Initial Stages of Romance Scams [Guest Diary], (Tue, Jan 27th)
Source SANS ISC Handlers Diary
Description
[This is a Guest Diary by Fares Azhari, an ISC intern as part of the SANS.edu BACS program]
Impact
For European organizations, the primary impact of this threat lies in the potential financial and emotional harm to employees, which can indirectly affect workplace productivity and morale. Individuals targeted by romance scams may suffer significant financial losses, identity theft, and psychological distress. Organizations may face reputational damage if employees fall victim and sensitive corporate information is inadvertently disclosed during the scam. Given the scammers' tactic of claiming UK residency and employment, UK-based individuals and organizations are particularly at risk. The widespread use of messaging apps across Europe facilitates the reach of these scams. Additionally, the emotional toll on victims can lead to increased support costs and potential legal liabilities for organizations if scams intersect with corporate resources or networks. While the threat does not compromise IT infrastructure directly, the social engineering aspect can be a vector for broader fraud schemes or insider threats if victims are manipulated into revealing sensitive information.
Defensive guidance
Mitigation should focus on comprehensive user education and awareness campaigns tailored to recognize the early signs of romance scams. Employees and the general public should be trained to treat unsolicited messages, especially those claiming 'wrong number' contacts, with skepticism and avoid sharing personal information. Organizations should encourage verification of identities through live video calls and caution against moving conversations to alternative platforms or numbers without validation. Implementing policies that discourage the sharing of corporate or personal sensitive information over informal communication channels can reduce risk. Reverse-image search tools should be promoted to verify the authenticity of profile pictures or images received. Security teams can monitor for reports of such scams internally and provide support to victims. Collaboration with law enforcement and reporting mechanisms for romance scams should be facilitated. Additionally, organizations can deploy messaging platform controls to limit unsolicited contacts and educate users on privacy settings to reduce exposure. Since the scam relies on psychological manipulation rather than technical exploits, technical controls alone are insufficient; a human-centric defense approach is essential.
Summary
Romance scams represent a sophisticated form of social engineering fraud that unfolds over multiple phases, primarily targeting individuals via messaging platforms such as WhatsApp. The initial contact phase typically involves the scammer sending a message under the guise of a 'wrong number' to lower suspicion and elicit a brief, helpful reply. Following this, scammers employ rapid rapport-building techniques, including over-the-top compliments and personalized messages, to disarm and engage the target. They establish fabricated identities, often claiming to be foreigners working in the UK with credible-sounding occupations like 'Business Analyst,' to build trust and explain linguistic inconsistencies. The scammers use scripted, copy-pasted replies for complex topics to maintain a veneer of legitimacy. After several days, they request to move the conversation to a 'personal' phone number, signaling a hand-off to a different operator or team specializing in long-term grooming. This phase is marked by changes in writing style, simpler grammar, and the use of likely stolen or AI-generated images to maintain engagement. Over time, they build credibility by sharing images and stories of financial success, luxury lifestyles, and charitable activities to emotionally prime victims for eventual financial requests. The scam's monetization phase often takes months and involves deep emotional manipulation. Practical detection indicators include unsolicited 'wrong number' messages, quick requests to switch communication platforms, refusal to engage in live video calls, and suspicious images that can be reverse-searched. The threat does not involve direct technical exploits but relies heavily on psychological manipulation to achieve financial fraud.