US romance scam losses topped $1.14B in a single year (FTC)Total US cybercrime losses hit $16.6B (FBI IC3 2024)Average cost of a data breach: $4.4M (IBM)Roughly 3 in 4 breaches involve the human element (Verizon DBIR)Median romance scam loss: $2,000 per victim (FTC)Business email compromise remains the costliest attack category (FBI IC3)Older adults report the highest total fraud losses (FBI IC3)Most account takeovers start with a reused passwordPhishing is still the number one initial access vectorFeelings meet technology.
../blog
CybersecurityAugust 2026·8 min read

The Perfect Man Doesn't Exist — Anatomy of a Romance Scam

Romance scams don't start with money. They start with attention. Here are the stages, the red flags at each one, and what to do if you recognize yourself in this.

by Pyro Chahua · Cyber Galan

I want to start with the part nobody says out loud: getting caught in a romance scam does not mean you are stupid. It means you were treated with attention, consistency, and warmth by someone whose full-time job was to give you exactly that. Every person I have sat with after one of these cases was intelligent. Most of them were generous. All of them were lonely in a way they had not admitted to anyone, sometimes not even to themselves.

Romance scams are the most human attack I work on. There is no exploit, no malware, no clever bypass. There is a script, a schedule, and a person who reads you better than the people in your life have bothered to. In the United States alone, reported romance scam losses have topped $1.14 billion in a single year, with a median loss around $2,000 per victim. Those are only the people who reported it. Shame keeps the real number somewhere much darker.

Stage one: the contact

It starts somewhere harmless. A dating app, a wrong-number text, a comment on a post about your church, your dog, your grief. The profile looks lived-in — a few years of photos, a job with a story behind it, often something that explains why they can't meet: offshore engineer, surgeon abroad, military deployment, crypto trader who travels.

Red flag at this stage: the photos survive nothing. Run a reverse image search on every picture. If the same face shows up on a different name, you are done — block and move on. A real person's photos have a messy digital trail. A stolen set has one clean origin.

Stage two: the flood

This is where it gets good, and I mean that seriously. Good morning texts. Voice notes. Questions about your childhood. They remember your sister's name. Within two weeks you are talking more with this person than anyone else in your life. Professionals call this love bombing. What it actually is, operationally, is data collection — every story you tell becomes leverage later.

Red flag at this stage: velocity that outruns reality. Real intimacy takes friction and time. Watch for someone who is deeply in love with you before they have ever been inconvenienced by you.

Stage three: the wall

Every attempt at a video call fails. Bad connection. Broken camera. Security policy on the rig. Then a short, blurry call that ends in nine seconds and somehow makes you feel worse for asking. The refusal is never a flat no — it is always an obstacle, so you become the one solving it.

Red flag at this stage: any relationship that cannot survive a five-minute live video call is not a relationship. Say it kindly, say it once, and hold the line.

Stage four: the crisis

The ask never arrives as an ask. It arrives as a problem happening to someone you love. Customs is holding equipment. A hospital bill for their kid. A frozen account. An investment that closes in six hours and they want to bring you in on it. Often they will even offer to pay you back with a check first — that check bounces after your bank releases the funds, and now you owe the money.

  • Gift cards, wire transfers, crypto, or payment apps to strangers — all four are effectively irreversible, which is exactly why they're requested.
  • Any instruction to keep the relationship or the transfer secret from family or your bank.
  • An investment platform they introduced you to that shows beautiful gains and then charges a fee to withdraw.

Stage five: the re-victimization

After the money stops, a second wave often arrives: a 'recovery agent,' an 'investigator,' or a 'lawyer' who found your case and can get your funds back for a retainer. It is the same crew, or one that bought your details from them. Nobody legitimate charges an upfront fee to recover scam losses.

If you're in one right now

  • Stop sending money. Today. Not after one more explanation.
  • Screenshot everything — profiles, chats, wallet addresses, phone numbers, receipts — before you block anyone.
  • Call your bank's fraud line immediately; some wires can be recalled within a narrow window.
  • Report to the FBI IC3 and the FTC. It feels pointless. It is not — it is how these networks get mapped.
  • Tell one person you trust. Isolation is the scam's oxygen.

And then, please, forgive yourself faster than feels reasonable. The person on the other end ran a process that has been refined against thousands of people. You met a machine wearing a face.

If any of this is sitting too close to home — for you or for someone in your family — send it to me. I do a free assessment: I look at the profile, the exposure, the accounts, and I tell you straight what I see. No cost, no lecture, no judgment.

Free security assessment

Want me to look at your situation?

I review every request personally and respond within 48 hours — no cost, no pressure.

request_assessment