Organised love scammers are gearing up for a flurry of fraud before Valentine’s Day, according to a cybersecurity company.
Virtual private network provider NordVPN said scammers were mobilising for Saturday’s day of romance and it detected a January spike in scammer activity.
It said fraudsters were “gearing up to exploit the seasonal focus on dating app usage and online social interaction as Valentine’s Day approaches”.
Scammers were sharing tips on secretive Telegram channels where tactics to run large-scale love scams were discussed.
“Romance fraud remains a high-yield form of fraud because it exploits trust, loneliness, and manufactured trust.”
NordVPN said scammers knew dating app usage rose before Valentine’s Day, when people were expected to be more open to emotional interaction.
“Activity then spreads out across the rest of the year, but rarely reaches the same level seen at the start of the year,” NordVPN said.
Organised teams rather than a lone catfish lurking in a basement were now often running love scams, the company said.
“What’s especially concerning is how criminals strategically prepare in January, knowing millions of people will be looking for connections ahead of Valentine’s Day,” said Mantas Sabeckis, NordVPN senior threat intelligence researcher.
“In January, fraudsters exchange tactics, buy accounts, and advertise scam-enabling services,” the company said.
That groundwork meant scam operations could run at full speed in February.
“Criminal discussions show a strong focus on mainstream social networks and dating apps,” NordVPN said.
“Despite not being a traditional social media platform, OnlyFans appears prominently in discussions due to the network’s connection to paid adult content and its use in impersonation and content resale schemes.”
The company said fraudsters liked platforms with large user bases and direct messaging features.
“A common tactic is to quickly move conversations to private channels where they can continue outside publicly visible spaces.”
Virtually all major social media platforms showed up in NordVPN’s latest scam watch, but there were some nuances.
“Snapchat and Instagram are prominently featured because they are commonly used for private chats, content sharing, and moving conversations off dating apps,” the company said.
“Facebook, Reddit, YouTube, and TikTok appear slightly less but still regularly. These platforms are likely used for finding targets, community access, or redirecting users to more private platforms.”
Catfish and other romance scammers also used dating apps.
“Tinder and Match are the most heavily targeted dating apps because of their scale and ease of reaching new victims.”
NordVPN said other dating apps appeared less often, likely because of smaller audiences and niches.
Currently, organised scam schemes had multiple steps.
First, stolen or AI-generated photos, scripted conversations, and fake identities might be used.
Next, victims were lured from dating apps to private messaging services.
Then the requests for money started, with criminals requesting gift cards, bank transfers, payment apps, or cryptocurrency.
In a sinister twist, “sextortion” might emerge.
NordVPN said it had detected growing use of intimate image blackmail, including AI-generated content.
And scammers were recycling some of the content they contrived or stole.
“Victim data is often resold and reused in follow-up scams, including fake ‘fund recovery’ offers.”
That would be similar to what have been termed “recovery room scams”, when a scam victim desperate for help was exploited by another scammer.
“Some campaigns also distribute malicious links disguised as photos or video chat tools, which can lead to account takeovers and further extortion,” NordVPN said.
“People seeking genuine connections are often targeted by scammers who exploit their vulnerabilities,” said Marijus Briedis, NordVPN chief technology officer.
“These crimes result in financial loss and lasting emotional harm. Many victims struggle to rebuild trust, both online and in other areas of their lives.”
NordVPN said criminals often posed as soldiers, doctors, or other professionals, and rarely requested money straight away.
“They build trust and emotional dependency by appealing to loneliness, hope, and the desire for companionship.”
Australia’s National Anti-Scam Centre this month released final quarter scam data, showing an increase in romance scam reports and losses across 2025.
“Romance scams remain one of the most financially and psychologically damaging financial crimes in Australia, with more than A$28.6 million [$33.4m] in financial losses reported to Scamwatch between January and December 2025.”
Catriona Lowe, of the Australian Competition and Consumer Commission, said criminals used carefully rehearsed tactics to build trust quickly and shift talk toward requests for money, gifts or personal information.
“Romance scammers operate all year round, but the lead-up to Valentine’s Day is a good time to have a heart-to-heart with loved ones and build awareness of how these scams work so we can help people better protect themselves and others,” Lowe said.
NordProtect managing director Tomas Sinicki offered several pieces of advice for the public:
Meanwhile, police in Auckland and Dunedin today said a woman had been arrested over an alleged romance scam spanning 18 years.
“Over this period, an unsuspecting Dunedin man has lost more than half a million dollars,” police said.
Dunedin police and the Auckland City Financial Crime Unit said a 44-year-old Ellerslie woman was charged with obtaining by deception.
Stay ahead with the latest market moves, corporate updates, and economic insights by subscribing to our Business newsletter – your essential weekly round-up of all the business news you need.