← All talks

So you wanna be a baiter. - Wayne May

BSides Bournemouth30:1356 viewsPublished 2025-09Watch on YouTube ↗
About this talk
🎀 Talk Title: So you wanna be a baiter. πŸ‘€ Speaker: Wayne May πŸ“ Abstract: You've likely heard about scambaiting on TV. Maybe you've always wanted to have a go but not known where to start. In this talk, Wayne May will discuss how to bait both safely and ethically. It will show the easiest ways to find scammer email addresses and phone numbers as well as talk you through how to communicate with the scammer based on his 20 years experience as both a scambaiter and member of the antiscam community. The talk ends with a display of several photos of scammers in funny situations as well as snippets of a few of the more ridiculous calls made to them, including the worst singing scammer ever and "The Pope" praying for a talking hamster. βš“ This talk was recorded live at BSides Bournemouth 2025 on 16th August 2025 β€” a community-driven cybersecurity conference bringing together researchers, practitioners, and enthusiasts to share knowledge, skills, and ideas. 🌐 Learn more: https://bsides-bournemouth.org/ πŸ’Ό Connect with us: https://www.linkedin.com/company/bsid... πŸ“Ί Stay tuned for more talks from the event, and don’t forget to subscribe for updates!
Show transcript [en]

There are two versions of it. There's one when I have Houdini the talking hamster uh which is basically a beta with a voice morpher pretending to be a talking hamster. Um talking to a scammer who we think is the the pope. But there's also another one where I pretend to shoot my wife. From that reaction, ignore that. We're going to go with the shooting my wife one. Okay. Some some some places are a bit Oh, you know, we don't really want to. >> How many months have you shot your wife now? >> Oh, lots. >> Yeah. I mean, I shot the same wife twice in a month. >> She's a good sport. >> Yeah. It's not my actual wife. It's uh

someone else from my site um who lives in Europe, so there's no gun that I could use for that. So, let's Okay, so we have here. Say, "You want to be a beta?" My name is My name isn't Wayne May. Um, I use the name Wayne May because what we do attracts things like death threats and lots of DOS attacks and so on. So, I use the name Wayne May. To all intents and purposes, I am Wayne May. I don't even have a real account of my own online anymore. >> Can I suggest the name Wayne King? >> I did think about it. It mean like um if you're a really good beta, you're a

master beta. That's the joke you're going for. So, how many people know what a scam baiter is? Yeah, one person, two people. Yeah, a couple of you. If you're not aware, basically when you receive an email from a scammer, most people will delete it or tell them to go shove it where the sun don't shine. A bait will go really $10 million for me and play them along. Mess about with them, waste their time, waste their resources. They will then get as much information as they can from the scammer, post that up online. There are two kinds of baiters. There's um your um tra let me try again. There's your trophy baiters who do things like get

them to do silly things and then there are straight baiters who just get the information. Both are as important as each other. They're just two sides of the same coin. So if you want to be a baiter, number one rule, always bait safe. When we start off, never use anything that can be tra uh traced back to you or your real life details. Hence Wayne may keep records if you want to um start doing it because if a scammer asks you a question, you're going to want to give the right answer. So make notes as you go along, you get better at it. You won't need to. So don't worry too much about it if you've done it for a while.

But to start with, make notes, keep them at the side of you, especially if you're going to speak to a scammer in real time. Very, very handy. Then if you do slip up, kill the bait. You can always rebait them again further down the line. Use a different email address, different name. You'd have learned from your mistakes and hopefully do it right the next time. So the dos and don'ts. First of all, do bait for the right reasons. This is essential. Do not bait because the scammers are in a different country, are a different skin color to you, speak a different language to you, have a different religion to you. If you are found to be racist on any

self-respecting anti-cam site, you will be kicked off very very quickly and with great joy in my case. No, we do not want those kind of people there. We also don't want people who are doing it just for the glory, for the fame, for the money. Most people are just chipping away um unknown, but are doing an excellent job. You get the the people you see on YouTube, they are the 1%. Most of most of us are going to be in the 99%. I've been on TV a couple of times. I've been lucky enough, but uh most of the time we just doing it because we want to do it. work with other baiters to share

