How do attackers use romance scams?

How romance scams work as an attack pattern

Romance scams are not just “fake dating” stories, they are a deliberate social engineering pattern. Attackers pace contact to build credibility, then use that trust to request money, redirect the victim to another channel, or pull personal information that supports later fraud. The scam often succeeds because the emotional relationship becomes the control surface.

That trust-building phase is the important operational feature. The attacker is testing what the target will disclose, how quickly they will comply, and whether the target can be moved away from platform safeguards into a private chat where the attacker controls the pace, tone and narrative.

What attackers try to obtain

The immediate goal is often money, but that is only one outcome. A romance scam can also be used to obtain credentials, recovery codes, identity documents, payment details or enough personal data to support account takeover and impersonation later. In that sense, the scam is often a data-gathering step before it becomes a deeper fraud campaign.

Attackers also exploit the emotional relationship to normalize requests that would otherwise look suspicious. Urgent travel costs, medical emergencies, account recovery stories and “temporary” transfers are common because they create pressure, reduce verification and make the victim feel personally responsible for helping.

Why detection is difficult before the loss happens

Romance scams work because the warning signs are spread across multiple interactions rather than appearing as one obvious malicious event. A single unusual payment request may not look decisive on its own, but rapid relationship escalation, repeated excuses to avoid video verification, and inconsistent identity details usually form a clearer pattern when viewed together.

Attackers benefit from moving the victim off-platform early because that can reduce moderation, reporting and fraud friction. Once the conversation is private, the attacker can replay stories, exploit sympathy and steer the target toward payments or disclosure without the platform’s usual protections.

Risk and Threat Considerations

Romance scams create both direct financial loss and secondary exposure through credential theft, identity data collection and follow-on fraud. The threat is not limited to a single payment request, because the attacker may be building a reusable profile of the target for future account recovery abuse or impersonation.

Failure mechanism: The attacker uses emotional dependency, channel migration and believable urgency to lower the target’s verification threshold until the target authorises a transfer or reveals sensitive information.

Impact: Victims can lose money, expose credentials or personal data, and become easier to target again through account takeover, impersonation or additional scam stages.

Practitioner Guidance

What to verify: Treat identity verification as a separate step from relationship-building. If the contact resists live verification, avoids consistent biography details, or introduces urgent financial need soon after contact begins, assume elevated fraud risk and slow the interaction down.

Decision rule: If the request involves payment, credential recovery, or disclosure of personal data, require independent verification through a channel you already trust. Do not let sympathy, time pressure or repeated contact replace verification.

Practitioner takeaway: The key judgement is to separate emotional trust from transactional trust, because romance scams succeed when the victim starts treating affection as evidence of legitimacy.

Related resources from NHI Mgmt Group

• Why do romance scams become more effective when attackers move conversations off platform and use AI generated voice or images?
• How do attackers turn a supply-chain incident into wider NHI compromise?
• How do attackers operationalise stolen OAuth tokens at scale?
• Why do attackers often check model availability before trying to generate content?