The Evolution of Romance Scams

Love is one of the most powerful forces in human psychology. The desire for connection, validation, and shared future plans can override rational caution in ways few other emotions can. Fraudsters understand this all too well and romance scams are among the most persistent, high-impact forms of social engineering facing financial institutions and customers today.

What makes these scams especially dangerous beyond just their emotional leverage is how they are evolving. Romance fraud has become more structured, more scalable, and more difficult to disrupt at the point of transaction. For fraud teams, that raises a pressing question: are current detection models equipped for what this category has become?

Key Takeaways

• Romance Scams Have Scaled Up
  
  Romance scams have shifted from crude, one-off email lures to structured, scalable operations — the emotional playbook stays the same, but AI now handles the grooming, content, and monetisation at a volume and believability human scammers alone couldn't match.
• AI Enables Scalable, Believable Cons
  
  AI chatbots, deepfakes, and hyper-personalised phishing let fraudsters run persistent, convincing relationships at scale, while cryptocurrency gives them a fast, low-friction way to cash out.
• Fraud Spans Multiple Accounts
  
  Romance fraud increasingly plays out across multiple accounts and touchpoints, meaning detection models built for single-account, single-transaction fraud can miss it — financial institutions need broader, relationship-level visibility to catch it.

The Early Era: Low-Scale, Email-Based Deception

Romance scams are not new. For years, they followed a relatively predictable pattern.

Early variants were typically launched through dating sites, social media platforms, or unsolicited emails. The personas were familiar: the widowed military officer stationed overseas, the offshore engineer, the doctor working in a conflict zone. The storylines were formulaic but emotionally effective, with sudden intimacy, rapid declarations of commitment, followed by a financial emergency that required assistance.

These scams were really slow-burning operations. Fraudsters invested time in building trust over weeks or months before requesting funds. Payments were commonly directed through Western Union, MoneyGram, or international wire transfers. These channels allowed money to move across borders quickly but left a visible financial footprint.

Operationally, these schemes were often run by individual actors or small clusters rather than structured networks. Communication was primarily email-based. Scripts were reused heavily. Linguistic inconsistencies, awkward phrasing, and obvious grammatical errors sometimes acted as warning signs for vigilant victims.

The Evolution of Romance Scams: Technology Accelerates, Psychology Endures

The core dynamic of romance scams: trust, attachment, and exploitation, remains unchanged. What has transformed are the tools enabling scale, believability, and operational efficiency. These tools and infrastructure make falling prey to romance scams more common: recent McAfee research in 2026 found 1 in 7 American adults have lost money to an online dating or romance scam.

The AI Layer: Scale, Believability, and Throughput

Recent advances in artificial intelligence have removed many of the friction points that once constrained romance fraud.

AI Chatbots for Persistent Grooming

AI-driven conversational systems now allow fraud networks to:

• Sustain long-form, emotionally coherent conversations

• Engage multiple victims simultaneously

• Maintain time-zone consistency

• Generate context-aware responses at scale

Large language models can mimic affection, vulnerability, shared ambition, and even subtle emotional pacing with surprising fluency. In structured pig butchering operations, automated systems may manage early-stage rapport building before human operators intervene during financial escalation.

The result is throughput. A single organised network can maintain hundreds of parallel emotional funnels, something that would have required significant manpower in earlier eras.

Deepfake Content and Identity Reinforcement

Visual verification was once a common failure point.

Today, scammers can generate:

• AI-created profile photographs

• Deepfake video clips

• Synthetic "live" calls

• Fabricated social media histories

When victims believe they have seen a live video interaction or heard a consistent voice, psychological anchoring deepens. The traditional safeguard to "ask for a video call" no longer guarantees authenticity. Believability has increased materially.

Hyper-Personalised Phishing and Script Optimisation

AI tools now enable targeted engagement at a level that removes many historical warning signs. Fraud networks can generate tailored messaging based on:

• Career background

• Interests and hobbies

• Geographic proximity

• Cultural context

This reduces the awkward phrasing and linguistic inconsistencies that once exposed deception. Language models also allow operators to test and refine messaging, adjusting emotional triggers, urgency cues, and escalation timing across large victim pools.

Romance fraud is iterative and optimised.

Cryptocurrency and Frictionless Monetisation

Monetisation pathways have evolved alongside engagement tactics.

While traditional wire transfers and remittance services remain in use, modern romance scams increasingly incorporate:

• Cryptocurrency deposits

• Stablecoin transfers

• Cross-border digital platforms

• Layered mule networks feeding crypto off-ramps

Cryptocurrency reduces recovery options, complicates jurisdictional enforcement, and accelerates value movement once victims commit significant funds. Combined with organised mule infrastructure, it enables rapid extraction before institutional intervention can occur.

Romance fraud today combines enduring psychological levers with scalable digital tooling and increasingly agile monetisation channels. For fraud teams, the challenge goes beyond identifying crude deception to detecting highly conditioned behaviour supported by structured, technology-enabled infrastructure.

