By NHI Mgmt Group Editorial TeamBased on Incode: “Romance Scams Are Everywhere. Does Your Dating Platform Have the Right Protection in Place?” (August 5, 2025)

TL;DR: Romance scams, synthetic profiles, and AI-generated sextortion are driving measurable losses across dating platforms, with global romance-related fraud exceeding $1 billion in 2024 and older adults losing $389 million, according to Incode’s cited sources. Identity verification is no longer a front-end convenience layer; it is core fraud infrastructure for protecting users, retention, and platform trust.


At a glance

What this is: This analysis argues that dating platform identity verification has become fraud infrastructure because fake profiles, AI-generated sextortion and scam networks are now part of the platform risk surface.

Why it matters: For IAM and fraud practitioners, the lesson is that identity controls on dating apps now shape user trust, abuse prevention and platform liability, not just account creation.


Context

Dating platforms depend on trustworthy identity signals because the product itself is built on user confidence, not just account access. When fake profiles, catfishing and synthetic identities are easy to create, the platform no longer has a user onboarding problem alone, it has a fraud infrastructure problem.

Incode’s article frames this as a business and governance issue, not a narrow UX problem. The practical question for identity teams is whether verification, age checks, device signals and liveness detection are being used to stop abuse before it enters the ecosystem, or only after users have already been harmed.


Key questions

Q: What should dating platforms do first when fake profiles and romance scams are rising?

A: Start by moving identity verification into the onboarding gate, before messaging and discovery features are available. The first goal is to reduce the number of untrusted accounts that can enter the platform at all. That means using liveness checks, document validation and risk signals to stop synthetic profiles early, rather than relying on reports after harm has already spread.

Q: Why do dating platforms need more than basic identity checks?

A: Basic checks can confirm that a user exists, but they do not prove the account is authentic, safe, or resistant to abuse. Dating fraud depends on believable personas, repeated contact, and escalation over time. Platforms need controls that separate age, identity, and behavioural risk rather than assuming one check covers all three.

Q: What are the signs that identity verification is not enough to keep a dating platform safe?

A: Warning signs include persistent abusive behaviour, explicit images reaching users, repeated fake profiles, and ongoing fraud reports despite onboarding checks. That usually means the platform is relying too heavily on identity proof at sign-up and not enough on monitoring after access is granted. Effective safety needs layered controls across verification, moderation, and content inspection.

Q: How should security teams balance friction and safety in dating platform verification?

A: The right balance is not zero friction, it is targeted friction at the highest-risk points. Teams should preserve fast onboarding for legitimate users while applying stronger checks when the account shows signs of synthetic behaviour, age risk or scam intent. That keeps conversion acceptable without leaving the platform open to abuse.


Technical breakdown

Why dating platforms need identity verification at the trust boundary

Dating apps create a high-trust environment with low-friction sign-up, which makes them attractive to fraud actors who want to create believable false identities at scale. Identity verification at onboarding is not about proving every user’s real-world identity for its own sake. It is about raising the cost of synthetic account creation, reducing bot density, and making abuse harder to industrialise. In this model, verification becomes a trust boundary control: the point where the platform decides whether a profile can enter the ecosystem at all.

Practical implication: treat onboarding verification as a fraud control, not a branding feature.

How liveness detection and document checks block synthetic profiles

Synthetic profiles and deepfake-assisted fraud exploit the gap between a claimed identity and a live human presenting it. Facial biometrics with liveness detection help distinguish a real person from a replayed image, mask attack, or fabricated media stream. Document checks add another layer by validating age and identity attributes against supporting evidence. These controls are strongest when combined with anomaly detection on device, location and enrolment patterns, because no single signal reliably catches every form of impersonation.

Practical implication: combine biometrics, document checks and behavioural signals instead of relying on one verifier.

Why fraud pressure changes the role of age and anomaly signals

Dating platforms face a mixed risk profile: underage access, scammer infiltration, bot amplification and extortion attempts all touch the same onboarding journey. That means age assurance, document validation and anomaly detection are not separate programmes, they are parts of one governance decision about who may participate and under what conditions. The control objective is not perfect identity certainty. It is reducing the chance that a malicious actor can enter, persist and scale abuse across the platform.

Practical implication: define which fraud scenarios each signal is meant to stop before you tune policy thresholds.


Threat narrative

Attacker objective: The attacker aims to convert platform trust into money, coercion, stolen identity data or other downstream criminal gain.

  1. Entry occurs when fraud actors create fake dating profiles, synthetic personas or bot-assisted accounts to gain access to the platform’s user base.
  2. Credential or identity abuse follows when attackers combine fake profile data, manipulated images and social engineering to build trust and move conversations off-platform.
  3. Escalation happens when that trust is used for investment fraud, sextortion, theft or other real-world harm, often at scale across many victims.
  4. Impact is platform-wide damage through user loss, reputational harm, regulatory scrutiny and the multiplication of abuse across the network.
  • Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.


NHI Mgmt Group analysis

Dating verification is now fraud infrastructure, not a front-end feature. The control decision has moved upstream because abuse now starts at account creation and profile fabrication, not only in post-login behaviour. That changes how identity teams should think about platform trust: the onboarding layer is where the abuse economics are either raised or removed. Practitioners should treat verification policy as a fraud prevention architecture decision.

