Attack Methods and Offender Strategies: How offenders identify, approach, groom, deceive, and exploit targets

Across the reviewed evidence, relationship‑based online frauds are consistently described as staged social‑engineering processes. Multiple independent analyses reproduce a stage‑based sequence in relationship‑based fraud: constructing an attractive or authoritative profile, initiating contact, intensifying interpersonal engagement (grooming), applying incremental compliance probes, making a money request, and (in many cases) continuing exploitation or a post‑discovery second wave. Research that pairs conversation corpora, victim narratives, crime‑script analyses, and case studies also documents operational organization (role specialization, templated scripts, and technical concealment) and two distinct extraction pathways: crisis‑framed advance‑fee requests and romance‑initiated investment (pig‑butchering/crypto‑rom) schemes. Important uncertainties remain about which specific micro‑interactional moves causally produce transfers, the mechanics and prevalence of sextortion within romance fraud, and generalizability across regions and scam subtypes because many studies rely on purposive or single‑case samples. Authors explicitly identify priority evidence gaps and recommend offender‑derived research and multi‑jurisdictional paired datasets that combine chat transcripts with independently verified financial traces and platform logs. ^{[1] [2] [3] [4] [5] [6] [7] [8] [9]}

Staged structure of attacks (recurring sequences)

Multiple independent analyses reproduce a stage-based sequence in relationship-based fraud: constructing an attractive or authoritative profile, initiating contact, intensifying interpersonal engagement (grooming), applying incremental compliance probes, making a money request, and (in many cases) continuing exploitation or a post‑discovery second wave. Crime‑script and qualitative syntheses explicitly map these scenes and find comparable sequences across chat corpora, victim reports, and court-judgment analyses. ^{[1] [2] [3] [4] [10]}

Authors using different data types note variation in step order and that not every case follows every step (for example, some scams begin with an immediate fabricated crisis). Nevertheless, staged descriptions routinely structure linguistic, interactional, and forensic work because they capture recurring operational patterns useful for detection and intervention planning. ^{[1] [11] [2] [10]}

Profile construction and target selection

Scammers commonly create false dating or social‑media profiles that use stolen or glamorous photographs and formulaic narrative structures; comparative corpus studies find scammer profiles use a narrower vocabulary and more repetitive phrasing consistent with templating or profile reuse. These profile features function as the primary mechanism for attracting and connecting with potential targets. ^{[12] [3] [13]}

Targeting strategies vary from high‑volume opportunistic outreach using pre‑prepared conversation templates to more selective profiling based on observable vulnerability signals (public disclosures, emotional expressions, or inferred financial capacity). Empirical work documents both mass‑contact approaches and purposive selection of emotionally vulnerable but resource‑capable individuals. ^{[14] [15] [16] [4]}

Grooming, compliance probes, and channel tactics

Grooming is typically sustained, personalized, and intensifies over time: offenders use declarations of exclusivity, reciprocity, tailored narratives, and small initial requests (gifts, favors, personal details) as probes to test compliance before escalating to monetary demands. Linguistic, conversation‑level, and qualitative analyses identify these incremental compliance techniques and personalization as routine interactional strategies. ^{[13] [1] [17] [18] [19]}

A near‑universal facilitation tactic is pushing communications off public platforms into private or less‑supervised channels (instant messaging, email, encrypted messengers). Research documents rapid channel transfer as a way to reduce platform detection, enable continuous contact, and normalize secrecy, which in turn isolates victims from external support and complicates platform or law‑enforcement responses. ^{[20] [21] [22] [23] [24]}

Adaptation to rewards and extraction modalities

Experimental and offender‑derived studies indicate offenders adapt their conversational tactics in response to perceived victim behavior and reward cues: fraudsters alter strategy when potential rewards change, offer assistance with monetization, and accelerate moves toward private channels and money requests as interactions suggest compliance potential. ^[5]

One common extraction pathway uses emotionally urgent crisis narratives—medical bills, travel/customs fees, legal trouble, or lost funds—presented after trust has been built; these narratives create time pressure and use third‑party authority personas (doctors, bank managers, customs agents) that increase plausibility. Conversation- and case‑level studies, victim testimonials, and crime‑script analyses repeatedly document this crisis‑framed extraction and the use of door‑in‑the‑face reductions when large requests fail. ^{[1] [13] [25] [26]}

