Protect & Connect: Understanding Scams and How to Avoid Them

// in general, it would be interesting to know how common or how many known cases there are where scammers have deliberately planned a long-term hoax of creating a service or tool that would be very useful and in demand for many; and for some significant period of time would be flawless from a security or legality point of view (zero fraud). Considering the "long-term"-base - is it even interesting for scammers when there are so many possibilities for petty scenarios and other misery? Or will this simply transfer the scam to the category of fraud (and, so, there will be a need to rely on some kind of fraud squad to deal with this)?

for instance, create a password manager. make it flawless from all sides and actively promote it. maybe even to gain legal profit from it. to be flawless for five years (which could even be sufficient already for good reputation, see Brave Browser was already quite promoted in the first five years, and now it’s widely known) or ten years (still for the scammers sideproject is not so 'long'). And then implement the original scam trick (whatever it could be). Where there is also an excellent opportunity to frame all this as "oops. there was a security incident. we have carefully considered everything, we will tell all the mitigations, we will take into account all the points, and made right conclusions, etc." Which may not even reveal the "scam"-nature after all. That is, they won't even have to stop sideporject.

what is the probability (or how many cases are known) of such professional scam activity at the level of long-term directly undercover operations (rather than typical long-lived activities deliberately acting as scammers for a very short time of interaction with 'target')? Posing as something other than a scammer while still acting as scammer, hoping to find someone who is gullible and fool him - when the initial idea is to scam at the end - this is, I think, quite more dangerous type of scam because is not really 'clear' how to spot it or verify their intentions. And even more so, how to distinguish them from a not very successful company (organization, initiative) which simply failed.

For me, this would look like a vector similar to how malicious things (in computing) began to look at ways to use legal paths or simply "improvised" tools. So-called scripts, chain attacks and fileless threats. By using (for example, for Windows) Powershell and so on. As a drastic change from a "simple" quick approach to something more thorough (albeit with implementation costs).