The Modern Variants of Romance Scams

Romance scams have certainly diversified into more sophisticated financial narratives. Historically, victims were persuaded to send money to resolve an urgent personal crisis like medical bills, travel costs, military leave, frozen accounts. Those things still happen, but now, rather than asking for help, the scammer often invites the victim into an opportunity.

Perhaps the most structured and headline-grabbing modern form is pig butchering.

In these schemes, the scammer builds a romantic or close personal relationship over weeks or months. Instead of requesting emergency funds, they introduce an "investment opportunity", often cryptocurrency or foreign exchange trading, supported by fabricated dashboards and staged initial gains.

Victims are encouraged to invest small amounts first. When those appear profitable, deposits escalate dramatically. Only when significant capital is committed does the illusion collapse.

What differentiates pig butchering is the conditioning process. Victims are invited into and tricked by both love-bombing and perceived wealth creation. Operationally, these schemes are often run from organised compounds with defined roles: groomers, technical support, account managers, and cash-out teams.

This industrialisation allows:

• Parallel victim pipelines

• Script optimisation

• Role specialisation

• Coordinated mule networks for rapid extraction

In an interesting recent case from April 2026, a woman and her son were arrested in Thailand for laundering money for a pig-butchering network in China. Total transactions in the front company that the mother and son were running totalled over $123 million.

Romance Fraud Is a Multi-Account Problem

Modern romance scams do not involve just one manipulated individual.

• They create an ecosystem.

• There is the victim who is manipulated.

• There is the receiving beneficiary.

• There are intermediary mules, some of whom might not even know they're sending money illegally.

• There are laundering accounts.

• There are crypto off-ramps.

By the time significant funds move, the payment is often only one step in a much larger fraud chain involving victims, mule accounts, laundering accounts, and multiple financial institutions. For fraud teams, this creates a structural challenge.

The risk emerges in the connections and in how those roles evolve over time. A manipulated customer may begin with small exploratory transfers, encouraged by someone they met on a dating site or social platform who is guiding them through an investment opportunity. The first deposit might be modest and the second slightly larger.

From the institution's perspective, these payments often appear voluntary and authenticated. There is no obvious coercion. The beneficiary may be newly added but not yet high-risk.

Meanwhile, the receiving account may initially show low-level inbound flows from unrelated individuals; small amounts that, in isolation, do not breach thresholds. Over time, those flows increase in frequency and size before being rapidly dispersed onward through mule networks or converted to crypto.

To disrupt this early, you must evaluate:

• Behaviour across the full customer relationship

• Signals across all interaction channels

• Patterns across counterparties, not just internal customers

• Progression, not just events

This requires continuous account intelligence and classification, not only of your own customers, but of the accounts they interact with.

Acoru's approach is designed around this reality.

Rather than analysing events in isolation, Acoru ingests data from across channels and systems regardless of format or origin and unifies it into a single risk framework. Signals from onboarding, payments, device activity, and counterparty interaction are orchestrated together.

This enables pre-fraud signal detection. Instead of reacting to a high-risk transaction, your company can better identify emerging patterns of romance scams in progress.

See Acoru in Action

Fraud is evolving fast, and the institutions keeping pace are the ones rethinking how they detect, share, and act on intelligence. If the challenges discussed in this episode sound familiar, we would be glad to show you how Acoru works in practice.

FAQ

1. Why do transaction detection models miss romance fraud?

Because the fraud signal isn't in any single payment. It's in the combination of signals across channels that, together, paint a much clearer picture: a new payee that keeps receiving transfers of gradually increasing size over several weeks, a customer calls in about increasing a credit limit or asking about pre-approved loans, and use of a higher-risk payment method like a crypto exchange or cash withdrawal alongside those transfers.

A model scoring each transaction independently sees a handful of small, low-risk payments; it never assembles these signals into the escalating pattern that signals romance fraud. Catching it requires linking activity across the payee, the payment method, and the account over weeks or months, not just flagging individual transactions against, often, static risk thresholds.

2.  What role does cryptocurrency play, and what should fraud teams watch for?

Crypto is often the final off-ramp: funds are moved to an exchange or wallet before disappearing, which limits recovery options. Fraud teams should flag first-time crypto exchange payments, especially when paired with a payee added recently or a customer describing a relationship or investment tip from an online contact.

3. How can fraud teams use AI-driven scam sophistication to their advantage?

Traditional fraud tools score one transaction at a time, which breaks down against scams that build slowly across weeks of small, individually unremarkable actions. Catching them requires continuous, cross-channel monitoring that holds a picture of an account over time, so preparation is visible before a payment is authorized, not after.

In practice, that means watching for:

• A recently added payee where the first payment is started, abandoned partway through the transfer flow, then resumed and completed a day or two later, followed by further payments to that same payee increasing in size over the following weeks.

• A customer service contact, like raising a limit or asking how fast a payment clears, shortly before a payment to a new payee.

• The same payee, device, or wallet newly added by several of your customers with the same pattern.