A romance scam is a type of fraud in which a criminal adopts a fake online identity to gain a victim's trust and affection, then uses that fabricated emotional connection to manipulate or steal from them. Romance scammers operate on dating apps, social media platforms, and even professional networking sites—anywhere people form relationships online—and they are one of the costliest forms of consumer fraud in the United States today.
Key Takeaways
-
Romance scams are social engineering attacks that exploit human emotions—trust, loneliness, love—rather than technical vulnerabilities. They are among the most financially damaging forms of cybercrime.
-
These scams are not just a personal issue—they are a cybersecurity issue. Romance scam victims can become unwitting insider threats, money mules, or entry points into corporate networks.
-
Crypto romance scams ("pig butchering") are exploding in scale, combining emotional manipulation with sophisticated fake investment platforms to steal billions annually.
-
No demographic is immune. Younger adults are targeted more frequently; older adults tend to lose more money. Both men and women are victimized.
-
The warning signs are identifiable with awareness and training: rushed emotional intimacy, inability to meet in person, requests for money, and investment pitches from romantic interests are all major red flags.
-
Cybersecurity professionals should integrate romance scam awareness into security awareness training programs. The social engineering principles at work in romance scams are the same ones that drive phishing, BEC, and pretexting attacks in the enterprise.
-
If you or someone you know is targeted, report it. Contact the FTC, the FBI's IC3, and the platform where the scam originated. Early reporting improves the chances of disrupting the attacker and may help with financial recovery.
Romance scams remind us that the most sophisticated firewall in the world can't protect against an attacker who bypasses technology entirely and targets the human heart. For cybersecurity professionals, understanding this threat isn't optional—it's essential.
How do romance scams work?
At their core, romance scams are a masterclass in social engineering. The attacker's weapon isn't malware or a zero-day exploit…it's emotional manipulation. Here's how the typical progression unfolds:
1. Initial contact and persona creation
The scammer creates a convincing fake profile, often stealing photos from real people's social media accounts or using AI-generated images. They craft backstories designed to appeal to their target: a military officer deployed overseas, a successful engineer working on an oil rig, a widowed doctor volunteering abroad. These personas are engineered to explain why the person can't meet in person and to elicit sympathy or admiration.
According to the Federal Trade Commission (FTC), romance scammers frequently reach out through dating apps (Hinge, Grindr, Tinder, etc.), social media platforms like Facebook and Instagram, or even through seemingly accidental text messages and direct messages.
2. Building trust and emotional dependency
Once contact is established, the scammer invests significant time—sometimes weeks or months—in building a deep emotional bond. They send frequent messages, make phone calls, share fabricated personal details, and express intense affection early in the relationship (a manipulation tactic sometimes called "love bombing"). The goal is to make the victim feel uniquely valued and emotionally dependent on the relationship.
This phase mirrors the "pretexting" stage of social engineering attacks that cybersecurity professionals are trained to recognize in corporate environments. The attacker is carefully constructing a believable narrative to lower the victim's defenses.
3. The ask
Once emotional trust is established, the scammer introduces a crisis or opportunity that requires money. Common scenarios include:
A medical emergency for themselves or a family member
Legal trouble or an arrest that requires bail money
Travel costs to finally meet the victim in person
A lucrative investment opportunity (especially in cryptocurrency)
Customs fees to release a valuable package
Requests typically start small to test the victim's willingness and escalate over time. The scammer may ask the victim to send funds via wire transfer, gift cards, cryptocurrency, or peer-to-peer payment apps—methods that are difficult or impossible to trace and reverse.
4. Continued exploitation
The scam rarely ends after a single payment. Scammers will continue to invent new emergencies and escalate financial demands for as long as the victim continues to comply. In some cases, if the victim becomes suspicious, the scammer may introduce a second fake persona—a "lawyer," "bank official," or "friend"—to validate the story. Some scammers also pivot to threatening or blackmailing victims who try to disengage, especially if intimate photos or personal information were shared during the relationship.
5. The disappearance
Eventually, when the victim can no longer send money or begins to push back firmly, the scammer vanishes—deleting profiles, disconnecting phone numbers, and cutting off all communication. Victims are often left with devastating financial losses and significant emotional trauma.
How long do romance scams usually last?
There is no single timeline for romance scams. Some are executed in a matter of weeks, while others play out over months or even years. The duration typically depends on several factors:
The scammer's patience and sophistication: More experienced scammers are willing to invest months of "grooming" time because they know that a deeper emotional bond leads to larger payouts.
The victim's financial capacity: Scammers who recognize a victim has significant assets or access to credit may extend the relationship to maximize the total amount extracted.
The victim's level of suspicion: If the victim raises concerns early, the scammer may accelerate demands or abandon the effort. If the victim is deeply trusting, the scam can continue indefinitely.
The FBI's Internet Crime Complaint Center (IC3) has documented cases where victims were exploited for years before recognizing the fraud. On average, many romance scams last between six months and a year, though shorter and longer durations are common.
For cybersecurity professionals, this extended timeline is significant. It demonstrates the attacker's willingness to execute low-and-slow campaigns—a pattern that should be familiar from advanced persistent threats (APTs) in the corporate space.