knowledge. Now, I've been doing this 20 years. Someone like um some of the younger people among you may just want to start know more about certain software, certain ideas. If we combine our ideas, combine our knowledge, we can all become better. And what we want is to be better than the scammers. So, work with other people. You may have a brilliant idea, but then you'll say to someone like me, for example, I thought we could do this. But when you actually tell it to me, I'll go, oh, we've done that. It doesn't work, and here's why. So, it's worth talking to other people, get their opinion as well. Post what you receive. You're going to mess with a

scammer. You're going to waste a bit of their time. That's it. You know, it's not really doing much damage. But if you post up their emails, you post up their email addresses, their phone numbers, scammers work on what are called scripts and or formats and they will use them time and again. So if you post them up and somebody gets one, does a bit of searching, they could find out that it's a scammer that causes them so much more harm than just having fun with them. And try out different scammer types as well. I spent seven years as a romance scam baiter, which you will see the results of later on. Um, but I tried a few other

ones. Didn't really fit with me. The moment I tried romance baiting, it just clicked. So, have a go. See, see what you like. See what you don't like. And let your imagination run wild. We have had scammers claim that they have a client who is an astronaut stuck on Mars in a hospital after being anally probed by Martians with a ruptured uterus. I should also point out that this was a male client. I have been part of NASA. I have been Cliff Richard and Joe Walsh's tour managers. I've been the father to a talking hamster. I've been a ghost. Whatever you can think of, go with it. And now the don'ts, this is the ethical

part of it. Don't give them anything that they can reuse. It's especially information. If you correct them or you say, you know, you are a scammer. I know you're a scammer and here's why. You're just making them a better scammer and we don't want that. Deeducate them. There is a scammer in Russia who thinks and I don't know how many of you will know this phrase total silence is a Welsh phrase which has no literal translation. It is if you stepped on some dog mucky go or if a child went to pick something up you go don't touch that it's there's a scammer in Russia that thinks that a means across the water and I will

show you that later too. Don't involve anybody else without their knowledge or permission. We call this the innocent third party rule. Just because your neighbor woke you up this morning at 6 um mowing his lawn. Don't give the scammer his number. Don't give the scam No, seriously, don't don't give him his uh his number, his address, anything. If somebody wants to be a part of the bait, let them be a part of the bait. If they don't want to be a part of the bait or unaware of the bait, don't involve them. Never get a scammer to send you money or goods. This used to be quite popular back in the early days, but then people

realized that the scammer wasn't sending you the money. They were getting somebody else to send you the money. So, it's not the scammer who's lost anything, it's another victim. And if they realize they've been scammed, they will then say, "Here's who I sent it to." And they've got your details. Uh we we call this cash baiting. and it is really frowned upon these days. Don't destroy anything the scammer didn't pay for. If they got a Gmail account, a Yahoo account, anything like that, don't kill it. Leave it be. Report it. Because if you kill it, all that information is gone and it might be in the middle of an investigation with law enforcement. If however the scammer has

bought a website or has a vanity in number or anything like this, kill them. And we do. We kill bank accounts. We kill websites. We get um phone numbers shut down. But only if they paid for it because if they paid for it, it's going to look more legitimate. And don't do anything illegal. And that definitely includes hacking. Weird to say this in a place where there's so much talk of hacking. The problem is you might be the greatest hacker in the world. You put up a YouTube video saying, "I hacked this scammer." Someone else will watch it and go, "Well, I could do that." And if they do it, they may completely mess it up. I have ended

up receiving uh viruses because somebody decided to hack a scammer. the scammer's email address book. It got sent out to all those and one of those people was somebody I was helping and it got sent out to everybody on her email account as well. So unless you 110% know what you're doing. Do not hack. I'm not saying I've never hacked, but you have to know how to do it to know why not to do it. Now, what tools do you need? actually very very simple. You need an internet connected device and a new email account or two. That is it. You can a laptop, a phone, a tablet. That's all you need. Provided they can

