In the aftermath of the Cambridge Analytica scandal I remember hearing - likely in an interview in a BBC Radio4 programme on the topic (unfortunately I don't recall more than that) - a claim that scammers were using past sharing behaviour on social media to identify the people who were most gullible and then targeting them (using social media's targeted advertising tools) for scams and confidence tricks.
However, googling this issue doesn't find much to corroborate this specific claim. I can only find more general statements which seem to imply it's feasible and even probable... but little hard evidence of it actually happening.
Some relevant things would seem to be:
- A quite prescient 2016 Forbes piece "Should We Fight Fake News By Banning Gullible People From The Internet?" which notes sharers of fake news could easily be assigned a "gullible" flag that "advertisers would likely find of great interest".
- Accounts (example) of sharing of fake news being used to target users for advertising (to recruit followers) by fake news sites.
- A Bloomberg piece on "shady advertisers" mentions "Facebook’s targeting algorithm is so powerful... they don’t need to identify suckers themselves—Facebook does it automatically" but unfortunately it's not clear how exactly those "suckers" are targeted and exploited.
- Update: A short but punchy IEEE piece (thanks to Elliot Svensson's answer for that) includes a statement that "my concern now is the people who are making themselves targets. People paint a bull’s-eye on their back when they share, respond to, or like certain social media posts. My advice is to check your facts before you show scammers you’re susceptible to fraud.". However, it seems to be short of hard evidence for its claim that "Sometimes what follows fake facts is identity theft and stolen financial information" and the best it can offer is that sharing a fake news story "could have been a machine-learning classifier to help predict the gullibility of potential marks" (my emphasis).
None of this is quite specific enough though. Ideally I'm looking for some more concrete specific examples as evidence: sharing of what sort of nonsense was subsequently used to target what sort of users and scam them how?