Living Evidence Synthesis

Attack Methods and Offender Strategies

Attack Methods and Offender Strategies: How Romance- and Relationship-Based Offenders Identify, Groom, Deceive, and Exploit Targets

Published Aug 31, 2026 Updated Aug 31, 2026 Romance Scam Research Center

Publications: 26
Evidence statements: 275
Cited sources: 26
Synthesis version: 67

Transparency

Evidence and review status

This Living Evidence Synthesis is AI-generated and machine-checked. Administrative approval is separate from content review; no human content review or subject-matter-expert review is recorded.

Source basis: Downloaded PDFs
AI-generated page content: Yes
Automated checks: Passed
Administrative approval: Yes
Human content review: Not recorded
Subject-matter-expert review: Not recorded

How this was prepared

Source basis: This version used preserved evidence from 26 approved publications with downloaded source PDFs.

Source snapshot generated: Aug 31, 2026
AI-generated page content: The executive summary and synthesis body were AI-generated from the preserved evidence snapshot.

Synthesis generated: Aug 31, 2026

Public page updated: Aug 31, 2026
Automated checks: 17 recorded checks passed for the linked synthesis version. 2 nonblocking warnings were also recorded.

Checks completed: Aug 31, 2026
Administrative approval: An authenticated administrator released this page publicly. Publication does not by itself mean the content received expert review.

Published by administrator: Aug 11, 2026
Human content review: No separate human content-review decision is recorded for the linked synthesis. A synthesis approval record exists, but its provenance does not establish a separate human content review.
Subject-matter-expert review: RSRC has not recorded review of this content by a subject-matter or methods expert.

Review-state definitions
Found a possible error? Request a correction.

Across the reviewed evidence, relationship-based online frauds are described as multi-stage deceptions that commonly use fabricated or impersonated social-media profiles—including Facebook and Instagram—to attract targets, present narrative-style profile content emphasizing self- and desired-partner descriptions while excluding non-narrative demographic fields, sustain communication over multiple letters or conversations, and escalate to financially framed extractions such as fake investment schemes or emergency/crisis scenarios. One analysis examined seven scam letter sets containing 18–23 letters each. Another study analyzed a two-year corpus of 53 authentic conversations between a romance scammer and the victim-author. Reported deception types in the reviewed material show fake investment schemes as the most common (54.2%) and emergency scenarios as the second most common (43.0%). The literature also notes limited scholarly attention to fraudsters’ communication strategies and factors influencing those strategies. ^{[5] [2] [1] [4] [6] [7]}

Staged progression and experimental confirmation

Independent analyses support components of a stage-like sequence in relationship-based fraud. One study analysed seven scam letter sets, each containing 18–23 letters. A separate finding reports that a fake profile functions as a key initial mechanism for attracting and connecting with potential romance-fraud victims. Another study compiled a corpus of 53 conversations between romance scammers and the author, collected over a two-year period (2021–2023). ^{[2] [8] [6]}

Controlled sequential-communication experiments and offender-facing interaction studies provide process-level confirmation that money requests typically follow extended rapport-building rather than appearing at first contact, and that offenders adapt some communicative features in response to perceived reward signals from targets. Authors of these experimental studies caution about sample and identifiability limits, but the findings align with corpus-based observations of staged escalation. ^{[7] [9] [6]}

Profile construction and target selection

Offenders commonly create idealized, formulaic, or stolen-photo personas aimed at maximizing perceived credibility and fit with target preferences; comparative profile-corpus studies report narrower vocabulary, recurring personal‑attribute adjectives (e.g., 'honest', 'loving'), and frequent use of first‑person constructions consistent with template reuse. These linguistic and corpus findings also report frequent claims of high-status occupations (military, executive, medical) to justify later requests. ^{[1] [10]}

Case analyses and complaint datasets show that 80% of the offenses were linked to romance scams, and that offenders used Facebook and Instagram to impersonate people and to create fake profiles that advertise attractive individuals or make initial approaches on social networks. One study experimentally used known scammer profiles alongside verified genuine profiles that were matched by gender and age. ^{[5] [12] [11]}

Grooming mechanics and persuasion techniques

Qualitative message-corpus studies, thematic analyses of victim testimonials, and discourse-analytic work identify a recurrent set of persuasion techniques used during grooming: personalization, reciprocity and commitment appeals, manufactured crises and urgency framing, invocation of apparent authority figures, progressive intimacy ('love‑bombing'), and repeated small requests (photographs, minor gifts, contact details) used as early compliance probes. These techniques are typically combined and sequenced to normalize requests and reduce critical evaluation. ^{[13] [2] [14]}

These techniques are typically combined and sequenced to normalize requests and reduce critical evaluation; multiple observational studies note that small earlier compliance acts (information, gifts) commonly precede larger monetary requests and that crisis narratives are frequently used at the point of extraction. ^{[3] [2]}