go on the internet, create an email account, you're you're up and away. That's it. What's nice to have but not essential is a way for the scammers to call you. Simplest way to do this is to get one of your old mobile phones, buy a cheap SIM, throw it in there, and you can give them the number. There are other ways to do it as well where you can actually use a VIP. Um, it's a bit more difficult these days. We used to use Skype a lot for this, but that obviously got shut down back in May. Oops. No, we're okay. Sorry, I jumped. I thought I jumped ahead. Um, a VPN is very nice. I do have a VPN, but if you

use a Gmail account, it hides your IP address anyway. So, you don't need a VPN to send an email to a scammer. And a sandbox. Sandboxes again are great. If you've got one, use it. What I usually do is if a scammer says, "Go to this site," I say, "I went on there and it kicked up an error message." Simple as that. He can't argue with me and say, "No, it doesn't. because as far as I'm concerned, yes, it does. Again, use one if you want, but there's no real need to get one. And then what's not needed is a fancy setup. You can dig out that old computer that's gathering dust in your cupboard, chuck a version of

Linux on it, and be up and away. I abated with computers that I bought for10. I abated with computers that I have spent too much money on. uh more money than the wife's notes I spent on it. But um either works exactly the same because all you're really doing is sending emails to and from a scammer. So where do we get the email addresses from the scammers? There are a couple of ways you can do it, but I will show you the absolute simplest way. Go to a website that's already got them. This is mycam survivors.com. And as you can see, every single one of these email addresses is already confirmed to be from a scammer. You're going to be able

to read the format on there. You see the reply to email. Everything is there. You know, if you write to these, they will reply to you and your email address will then get passed around and you start receiving more and more. When you get one, look at the email text. On this one, you can see it's got urgent attention, please. then the text of the email and on the bottom you can see the reply to write to the reply to just put re urgent attention please put the rest of the text in and then put your message as far as they're concerned they must have written to you because you've got all that information it's again really really simple

um as I say I spent seven years specializing in romance scammers So, I'll talk a bit about that for you now. First up, find a free dating site known to be full of scammers. Again, you can find them on our site. We'll often list the the websites that we found the scammers on. At the moment, there's a site called Waplog, which is crawling with them. Go on there and play a game, see how many you can spot. Uh, and you'll find it's actually quite easy. Then, choose your trap type and create your profile accordingly. three trap types. The honey trap, basically a picture of a good-looking person, very, very friendly text. The problem with that is you are going to

get genuine people contacting you as well. Not the one I use. Neutral trap. Maybe not a picture, a simple, hi, I'm new here. Why not say hello? Again, you are going to get some genuine people but you are going to get scammers. again. Then is my favorite, the vinegar trap. I have had one that said, um, loves to have sex with men, women, animals. My the end of an ideal first date would be sipping a glass of acid, watching the sunset over the seage works. And the scammers wrote to me two, three dozen a day saying how much they loved my profile. So, they're not reading it anyway. But if you put these in, no

genuine people are going to contact you. Then click on obvious scammer profiles, but let them make the first contact. Obvious scammer profiles are blondhaired, blue-eyed models living in Nigeria. Straight away if you see one of them 99.999% it's a scammer. Go through, as I say, try WAP blog. Go through them, look at the pictures, and you will see that picture is too good to be on a free dating site. So, that's what you do. Find them, click on their profile, but don't write to them. Let them make the first move because then you can't be accused of entrapment. Expect them to attempt to get you off the site as quickly as possible. They know that the site is going to kick them

off sooner rather than later. So, they will try to get you off saying, "Oh, that's the wrong word term, wouldn't it?" They will try to get you off the site sooner rather than later by saying, "Oh, you're my one love. I don't need to be on the site anymore. Let's go somewhere else." Uh maybe an instant message that I say they're doing this because they're going to get kicked off the site or they got competition from other scammers. So they are going to do do that. Don't be shocked when they do. And then fight the inevitable ick factor. When I did my first romance bait, I hated it. I had to pretend to fall in

love with someone who was really a guy pretending to be a female and giving me all these flowery messages. I wanted to scrub my eyes with bleach. But somebody said to me, "Well, if you felt that bad, you felt that uncomfortable, they had to pretend to be a female." And it was like, "Ding, I'm going to make them 10 times more uncomfortable than I felt." And that, if you read my early stuff, is why it's so gynec gynecological, so scatological. Uh quite frankly, I would never ever speak to a real female the way I speak to those fake females. Uh but yes, you can use that to your advantage down the line because once you

