Romance and Investment Scams: Investigating the Networks Behind Relationship-Based Fraud
Source: Fraud Intelligence Lab original analytical framework. It is not a statutory test, regulatory model or law-enforcement investigation standard.
The relationship explains how a victim may have been persuaded to transfer money. It does not necessarily explain who organised the fraud, where the money went or what infrastructure supported the deception. Investigating relationship-based investment fraud therefore requires investigators to move beyond the victim-facing persona and examine payment chronology, beneficiary accounts, cryptocurrency infrastructure, digital identifiers, corporate entities and connections with other victims. The investigative challenge is to connect those elements without treating an association, indicator or analytical pattern as proof of criminal involvement.
Key Points
- Romance fraud, investment fraud and hybrid relationship-based investment fraud overlap, but they should not be treated as interchangeable typologies.
- The relationship narrative may explain victim persuasion, while financial and digital infrastructure may reveal how the wider fraud operation was organised.
- Payment chronology should be analysed alongside the development of the relationship because changes in trust, investment propositions and payment behaviour may be temporally connected.
- Beneficiary accounts, cryptocurrency wallets, telephone numbers, domains, companies and other identifiers can generate investigative leads without establishing that their owners knowingly participated in fraud.
- Cross-victim analysis can increase intelligence value when apparently separate complaints share beneficiaries, wallets, platforms, domains, communications infrastructure or other identifiers.
- Effective network investigation should be capable of corroborating a suspected connection, downgrading it or refuting it altogether.
Introduction
Romance fraud is frequently understood through the relationship between the fraudster and the victim. That perspective is necessary because emotional manipulation, perceived intimacy and accumulated trust can explain why a victim makes payments that appear inconsistent with previous financial behaviour. It is not, however, a complete investigative model. Once money begins moving, the enquiry may extend beyond the person communicating with the victim to beneficiary accounts, money mules, companies, cryptocurrency wallets, payment services and digital infrastructure. The relationship may explain the persuasion, while the infrastructure may reveal how the fraud was organised. For investigators, the critical shift is therefore from asking only who deceived the victim to asking what wider financial and digital architecture made the deception financially effective.
That distinction has become increasingly important as romance and investment fraud intersect. INTERPOL’s Global Financial Fraud Threat Assessment 2026 identifies investment fraud, romance baiting, cryptocurrency fraud and romance scams within the contemporary global fraud environment. The FBI’s guidance on cryptocurrency investment fraud similarly describes these schemes as socially engineered and trust-enabled, with approaches occurring through dating sites, social media, unsolicited messages and other channels. These sources do not establish that every romance fraud develops into investment fraud, or that every investment fraud relies on a romantic relationship. They instead demonstrate why investigators should identify the mechanism evidenced in the individual case rather than force different behaviours into one convenient typology. That distinction matters because classification can influence which evidence investigators seek and which parts of the financial network receive attention.
Current UK figures demonstrate the financial significance without resolving the investigative question. UK Finance reported that investment fraud accounted for £221.5 million of authorised push payment losses in 2025, an increase of 40 per cent year on year, while romance-fraud losses in its dataset increased by 23 per cent to £39.2 million. Separately, City of London Police reported more than £106 million in romance-fraud losses from 9,449 reports during the 2024/25 financial year. These figures arise from different reporting frameworks and should not be combined as though they represent a single population. Their relevance is narrower but important: relationship-based and investment fraud generate substantial volumes of financial activity that can create investigative opportunities beyond the original victim report. The scale of loss also reinforces the need to distinguish individual victim intervention from the wider task of identifying reusable fraud infrastructure.
The central proposition of this article follows from that distinction. The relationship can help explain how the victim was persuaded, while the financial and digital network may help explain how the fraud was organised. An investigation concentrating exclusively on the fictitious persona risks treating the visible deception as the entire criminal architecture. Conversely, an investigation concentrating only on transactions may fail to understand the manipulation that caused the victim to authorise them. Effective investigation requires both perspectives to be connected through temporal sequencing, financial tracing, corroboration, refutation and network analysis. That is the point at which a victim account begins to develop into fraud intelligence.
Romance Fraud, Investment Fraud and the Hybrid Model
Romance fraud ordinarily involves constructing or exploiting a relationship of trust or intimacy for financial gain. Investment fraud instead depends on persuading a person to commit funds to an investment that is fictitious, manipulated or materially misrepresented. The two mechanisms can operate independently. A romance fraudster may request money for an alleged emergency without introducing an investment, while an investment scam may acquire victims through advertising or fraudulent promotions without establishing a romantic relationship. Investigators should therefore establish the behaviour evidenced in the particular case before assigning a typology. Typology should organise investigative understanding rather than substitute for it.
