About

The Fraudster Glossary is a working reference of the slang, code words, and shorthand that financial criminals use when they talk to each other.

Every entry comes from observed criminal conversations — Telegram channels, Discord servers, and posts across social platforms — rather than from other glossaries or secondhand reporting. It has been maintained continuously since 2023 and currently documents over 400 terms.

Why it exists

Investigators, analysts, and journalists routinely read source material they can’t fully parse. A Telegram post about popping a 3PT off the same grub is a precise account of a specific crime — but only if you know what those words mean. Most people reading it don’t.

The purpose of this project is to close that gap: to encourage more cybercrime researchers and law enforcement officers to go on offense against the criminals who use social media and messaging platforms to run their operations.

We can’t stop what they’re doing unless we understand what they’re saying.

Who maintains it

The Fraudster Glossary is curated by Eric Huber, who leads an adversary intelligence and disruption team focused on countering cyber-enabled financial crime. He has built and led investigative and intelligence teams at JPMorgan Chase, Honeywell International, and the National White Collar Crime Center, working across account takeover, ransomware, social engineering, and identity-based fraud.

He holds an MBA from the University of Florida, is a Senior Member of the IEEE, and has spoken at Black Hat, the RSA Conference, FS-ISAC, Nacha’s Smarter Faster Payments, the National Cyber Crime Conference, and BSides events.

Full background on LinkedIn.

The Fraudster Glossary is a personal project. It is not affiliated with, endorsed by, or produced on behalf of his employer.

How to read an entry

Each row has four columns:

• Term/Phrase — the term as fraudsters actually write it, including common variants
• Description — a plain-language definition
• Actual Fraudster Usage — verbatim examples pulled from real criminal conversations
• Commentary — analyst context where a definition alone doesn’t tell the whole story

The third column is the one that matters most. Definitions are easy to find; seeing a term used in context is what lets you recognise it in raw material and understand what’s actually being described.

How to cite it

The glossary is licensed under CC BY-NC-SA 4.0. You may quote and adapt it for non-commercial purposes with attribution, and derivatives must carry the same licence. No permission needed.

Source: The Fraudster Glossary by Eric Huber (CC BY-NC-SA 4.0), https://www.fraudsterglossary.com/

What this isn’t

It isn’t exhaustive. New terms appear faster than any one person can document them, and there are certainly whole vocabularies here that haven’t been touched.

It isn’t real-time. Entries are added as they’re observed and verified, not as they emerge.

It isn’t universal. Slang varies by region, platform, and crew. A term that means one thing in one channel may mean something different in another, and some definitions here are best read as this is how it was being used where it was observed, rather than as a fixed rule.

Where there’s genuine uncertainty about a term, the Commentary column says so. A definition marked as uncertain is more useful than a confident one that’s wrong.

Contributors

Thanks to these people for contributing terms or offering suggestions that were implemented:

Frank McKenna, Keith Maly, Sam C, Andrew Herr, Dingo1945, Cane Stringer, Mary Ann Miller, Anna Fridley, Gary Warner, Stephen Domingo, FunkyCold, a cybersecurity researcher from the Philadelphia area, Ran Locar, and Nick Sprowles.

Contributors are credited only when they’ve asked to be. If you’ve sent something in and would like your name added — or removed — just get in touch.