Extraction pathways and investment‑hybrid (pig‑butchering) variants

Final extraction commonly employs framed emergencies (medical, travel/customs, legal) and, in a large share of recent samples, investment narratives. Studies of pig‑butchering and related hybrid romance–investment schemes document a pattern in which offenders first build prolonged trust and later steer victims toward fraudulent trading or investment platforms showing apparent early returns; victims then face escalating deposit requests and withdrawal obstacles. ^{[4] [15] [16] [17]}

Empirical sources and convicted‑case analyses report diverse cash‑out channels in practice—including gift cards, money‑transfer services, bank transfers, and cryptocurrency wallets—and document that escalation from small initial transfers to large sums is a commonly reported trajectory in victim accounts. ^{[3] [5] [18]}

Organizational modes and offender perspectives

Operational modes vary across contexts: documentary analyses of convictions and investigator interviews describe structured, role‑specialized groups with distinct functions (account/identity creation, chat/grooming personnel, technical support, and cash‑withdrawal or money‑movement roles). These organizational findings are based on court judgments, investigator reporting, and multi‑site qualitative descriptions. ^{[19] [20] [21]}

The batch includes offender-facing research from Ghana: an ethnographic study using interviews and observations of Ghanaian romance‑fraud offenders (methods described) and a hotspot survey that sampled 320 respondents from validated Ghanaian internet romance fraud hotspots. A separate survey of 397 respondents found 303 (76.4%) reported having engaged in some form of cybercrime. ^{[23] [22] [24]}

Methodological patterns, limitations, gaps, and future directions

The evidence base is methodologically heterogeneous: high-value contributions include PRISMA-guided reviews, crime‑script and correspondence analyses, offender interviews, court‑file documentary studies, controlled sequential‑communication experiments, and blockchain forensics. This diversity enables triangulation of recurring tactics but also produces evidence‑specific limits to inference because many studies use small, purposive, geographically bounded samples or rely on self-selected complaint datasets. ^{[25] [2] [5] [7] [8]}

Important evidence gaps identified by authors include: (a) systematic, ethically approved offender interview studies across diverse jurisdictions to explain motives and decision rules; (b) larger authenticated datasets that link conversation transcripts to confirmed payment flows (including blockchain tracing where relevant); (c) cross‑platform comparative research to test whether persuasion repertoires vary by platform or scam subtype; and (d) longitudinal or experimental replication to measure attacker adaptation and tactic effectiveness. ^{[26] [4] [7] [16]}

Where evidence supports it, authors recommend combining offender‑facing qualitative work, larger authenticated conversation‑to‑transfer datasets (including blockchain tracing for crypto-enabled schemes), and replication of sequential‑communication experiments with larger, better‑validated samples to strengthen causal inference about tactic effectiveness and offender adaptation. Cross-disciplinary approaches—linking discourse analysis, behavioral experiments, and forensic tracing—are repeatedly proposed. ^{[7] [8] [16] [6]}

References

This AI-assisted synthesis is based on reviewed evidence records. It may contain errors or omissions. Follow the publication and DOI links, consult the original works, and make your own judgment about the evidence.

Topic evidence hub

Explore the Attack Methods and Offender Strategies evidence base

This synthesis version cites 26 public RSRC records. The broader Library currently contains 211 approved publications mapped to this topic. Newly mapped publications can appear in the topic collection before they are incorporated into a later synthesis version.

