Dating App Scam Investigation: What Can Actually Be Proven

What an investigation can and cannot establish

The distinction matters because most victims arrive with the same request: find out who they are. In a typical case the honest answer is that the identity behind the profile is not knowable from outside, and pursuing it is usually the least productive line of work.

What is establishable. The chronology of the relationship, with timestamps. The platform accounts involved and when they were created or changed. The receiving accounts that took the money, the banks or payment institutions that hold them, and the dates of each transfer. Whether the images used appear elsewhere on the internet and how widely. Whether the same infrastructure has been used against other people. Whether the victim's own accounts were accessed without authorisation. The total loss, documented in a form an insurer or a bank will accept.

What is usually not establishable. The real name, location and legal identity of the operator. A photograph is not an identity, and reverse image search returning a stock model or an influencer is the most common single finding in these cases. Shared infrastructure suggests a group, not a person. And even where a receiving account holder is identified, they are frequently a money mule recruited through a job scam, not the operator.

What is never legitimate. Accessing someone else's accounts, buying a "trace" from a vendor who claims to have database access, paying a recovery service a percentage of the loss upfront, or using the victim's credentials to log into the scammer's profiles. Each of those either destroys the evidential value of the case or continues the fraud under a different name.

The practical output of a competent investigation is therefore a document set - timeline, evidence schedule, financial flow, platform analysis - rather than a name. That set is what unlocks reimbursement, triggers a platform action, and gives law enforcement something to work with. Cases that produce a name but no evidence schedule rarely recover anything.

Why these cases are structurally hard

Three structural features explain why romance and confidence fraud has the lowest recovery rate of any financial crime category, and none of them is a failure of effort.

The victim participates voluntarily. Every transfer was authorised by the account holder. Card schemes, banks and regulators build their protections around unauthorised transactions, and an authorised push payment to an account the customer chose is a different legal category. That is the single most important fact in the case, and it shapes every recovery route that follows.

Time is on the fraudster's side and against the evidence. The relationship runs for weeks or months before money moves, and the money moves in many small transfers rather than one large one. By the time a victim accepts what happened, the receiving accounts have usually been emptied and abandoned, and the messaging history sits on a platform with its own retention policy.

Jurisdiction is dispersed by design. The profile claims one country, the phone number is from a second, the receiving bank is in a third, the crypto exchange is in a fourth, and the operators sit somewhere else again. Each border adds a legal process that takes months and has a defined end point - often a polite refusal.

The numbers reflect that structure. In 2024 the FBI's Internet Crime Complaint Center recorded 17,910 confidence fraud and romance complaints with reported losses of 672,009,052 dollars, part of a record 16.6 billion dollars in total reported losses across 859,532 complaints. Every one of those figures is a floor: the FTC's own research on mass-market fraud has consistently found that only a small single-digit percentage of victims ever report to a government agency at all.

The first 48 hours: preserve before you block

The instinct to block and delete is understandable and it is the most damaging thing a victim can do in the first two days. Blocking removes the conversation from the victim's own view on some platforms, and deleting it removes it permanently. The order of operations below is not fussy; each step exists because a bank, an insurer or a detective asked for it and it was gone.

Capture the whole conversation, not the highlights. Export where the platform allows it - WhatsApp offers chat export with media, Telegram offers desktop export, Instagram and Facebook allow a download of your information that includes messages. Where export is not available, screen-record a scroll-through and then take discrete screenshots of the parts that carry money requests, account numbers, links and timestamps. A screenshot without the timestamp, the sender handle and the platform chrome is much weaker.

Do not accept or open new files. Documents, APKs and "investment platform" links sent near the end of a scam are frequently malware. If anything was installed at the operator's direction - a trading app, a remote-support tool, a "verification" utility - treat the device as compromised and stop using it for banking before anything else in this list.

Write the money list from your own bank, not from memory. Download statements covering the whole relationship and mark every outbound payment: date, amount, beneficiary name as shown, reference, payment type. Victims routinely under-report their own losses by 20 to 40 percent when working from memory, and the bank's records are the ones that count.

Preserve the profile as it was, not as it is. Profiles are edited and deleted quickly once reported. Capture the profile URL, the handle, the photos, the bio, the follower pattern, and the creation cues on the account. A screen recording of the profile page from a second account is worth more than a screenshot from the victim's own, because it shows what a stranger sees.