A distinct, increasingly prominent pathway is romance‑initiated investment fraud (pig‑butchering or crypto‑rom), in which offenders cultivate romantic trust over weeks or months and then direct victims to fraudulent trading or investment platforms. Forensic and case‑level work documents staged small early returns, platform‑navigation assistance, induced larger deposits, then blocked withdrawals explained by invented taxes, fees, or verification charges. ^{[27] [28] [4] [21]}

Organizational forms, technical concealment, and labor

Multiple sources document organized operations with division of labor—separate host/communicators, resource/data roles, IT/telecom support, and cash‑out or laundering personnel—often operating from compound‑style or call‑center arrangements. Studies describe scripted conversation formats, purchasable image and script bundles, and operational use of translation software and multiple social‑media accounts to sustain credible personas. ^{[4] [29] [14] [30]}

Motivations reported among offender samples commonly include financial need, peer socialization, and perceived livelihood opportunity; neutralization and rationalization themes (game/service/livelihood or restorative narratives invoking colonial reparative language) appear in several offender‑focused studies. Researchers caution that many offender accounts are geographically concentrated and self‑selected, so observed motives and rationalizations may not generalize. ^{[31] [32] [33] [34] [15]}

Sextortion, recognition triggers, and aftermath dynamics

The analysis used O’Malley and Holt’s cyber-sextortion codebook and added variables on offender gender, multiple offenders, image existence, prior relationships, image timing, and malware. The dataset contained limited direct indicators of image theft or hacking (seven reports) and 21 reports noting claimed malware that gave offenders access to images, webcams, or browsing history. In the subset of romance‑fraud reports analyzed, blackmail attempts involved only direct financial requests. Sextortion is likely under‑recorded in this dataset because it was identified by reading a variable‑length free‑text description rather than via a dedicated question, and because some cases classified as romance fraud may not reflect a pre‑existing relationship, complicating distinction from standalone sextortion. ^{[35] [36]}

Victim recognition of fraud most often occurred when additional requests for money were made (251 cases, 25%). Communication-related triggers were reported in 134 cases (13%) and included threats, lies or inconsistencies, ghosting or blocking, and admissions of fraud. In a smaller number of cases (38, 4%), victims cited offender actions—such as repeatedly failing to meet, using victims’ credentials or accounts, or sending obviously false documents—as indicators of fraud. Several studies also reported that some victims experienced a second wave of the scam after discovery, including offenders posing as police or bank managers or claiming to have fallen in love, and that a second wave sometimes exploited victims’ difficulty accepting the deception. ^{[1] [20] [37]}

Methodological patterns, limitations, and evidence gaps

Methodological approaches in the reviewed literature include corpus and conversation‑level analyses of authentic chat material, thematic analyses of victim narratives and police reports, crime‑script mapping from multiple studies, single‑case forensic tracing (including blockchain methods for cryptocurrency cases), and offender‑derived experimental or interview work. Several transparent reviews synthesize empirical study types and identify common themes. ^{[38] [4] [2] [6] [7] [5]}

The evidence repeatedly notes gaps and limitations in the literature: no prior publication has provided a detailed anatomy of the online dating romance scam; research is lacking on the wide variety of online frauds, their victims, and why victims fall for them; and existing romance‑fraud studies have lacked data collected from offenders themselves. Generalizability is constrained in some studies because user demographics may differ across portals and were not considered in sampling, and some corpora were not verified as non‑scammer data and could include scammer profiles. Authors also call for further empirical testing of proposed explanatory factors and for longitudinal studies to track how scams, such as cryptocurrency fraud, evolve over time. Finally, several sources recommend conducting careful, ethically approved interviews with reformed scammers to obtain insider perspectives. ^{[1] [39] [5] [3] [8] [9]}

Authors explicitly identify priority evidence gaps and research directions supported in the reviewed literature: ethically governed offender interviews and ethnographies across diverse settings; larger multi‑jurisdictional datasets that pair chat transcripts with independently verified financial traces and platform logs; longitudinal and cross‑platform tracking of tactic evolution (including AI/deepfake impacts); focused micro‑interactional and experimental work to test which specific moves produce compliance; and more systematic study of trafficking and coerced labor within pig‑butchering operations. ^{[5] [40] [12] [9] [41] [28]}

References

This AI-assisted synthesis is based on reviewed evidence records. It may contain errors or omissions. Follow the publication and DOI links, consult the original works, and make your own judgment about the evidence.