The hybrid model creates a more complicated investigative problem because emotional trust and apparent investment activity become parts of the same deception. INTERPOL identifies romance baiting within the investment-fraud environment, while the FBI describes schemes in which confidence-building precedes the introduction of an apparent cryptocurrency investment opportunity. The apparent investment environment may therefore be part of the representation used to influence the victim rather than an independent financial service through which an unfortunate investment occurred. Investigators should establish what the victim was shown, what money actually moved and whether any genuine investment corresponding to the representations can be independently verified. This requires separation of the victim’s apparent investment experience from the underlying financial reality. The distinction becomes particularly important where an interface displays profits that cannot be reconciled with independently verifiable assets or transactions.
Terminology matters because classification can influence enquiry strategy. Describing every relationship-based investment case simply as romance fraud may concentrate attention on the persona while underemphasising investment and payment infrastructure. Describing every case solely as investment fraud can obscure the emotional conditioning that may explain repeated payments, concealment from banks or continued engagement after warnings. Investigators should therefore be cautious about allowing a typology label to determine the outer boundary of an enquiry. The stronger investigative question is not which popular label sounds most recognisable. It is which sequence of behaviours, transactions and infrastructure the available evidence actually establishes.
The Relationship Is Evidence, Not the Boundary of the Enquiry
A victim’s communications can provide important evidence about how trust developed and how financial requests were framed. Messages may show changes in tone, the introduction of an investment proposition, claims of expertise, representations about returns, pressure to increase deposits or explanations for unsuccessful withdrawals. They may also establish the temporal relationship between emotional reinforcement and consequential financial decisions. That chronology can be particularly important when a victim initially understands payments as voluntary investments rather than transactions induced by deception. Investigators should therefore preserve relevant communications not merely to demonstrate that a relationship existed, but so that representations can be compared with actual financial events. The communications and transactions should be analysed as related evidential streams rather than isolated records.
The Financial Conduct Authority’s multi-firm review of romance fraud provides particularly useful practitioner evidence on this problem. The regulator reviewed six firms and assessed 60 confirmed romance-fraud cases, examining how firms detected and prevented fraud and supported victims. The FCA identified missed detection opportunities involving overseas transactions, multiple payments over extended periods and sudden departures from previous customer behaviour. One reviewed victim made 403 payments over a year and lost more than £72,000, while another made six high-value overseas payments totalling more than £131,000 despite having no comparable previous transaction history. In 25 per cent of reviewed cases, victims obtained money from additional sources, including loans, friends and family or the liquidation of personal assets. These examples illustrate why investigators should compare what is said about a payment with the wider behavioural and transactional evidence.
That distinction requires care because an inaccurate explanation from a victim does not automatically establish dishonesty or criminal complicity. A person under sustained manipulation may conceal the real purpose of a transfer because an offender has anticipated intervention and provided an explanation to use. Alternatively, an unusual transaction may have an entirely legitimate explanation that has nothing to do with fraud. Investigators therefore need to test customer explanations against communications, transaction history, beneficiary information and other available evidence instead of treating either the narrative or the alert as conclusive. The same evidential discipline applies to fraud indicators generally. Suspicion should generate proportionate enquiry, not an automatic finding.
The F.I.L. Relationship-to-Network Investigation Model
Fraud Intelligence Lab proposes a structured model for examining relationship-based investment fraud. It is designed to distinguish the victim-facing progression from the financial and infrastructure-facing progression without assuming that every case contains every stage. The sequence begins with contact and trust because these may explain the victim’s subsequent decisions. It then moves through the investment proposition and apparent investment environment before examining payment escalation and the infrastructure receiving or moving value. Cross-victim corroboration follows because infrastructure may acquire greater intelligence significance when it appears in otherwise separate cases. The final stage is an assessed investigative outcome rather than an assumption of criminality.
Source: Fraud Intelligence Lab original analytical framework. It is not a statutory test, regulatory model or law-enforcement investigation standard.
The model is useful because the person communicating with the victim may not necessarily control every component involved in the fraud. Different actors may potentially perform different functions relating to contact, technical infrastructure, beneficiary accounts, money movement or onward dispersal. Investigators should not assume such role separation without evidence, but neither should they assume that one online persona represents the entire operation. INTERPOL’s 2026 threat assessment places contemporary financial fraud within a wider environment involving transnational criminal collaboration, scam centres and specialist money-laundering capabilities. The analytical purpose of the model is therefore to convert possible relationships into testable investigative hypotheses. It should expand the enquiry without predetermining what that enquiry will establish.
Temporal Sequencing: When Did the Financial Behaviour Change?
