The gap is weak visibility into the pre-contact layer. Attackers use themed domain registrations, credibility cues and staging infrastructure to look legitimate before any direct interaction occurs. By the time the victim reaches the chat or support flow, the scam has already exploited trust formation. Teams need to detect registration bursts, suspicious naming patterns and off-platform migration early.
How the scam wins before the first conversation
Romance scams rarely start with a live conversation. They usually start with a pre-contact trust setup that makes the eventual chat feel ordinary, expected and safe. The control gap is not just weak moderation of messages, it is weak visibility into the staging layer where attackers register domains, publish credibility cues and prepare the handoff into chat or support.
That matters because the victim is being conditioned before any explicit ask is made. If teams only look after a click, login or payment, they miss the earlier signals that the scam has already established a believable identity and a plausible story.
What early indicators reveal the setup
The useful indicators are usually operational, not conversational. Look for themed domain bursts, lookalike brand or person naming, short-lived landing pages, reused template assets and off-platform migration prompts that move the target away from channels where scrutiny is higher. Those signals are often more reliable than the wording of the eventual message itself.
Domain age, naming clusters and infrastructure reuse are especially useful when they appear together. A single new domain is not proof of fraud, but a pattern of related registrations, copied content and rapid redirection can show that the scammer is building legitimacy at scale rather than improvising a one-off approach.
Why control owners need to move detection earlier
Detection has to shift left of the interaction layer. That means treating registration events, hosting changes and naming patterns as part of the fraud signal, not as unrelated internet noise. In practice, this is where Authorised Push Payment (APP) Fraud Guide is useful, because romance scams often become payment scams once trust has been established and the victim is steered into a transfer, wallet move or account-to-account payment.
For crypto-enabled variants, pre-contact staging often overlaps with fake support flows, wallet setup prompts and other trust-building steps that come before the theft event. Crypto Scam and Drainer Guide helps frame why the earliest compromise point is often the credibility layer, not the payment layer.
Teams should also treat brand protection, domain monitoring and social engineering telemetry as one joined control surface. The practical aim is to spot the scam while it is still assembling trust cues, before the victim is nudged into a private chat, a support form, a spoofed website or a payment instruction.
Risk and Threat Considerations
The risk is that fraud controls become too transaction-centric, so the organisation sees the harm only after the victim has been persuaded. In romance scams, the attacker can build rapport, validate the persona and create a false sense of exclusivity long before any obvious malicious action appears.
Failure mechanism: Attackers exploit the gap between infrastructure creation and user interaction by using themed domains, staged content and channel migration to manufacture legitimacy before scrutiny begins.
Impact: By the time the victim reaches chat or support, trust has already been formed, which increases conversion into payment fraud, credential theft, account takeover or additional social engineering.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-15 — Service Provider Management | Pre-contact scam staging often uses third-party hosting and registration services. |
| Recommendation — Monitor third-party registrations and hosting for abuse patterns tied to scam infrastructure. | ||
| NIST CSF 2.0 | DE.CM-09 — Monitoring for Unauthorized Personnel, Connections, Devices, and Software | Early scam detection depends on monitoring suspicious domains, redirects and related infrastructure. |
| Recommendation — Add domain and redirect telemetry to continuous monitoring for abuse signals. | ||
| MITRE ATT&CK | T1583 — Acquire Infrastructure: Acquire Infrastructure | The answer centers on attackers building themed infrastructure before contact. |
| Recommendation — Hunt for infrastructure acquisition patterns that support fraudulent trust-building campaigns. | ||
Practitioner Guidance
What to verify: Monitor for bursty registration behaviour, recently created domains with high similarity to known themes, repeated hosting patterns and landing pages that funnel users off platform. The key judgement is whether the asset pattern itself is behaving like a campaign, not a single website.
Decision rule: If a domain, page or profile is clearly part of a trust-building funnel, escalate it as a fraud indicator even when no payment has yet been attempted. Waiting for the payment event usually means the control has already failed.
What good looks like: Security, fraud and abuse teams should be able to join registration intelligence, content similarity and channel-migration signals into one workflow so that suspicious pre-contact infrastructure is flagged before it reaches the victim at scale.
Practitioner takeaway: The most important control is earlier visibility into the scam’s setup phase, because once the target has been moved into a private trust relationship, downstream detection becomes much harder.
Related resources from NHI Mgmt Group
- Why do attackers often check model availability before trying to generate content?
- Why do secrets stay dangerous even when they are no longer actively used?
- How should organisations stop romance and investment scams before money moves?
- Why do bank impersonation scams still succeed even when MFA is enabled?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org