Keep the originals. Work from copies. Original files carry creation and modification metadata, and re-saving a screenshot through a messaging app strips it. Store the originals unmodified, hash them, and record the hash alongside the file name in a simple evidence schedule - this is the same discipline any forensic examiner applies and it costs nothing.

Evidence that survives scrutiny

There is a wide gap between evidence that convinces a friend and evidence that convinces a bank's fraud team, an insurer's claims handler or a court. Four properties separate them.

Authenticity. Can the source be shown to be what it claims? A messaging export from the account that sent and received the messages is stronger than a forward. A screenshot is weakest. Where the case may reach litigation, an examiner can capture the device forensically and document the chat database directly, which removes the authenticity question altogether.

Completeness. Partial conversations invite the argument that context was withheld. Export the full thread, including the parts that are embarrassing. A report that omits the victim's own replies is easy to attack and, in a reimbursement assessment, easy to discount.

Continuity. The evidence schedule should show who held each item from capture to production. In practice this means a numbered list, a hash per file, a storage location and a date - enough that a third party can see nothing was swapped or edited between the capture and the submission.

Contemporaneity. Notes written at the time carry weight; a narrative reconstructed six months later does not. If the victim kept a diary or messaged a friend as events unfolded, those artefacts are evidence too and should be captured with the rest.

The evidence schedule itself is a single table: exhibit number, description, source, date captured, hash, and where the original is stored. It takes an hour to build and it is the difference between a report that gets read and one that gets filed.

Building the timeline: the script has a schedule

Romance fraud is not improvisation. The sequences are stable enough that a timeline can be checked against them, and deviations are informative - they usually indicate either a different operator or a victim who was identified as a professional contact and handled differently.

Days 0 to 7: contact and rapport. An approach on a dating app, a social platform or, increasingly, a misdirected message. The profile is attractive, geographically plausible, and often recently created. Conversation moves off the platform quickly - to WhatsApp, Telegram, Line or a "private" number - which is the single most reliable early indicator in the data. The stated reason is usually privacy or a dislike of dating apps.

Weeks 1 to 4: the narrative. A profession that explains travel and unpredictable availability: oil rig, military deployment, UN contract, ship's engineer, surgeon with a charity mission. Video calls are avoided or brief and poor quality. The relationship escalates emotionally faster than any real relationship plausibly would, and exclusivity is established early.

Weeks 3 to 8: the first request. A crisis: a customs fee, a hospital bill, a blocked account, a seized shipment, a phone broken so a gift card is needed. The amount is small enough to seem trivial against the relationship. Payment methods are chosen for irreversibility: gift cards, crypto, remittance to a third party's account, payment to a "lawyer" or "agent".

Weeks 6 to 16: the investment turn. The most common modern variant abandons the crisis narrative and introduces an opportunity. A relative's trading platform, an arbitrage window, a token launch. A small withdrawal is permitted early to prove the platform is real - this is the single most persuasive element of the entire scheme and it is deliberately engineered. Deposits escalate. Withdrawals attract "tax" or "verification" fees.

The end: the freeze. Withdrawal stops working, support goes silent, the romantic contact becomes intermittent and then unreachable. In pig-butchering cases the operator often keeps the emotional channel open for weeks after the money stops, because a victim who still believes in the relationship is a victim who has not yet called the bank.

Mapping a victim's own dates onto those phases produces two things a report needs: the date of first contact, which establishes the dwell period, and the date of the first transfer, which starts most financial clocks.

The money layer: five channels, five different outcomes

Recovery prospects are decided almost entirely by the payment channel, not by the skill of the investigation. A report that separates the loss by channel therefore tells the victim where to spend effort and tells the bank where its own exposure sits.

Card payments. The most recoverable. Card transactions carry a dispute mechanism, a defined reason code and a scheme that arbitrates between banks. Recovery depends on whether the payment was for goods or services never received, and on how the transaction was classified.

Bank transfers. Recoverable only while the money is still in the receiving account, or later under a reimbursement scheme where one exists. Once funds are withdrawn or forwarded, recovery depends on the receiving bank agreeing to act and on the legal regime in its jurisdiction.