A transaction list records movement of money, but temporal sequencing can reveal how that movement relates to other events. Investigators should establish when contact began, when communication intensified, when investment was first discussed, when the first payment occurred and when the value or frequency of payments changed. Withdrawal attempts, demands for further payments, financial-institution interventions and significant changes in the contact’s behaviour should also be placed on the timeline where relevant. Combining these events can reveal whether changes in financial behaviour correspond with identifiable stages of the relationship. The purpose is not to infer causation merely because two events occurred close together. It is to create a structure within which competing explanations can be tested.
A behavioural baseline can make that chronology more informative. First-time cryptocurrency purchases, new overseas beneficiaries, unusual borrowing, liquidation of assets or repeated transfers may acquire greater investigative significance when they emerge after specific communications or financial representations. The FCA identified examples involving first-time or unusual cryptocurrency activity and payments to new beneficiaries, while 25 per cent of the cases it reviewed involved victims obtaining funds from additional sources. Those characteristics remain indicators rather than proof of fraud. Their evidential weight can nevertheless change when independent information shows that the activity corresponds with instructions from an online contact. The investigative question becomes not simply whether the payment is unusual, but what explains the departure from established behaviour.
Payment escalation deserves particular attention because the first transfer may not resemble the eventual loss. Fraudulent investment schemes can use apparent returns, displayed profits or other confidence-building representations to encourage further payments. A small initial payment may therefore perform a different function from a later high-value transfer. Investigators should examine incoming payments or apparent withdrawals as carefully as losses because a return of funds may potentially form part of the persuasion sequence. A payment received by the victim is not automatically evidence that the underlying investment was genuine. The entire sequence needs to be assessed against what was represented and what can independently be established.
From Beneficiary Account to Financial Network
The first beneficiary account is an obvious investigative starting point, but it should not automatically become the endpoint. Investigators may need to establish the account holder, available indicators of control, how the account was opened, whether other relevant payments were received and what happened to funds after receipt. Depending on lawful access and investigative authority, enrichment may include associated transaction counterparties, account information and other relevant identifiers. Corporate beneficiaries may require examination of company records, directors, addresses and filing histories where those records are relevant to the hypothesis under examination. Cryptocurrency payments may require appropriate blockchain and attribution analysis while recognising that a wallet address alone does not necessarily identify the person exercising ultimate control. Each enrichment step should answer a defined investigative question rather than merely accumulate data.
The distinction between ownership, control, knowledge and participation is fundamental. A receiving account may belong to a knowing participant, a recruited money mule, another manipulated person or an entity whose account has been misused. A company may have been established for fraudulent purposes, exploited by another party or connected through an address that has an entirely legitimate explanation. A cryptocurrency address may receive suspicious funds without the available evidence immediately identifying its controller. Network analysis should therefore produce hypotheses and priorities rather than convert every association into an accusation. The evidential question is always what the connection actually establishes.
The F.I.L. Relationship-Based Fraud Network Map
Once relevant identifiers have been extracted, investigators need a disciplined way to organise them. The F.I.L. Relationship-Based Fraud Network Map begins with the victim because that is often where the investigation becomes observable. It then separates the persona and communications from the investment and payment infrastructure before moving towards people, companies and other potentially relevant entities. Onward transactions and shared identifiers are included because they may reveal relationships outside the original complaint. The final stage is a network assessment, not a declaration that every connected node belongs to a criminal organisation. This distinction protects the analytical value of network mapping from being undermined by overstatement.
Source: Fraud Intelligence Lab original analytical framework. It is an investigative organising construct and does not presume that every identified node forms part of a criminal network.
The map should be populated with evidence whose provenance and reliability can be assessed. Relevant identifiers may include telephone numbers, usernames, email addresses, profile material, domains, wallet addresses, beneficiary accounts, company names and other information legitimately available to the investigation. Each identifier should be examined for what it proves, what it merely suggests and what alternative explanation remains credible. Entity resolution is especially important because similar names, recycled contact details, shared service providers and incomplete data can create misleading connections. Investigators should therefore validate relationships before using them to expand an enquiry or support an allegation. A smaller corroborated network is analytically stronger than a large diagram built from weak associations.
Cross-Victim Analysis Can Change the Investigative Picture
A single complaint can make a beneficiary or identifier appear unique to one victim. A second complaint involving the same beneficiary may materially change the intelligence value of that information, particularly where independent identifiers also overlap. Repeated wallet addresses, domains, telephone numbers, payment references or corporate entities can reveal relationships that remain invisible when cases are examined independently. The analytical task becomes partly one of entity resolution: determining whether separate records actually refer to the same underlying account, person, device, organisation or infrastructure. Poor matching can create false associations just as poor data can conceal genuine ones. Cross-victim analysis therefore requires validation, not simply aggregation.