Synthetic identity is the core failure mode, not just bot traffic. Romance scams, deepfake profiles and AI-generated sextortion all depend on believable identity presentation that survives casual scrutiny. Once that presentation is accepted, downstream controls have to deal with harm after the fact. The governance problem is therefore not only detection, but the platform assumption that profile authenticity can be judged visually or socially. Practitioners should re-evaluate where authenticity is actually established.

Age assurance and liveness checks belong in the same risk conversation. Dating platforms often separate underage access, impersonation and scam prevention into different review paths, but the attacker does not respect those boundaries. A single onboarding journey can be used to bypass age controls, create false trust and seed extortion later. That makes the platform’s risk model incomplete unless it ties age, identity and fraud signals together. Practitioners should align these controls around one abuse taxonomy.

Trust loss is the business signal that identity governance has failed. The article is right to connect user safety, retention and legal exposure because fraud on dating platforms is not confined to isolated victims. Repeated abuse degrades the platform’s legitimacy and drives a larger exodus than any single scam case. The implication for practitioners is that identity governance is a product trust issue, not just a security queue.

Verified identity must be evaluated as a user experience control with security consequences. The operational question is not whether friction exists, but whether the right users can complete verification quickly enough while attackers are screened out. A platform that cannot do both will either lose legitimate users or invite abuse. Practitioners should measure verification as a balance of abuse resistance and conversion, not as a binary pass-fail gate.

What this signals

Identity verification is becoming the platform’s first fraud decision. Dating services can no longer treat sign-up as a neutral access event because the attacker’s objective is often to create a durable false persona. The programme implication is that verification policy, fraud analytics and trust & safety operations need to be governed together, not as separate queues.

Trust boundary control now matters more than static account proof. The key question is whether the platform can prove a user is real enough, live enough and low-risk enough for the next action they want to take. That shifts identity governance toward dynamic decisioning, where onboarding, messaging and payment-risk signals inform one continuous control model.


For practitioners

  • Tighten onboarding verification at the trust boundary Require identity checks before profiles can message at scale or reach high-risk features, so fake accounts are stopped before they can seed scams.
  • Pair liveness detection with document validation Use facial biometrics, replay resistance and document review together to reduce synthetic profile creation and impersonation.
  • Add anomaly signals to verification decisions Feed device, location and enrolment anomalies into decisioning so suspicious registrations are challenged before they become active accounts.
  • Unify age assurance and fraud policy Set one policy model for underage access, scammer infiltration and deepfake abuse, rather than maintaining separate thresholds that attackers can route around.
  • Measure fraud as a trust metric Track scam complaints, bot density, verification pass rates and user abandonment together to see whether the control is protecting platform trust or merely shifting friction.

Key takeaways

  • Dating platforms now face fraud patterns that turn identity presentation into a criminal tool, especially when synthetic profiles and sextortion are involved.
  • The article links the problem to material business harm, including more than $1 billion in global romance-related fraud in 2024 and $389 million lost by older adults.
  • The practical response is to make verification part of the fraud control stack, with liveness, document checks and anomaly signals working together.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

FrameworkControl / ReferenceRelevance
OWASP Non-Human Identity Top 10NHI-04 — Insecure AuthenticationThe article centers on verifying real users and stopping synthetic profiles at signup.
NHI-10 — Human Use of NHIDating scams exploit human trust through fake identities and synthetic personas.
Recommendation — Apply stronger identity proofing and liveness checks before accounts can enter the platform. Treat profile creation as an abuse-control problem and block identities that are built to deceive people.
NIST CSF 2.0PR.AA-05 — Access Permissions, Entitlements and AuthorizationsThe platform must decide which users are allowed to reach higher-risk actions.
Recommendation — Gate messaging and other sensitive actions behind risk-based authorization decisions.
MITRE ATT&CKTA0001;TA0009;TA0040 — Initial Access; Collection; ImpactThe article describes fake-profile entry, trust-building and downstream victim harm.
Recommendation — Map scam account behaviour to initial access, collection and impact tactics in your abuse detections.
CIS Controls v8CIS-5 — Account ManagementDating platforms need strong lifecycle controls for account creation and abuse suppression.
Recommendation — Enforce account creation review and rapid removal of abusive or synthetic accounts.

Key terms

  • Identity verification: Identity verification is the process of confirming that a user, workload, or agent is the entity it claims to be before access is granted. In AI-heavy environments, that verification must include the requester, the system acting on its behalf, and the sensitivity of the action.
  • Liveness Detection: Liveness detection is the mechanism that checks whether a biometric sample comes from a real, present person rather than a spoof such as a photo, screen, or mask. In identity programmes, it is a core defence against presentation attacks and should be tested under realistic operating conditions.
  • Synthetic Profile: A synthetic profile is an account built from fabricated or stitched-together identity details to appear legitimate enough for platform access. These profiles often use real images, generated media, or reused data points to bypass weak onboarding checks and scale fraud activity.
  • Age Assurance: Age assurance is the set of controls used to determine whether a person can access content or services restricted by age. It can include document checks, biometrics, in-band verification and decision logging, but the governance requirement is the same: the organisation must be able to justify the outcome.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
NHIMG Editorial Note
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org