Browse 211 topic publications

View 26 cited publication records from synthesis version 67

Citation 1
Self and desired partner descriptions in the online romance scam: a linguistic analysis of scammer and general user profiles on online dating portals
Lee, KF.; Chan, MY.; Mohamad Ali, A. (2022) Crime Prevention and Community Safety
Citation 2
Devices of Textual Illusion: Victimization in Romance Scam E-Letters
Dreijers, G.; Rudziša, V. (2020) Research in Language
Citation 3
Anatomy of the online dating romance scam
Whitty, MT. (2013) Security Journal
Citation 4
Modus Operandi and Blockchain Analysis of Romance Scams: Cryptocurrency-Driven Victimization
Lim, A.; Choi, KS. (2025) International Journal of Cybersecurity Intelligence & Cybercrime
Citation 5
Love, Lies, and Larceny: One Hundred Convicted Case Files of Cybercriminals with Eighty Involving Online Romance Fraud
Soares, Adebayo Benedict; Lazarus, Suleman; Button, Mark (2025) Deviant Behavior
Citation 6
The Frames of Romance Scamming
Faber, P. (2024) Research in Language
Citation 7
Hyperpersonal feedback and online romance fraud: an empirical examination
Wang, Fangzhou; Dickinson, Timothy (2024) Journal of Crime and Justice
Citation 8
Using artificial intelligence (AI) and deepfakes to deceive victims: the need to rethink current romance fraud prevention messaging
Cross, C. (2022) Crime Prevention and Community Safety
Citation 9
What Money Can Do: Examining the Effects of Rewards on Online Romance Fraudsters’ Deceptive Strategies
Dickinson, T.; Wang, F.; Maimon, D. (2023) Deviant Behavior
Citation 10
Mapping Computer Mediated Communication Theories and Persuasive Strategies in Analysing Online Dating Romance Scam
Annadorai, Kalaivani; Krish, Pramela; Shaari, Azianura Hani; Kamaluddin, Mohammad Rahim (2020) Journal of Xidian University
Citation 11
Who can spot an online romance scam?
Whitty, MT. (2019) Journal of Financial Crime
Citation 12
Romance Scam: Victim Manipulation and Human Trafficking
Grace Carvalho Fernandes, S.; BASTOS DO NASCIMENTO, V.; Castelo Branco Do Nascimento, V. (2023) Anais do Congresso Internacional de Relações Internacionais do Amazonas: a Amazônia no mundo e o mundo na Amazônia
Citation 13
Understanding Romance Scammers Through the Lens of Their Victims: Qualitative Modeling of Risk and Protective Factors in the Online Context
Wang, F.; Topalli, V. (2022) American Journal of Criminal Justice
Citation 14
Lovextortion: Persuasion strategies in romance cybercrime
Anesa, Patrizia (2020) Discourse, Context & Media
Citation 15
Romance baiting, cryptorom and ‘pig butchering’: an evolutionary step in romance fraud
Cross, C. (2023) Current Issues in Criminal Justice
Citation 16
Persuasive Schemes for Financial Exploitation in Online Romance Scam: An Anatomy on Sha Zhu Pan (杀猪盘) in China
Wang, F.; Zhou, X. (2022) Victims & Offenders
Citation 17
Analysis of a Cryptocurrency Investment Scam: Pig Butchering
Botha, Johannes George; Singh, Kreaan; Leenen, Louise (2025) European Conference on Cyber Warfare and Security
Citation 18
Unveiling the Romance Scam Scheme: Psychological Manipulation and Its Impact on Victims
Yosiandra, Syakira Yuniar; Sakariah, Dewi Saraswati (2024) HUMANIKA
Citation 19
Unveiling the Patterns of Romance Scams in South Korea
Choi, SW.; Lee, J.; Choi, YJ. (2024) International Journal of Cyber Behavior, Psychology and Learning
Citation 20
Analyzing the Evolving Modus Operandi of Romance Scams via Court Judgments: Crime Script and Policy Implications
Lee, Hyejin; Boo, Minseo (2025) KOREAN CRIMINOLOGICAL REVIEW
Citation 21
Butcher or be butchered: understanding the unwitting recruitment by cybercrime groups in China
Luo, Qiaoyu; Zhao, Yun (2025) Trends in Organized Crime
Citation 22
Modelling the modus operandi of online romance fraud: Perspectives of online romance fraudsters
Abubakari, Yushawu (2024) Journal of Economic Criminology
Citation 23
The client’s consent strengthens the ‘Gamers’ hand; The deterrence theory’s perspective of the Internet romance fraudsters.
Toku, L.; Otu Offei, M. (2023) International Journal of Technology and Management Research
Citation 24
Understanding Cybercrime in Developing Economies: Insights from Agona Swedru, Ghana
Obeng, Charles; Kumah, Paul Kwasi; Asiedu, Hubert Bimpeh; Obeng Senior, Felix Awuah (2024) E-Journal of Humanities, Arts and Social Sciences
Citation 25
Tainted Love: a Systematic Literature Review of Online Romance Scam Research
Bilz, A.; Shepherd, LA.; Johnson, GI. (2023) Interacting with Computers
Citation 26
Therapeutic but toxic spaces: Romance fraud victimization from a psychosocial perspective
Yoshida, Yutaka (2025) Journal of Economic Criminology

Revision history

This history includes approved public synthesis versions. Drafts and unsuccessful generation attempts are not shown.

Version 67
Current public version Aug 31, 2026

Automated claim-level support repair round 2, correcting 2 passages from synthesis version 66.
Version 66
Aug 31, 2026

Automated claim-level support repair round 1, correcting 4 passages from synthesis version 65.
Version 65
Aug 31, 2026

Automated evidence-grounded revision attempt 1. Initial version. This synthesis reproduces several protected, previously verified passages verbatim (experimental confirmation of staged escalation; profile‑corpus linguistic findings; identified persuasion techniques; methodological heterogeneity; prioritized evidence gaps; and cross‑disciplinary recommendations) and integrates them with corroborating empirical findings from profile corpora, victim reports, court analyses, and offender‑facing stud...
- Publications: 26 (-8)
- Evidence statements: 275 (-39)
- Cited sources: 26 (-8)
Sources added: Analysis of a Cryptocurrency Investment Scam: Pig Butchering; Romance baiting, cryptorom and ‘pig butchering’: an evolutionary step in romance fraud; Romance Scam: Victim Manipulation and Human Trafficking.

Sources removed: A new type of victim? Profiling survivors of modern slavery in the online scam industry in Southeast Asia; A scoping review of online romance scams: Conceptual construction and comparative analysis; A Study on Romance Scam : The Current Situation and Effective Countermeasures; Bi-Directional Exploitation of Human Trafficking Victims: Both Targets and Perpetrators in Cybercrime; and 7 more.

View full revision history (67 versions)

Return to Research Insights