Skip to content
RESEARCH INDEX BREACHROAD / INTELLIGENCE NOTE

A relationship first, an investment later: spotting romance scams without blame

A criminal may build closeness for weeks before revealing an apparent opportunity. Learn the manipulation signs and a response that does not start with shame.

PUBLIC RESEARCH
AUTHOR
/ CEO of Breachroad · OSCP · PNPT
PUBLISHED
2 September 2026
READING TIME
9 min read
TOPIC
Human Security
A relationship first, an investment later: spotting romance scams without blame

It does not begin with an investment. It starts with an “accidental” message, an easy conversation and someone who seems to listen. Contact moves from a dating app or social network to a private messenger. The conversation becomes part of every day. Only after trust exists does money enter the story.

That is what separates a romance scam, also called romance baiting, from an aggressive investment advert. The criminal does not sell a platform in the first message. They first create a relationship in which financial advice sounds as though it comes from someone close.

The pattern matters more than one clue

In its February 2026 guidance, Europol identifies signs that gain meaning in combination: very rapid attachment, generic or repetitive messages, inconsistencies in the story, avoidance of meetings or video calls, requests for intimate material and a gradual shift towards money, gifts, travel costs or investments.

No single clue proves fraud. Someone may dislike video calls or genuinely travel often. The concern grows when every question receives a convenient answer, every meeting is postponed, and emotional closeness develops much faster than basic facts can be verified.

In the investment version, the contact shows their own results and proposes a “safe” start with a small amount. The site may look professional, display charts and even allow a modest withdrawal. Later comes a better opportunity, pressure for a larger deposit or a fee needed to unlock the profit. The balance is part of the story, not proof that the money exists.

Why a warning from family can be hard to hear

Relatives often see only the transfer. The person involved sees weeks of conversation, care, shared plans and someone who knows private parts of their life. Saying “this is obviously a scam” does not erase that relationship. It can make the contact with the criminal secret instead.

A better conversation begins with curiosity:

  • “How did you meet, and what have you independently verified?”
  • “Can you withdraw the money without paying another fee?”
  • “What happens when you suggest an ordinary meeting or video call?”
  • “Can you take a 48-hour break without consequences?”
  • “Could we check the company together, outside the links they sent?”

The aim is not to win an argument. It is to restore time and an independent point of view.

Boundaries that protect without shutting people out

An online relationship can be real, so the right rule is not “trust nobody”. Use these boundaries instead:

  1. Do not send money, cryptocurrency, gifts or banking details to someone whose identity has not been verified independently.
  2. Do not invest through a platform or link recommended in a private conversation. Check the entity yourself in the relevant regulator’s register.
  3. Do not share intimate material under pressure to “prove trust”. Europol warns that it may later be used for control or blackmail.
  4. Do not receive or forward money for an online relationship. You may be used to move criminal proceeds.
  5. Before a large decision, show the complete story to someone you trust, not only a screenshot of a profit.

If you suspect it is already happening

Step back, but first preserve chats, profiles, web addresses, bank accounts, cryptocurrency wallets and transaction records. Do not send another payment for an alleged tax, verification or withdrawal release. Do not pay a “law firm” or “hacker” promising recovery for an advance fee either.

Contact the bank, exchange or payment provider immediately. Report the profile to the platform and the crime to the police. If you shared passwords, identity documents or intimate material, say so explicitly because it changes the plan for protecting accounts and evidence. Suspicious domains and incidents affecting Poland can also be reported to CERT Polska.

Europol stresses that embarrassment is common but being targeted is not a personal failure. That is practical response advice: help without judgement makes it more likely that someone will reveal the full scope quickly and stop sending money.

Organised crime, not a private embarrassment

In July 2026, INTERPOL reported that Operation First Light 2026 involved 97 countries and territories, led to 5,811 arrests and identified more than 142,000 victims of multiple social-engineering fraud types. The operation included romance, impersonation and investment scams. Those figures do not describe one dating app or romance baiting alone, but they show the industrial scale behind the manipulation.

The warning signs, escalation pattern and victim guidance come from Europol. The operation figures come from INTERPOL. The 48-hour pause, family questions and separation of a relationship from an investment decision are Breachroad conclusions.

Pair this article with our guide to deepfake-promoted investment scams. We provide employee cybersecurity training that helps people recognise pressure and ask for help without shame, including when a private relationship begins to affect company money or data.

SHARE / COPY