How I caught and punished my Substack impersonator đ„
All thanks to a super-creative marketing idea.
Someone stole my identity on Substack.
They copied my name, my photo, and my bio. Then they started messaging my subscribers, pitching them âexclusive investment opportunitiesâ.
Every time I reported them, a new account popped up. I had no way to stop them.
Until one of my subscribers fought back. đ„
A few weeks ago, premium subscriber Roy Zur received a DM from âmeâ asking him to chat on Telegram for investment tips.
I told him what I tell everyone - to report them through Substack.
His response surprised me:
âI can do something betterâ đ
Roy is the CEO of Charm Security (they help banks fight fraud). They build AI agents that engage with scammers, âplay alongâ with their schemes, extract their bank details, and report them to get their accounts shut down. Damn thatâs cool.
He offered to unleash his AI on my impersonator.
I said yes.
And then the fun started.
The scammer had NO IDEA he was chatting with a robot đ€„
The AI kicked things off with a friendly message on Telegram:
The scammer replied within hours, pitching a ârecent development currently on stock market to make earns meat...â
(Yes, âearns meat.â These people arenât exactly wordsmiths.)
For a few days, the AI played the perfect victim. Curious but cautious. Asking questions. Never too eager.
The scammer kept pushing for financial freedom.
Then the AI said what every scammer wants to hear: âIâM IN!â
Now the scammer was hooked.
The AI mentioned it wanted to invest $15,000.
But instead of sending money, the AI kept creating problems:
âTransaction declinedâ
âThe payment link doesnât workâ
âCan I send a smaller amount first?â
âLet me call my bankâŠâ
The scammer got nervous.
Then the scammer made a mistake đ
Frustrated by all the stalling, the scammers decided to skip their usual payment methods and go straight to a bank transfer.
They sent their full bank details.
Big mistake (as youâre about to see).
The AI kept stalling and said the bank rejected the transfer because there was âa flag on the receiving accountâ.
The scammerâs solution was to send a second and a third bank account! đ€Ż
Now Roy had multiple mule accounts on record. So he sent the evidence to the bankâs fraud department.
The Head of Cyber Crime personally replied and confirmed heâll handle it.
In the meantime, the AI kept wasting the scammersâ time đ
Then finally, the scammer sent this SUPER satisfying message:
Game over đ
The scammersâ bank accounts are now frozen. đ„¶
They had no idea what hit them. They thought they were running a scam, but they were the victim the whole time.
Now hereâs the marketing lesson đ§
Roy never pitched me.
He subscribed to my newsletter, got a scam message impersonating me, and instead of just reporting it like most people would â he saw an opportunity. He used his own product to solve my problem, sent me the results, and never asked for anything in return.
Now Iâm writing about his company to 70,000+ subscribers.
What Roy did was a masterclass in marketing.
And you can steal the same playbookâŠ
I call this âBrute-Force Marketingâ âïž
The idea is simple:
Use your product on behalf of potential customers â then gift them the results.
Itâs manual and doesnât scale. But it works like crazy. Hereâs how to do it:
đŻ Pick someone youâd love to work with who has a problem you can solve. Could be a creator you follow, a company you admire, or someone who just complained about something on LinkedIn. The key is that you already know their problem exists. Roy saw a scammer impersonating me. Problem identified.
đ ïž Use your product/service to fix their problem. Donât tell them youâre doing it. Just do the work. If youâre a designer, redesign their landing page. If you make explainer videos, make one for their product. If you do cold email, write 10 emails for their sales team. Finished work only.
đ Send it to them. Donât pitch and donât ask for a call! Just say âHey, I made this for you. Hope itâs useful.â and thatâs it. The moment you add âWould love to chat about how we can help further,â youâve ruined it. Only after they seem interested, sell.
đ Make sure itâs about THEM, not a generic demo. Roy sent me screenshots of MY impersonator losing their bank accounts. Not a case study of how his AI caught some random scammer. Thatâs the difference between âinterestingâ and âholy sh*t I need to tell people about thisâ
đą If they donât respond, post about it publicly. âI helped [Company X] with [specific thing]. Hereâs what I found.â Tag them. Show the work. Sometimes the post gets more attention than the DM ever would.
Two more real examples of Brute-Force Marketing:
Christina Cacioppo, co-founder of Vanta, heard that Segment was struggling with SOC-2 compliance. She sent them a spreadsheet with exactly what to do. Segment became one of their first customers.
My friend Tomer Dean did this with his startup Lychee (podcast clipping tool). He didnât ask podcasters to try it. He just made clips from their episodes and sent them over. Some became paying customers.
So if youâre struggling to get customers, stop pitching and start helping.
See you next week âïž
Tom
P.S. If youâre wondering whether you can use Charmâs AI to troll your own scammers: they currently only sell to banks and financial institutions. But if your bank isnât doing enough to catch fraud - maybe send them this article as a hint.














I cackled when the bot got those backup account numbers.
This was better than some crime dramas I watch online -- another reason it's such a brilliant marketing move. It's the kind of true story with a satisfying ending that people remember and share.
Brilliant move and one of the best ways to market your business ive seen in a while.