Cryptocurrency. Recoverable in a narrow set of circumstances: the destination is a regulated exchange that will freeze on notice, the funds have not moved, and law enforcement engages quickly enough to make a preservation request. Outside those conditions, tracing produces evidence rather than money.

Gift cards. Effectively unrecoverable. The card number is a bearer instrument, and the balance is spent within hours. The brand can sometimes confirm redemption details and those details are useful evidence of where the money went, but the value does not come back.

Cash and remittance. Remittance corridors keep records that a police request can reach, and a money transfer agent can sometimes recall an uncollected payment. Cash sent by post or courier is gone, and the courier's records are the only residue.

Sorting the loss this way in the first week also prevents a common failure: a victim who reports the whole loss as "crypto" because the last and largest transfer was crypto, and never files the card disputes that would have succeeded.

Card payments: the dispute window and what to say

Card disputes have the shortest clock in the case, which is why they belong first in the work plan.

The window. Chargeback rules are set per scheme and per issuer, and the practical limit is often around 120 days from the transaction processing date, with some reason codes allowing longer. That is not long when a victim has spent three months believing in a relationship. Contact the card issuer's fraud line and ask explicitly for a chargeback on the specific transactions, in writing, with the evidence schedule attached.

The reason code. For a romance scam the honest framing is usually goods or services not received, or fraudulent transaction where the merchant is complicit. Naming the wrong reason gets the case rejected on process rather than merit. Ask the issuer which reason code fits the facts rather than guessing.

What to send. Statements with the transactions highlighted, the evidence schedule, a two-page narrative timeline with dates, and a clear statement of what was promised and what was delivered. Claims handlers process volume; a document that can be read in ten minutes is decided differently from a hundred screenshots.

What not to do. Do not describe the payment as unauthorised if the victim made it. Banks check, the inconsistency damages credibility, and in some jurisdictions a false unauthorised-transaction claim is itself an offence.

Bank transfers: recall, reimbursement schemes and realistic odds

An authorised push payment is where most of the loss usually sits, and where the law is most uneven across borders.

Immediate recall. Call the sending bank the same day, state that it is an authorised push payment scam, give the exact payment references, and ask for a recall request to the receiving institution. Speed is everything: the receiving bank can only hold what is still there, and mule accounts are typically emptied within hours to days.

The receiving bank's role. A receiving bank that acts on a recall can freeze the balance and return funds. Its willingness depends on its own fraud controls, its regulatory obligations in its jurisdiction, and whether the account has already been flagged. A well-drafted recall request with evidence attached materially improves the odds.

Reimbursement schemes. The United Kingdom is the clearest example of a regime that does not require unauthorised status. Since 7 October 2024 the Payment Systems Regulator has required payment firms to reimburse victims of authorised push payment fraud made over Faster Payments and CHAPS, up to 85,000 pounds per claim, with an optional excess of up to 100 pounds that cannot be applied to vulnerable customers. Firms are expected to reimburse within five business days, may stop the clock to gather information but must reach an outcome within 35 business days, and claims must be made within 13 months. The 85,000 pound cap covers more than 99 percent of claims by volume; losses above it can go to the Financial Ombudsman Service, whose award limit is 430,000 pounds. The scheme does not apply where the customer was complicit or grossly negligent, and gross negligence is a deliberately high bar that cannot be used against a vulnerable customer.

The United States position. Regulation E protects consumers against unauthorised electronic transfers, with a 60-day window from the statement that first shows the problem for full protection. It does not generally cover a payment the consumer was tricked into authorising. That is why US cases turn on the receiving bank's own conduct, state-level elder financial protection statutes, and civil recovery against the account holder rather than on a federal reimbursement right.

Card versus transfer. A victim who paid by card has a process. A victim who paid by transfer has a request, a scheme if their jurisdiction has one, and a civil claim. Telling people that difference plainly, early, prevents a great deal of wasted effort in the wrong direction.

Crypto: tracing produces evidence long before it produces money

Crypto is the channel where expectations and reality diverge most sharply, and where the second fraud wave is most active.

What tracing does. A public ledger lets an analyst follow a payment from the victim's exchange withdrawal through intermediate addresses to a deposit address at another exchange. That produces a flow diagram with timestamps and a probable endpoint: a specific exchange account. That is evidence, and it is genuinely useful - it is what a preservation letter or a subpoena attaches to.

