FlagThis

Abstract

Existing cybercrime classification schemas capture contact metadata and financial transactions but omit the psychological manipulation techniques perpetrators employ. We present a forensic schema (four categories, 35 questions) adding 11 manipulation indicators and cryptocurrency evidence fields to established forensic foundations. Applied to 10,994 victim reports via large language model (LLM)-driven annotation and validated against two human annotators (mean LLM-human __ = 0 . 69 , matching inter-annotator __ = 0 . 68 ), the schema revealed a statistically distinct manipulation profile for each major fraud type (Cramers _V_ up to 0 . 790 ). A rationale-based evidence audit nonetheless exposed a _forensic detail gap_ : detection of manipulation techniques was reliable, but victim narratives varied widely in the actionable detail supporting each Yes answer, and blockchain-specific identifiers were nearly absent. These findings point to AI-assisted victim intake with schema-informed followup questions as the most direct way to close the gap. The tiered annotation strategy also provides a reusable template for LLMbased extraction from other forensic text domains.