbook 01

Tech support: the fake virus

What you hear. A pop-up says your computer is infected. A number is provided. The person who answers says they are from Microsoft, Apple or Amazon, asks you to install remote-access software, then "finds" a serious problem and charges hundreds of dollars to fix it.[S22]

The pieces. A pop-up ad or a phone list, a call center, remote-access software, a card payment, and a processor willing to take the charge. The FTC's 2023 case against Nexway describes a processor that handled tens of millions of dollars in charges for offshore tech-support scammers. Paddle and Restoro/Reimage settled similar cases.[S21]

Follow the money. The victim pays by card. The processor keeps a fee, the call center keeps a share, and the operator keeps the rest. The card charge is the paper trail, and the processor's merchant file is the evidence.[S21]

What the record shows. Nexway and two individuals, Victor Iezuitov and Casey Potenzone, agreed to a $16.5 million judgment, mostly suspended. Paddle settled in June 2025. Restoro and Reimage settled in March 2024. FirstIdea Infotech in Noida and MUSK Communications in Bengaluru were raided in 2025.[S21][S22]

Evidence to keep. The pop-up URL, the callback number, the call recording, the remote-session log, the card statement, and the merchant descriptor.[S23]

Editorial illustration of a debt-relief robocall: a phone, a stack of bills, and a shadowy hand reaching out of the receiver.
Playbook 2. Debt relief. Illustration, not a real screenshot.
Playbook 02

Debt relief: the fake pre-approval

What you hear. "Good morning, Sarah Thompson calling from Iron View Financial. I work in underwriting. TransUnion and Equifax finished their update, and your file came back with a pre-approval for a $41,265 hardship personal loan. No hard credit check. Same day funding." The brand and the rep name change. The script does not.[S18]

The pieces. A list, a dialer, an AI or scripted voice, a 1-8xx callback, a carrier, a call center, a closer and a payment processor. The 31 toll-free lines sit on five US RespOrgs: Excel Telecommunications (12), Telnyx (9), Inteliquent (5), thinQ (4) and Pestilence Labs (1).[S6]

Follow the money. The call is the product. A live transfer sells for $35 to $130. A qualified debt-relief call is advertised at $41.25. The closer sells a debt-relief program or a fake loan, and the fee is split across the chain.[S2]

What the record shows. The Better Debt Solutions family is named in 19 federal TCPA dockets and MDL No. 3123. The Minnesota Department of Commerce entered a final consent order on 2024-10-03. The public record supports 33 candidate numbers, not the 200 some assume. One campaign callback, 833-684-5548, carries 111 FTC complaints; the complaint volume otherwise sits on the rotating caller IDs.[S1][S4]

Evidence to keep. The voicemail audio and transcript, the callback number, the caller ID, the date and time, the carrier call record, and the bank or card statement if money moved.[S23]

Editorial illustration of a Medicare phone scam: a phone, insurance paperwork, a stethoscope, and a call-center silhouette.
Playbook 3. Medicare and final expense. Illustration, not a real screenshot.
Playbook 03

Medicare and final expense: the government program

What you hear. "There is a new government program for your zip code." Or "your final-expense benefit is about to expire." The caller asks for your Medicare number, your date of birth, or a payment to lock in the benefit.[S15]

The pieces. A lead seller, a call center, a licensed or unlicensed broker, a carrier, and a payment rail. In this vertical the lead-broker layer is the biggest: 30 of the 55 health-insurance actors in the register are lead generators or brokers.[S5]

Follow the money. The lead is sold to a broker or agency, the enrollment generates a commission, and the call center is paid per enrollment or per transfer. The victim may never know which company actually sold the policy.[S16]

What the record shows. Simple Health and Steven Dorfman were hit with a $195 million judgment and a permanent telemarketing ban in February 2024. Assurance IQ and MediaAlpha paid $145 million in August 2025. The DOJ sued eHealth, SelectQuote and GoHealth in May 2025 over kickbacks and lead routing. The HIMS case in Karachi is charged with $703.8 million in Medicare claims.[S15][S16][S24][S14]

Evidence to keep. The enrollment documents, the call recording, the policy number, the commission statement if you can get it, and the bank or card record.[S23]

Editorial illustration of an auto-warranty robocall: a car dashboard at night, a ringing phone, and a fake warranty letter.
Playbook 4. Auto warranty and solar. Illustration, not a real screenshot.
Playbook 04

Auto warranty and solar: the expiring benefit

What you hear. "Your vehicle's warranty is about to expire." Or "your home qualifies for a new solar program." The caller reads a partial VIN or an address, which makes the call sound official. Then comes the pressure to pay today.[S17]