What tracing does not do. It does not identify the account holder. Attribution requires the exchange to respond to legal process, and exchanges in permissive jurisdictions frequently do not. It also does not recover funds by itself. The window is between deposit and withdrawal, and sophisticated operations sweep deposits within minutes through chains of addresses, mixers or bridges.

Where recovery actually happens. Cases that end in a return of funds share a pattern: the deposit went to a large, regulated exchange with a compliance team, the victim reported within days, and law enforcement or the exchange's own law-enforcement channel issued a preservation request before the funds moved. That is a narrow path and it is entirely time-dependent.

The recovery-hacker problem. Victims who search for help find an industry of crypto recovery services. The pattern is consistent: an upfront fee, a persuasive dashboard showing recovered funds pending release, then a demand for a tax or gas fee before withdrawal. Some of these operations are run by the same networks that ran the original fraud, working from the same victim lists. A legitimate engagement does not ask for a percentage of the loss in advance, does not promise recovery, and does not require payment in crypto.

Identity: what can legitimately be established

Identity work in these cases is bounded by law and by what the internet actually contains. The legitimate techniques are all open-source or consensual, and each produces a probability rather than a fact.

Image analysis. Reverse image search across multiple engines, including regional ones, plus checks against stock libraries and social platforms. The typical finding is that the photographs belong to a real person with no connection to the case - a model, a soldier whose photos were harvested from a public profile, a surgeon in another country. That finding is itself valuable: it converts the case from a claim about a person into a finding that an identity was impersonated, which is the framing banks and platforms respond to.

Metadata. Original image files sometimes carry camera or software metadata that narrows the source. Most platform uploads strip it, which is why capturing files as sent - rather than re-saved screenshots - matters.

Infrastructure. Phone number ranges, the registration history of any domain used for a fake platform, hosting and certificate data, and email header analysis where an email was received. These produce indicators that link separate victims to the same operation, which is often more useful to law enforcement than a name.

Writing and behaviour patterns. Script structure, recurring phrases, time-zone clues in message timing, and the vocabulary of the pitch. Analysts use these to cluster cases rather than to identify individuals, and clustering is what turns a single complaint into a pattern a police unit will act on.

The limit. Anything that requires accessing an account, a device or a private database without consent is out of scope, and in most jurisdictions a criminal offence. An investigator who claims otherwise is selling something other than an investigation.

Deepfakes and voice cloning: why a video call proves nothing now

For twenty years the standard advice was to insist on a live video call. That advice has expired. Real-time face-swap software runs on consumer hardware, and voice cloning needs only a few seconds of sample audio, which is trivially harvested from a public video or a voice message.

What the reporting shows. Victims describe calls where the face matched the photographs, the voice matched the voice notes, and the conversation was plausible - and where the person on the other end was synthetic for its entire duration. FBI field offices have publicly warned about AI-generated voice messages being used to make these schemes more believable, and the 2025 complaint data records a small but growing set of romance losses with a stated AI component.

What still works as a check. Asynchronous, unpredictable verification. Ask the person to perform an action that a pre-recorded or face-swapped stream handles badly: turn fully in profile while holding a hand up, read a sentence written at that moment with a specific number in it, or respond to a question about something said thirty seconds earlier. Ask for a live video where the phone is passed to another person who says hello - synthetic pipelines handle a single static subject far better than a handover. None of these is decisive, and all of them raise the cost of the deception.

The stronger check. Presence, documents and money all point the same way: a relationship that never becomes physically verifiable and eventually requires money is not a relationship. The behavioural test outperforms every technical one, and it is the only check that scales to a victim who is being managed by a professional.

Platform reporting: what to send and what it achieves

Platform reports are cheap to file and most victims file them badly, which is why they are closed without action.

Report the account, not the conversation. Use the in-app report flow and select the fraud or romance category, then add the specifics in the text field: profile URL, the handle used to move the conversation off-platform, the payment requests, and the dates. Attach the captured profile images.

Report every account involved. The profile on the dating app, the messaging account, the payment-collection account on social media, the fake platform's domain host and its payment processor. Each is a separate report to a separate party, and the payment processor is the one most likely to act quickly.

