Attack Methods and Offender Strategies

Across the reviewed, human‑approved evidence, relationship‑based online frauds—including classic romance scams, catfishing, and hybrid investment variants often labelled pig‑butchering—operate as staged social‑engineering sequences. These sequences typically begin with a deceptive profile and initial contact, proceed through grooming and rapport building using personalized and often formulaic messaging, include small compliance tests or information probes, and culminate in escalating monetary or data extraction accompanied by tactics to frustrate recovery or detection. Multiple independent empirical, linguistic, experimental, offender‑perspective, and forensic studies document recurring elements in this staged progression and document distinct variant paths (for example, direct crisis requests versus investment‑platform inducements). Methodologically, the literature combines victim and complaint corpora, small qualitative interviews, offender ethnographies and interviews, experimental live‑interaction work, discourse and corpus analyses, court‑judgment coding, and blockchain forensics; each method contributes different evidence about specific stages or tactics and also carries specific limitations that affect generalizability and inference. ^{[1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12]}

Reproducible staged progression of attacks

Multiple empirical and analytic studies converge on a multi‑stage progression used by many relationship‑based scammers: (1) creation of a deceptive profile and initial contact, (2) grooming and rapport building through personalized interaction, (3) small initial requests or information probes to test compliance, and (4) escalation to monetary requests or staged investment propositions that culminate in extraction and possible re‑targeting or recovery fraud. ^{[1] [2] [4] [3]}

Classic stage models and corpus/discourse analyses place explicit monetary requests toward later correspondence stages, and experimental live‑interaction work shows offenders adapt strategies responsively as perceived reward or target behavior changes—supporting a dynamic, feedback‑sensitive sequence rather than a single rigid script. ^{[2] [4] [13]}

Profile construction and initial approach

Offenders commonly construct idealized, often repeat‑templated online profiles that foreground attractive photos, high‑status or sympathetic biographical elements, and tailored personal attributes to increase appeal. Comparative corpus analyses and validated profile‑classification tasks find scammer profiles use narrower vocabulary ranges, repeated evaluative adjectives (e.g., ‘honest’, ‘loving’), and distinctive first‑person, attribute‑heavy phrasing consistent with formulaic self‑presentation. ^[14]

Empirical studies report that most romance‑fraud campaigns initiate on dating or social‑networking sites and that offenders commonly attempt to move correspondence off the hosting platform to encrypted or private channels (for example, WhatsApp or private messaging) to reinforce exclusivity and reduce platform detection. ^{[15] [16] [17] [4]}

Verified‑profile experiments and comparative corpus work examined static profile features by directly comparing known scammer profiles with verified genuine profiles. One corpus‑based study compared 500 user profiles identified as having fraudulent characteristics with 500 user profiles downloaded from five popular dating portals. A separate experimental study used 20 verified scammer profiles and 20 known real profiles matched on gender and age. ^{[14] [18]}

Grooming mechanics and persuasive tactics

Grooming routinely uses personalized attention, exaggerated romantic language (love‑bombing), and narratives invoking sympathy or shared identity. Corpus and qualitative studies document repeated scripted language, time pressure, manufactured crises (medical bills, travel or customs problems), and appeals to purported authorities to legitimize requests. ^{[15] [9] [19] [20] [21]}

Studies identify interactional devices to maintain engagement—prompts to respond quickly, repeated follow‑ups, and staged disclosures that increase intimacy—while some analyses highlight that scripts are not always completed (research samples show a nontrivial proportion of attempted interactions end before a crisis request), indicating heterogeneity in execution and opportunity for interruption. ^{[4] [9]}

Escalation, compliance testing, and extraction mechanics

Tactical escalation commonly follows a foot‑in‑the‑door pattern: small early requests or informational probes (for example, photographs or minor gifts) serve as compliance tests and precede larger financial demands. Message‑corpus analyses and victim‑report studies show that explicit money demands tend to appear after rapport has been established or after a reward cue, and repeated or additional money requests are a frequent trigger for victims to recognize fraud. ^{[4] [2] [22]}

In investment‑focused variants, offenders sometimes stage early apparent profits and permit small test withdrawals to build confidence prior to inducing larger deposits; withdrawal attempts are then blocked or delayed with successive fee or tax pretexts that extract further funds or prevent recovery. ^{[23] [24]}

