Investment and romance scams: detection patterns

Investment and romance scams are among the most common and damaging types of fraud affecting customers today. Financial losses are often significant, and the emotional impact can be just as severe. 

Although the stories differ, the mechanics are similar. Criminals build trust over time, apply pressure through emotion, and persuade victims to make authorised payments. Credentials are not compromised, and authentication usually succeeds. 

For banks and payment service providers, this creates a difficult challenge. 

Traditional fraud controls are often designed to stop unauthorised activity, not manipulation that unfolds gradually and appears legitimate on the surface. 

What are investment and romance scams? 

Investment and romance scams rely on deception rather than technical compromise. Victims are persuaded to transfer funds willingly, believing the payments serve a legitimate purpose. 

In investment scams, criminals present opportunities that appear credible and professional. Victims may be promised: 

• High or guaranteed returns,
• Access to exclusive or time-limited opportunities,
• Professional-looking trading platforms or dashboards,
• Payments are framed as deposits, investments, or administrative fees. Apparent early “returns” are often shown to encourage further transfers. 

Romance scams focus on emotional connection. Criminals build relationships over weeks or months before requesting funds, often citing: 

• Medical or personal emergencies,
• Travel expenses,
• Business difficulties,
• Joint investment opportunities.

In both cases, trust replaces technical compromise as the main attack vector. 

Why these scams are hard to detect 

Investment and romance scams often bypass traditional controls because: 

• Payments are authorised by the customer,
• Transactions may start with small amounts,
• Payment behaviour can appear reasonable in isolation.

Emotional manipulation also plays a major role. Victims may act under pressure, excitement, or fear, overriding rational checks and ignoring warnings. 

Effective detection depends on observing behaviour over time, not assessing single transactions in isolation. 

Common behavioural patterns banks should monitor 

While individual transactions may appear legitimate, scam activity often follows recognisable patterns over time. 

Gradual escalation of payments 

Most scams don't begin with large transfers. Instead, they often involve small initial “test” payments, reassurance after apparent success, and increasing amounts as trusts grows. 

Escalation is one of the strongest indicators of scam activity and should be closely monitored. 

Repeated payments to new or specific beneficiaries 

In this case, victims frequently add new beneficiaries, make repeated transfers to the same recipient, and continue payments even after receiving warnings. Repetition combined with novelty is a key risk signal. 

Payments that don't align with the customer profile 

Examples include customers with no investment history making large “investment” payments, sudden cross-border transfers, as well as activity that doesn’t match the user’s income, occupation, or previous behaviour. Context is often more informative than transaction value alone. 

Emotional or urgent behaviour 

Scam victims may show signs of emotional pressure, such as panic, excitement, or anxiety, urgency to complete payments, and requests for secrecy or reluctance to involve the bank. These behaviours frequently correlate with escalating fraud risk. 

Resistance to intervention 

A particularly important signal is resistance. Victims may insist on proceeding with payments and/or simply dismiss any warnings and risks. 

A typical investment scam pattern 

A common scenario follows a predictable path: 

• A customer discovers an online trading platform.
• A small initial payment is made.
• A dashboard shows apparent gains.
• Larger transfers follow.
• Requests for additional “fees” or “taxes” appear.
• Funds become unrecoverable

Without behavioural monitoring, detection often occurs only after losses are final. 

How banks can improve detection 

More effective detection combines behavioural insight with timely intervention. 

Key elements include: 

• Behavioural monitoring over time to identify escalation and repetition.
• Contextual risk scoring based on customer history and behaviour.
• Beneficiary analysis to identify repeated payments to new or high-risk recipients.
• Vulnerability detection to spot signs of manipulation or repeated exposure.
• Human-led intervention for sensitive cases where automated blocking is not enough.

How Trapets supports scam detection 

Trapets helps financial institutions identify investment and romance scam patterns before losses escalate. 

Key capabilities include: 

• Behaviour-driven monitoring to detect escalation, repetition, and abnormal payment behaviour.
• Real-time risk scoring during the payment journey.
• Cross-channel context combining transactional, behavioural, and historical data.
• Risk-based alert prioritisation to focus attention on the most critical cases.
• Integrated case management with clear documentation of decisions and actions.

Learn how Trapets supports compliance teams with effective AML solutions.