The domain and the host. A fake trading platform has a registrar, a hosting provider and often a content delivery network. Abuse reports citing impersonation and fraud routinely take the site offline within days - which stops the next victim even when it recovers nothing for this one.

What to expect. Account removal is the commonest outcome and it is not nothing: it interrupts an active operation. Data preservation is rare unless law enforcement asks. Money is never returned by a platform, and any message claiming otherwise is not from the platform.

Law enforcement: what each report actually does

Filing reports is not a formality. Each agency's data feeds a different downstream action, and the choice of where to file determines what can happen next.

IC3 in the United States. The FBI's complaint system feeds its own casework and the recovery asset team that can request a freeze at a receiving institution when funds are still in place. Speed matters more than polish: file within 72 hours of discovering the loss, then supplement. Include wallet addresses, transaction hashes, receiving account numbers and exact amounts.

The FTC. ReportFraud.ftc.gov feeds the Consumer Sentinel database that state and federal agencies query. It does not investigate individual cases, but it is the dataset that establishes patterns and drives enforcement, and it is often the report an insurer or bank asks for as proof the matter was reported.

Local police. Necessary for a crime reference number, which banks, insurers and platforms frequently require. Ask for the reference in writing and put it on every later submission.

Action Fraud and the National Fraud Intelligence Bureau in the UK. Reports are assessed centrally and passed to forces where there is an actionable line of inquiry. The crime reference is again the practical asset, and the UK reimbursement regime makes the paper trail unusually decisive.

Cross-border. Where the receiving account is abroad, the route is mutual legal assistance or a letter rogatory - slow, formal and discretionary. Some jurisdictions have channels for urgent preservation between authorities, but the practical consequence is that speed at the point of loss is worth more than any later legal process.

The data protection angle, and the trap in it

Victims increasingly ask for a subject access request or an erasure demand against the platform or the messaging service. Both rights exist; in a fraud case one of them is a mistake.

Access. Under the GDPR, and equivalents in the UK and elsewhere, a data subject can request a copy of their personal data, usually within one month. For a messaging platform that can produce the account metadata and message content the service holds - useful corroboration, and sometimes the only surviving copy of a conversation the victim deleted. Requests should specify the date range and the identifiers used.

Erasure. A successful erasure request removes the data from the platform. In an active fraud case that is the opposite of what the victim needs, because the platform's copy is often the only evidence that the account existed. Erasure is for afterwards, once the case is closed and the claim is settled.

The investigator's own position. Any professional handling this material is a controller or processor of sensitive personal data. That means a defined purpose, minimum necessary collection, a retention period, secure storage, and a clear statement of who the report will be shared with. A report that circulates freely through WhatsApp groups is a liability to the client and to the case.

When the victim is a parent or a person with capacity concerns

A large share of these cases involve older victims, and the dynamics change when family members are the ones making the call.

Consent is the whole question. An adult with capacity decides for themselves, including the decision to keep sending money. Family members who want the accounts frozen, the phone monitored or the contact blocked need a legal basis: a power of attorney that covers financial decisions, a deputyship or guardianship order, or a documented finding of incapacity. Without one, an investigator acting for the family is acting against the account holder, and that is not a lawful engagement however good the intentions.

What helps when consent exists. A single point of contact at the bank, a written authority on file, and a report framed for the bank's vulnerable-customer team rather than its general fraud queue. Banks have specific processes for suspected exploitation of a vulnerable customer, and they respond to them faster than to a generic complaint.

Safeguarding. Where there is coercion, dependency or a pattern of repeat victimisation, adult safeguarding services and, in the UK, the banking protocol route exist precisely for this. They are not optional extras; they are often the fastest way to stop the loss.

What a legitimate engagement looks like, and what it costs

The recovery market is polluted by operators who target victims a second time. A few structural markers separate real work from the rest.

Scope stated before payment. A defined deliverable - timeline, evidence schedule, financial flow, platform analysis, report - with an hourly or fixed fee. No percentage of recovered funds, no success fee on money that has not been recovered, and no payment in crypto or gift cards.

No promises about outcomes. Recovery depends on banks, exchanges, prosecutors and foreign authorities. Anyone guaranteeing a return of funds is either guessing or lying.

No requests for account access. An investigator may ask for exports and statements. They should never ask for a password, a one-time code, or remote access to a device, and they should never need to log in as the client.

