Characterising Mobile Money Phishing Attacks Using Imitation Learning Relying on Expert Demonstrations

Abstract Mobile money has become hugely popular in Africa, but its growth has been shadowed by phishing, a form of social engineering in which fraudulent messages, emails, or calls trick users into revealing sensitive information and surrendering their funds. Designing effective countermeasures first requires understanding how attackers actually operate. This paper characterises mobile money phishing with imitation learning relying on expert demonstrations: instead of hand-crafting a reward, as prior reinforcement learning approaches must, at the cost of sparse rewards and limited scalability, we learn the attacker's strategy directly from examples of the attacker's own behaviour. Treating the attacker as the expert, we formalise the attack as a four-state process in which transitions depend jointly on the attacker's actions and on the victim's reactions, build a simulated dataset of expert demonstrations (state--action pairs) from the attack scenario observed in real cases, and apply two imitation learning algorithms to it: Behavior Cloning (BC) and Generative Adversarial Imitation Learning (GAIL). Behavior Cloning reproduced the attacker's actions accurately, performing best at a learning rate of 0.006, though it struggled with the branching decisions at the exit state. In GAIL, the learned policy generated state--action pairs while a discriminator separated them from those of the attacker's demonstrations; across training the discriminator loss decreased steadily and the generator loss rose, showing that the learned policy remained distinguishable from the attacker within the training budget. The results indicate that imitation learning from expert demonstrations offers a promising lens for understanding and ultimately countering mobile money phishing.