The pieces. A dialer, a fake warranty letter or a solar lead form, a call center, a payment rail, and a carrier. The FCC's auto-warranty case identified eight US providers carrying the traffic: Call Pipe, Fugle Telecom, Geist Telecom, Global Lynks, Mobi Telecom, SipKonnect, South Dakota Telecom and Virtual Telecom.[S17]

Follow the money. The victim pays a fee for a warranty that may not exist. The call center and the lead seller take a share, and the payment processor takes a fee. The FCC assessed a $299,997,000 forfeiture against the Sumco Panama enterprise in 2023.[S17]

What the record shows. CarShield paid $10 million in 2024. The Sumco enterprise was the target of the FCC's forfeiture. The vertical is smaller in the register, 17 actor memberships, but the infrastructure is the same carrier and payment layer.[S17][S25]

Evidence to keep. The mailer or letter, the call recording, the contract, the payment record, and the caller ID.[S23]

Editorial illustration of a pig-butchering romance and crypto scam: a phone chat, a crypto wallet, a heart-shaped lure, and an offshore compound.
Playbook 5. Crypto and romance. Illustration, not a real screenshot.
Playbook 05

Crypto and romance: the long con

What you hear. A wrong number, a dating match or a friendly message. Weeks of conversation. Then a "once in a lifetime" investment platform, a small withdrawal that works, and a request for more. The victim watches a fake balance grow and cannot withdraw it.[S26]

The pieces. A chat script, a fake trading platform, a crypto wallet, a network of money mules, and an offshore compound. The phone is only the first contact. The money leaves through crypto or a US shell company.[S26]

Follow the money. The victim sends crypto or wires dollars to a mule account. The platform shows a fake balance. The money is moved through exchanges, over-the-counter desks and shell companies. The US laundering tier in the register moved $36.9 million through US shell companies and banks into USDT.[S26]

What the record shows. Prince Group and Chen Zhi were designated by OFAC, with a forfeiture of about $15 billion. The Shunda and Tai Chang compound managers were charged, with more than $700 million restrained. The SEC brought its first pig-butchering cases against NanoBit and CoinW6. Huione Group was cut off by FinCEN under Section 311.[S26][S27][S28]

Evidence to keep. The chat logs, the platform URL, the wallet addresses, the transaction hashes, the bank wires, and the fake balance screenshots.[S23]

04 / The number problem

Why the numbers rotate, and why the callback does not answer.

People assume a number with a thousand complaints must belong to a big company. The data says the opposite. In the debt-relief pool, 95 percent of the numbers were reported only once. The campaign burns a number and moves on before the complaints pile up.[S4]

The client's own recordings add a detail the complaint data cannot show. The callback number in the voicemail never answered. It rang out, every time. The voice sounded like a white American English speaker, consistent with an AI voice or a US-trained front. The transfer, if it happens, happens on the outbound call, not on the callback.[S18]

The honest count

33, not 200

The public record supports 33 Better Debt candidate numbers: nine multi-cluster numbers in the FCC graph and 24 transcript-linked voicemail lines. The largest pools are 216, 198, 116 and 113 numbers. Two match a named FCC campaign, but the per-number subscriber is still unknown. A cluster is not an actor.[S4][S29]

The pattern

0 to 2 complaints

The campaign's own callback lines carry 0 to 2 FCC complaints each. The complaint volume sits on the outbound caller IDs, not the callback. That is why complaint count is a poor way to find the operator.[S4]

05 / The carrier

Why the carrier gets paid either way.

A toll-free call is not free. The called party pays the carrier to connect it. The carrier is paid by the minute, so it does not need the scam to succeed. It only needs the call to happen.[S6]

Estimated split of 1,000 dollars of victim money across closer, operator, carrier, lead generator, broker and processor.
Figure 3. Illustrative split of $1,000. The carrier slice is smaller than the closer's, but it is the one that makes the call reach the victim. Assumptions and public price sources are in the caption on the summary page.

This is also why the legal line is narrow. A carrier that only carries the call is not a private TCPA defendant. The private right of action reaches the party that makes or initiates the call. The carrier is a regulator target and a subpoena route. The FTC's substantial-assistance rule and the FCC's gateway rules are the tools that reach the carrier's own conduct.[S7][S8][S9][S10][S11][S12]

06 / What can be done

Four moves, in order.

