OXIL urges safeguarding framework to curb online scams

OXIL Research has launched an initiative calling for a "safeguarding" framework for online scam prevention, shifting the focus from individual vigilance to coordinated action by organisations people interact with.

Backed by funding from Google.org, the non-profit is analysing large volumes of scam-related signals to identify patterns in how fraudsters choose targets and run campaigns. The work draws on data shared through the Global Signal Exchange, a cross-sector clearing house for threat signals.

Safeguarding is a structured approach used in areas such as health, education, and social care. It focuses on early warning signs, shared responsibility, and intervention across networks. OXIL Research argues similar principles should apply to online fraud, where multiple organisations may spot risk indicators before a victim loses money or data.

The initiative comes as governments and companies continue to invest in public-awareness campaigns that teach people how to identify scams. OXIL Research argues this model can leave victims isolated and add stigma when a scam succeeds. It also notes that modern fraud operations use specialised methods that exploit legitimate needs and everyday online behaviour.

Signal analysis

The team analysed 28.6 million domain-based scam and fraud signals collected and shared through the Global Signal Exchange. Domain-level signals can flag fraudulent websites, impersonation pages, and other infrastructure that supports scams.

Preliminary findings describe two broad targeting patterns: a "scattergun" approach that prioritises scale with generic lures, and a "sniper" approach aimed at groups with protected characteristics. The latter involves lower volume but more tailored tactics, sometimes extending to family members or support networks.

The general population was the most-targeted group in the domain-based signals. Much of the activity involved high-volume, generic content such as fraudulent retail and service websites. These domains can be distributed through multiple channels, including search results, social media links, and messages directing users to web pages.

The analysis also challenges assumptions about who is most at risk. Older adults ranked 11th among targeted groups in the assessed domain-based signals. Most activity targeted working-age adults, which the researchers linked to online activity levels, while noting that adults can be targeted through combinations of online and offline routes.

Situational risk

Another early theme is that scammers exploit situational vulnerabilities more than immutable characteristics. The research highlights factors such as stress, tiredness, distraction, and major life events including bereavement or divorce. These circumstances can increase exposure to fraud attempts or reduce the likelihood of spotting warning signs.

This supports a safeguarding approach that treats vulnerability as contextual and changing rather than fixed. Under this model, organisations have a duty to recognise cues and intervene. It also implies more formal processes for sharing signals and escalating concerns when warning signs appear across services used by the same person.

In this model, responsibility shifts from citizens to a wider ecosystem that includes public services, financial firms, platforms, telecoms providers, retailers, and other organisations that scammers impersonate or use as channels. The initiative calls for coordinated action based on risk identification and timely intervention.

Emily Taylor, CEO of OXIL Research, said the findings show the limits of awareness-only approaches and point to the need for broader interventions and accountability across sectors.

Taylor said, "This new study is giving us the data insights we need to call time on an era of consumers feeling alone when they are scammed online - with an implied assumption that they have done something wrong. Consumers are not the weakest link when it comes to online crime, and education and awareness need to be complemented by additional interventions. This research aims to help evolve the conversation and unlock new effective solutions.

"Drawing on the data from the Global Signal Exchange, our research proposes a rethink on how we understand and tackle online crime, fraud and abuse, based on a new safeguarding approach. Here, all people will be seen as potentially vulnerable to attacks, with situational vulnerability to lures being more critical than immutable characteristics. It's not about stopping at training citizens - rather, adding training programs for government, law enforcement, and private and public sector entities to spot cues and intervene to protect their customers and citizens at the right point in time."

Haviva Kohl, Senior Program Manager at Google.org said its support is intended to build an evidence base on scam tactics and shift attention away from individual blame. The funding is tied to the year-long research study.

Kohl said, "Effective digital safety begins with evidence, not blame. Google.org's support of OXIL Research is rooted in the need to better understand the 'how' and 'why' behind modern scam tactics, shifting the focus from individual error to systemic exploitation. We believe that deep, data-driven research into better digital protections is critical to dismantling the culture of victim-blaming and building a safer internet for everyone."

The Global Signal Exchange was co-founded by Oxford Information Labs, the Global Anti Scam Alliance, and Google. It shares indicators such as URLs, domains, IP addresses, and email signals across partners. OXIL Research is using this dataset to understand how scam infrastructure is set up and how it evolves over time.

The next phase of the study will continue analysing scam signals and develop recommendations for how organisations can identify and act on potential exploitation cues across customer journeys and public services.