Deliverables that can be used by someone else. The test of a report is whether a bank's fraud team, an insurer and a police officer can each use it without the investigator present. Reports that only make sense with the author in the room are not evidence.

Realistic cost and duration. A single-jurisdiction case with complete records is typically a matter of days of analyst time. Cross-border tracing with platform and infrastructure analysis runs into weeks. Costs are driven by the number of payment channels and jurisdictions, not by the size of the loss, which is why a small case with a card payment and a clear counterparty can be cheaper to resolve than a large one spread across five channels.

The sextortion overlap, and why it changes the plan

A significant minority of dating app cases turn into image-based extortion, and the correct response is different from a financial fraud case in one important respect: the payment is not the main harm, and paying reliably makes it worse.

The pattern. The conversation moves to a video call or an exchange of intimate images, sometimes with the other party apparently initiating. Within days comes a demand, with a threat to publish to family, employers or followers, and a screenshot of the victim's contact list as proof of reach. The amount demanded is usually small, calculated to be paid quickly.

What works. Stop responding, do not pay, capture the demands as evidence, report the account on the platform where the contact list was scraped, and report to the FBI's IC3 or the local equivalent. Payment is followed by escalation in the overwhelming majority of cases, because a payer is a proven revenue source. In cases involving minors, the appropriate route is a child protection report to law enforcement and to the platform, and the urgency is higher.

Where an investigation helps. Establishing which accounts are involved, whether the contact list was scraped from a single platform, and whether the same infrastructure has targeted others. What it cannot do is guarantee that images will not be published, and any vendor who makes that promise is selling reassurance rather than a service.

Prevention that actually holds up

Advice in this area is usually either useless or condescending. A short list of behaviours that change outcomes:

Keep the conversation on the platform for longer than feels polite. Every move to WhatsApp or Telegram within days of matching is a signal, and platforms are where the reporting and blocking tools actually work.

Verify in a way the other person can pass. A live video where they respond to something said moments earlier, plus one asynchronous proof - a photograph holding a handwritten note with a word you choose. A real person finds this trivial; a synthetic pipeline finds it expensive.

Never send money to someone you have not met, in any form, for any reason. Not a customs fee, not a hospital bill, not a trading account, not a gift card, not a courier. The first request is the test, and agreeing to it converts a suspicious contact into a revenue stream.

Set the boundary before the emotion arrives. People who decide in advance that they will not send money to someone they have never met in person are dramatically less likely to be persuaded by a well-constructed crisis, because the decision has already been made by someone calmer.

If it has already happened, tell one person today. Shame is the fraudster's most valuable tool. Cases reported within 72 hours recover money far more often than cases reported after three months, and the difference is not investigative skill - it is whether the receiving account was still open.

What a completed investigation delivers

The end product is a document set, and its value is measured by what other parties can do with it.

A chronology with dates from first contact to last payment, mapped against the standard phases so that a reader can see where the case departed from the pattern.

An evidence schedule listing every exhibit with its source, capture date, hash and storage location, so nothing is challenged on authenticity in a bank assessment or a hearing.

A financial flow by channel: card transactions with merchant identifiers, transfers with receiving institution and account details, crypto with addresses and transaction hashes, and totals that reconcile to the statements.

A counterparty and infrastructure section covering the profiles, the domains, the hosting, the phone ranges and the overlap with other reported cases - the part that turns an individual complaint into a pattern.

A recommendations page stating, plainly, which recovery routes remain open, which deadlines apply, what each is likely to achieve, and what is no longer worth pursuing. Half the value of the work is telling a victim where to stop.

That structure is the same whether the case ends with a bank reimbursement, a civil claim against a mule account holder, or a police file that goes nowhere. The difference is what the reader can do with it - and a report written for the reader, rather than for the investigator's invoice, is the one that gets acted on.

Where to go next

If the loss sits in cryptocurrency rather than a card, the tracing and freeze mechanics are set out in our guide to cryptocurrency scam recovery. If the case has moved into civil or criminal proceedings and the evidence has to stand up in a hearing, the standard for exhibits is covered in digital forensics for legal cases. And where the cash flow is corporate rather than personal, the counterparty and account work overlaps with our digital forensics service; you can start a scoped case through the contact page.