The weak link here is: to run a successful scam, you need to publicize the incoming address widely. That allows exchanges to block it. If you keep the address in secret, you can't get the gullible masses to fall for it.
It would be reasonable for exchanges to parse Twitter feeds and other social channels for anti money laundering and fraud signal, similar to Github shipping AWS secrets accidentally exposed in commits to AWS for triage/suspension.
Once you’ve got the infra in place, you can have AML and other compliance staff triage and action from a dashboard (blocking suspect transfers until further review has been performed, and releasing transfers of a review shows nothing suspect).
(Have done some AML/KYC work in the fiat finance space)
One thing I've learned in life is that nothing is as polished or automated as you'd think. I would be surprised if anybody was doing this except maybe high tier law enforcement.
Only because I've seen first-hand how advanced their taint analysis is, so I'm already over that surprise.
You can, but typical spam target won't, because they don't think they need to - they think it's a legit thing so they don't need to make any effort to hide it.