Move 01

Preserve the evidence

Keep the original voicemail audio, not just a transcript. Export the call log and texts. Hash the files. Write a short declaration. A phone dump is not automatically hearsay, but authentication is the real gate.[S23]

Move 02

Subpoena the carrier

Ask the RespOrg or gateway for the subscriber of record, the port history, the call detail records and the billing file. The carrier is not the caller, but it is the only way to name the caller.[S6]

Move 03

File the regulator lane

File with the FCC, the FTC, your state attorney general, and the Anti-Robocall Task Force. The Task Force is already investigating Inteliquent and Telcast. The NCCIA handles the Karachi call centers.[S9][S10][S11]

Move 04

Join the class, not a solo suit

Nineteen TCPA dockets are already open against the Better Debt family, and MDL 3123 was denied centralization. A solo small-claims case caps at $5,000 in Arizona. The class route is where the statutory damages and the discovery live.[S19]

Sources

Where each claim comes from.

The full register has a source on every row. These are the sources used on this page.

  1. [S1]Master actor register (375 actors, 152 entities, 223 edges). actors.csv. citable / lead per row
  2. [S2]Lead and live-transfer prices. LeadsRefer, HyperTarget, SalesPromis public pages. LeadsRefer. lead
  3. [S3]Edge register. edges.csv. citable / lead per row
  4. [S4]Number-to-actor clusters. 170,260 FCC rows, 86,963 8xx numbers, 4,383 pools, 33 Better Debt candidates. FCC corpus; number-clusters.csv. citable for FCC rows
  5. [S5]Actor clusters by scheme type. actor-clusters.csv. inference from the register
  6. [S6]Carrier and RespOrg map. Somos; org-map.csv. citable registry fact
  7. [S7]FTC cease-and-desist to Telcast, 2023-03-17. ftc.gov PDF. citable
  8. [S8]FTC cease-and-desist to Peerless, 2023-03-17. ftc.gov PDF. citable
  9. [S9]Task Force notice to Peerless, 2025-12-03, 5,662 tracebacks. ag.hawaii.gov PDF. citable
  10. [S10]Task Force second-and-final notice to Telcast, April 2025. ncdoj.gov PDF. citable
  11. [S11]FTC warning to Inteliquent, 2022-05-10; Task Force notice, 2025-12-03, 9,712 tracebacks. FTC; nmdoj.gov PDF. citable
  12. [S12]FCC cease-and-desist to thinQ, 2022-03-22. fcc.gov. citable
  13. [S13]US v. Augustinsky, E.D. Va. 2:25-cr-97, convicted 2026-07-21. justice.gov. citable
  14. [S14]US v. Charolia et al., N.D. Ill. 1:25-cr-00304, $703.8M Medicare claims. justice.gov. citable
  15. [S15]FTC v. Simple Health, $195M, 2024-02-09. ftc.gov. citable
  16. [S16]FTC, Assurance IQ and MediaAlpha, $145M, 2025-08-07. ftc.gov. citable
  17. [S17]FCC auto-warranty order and Sumco forfeiture, 2023-08-03. fcc.gov. citable
  18. [S18]Script fingerprints and client observations. script-fingerprints.csv. citable as the client's record; lead for pattern
  19. [S19]Class-action and counsel map. class-action-map.csv. citable / lead per row
  20. [S20]Case records and unadjudicated actors. case-evidence.csv. citable / lead per row
  21. [S21]FTC v. Nexway, $16.5M judgment, 2024; Paddle settlement, June 2025; Restoro/Reimage settlement, March 2024. FTC Nexway. citable
  22. [S22]Tech-support and government-imposter record. FirstIdea Infotech (CBI, July 2025), MUSK Communications (Bengaluru, August 2025), American Tax Service. tech-gov.csv. citable / lead per row
  23. [S23]Phone-evidence memo and collection SOP. Authentication, hearsay, hash and declaration. professional report, evidence section. practice guidance, not legal advice
  24. [S24]DOJ v. eHealth, SelectQuote and GoHealth, D. Mass., May 2025. justice.gov. citable, not adjudicated
  25. [S25]CarShield, $10M, July 2024. ftc.gov. citable
  26. [S26]Crypto and romance record. Prince Group OFAC designation; Shunda/Tai Chang; US laundering tier; NanoBit; CoinW6; Huione. crypto-romance.csv. citable / lead per row
  27. [S27]SEC v. NanoBit and related pig-butchering cases. sec.gov. citable
  28. [S28]FinCEN Section 311 action against Huione Group, 2025. fincen.gov. citable
  29. [S29]FCC cease-and-desist letter to Alliant Financial, EB-TCD-23-00035896, 2024-05-20. Names the company and Mohammad Hossain; reports the Main Street and One Street campaigns. fcc.gov. citable

A name in a complaint is a lead, not a finding. This page does not assert liability against any person or entity. The status of every actor is recorded in the register.