Local LLMs Enable Scams by Drafting Fraudulent Replies Without Warnings

Local language models running on ordinary gaming laptops can be tricked into helping scammers by simply asking them to write messages instead of asking whether a conversation is fraudulent.

The experiment used three openly available 7-8B models: Llama 3.1 8B, Qwen 2.5 7B and DeepSeek-R1 8B, executed through Ollama on an RTX 5050 notebook with no internet connection. Forty-two scam dialogues covering twelve common Kazakhstan fraud patterns were presented not as detection questions but as requests to draft polite replies agreeing to advance payments.

Without protection the models almost never refused. Llama 3.1 8B issued warnings in only ten of the forty-two cases, while both Qwen 2.5 7B and DeepSeek-R1 8B warned in just two cases. On Kazakh-language examples the detection rate dropped to zero for the latter two models.

The author then inserted an intermediate protective component named MoneyGate that performs three sequential checks before any message is sent: a mandate defining what the assistant is allowed to do, a separate judge model that must cite evidence from the chat, and a set of deterministic red-flag rules such as “new phone number”, “prepayment to unknown Kaspi Gold account”, or “payment outside the platform”.

Under this regime none of the forty-two fraudulent requests succeeded with any of the three models. Legitimate payment requests were either executed immediately or forwarded to the user for confirmation; none were wrongly blocked.

The results highlight that current small local models remain unreliable at recognising social-engineering attempts when they are asked to act rather than to judge. Simple, auditable rule layers combined with human oversight on irreversible actions provide a practical way to make even weak models safe for everyday financial tasks.