get over it, you can then start to push them. Uh, I'm not going to go into too much details about some of the stuff I did but back when I was first starting, I made a site called romancecam beta.com. Uh, it it was updated for a for a little while, then I moved on, but you can still see it and you'll see some of the messages that I wrote there. They are not for the faint-hearted. So, then you're going to start getting your replies. First thing, be patient. Don't rush. I had somebody come to me say, "I write to the scammers and they never reply back." First, well, what are you saying to them? All I'm saying, yes, I can work

with you, but first of all, you need to send me a video of yourself wearing a fish on your head, maracas in your hand, singing a macarina. Said, "Well, they've not spent any time or energy with you yet. Build up to it. And when you build up to it, they've invested more. They are more likely to do these kind of things. Keep your replies generic so you can reuse them. They are sending out scripts. You can send out your own scripts as well. But make it in such a way that you can use them for any of your scammers. Uh quite a popular one is, "Oh, really? I'm interested. Tell me more." That's all you need to say to them and

they will reply back to you. and then play dumb. The scammer might try to see if you know that they're a scammer by sneaking in a word or a term. If you see it, don't say, "Ha, you're a scammer. I know you're a scammer because you said this." Or, "You said this to me. What does it mean?" If you see it, ignore it. Make them try to appease you when you argue. Now, the scammers will argue with you because they expect you to send money and you're not sending money. So, they will turn around and get quite abusive. Don't then turn around to them and say, "You're an idiot." Turn around to them and say, "Why are you talking to me like

you think I'm an idiot?" That way, they're on the back foot and they have to appease you. And once you get them to do it the first time for something small, later on down the line, you can get them to apologize or try to keep you happy for much, much bigger things. And this is usually how we get these trophy pictures. Many lads make life work. If you're only writing to one scammer, they may not write back to you for three days. If you're writing to 20 scammers, you are constantly just using your scripts. they are replying back and you're keeping yourself busy. As they start dying down, start running to to another couple. So, you got these

constant waves going on where it levels out and you've got say maybe 20 scammers uh at a time that you're working with. Now, lad calling. Oh, this is the bit that I love. As you can see on this, the scammer gives you his phone number. Um people ask where do we get them from? Well, this is where we get them from. So, when we call them up, first of all, let the spotlight be on the scammer. You're in every call. Nobody cares what you say. You are there to be Michael Parkinson. You want to get the best of the worst out of the scammer. Listen and be ready to go in a different direction. You may say, "I'm going to go

in and I'm going to get them to do this. I'm going to say that." But then they may say something and you go, "Let's go that way instead." We had one when I was calling up a scammer trying to buy a a prostitute cat for my cat. I know. And we were asking if it had its bronze swimming certificate, if it had fin rot, but then he said, "Um, I'm selling the cat because I'm painting my daughter's wedding." And then straight off, "Really? I'll come to your daughter's wedding. Invited myself to the wedding. Offered to buy surprisingly nice wedding gifts, all sex toys, but good quality. So, we went off in this completely different direction from what we originally had.

Get the scammer off his script. He's going to try to keep on it. If he says, "Will you send me an email?" I said, "Yes, I'll send you an email, but while I'm on the phone to you," and they go off in an opposite direction. Cuz if you agree with them, they can't argue with you. Having a fellow beta with you can make for a better call. A lot of the time you'll hear me do calls with another beta called the lovely Jill, lady who lives in Bristol, and we have had an absolute blast doing calls. Um, we've had a scammer marry us. We've gotten divorced. We've had sex even though we live like 80 miles away

during a call. Uh, the lot. And uh, because we can bounce ideas off each other or if one of us is struggling a little bit, we'll say, "Oh, um, you talk to him instead for a moment. I need to nip out." And then you can get the scammer to repeat everything as well. ramp up the crazy slowly. Same with the uh when you send emails, don't jump straight in the the call when I killed my wife. Five minutes is all it took. Five, six minutes to ramp it up to that stage. And when you hear it, you'll hear just how crazy it is. And expect duds. There are going to be nine out of 10 calls that you make that

