For a few months, he spent some free time here and there learning about different types of scams and how to report them. He shared his initial experiences with friends, and one suggested he stream a call or two on Twitch so they could listen in. A private scam-baiting party, as it were, because Kitboga was already becoming skilled at killing time on these calls. "Just goofing around," he called it. On one call, he played a silly guitar song through the phone to a scammer. Someone picked it up and posted it to Reddit.
"The next time I streamed, all of a sudden there was 10 or 15 people watching," he recalls, "and it just grew from there. I started streaming once a week, and 15 people became 50 people became 150 people, and it kinda blew up after that." Kitboga's popularity grew, and the nature of his work as a software engineer allowed him to wind down the hours he spent on his regular job and dedicate more time to streaming. Eventually, he was making enough money from Twitch and YouTube to pay his mortgage, and less than six months ago, he made the jump to streaming full-time. In a bizarre, somewhat ironic twist, he now makes a living scamming scammers.
These days, Kitboga's viewers tend to send in scams they come across. He receives a handful of submissions every day, an endless supply of material. When he first started, though, he would seek them out himself. He would misspell the names of popular websites intentionally, hoping that opportunistic domain squatters would have sold the redirection traffic to a tech support scam that day. If he did encounter a virus-warning pop-up encouraging him to contact "official" Microsoft agents, he would report the scam and then add it to his to-do list.
He would also try to mimic searches a less tech-savvy person might perform -- "How to remove viruses off my computer for free," for example -- and find fake antivirus software claiming that a brand-new virtual machine was compromised. Naturally, there was a phone number attached to this warning. He would sometimes simply search for Microsoft technical support and find scams listed as early as the second page of results. There's an inexhaustible supply of targets, it seems.
Kitboga likes to challenge a variety of scammers. IRS scams are fun, he says, because they're very aggressive and know nothing about tax law. "I'll ask them questions anyone that actually works for the IRS would know how to answer and they just can't respond. It makes me grin." Those calls can last only so long, though. "It's weird to say 'enjoy,' because you're talking to scammers, but ... Tech scams are my favorite, just because you add more depth to the conversation when they're on the computer."
His elderly grandma act is the perfect cover. She's not good with computers, and scammers spend forever just talking her through granting them remote access to her machine. And that's just the beginning. "Even though they're going to go through their script, when they get on my computer, now it's my world. It's my little playground," he tells me. "I put them through all kinds of little traps and silly ways to waste their time." The scammers all like using Notepad to type out the nonexistent diagnoses and the cost of repairs. Kitboga has coded his own Notepad for his virtual machines that purposefully changes letters, ignores keystrokes and randomly crashes.
Tech support scams offer the most opportunities to extend the conversation and make each interaction unique. "My current record is three hours and 52 minutes, I think," he says. Kitboga doesn't just do it for the laughs, though, or the views. "I'll have some fun and I'll do these personas to waste their time, but I think it gets the word out there and gets people talking about it, and that's what I'm more excited about."
While every conversation is different, the formula doesn't change. Toward the end of the call, there's always the reveal, where Kitboga tells the scammer he knows his virtual machine hasn't been hacked and the whole tech support angle is a ruse. He asks them, gently, why they do what they do and whether they ever think about who they're hurting. Some hang up immediately; others plead ignorance, maintaining that they are legitimate tech support workers to the very end, even when they've asked for payment in iTunes gift cards. On occasion, the scammers are angry; sometimes they even say the joke's on him, because there are "stupid" people on hold right now just waiting to get scammed.
Kitboga is never aggressive toward them. That's just his style. The way he sees it, it's like a parent talking to a child. Getting angry isn't always the best approach -- telling a child you're disappointed in them typically has more impact. He doesn't think there's any right way to approach the end of these calls, though. Perhaps scammers who might shrug off his softer line of questioning would think harder about their work if the last call of the day ended with a scam baiter shouting horrific things at them in Hindi. He hasn't always been so stoic, though. "If I look at some of the older calls -- a lot of them aren't on YouTube or anything -- I said some stuff that I don't say now. I was just upset and I was like, How on earth can you do this to people?"
He pays attention to a few other scam baiters, like The Hoax Hotel and Jim Browning, but he doesn't consider himself part of any wider scam-baiting community. "There's a lot of different opinions that scam baiters have. How we handle the calls at the end, what we say to the scammers. Sometimes that's deterred me from reaching out to more people. I don't know if we're aligned or like-minded," he tells me.
Kitboga's never considered using his technical background to hack scammers, as some scam baiters do. "Technically, it's illegal," he says. "I don't really want to fight it that way. Two wrongs don't make a right," not to mention it would go against Twitch's policies. Sometimes scammers even log into their payment-processing services through his virtual machine. He simply takes note of the important information and reports it to the relevant services and authorities.
There are plenty of people who can't relate to a hacking demonstration, he feels, even though he would find it interesting personally. He believes his old grandma persona is more relatable to a broader audience. Having read up and spoken to people about how these call centers operate, hacking a scammer's computer has little value in the grand scheme of things. "It is very, very easy to spin up one of these call centers. A lot of times, they're using virtual machines or junk computers," he explains.