Pig‑butchering and hybrid investment variants

A distinct hybrid—commonly labelled pig‑butchering (Sha Zhu Pan)—follows the same hunting and grooming logic but redirects targets into fabricated investment or trading platforms. Studies that analyze victim narratives, police chat extracts, and forensic traces report a three‑phase lifecycle in these schemes: hunting (target selection and initial contact), nurturing/fattening (long‑term grooming and staged small gains), and harvesting (induced large cryptocurrency deposits and withdrawal barriers). ^[3]

Forensic and tracing work on crypto‑enabled romance cases documents consistent operational patterns: offenders show apparent early profits on fake platforms, allow small test withdrawals to build confidence, then block withdrawals and introduce successive fees or taxes. Blockchain‑forensics case studies additionally reveal structured on‑chain architectures (hub/intermediary/holding layers) used to aggregate and launder proceeds in some traced networks. ^{[23] [12] [11]}

Organizational forms, offender perspectives, and role differentiation

Evidence from offender and survivor accounts and transaction‑architecture analyses documents that relationship‑based scams commonly involve organized, specialized syndicate structures and staged operational chains. Recruited individuals are assigned to distinct groups responsible for victim communication, personal‑data resources, IT/telecom support, and money laundering, and operations typically follow sequential stages: organizational formation, organizational operation, target selection and relationship building, fund solicitation and extraction, transfer of victim funds, distribution of proceeds, and evasion of investigation. Survivor interviews from scam compounds in Cambodia, Myanmar, and Laos corroborate accounts of recruitment, division of labor, and staged operations, and thematic blockchain‑forensics analysis of financial flows has identified recurring patterns such as aggregation, redistribution, layering, balance retention, mining‑pool exposure, and internal connectivity. Additionally, offenders use multiple communication channels to increase perceived legitimacy and reinforce victim trust and compliance. ^{[3] [25] [17] [10] [11]}

Offender‑perspective studies also note socialization and neutralization mechanisms that facilitate entry and persistence: peer training, economic pressures, rationalizations (game, livelihood, or restitution narratives), and organized recruitment channels. Several offender‑focused empirical studies caution about generalizability because samples are purposive and often hotspot‑based, but they nonetheless document patterns of specialization and sometimes coercive labor recruitment in large compound operations. ^{[26] [27] [28] [29]}

Methodological patterns, limitations, evidence gaps, and future directions

Research has employed survivor interviews, systematic review, and blockchain transaction analysis. A review identified common scammer profile features and techniques, countermeasures, and factors associated with becoming a scammer or a victim. One study used 32 in-depth interviews with survivors of scam compounds in Cambodia, Myanmar, and Laos. Another analyzed the internal transaction structure of 29 sanctioned Bitcoin addresses linked to the Prince Group and Chen Zhi. One finding across studies is that requests for money typically appear near the end of romance scams. ^{[2] [6] [10] [12]}

Authors explicitly identify several priority evidence gaps and research directions reflected in the reviewed records: the lack of fraudster‑derived investigation of offender strategies; investigation of scammers’ behavioral patterns, including risk‑avoidance strategies; limited knowledge of how pig‑butchering scams persuade and how those conversations unfold; use of experimental dependent measures that capture fraudsters’ personal identity claims, requests to move channels, victim‑identity manipulation, relationship framing, follow‑up, and message length; and the need to directly interview fraudsters about their incentives and to compare those interview findings with experimental results. ^{[4] [3] [30] [13]}

Different research methods document distinct kinds of evidence. Small, in-depth qualitative or forensic studies can reveal operational detail of scams, as shown by interviews with 32 scam-compound survivors and calls for more linguistic analysis of fraud cases. Experimental or corpus-based studies can test specific mechanisms, as when dependent measures captured fraudsters’ strategies such as identity claims, requests to move channels, relationship framing, follow-up, and message length. Blockchain-forensics analyses can identify recurring behavioral patterns (for example, aggregation, redistribution, layering, balance retention, mining-pool exposure, and internal connectivity). ^{[9] [13] [10] [11]}