you will get nothing. But then you get that one call that is absolute gold and that keeps you going wanting to do more. So then what do we take away from this call uh from this talk? Bait safely, bait ethically. Don't jump straight into the crazy. Report all the scammer info you have and have fun with it. Because if you're not having fun, it's not worth doing. Now we're going to look at some trophy picks. I don't know if you noticed out in the sticker, there was this weird kind of head with a different color thing. That's where it came from. Panty claws. In fact, it was that one there. I say have a look out there. You'll also see

there are two copies of my latest book. Again, part of that design is from that. Told you I could be >> these are handwritten letters and actual physical photographs. But the thing is if you look at that, look at the handwriting. Look at the words. You got for example second line. Oh, it is so strange. Here's another one. And if you want to see these, they're in my bag there. You can have a look at them. So these are scammers. All these are the same scammer writing as four different people because I kept stretching the bait out saying, "Oh, if you got anybody else, I can send them money, too." But you need to justify why

I should send you the money. So, there's two. There's another two. All the same handwriting. That end some examples of scammer calls. I'm going to put the lyrics up on this. We're going to need the audio for this now. Yeah. Um, does anybody know Joe Walsh from the Eagles? Yeah, he had a solo uh well, a few solo albums and one of them had a song called The Gamaguchi. And I'm going to put the words up so you can see just how ridiculous it is.

[Music] Oh yeah. >> The worst singing scammer ever. I believe I can sing. [Music]

[Music] >> It's bad. Okay. I've only ever burst out laughing one time during a scam call. And you will understand why when you hear this. Uh, you will hear me laughing and then you will hear two other baiters who are listening in on the call start to laugh too. >> Excuse me. I want you to talk to my baby. >> I can talk to your baby. >> Yeah. Yeah. Yeah. >> Okay then. >> Okay. Let me get my baby. >> Okay then.

[Laughter] >> Exactly. Now, who wouldn't laugh at that? [Music]

[Music] already. >> Ready for this bit? [Music]

now. How many people think that was actually his daughter? Okay. All right. My friend, how are you? >> My friend,

>> so we're going to skip Houdini the hamster. >> Um, if you enjoyed this, uh, there is a book based on this talk called the baiting bibble. And yes, it is bibble because a scammer once said to me, "It is said in the Bible." And it just tickled me. So, I thought, "Right, I'm going to call a book that." Uh, so yeah, if you go on to Amazon today, tomorrow, you can get the ebook for free. If you look out at the charity auction, there are two copies of my two books. this one and the the previous one uh that you can win in the raffle. Worth 24 pound if you uh you know worth a punt. So, I'm gonna play

you I shot my wife because of the scammer's email. >> Just to finish off and it's going to be in two parts. First of all, you'll hear me shoot her and then you'll hear his reaction after. >> Don't cry. You're dead already. >> Dead? Me dead? Me dead? Look, I tell you who's dead. You are dead. You know what? I've had enough of it. I've had enough of you. I've had enough of lies and the [ __ ] and the cheating. You know what I got to do? I got to introduce you to my journey. How does that make you feel? >> Please, Madam You are a coward. >> Let me let me show you. I'll show you

how much of a coward I am. Right. Let me get my gun. >> No, don't do that. Don't do that. >> No. If you can do that, I will report it to the FBI. I'm not sure they got much jurisdiction. >> Take that. Now he's dead. Now who's dead? >> Some fine acting on my part. He got scared. He hung up. >> He did get a report. >> See, my wife is still alive. >> So we called him back and here's a little clip from that as well. >> Listen, I I still let you get your gun. If I find out your family or your wife because of what she's saying, I'm going to report to the FBI also the United

Nations and I found your pardon Mr. Man. I don't want anything new, no matter how she said or anything you to gun on her or to sh please, if that is a play, you should stop that. >> Yeah. And later on he said to me, uh, did you have any children? And I went, "No." Said, "Then you were a big bastard." >> And that is my talk. Uh, I say I hope you enjoyed it.