5 common types of online romance scams
Online romance scams have diversified considerably. While the emotional manipulation at the core remains consistent, the specific mechanics vary:
1. Dating App and Social Media Scams
The most common variety. Scammers create fake profiles on platforms like Tinder, Bumble, Hinge, Facebook, and Instagram to initiate contact. They may target people who publicly display personal information—relationship status, recent life changes, or emotional vulnerability.
2. Military Romance Scams
Scammers impersonate active-duty military personnel, leveraging the respect and sympathy people often feel toward service members. They claim to be deployed in locations where communication is difficult and in-person meetings are impossible. The U.S. Army Criminal Investigation Division has issued repeated warnings about this tactic.
3. Catfishing
A broader and more commonly known term (thanks MTV) for creating an entirely fake online identity to deceive someone. While not every catfishing scenario involves financial fraud, it is a core component of romance scams.
4. Recovery Scams
After a victim has already been defrauded, a second scammer (sometimes the same person using a different identity) contacts them claiming to be a law enforcement officer, attorney, or recovery specialist who can help retrieve their lost funds—for a fee.
5. Sextortion Crossover
Some romance scams evolve into sextortion schemes. After convincing the victim to share intimate photos or videos, the scammer threatens to distribute the material unless the victim pays. This is increasingly common and represents a direct intersection with cybercrime.
Red flags that you are a victim of a romance scam
Recognizing the warning signs of a romance scam is critical. Here are the most common red flags:
The relationship moves unusually fast. Declarations of love or deep emotional attachment come within days or weeks. The scammer "love bombs" the victim with constant attention and affection.
They can never meet in person. There is always a reason—deployment, work obligations, travel restrictions, medical issues—why a video call or face-to-face meeting is impossible.
Their story doesn't add up. Details about their life, location, or profession are inconsistent or don't hold up to basic scrutiny. Reverse image searches may reveal their photos belong to someone else.
They ask for money. This is the clearest red flag. A legitimate romantic interest will not ask you for money, gift cards, cryptocurrency, or wire transfers—especially if you have never met in person.
They want to move communication off the platform. Scammers prefer to move quickly to personal text messaging, WhatsApp, Telegram, or other channels where their activity is harder for platform moderators to monitor.
They discourage you from telling friends or family. Isolation is a key manipulation tactic. Scammers know that outside perspectives make it harder to maintain the deception.
They introduce investment opportunities. Especially in cryptocurrency. An online romantic interest who starts pitching you on an investment platform is a major red flag.
They claim to be in the military, working overseas, or on an oil rig. These are among the most commonly used cover stories because they conveniently explain limited availability.
How to avoid romance scams
Whether you're advising end users in a security awareness training program or looking to protect yourself, these practical steps can significantly reduce romance scam risk:
1. Be skeptical of unsolicited contact. If someone you don't know reaches out on social media or a dating platform with an overly flattering or emotionally intense approach, proceed with caution.
2. Do your research. Perform a reverse image search on profile photos. Search for the person's name along with keywords like "scam." Check whether their story is consistent across platforms.
3. Never send money to someone you haven't met in person. This is the single most important rule. No matter how compelling the story, no matter how real the relationship feels, do not send money, gift cards, or cryptocurrency to someone you have only communicated with online.
4. Keep communication on the platform. Dating platforms and social media sites have fraud detection systems. Moving to private channels removes that layer of protection.
5. Talk to people you trust. Share details about the online relationship with friends, family, or colleagues. An outside perspective can often identify red flags that are hard to see from inside the relationship.
6. Be cautious about sharing personal information. Avoid sharing financial details, your home address, workplace information, or intimate photos with someone you've met online.
7. Watch for investment pitches. If an online romantic interest steers the conversation toward investing—especially in cryptocurrency—treat it as a major red flag.
8. Report suspicious activity. If you suspect a romance scam, report it to:
-
The platform where the contact occurred
-
Your local law enforcement
9. For cybersecurity professionals: incorporate romance scam awareness into training. Include romance scam scenarios in your organization's security awareness curriculum. Emphasize the connection between personal social engineering risks and corporate security.
Romance Scams by the Numbers
The financial and human toll of romance scams is immense and growing:
-
In 2023, Americans reported losing $1.14 billion to romance scams, according to the FTC. The actual number is almost certainly higher, as many victims never report the fraud due to embarrassment or shame.
-
The median individual loss to romance scams is significantly higher than for other fraud types, reflecting the deep emotional manipulation involved and the prolonged nature of these schemes.
-
Cryptocurrency has become the single most commonly reported payment method in romance scam losses, fueled by the explosion of pig butchering scams.
-
Romance scams affect people across all age groups, genders, education levels, and income brackets. While adults over 60 tend to report the highest dollar losses, younger adults (ages 18–39) report the highest number of incidents, according to FTC data.
-
The FBI's IC3 2023 Annual Report ranked romance-related fraud among the most financially damaging cybercrime categories.
Frequently Asked Questions (FAQs)
AI is making romance scams more convincing and scalable. Scammers now use AI-generated profile photos that don't appear in reverse image searches, AI chatbots to maintain conversations with multiple victims simultaneously, and deepfake video and audio to simulate live calls. For cybersecurity professionals, this represents a significant evolution in social engineering capability that has implications well beyond romance fraud.
Protect What Matters