References

1. Whitty, MT. (2013). Anatomy of the online dating romance scam DOI
2. Dreijers, G.; Rudziša, V. (2020). Devices of Textual Illusion: Victimization in Romance Scam E-Letters DOI
3. Wang, F.; Zhou, X. (2022). Persuasive Schemes for Financial Exploitation in Online Romance Scam: An Anatomy on Sha Zhu Pan (杀猪盘) in China DOI
4. Dickinson, T.; Wang, F.; Maimon, D. (2023). What Money Can Do: Examining the Effects of Rewards on Online Romance Fraudsters’ Deceptive Strategies DOI
5. Dickinson, T.; Wang, F. (2023). Neutralizations, Altercasting, and Online Romance Fraud Victimizations DOI
6. Bilz, A.; Shepherd, LA.; Johnson, GI. (2023). Tainted Love: a Systematic Literature Review of Online Romance Scam Research DOI
7. Wang, Fangzhou; Topalli, Volkan (2024). The cyber-industrialization of catfishing and romance fraud DOI
8. Abubakari, Yushawu (2024). Modelling the modus operandi of online romance fraud: Perspectives of online romance fraudsters DOI
9. Faber, P. (2024). The Frames of Romance Scamming DOI
10. Franceschini, Ivan; Li, Ling; Bo, Mark (2023). Compound Capitalism: A Political Economy of Southeast Asia’s Online Scam Operations DOI
11. Stern, Matthew; Choi, Kyung-shick (2026). Three-Tier On-Chain Transaction Architecture in a Sanctions-Linked Pig-Butchering Network: A Blockchain-Forensics Case Study DOI
12. Parti, Katalin; Choi, Sinyong; Dearden, Thomas (2026). Analyzing Modern Scam Typologies: From Pig-Butchering and Nigerian Advance-Fee Fraud to Crypto Airdrop Schemes DOI
13. Wang, Fangzhou; Dickinson, Timothy (2024). Hyperpersonal feedback and online romance fraud: an empirical examination DOI
14. Lee, KF.; Chan, MY.; Mohamad Ali, A. (2022). Self and desired partner descriptions in the online romance scam: a linguistic analysis of scammer and general user profiles on online dating portals DOI
15. Walther, Joseph B.; Whitty, Monica T. (2020). Language, Psychology, and New New Media: The Hyperpersonal Model of Mediated Communication at Twenty-Five Years DOI
16. Gillespie, AA. (2017). The Electronic Spanish Prisoner DOI
17. Cross, Cassandra (2018). (Mis)Understanding the Impact of Online Fraud: Implications for Victim Assistance Schemes DOI
18. Whitty, MT. (2019). Who can spot an online romance scam? DOI
19. Annadorai, Kalaivani; Krish, Pramela; Shaari, Azianura Hani; Kamaluddin, Mohammad Rahim (2020). Mapping Computer Mediated Communication Theories and Persuasive Strategies in Analysing Online Dating Romance Scam DOI
20. Whitty, MT. (2013). The Scammers Persuasive Techniques Model: Development of a Stage Model to Explain the Online Dating Romance Scam DOI
21. Wang, F.; Topalli, V. (2022). Understanding Romance Scammers Through the Lens of Their Victims: Qualitative Modeling of Risk and Protective Factors in the Online Context DOI
22. Cross, C. (2023). “I knew it was a scam”: Understanding the triggers for recognizing romance fraud DOI
23. Botha, Johannes George; Singh, Kreaan; Leenen, Louise (2025). Analysis of a Cryptocurrency Investment Scam: Pig Butchering DOI
24. Anderson, Matthew; March, Evita; Land, Lesley; Boshuijzen-van Burken, Christine (2024). Exploring the roles played by trust and technology in the online investment fraud victimisation process DOI
25. Lee, Hyejin; Boo, Minseo (2025). Analyzing the Evolving Modus Operandi of Romance Scams via Court Judgments: Crime Script and Policy Implications DOI
26. Toku, L.; Otu Offei, M. (2023). Service, game and livelihood, the new dimensions of neutralization techniques in Internet Romance Fraud: Extending the Neutralization Theory in Modern Internet crimes. DOI
27. Franceschini, Ivan; Li, Ling; Hu, Yige; Bo, Mark (2024). A new type of victim? Profiling survivors of modern slavery in the online scam industry in Southeast Asia DOI
28. Luo, Qiaoyu; Zhao, Yun (2025). Butcher or be butchered: understanding the unwitting recruitment by cybercrime groups in China DOI
29. Han, Bing (2026). Romance Fraud in China DOI
30. Dove, Martina (2024). Scam Techniques in Pig Butchering Scams: Case Study DOI

This AI-assisted synthesis is based on reviewed evidence records. It may contain errors or omissions. Follow the publication and DOI links, consult the original works, and make your own judgment about the evidence.