Disruption Labs: Interview with a Phisher

An Afternoon in East London with a Man Who Steals through the Internet for a Living

He agreed to meet on the condition that we describe neither his face nor his voice. The introduction came through a source we've worked with before on stories about financial crime, passed along after weeks of encrypted back-and-forth on a platform we've been asked not to name. He chose the venue: a small café off a side street in East London, the kind of place with condensation on the windows and a bell above the door that hasn't been oiled in a decade. He was already seated when we arrived, cup of tea going cold in front of him, and he watched the door for a full minute after we sat down before he spoke. Call me Andrei, he said, in a way that made clear it was not his name.

He is, by his own account, a phisher. He described his work in the way a mid-career professional might describe any other trade: with a shrug, with the occasional flash of pride, and with the kind of dry humor that comes from doing something for a long time and no longer being surprised by any of it. What follows is an edited transcript of our conversation. We removed identifying details at his request. Everything else is as he said it.

Carlos: Thanks for sitting down with us. Off the record, of course.

Andrei: Off the record is my favorite record. Ask away.

Carlos: What's that one thing that stands out about your victims?

Andrei: They see the phishing email. They see the typos, the weird sender address, the URL ending in some top level domain nobody's heard of. And they click every time. I could sign my emails "Yours Truly, A Scammer" and the numbers wouldn't go down.

Carlos: What about the ones who don't fall for the email?

Andrei: We get them another way. My favorite is the relationship play. A lonely widower sees a photo of a smiling woman half his age, and six weeks later he's wiring his pension because "she" needs surgery. He wants it to be real. My job is to stay out of his way while he convinces himself.

Carlos: Do you worry about law enforcement?

Andrei: (laughs) Which one? The victim's in one country, I'm in another, the money moves through a third, and the domain sits at a registrar in a fourth. Every jurisdiction has different laws, different priorities, different definitions of what I'm even doing wrong. Most cybercrime units are three people and a shared inbox. God bless them.

Carlos: Is there any agency you actually respect?

Andrei: (pauses) The Dutch. Their high tech crime unit moves fast, they coordinate, they don't need permission from six other countries to do their job. We notice when they show up in an investigation. A few American units too, like when the FBI decides that a case matters. But it has to matter to them first. Most days I'm not big enough to matter and that's how I like it.

Carlos: What about Europol? The UK's National Crime Agency?

Andrei: Europol I respect. They coordinate, they get the Dutch and the Germans and the Romanians, all of them talking to each other in the same week, which nobody else manages. When they run one of their coordinated takedown days, we lose infrastructure in eight countries before breakfast. The NCA is smaller than people think, but the people they have are good, sophisticated. Quiet, patient, they build a case for two years and then you wake up to your door coming off its hinges. I'd rather deal with a loud agency than a patient one.

Carlos: What about ICANN? The registrars?

Andrei: (laughs harder) My favorite people. Some of them built the whole business model around this. Register a domain in minutes, take a few days to respond to abuse reports, and by the time the domain comes down I've already cashed out. Then they publish their takedown numbers, they win an award, they speak on a panel about how seriously they take abuse. I register a hundred more the same afternoon. Everyone wins, except the widower, of course.

Carlos: And these new platforms where anyone can spin up a website in minutes? Where you describe what you want and a chatbot builds it for you?

Andrei: Beautiful. Free hosting, free subdomain, HTTPS included, live in about ninety seconds. I don't need a registrar, I don't need a server, I don't even need to know how to code. Ten years ago I had to buy infrastructure. Now I ask an AI to build me a login page that looks like a bank, and the platform hands me a URL with their own trusted brand in the address bar. Their abuse teams are polite when they eventually reply. By then I'm three sites deep on the next one.

Carlos: Who's your ideal target and why?

Andrei: Seniors because they trust. They answer the phone. They have savings they spent forty years earning. And when something feels off, they're too embarrassed to tell their kids, which gives us a second bite before anyone notices.

Carlos: What about young people? They grew up online.

Andrei: They grew up trusting a screen. That's worse. They click faster, they scan less, they assume their phone would warn them. The older ones are cautious in the wrong places. The younger ones aren't cautious anywhere.

Carlos: What about the big banks? The Fortune 500 brands people trust?

Andrei: They print my costumes. Every 'verify your account' email their marketing team sends looks exactly like what I send. Customers can't tell the difference anymore, and honestly, neither can I. And when a customer calls the bank to check if a message is real, the phone tree keeps them on hold for forty minutes. By minute thirty-nine they've clicked anyway.

Carlos: Is there anything they do that frustrates you?

Andrei: A few of them actually invest. They hire companies like yours to watch for lookalike domains the day I register them. They pull the money back before it moves. You're fast. You cost me money. I try to skip your customers but I don't know the whole list. Gimme a couple names? (laughs hard) Life is short. There are plenty of others whose fraud team goes home at five.

Carlos: What about the security awareness training all these companies run?

Andrei: I love the training. It teaches people what last year's email looked like. I send this year's.

Carlos: Any advice for the cybersecurity community?

Andrei: Keep writing your blog posts. I read them. I take notes. The conference talks are useful too. I know exactly which detection you rolled out last quarter, and I already changed what I do.

Carlos: One last thing. Any regrets?

Andrei: Only that I didn't start sooner.

He finished his tea and paid in cash. He asked us not to follow him out, and we didn't. On the walk back to the tube, past the shuttered shops and the wet pavement reflecting the streetlights, what stayed with us was how ordinary he seemed, not his cynicism, or the boasting, or even the part about the widower. How much he sounded, at moments, like anyone else complaining about their job.

Do you think this conversation is fictional? Did we make this up entirely? We'll leave that up to you to decide.

ZeroFox spends its days increasing the operational cost for criminals like Andrei. We monitor for lookalike domains the moment they're registered and hunt phishing kits across the open and dark web. Our Global Disruption Network gets his infrastructure blocked fast, blocklisted everywhere, and filtered by DNS providers and ISPs before his campaign has time to breathe. Our takedown teams go after the domains and URLs themselves, working with registrars, registries, hosting providers, social media platforms, and other providers to pull his domains and content offline for good.

If you'd like to be one of the customers he skips, see the ZeroFox Platform in action or write to us at [email protected]. We can't promise Andrei will retire, but we can promise to make him grumpier about coming to work.