Network comparison can also reveal possible functional relationships. Several personas may direct different victims towards one beneficiary, or apparently unrelated beneficiaries may subsequently connect through common financial or digital infrastructure. Different investment sites may present separate brands while sharing identifiers that justify further examination. Companies may share officers or addresses, although those relationships can have legitimate explanations and require contextual assessment. These patterns can strengthen an investigative hypothesis when corroborated by independent information, but they remain analytical propositions until tested. Network analysis is most valuable when it can both reveal and eliminate connections.
This is where fraud intelligence becomes more than individual case administration. An investigator examining one complaint may appropriately ask whether the victim was deceived, whether a payment can be recovered and whether further loss can be prevented. An intelligence-led enquiry can additionally ask whether the beneficiary, wallet, domain, company or persona appears elsewhere and whether apparently separate reports form part of a wider pattern. That broader analysis may identify additional victims, reusable infrastructure or more consequential disruption opportunities. It can also prevent investigative attention being concentrated exclusively on disposable victim-facing personas. The question becomes not only what happened in this case, but what this case reveals about activity beyond itself.
Case Studies: What UK, US and European Evidence Reveals
UK Case Study: When the Transaction Pattern Contradicts the Surface Narrative
The FCA’s review of 60 confirmed romance-fraud cases provides a useful UK case study because it examines the point at which customer behaviour, transaction monitoring and human investigation meet. In one case, six high-value payments totalling more than £131,000 were sent overseas despite the customer having no prior history of comparable transactions. In another, a victim made 403 payments over a year and lost more than £72,000, with the firm acknowledging that sustained out-of-character activity had not been identified. The FCA also found that 25 per cent of reviewed victims had obtained money from additional sources such as loans, friends and family or liquidation of personal assets. These are not simply red flags to be transferred mechanically into a detection rule. They show how the evidential value of a transaction changes when it is examined against behavioural history, payment sequence and the wider circumstances of the customer.
The practitioner lesson is that an investigator should not allow the customer’s immediate explanation to terminate the enquiry where independently available evidence points towards a material behavioural change. That does not justify presuming that the customer is being manipulated whenever a payment is unusual. It requires the investigator to reconcile the explanation with transaction chronology, beneficiary information, previous behaviour and any relevant communications or intervention history. Where several indicators converge, the case for further enquiry becomes stronger even though none of those indicators independently proves fraud. Where the wider evidence supports the customer’s explanation, the hypothesis should be downgraded accordingly. The quality of the investigation lies in testing the discrepancy rather than automatically preferring either the alert or the customer narrative.
The UK case also illustrates an important distinction between detection and investigation. A monitoring system may correctly identify a high-value transfer without understanding the relationship that produced it, while an investigator may understand the victim narrative without seeing earlier payments that reveal escalation. Neither perspective is sufficient on its own. The control environment therefore needs a mechanism for connecting behavioural change, payment history, intervention outcomes and investigative information. That integration can create opportunities for earlier intervention and more informed disposition decisions. For practitioners, the case study demonstrates why transaction monitoring should be treated as an investigative trigger rather than as an evidential conclusion.
US Case Study: When a Victim Becomes Part of the Financial Chain
A concluded US Department of Justice prosecution demonstrates why the first person receiving or moving money cannot automatically be classified by transactional position alone. In September 2025, the US Department of Justice reported that Charles Uchenna Nwadavid had been sentenced after pleading guilty to mail fraud, aiding and abetting money laundering and money laundering in a scheme involving more than $2 million stolen from at least six romance-scam victims. According to the DOJ, a Massachusetts victim was manipulated into receiving funds from other victims across the United States and subsequently passing those funds through cryptocurrency transactions. The defendant repeatedly accessed accounts in the victim’s name from overseas and transferred funds to cryptocurrency accounts he controlled. The case therefore connected victim manipulation, third-party victim funds, account access and cryptocurrency movement within the same financial architecture. It provides a concrete example of why investigators should distinguish account ownership from operational control and transaction participation from criminal knowledge.
The evidential lesson is particularly important for mule-account investigations. A transaction graph could initially place the Massachusetts victim between other victims and the ultimate recipient, creating an apparent intermediary role. Without the relationship evidence and account-access evidence, that position could be interpreted too simplistically. The concluded prosecution showed that the financial chain had to be read alongside the manipulation that caused the victim to receive and move other victims’ funds. Investigators should therefore test whether an intermediary knowingly facilitated the scheme, was recklessly involved, was itself manipulated or occupied some other role supported by the evidence. Transactional position is evidence of movement; it is not by itself proof of state of mind.
The case also demonstrates why cryptocurrency should be treated as part of the financial investigation rather than as an analytical endpoint. The relevant question is not merely whether cryptocurrency appears in the case, but how the available evidence connects particular transactions, accounts and control to the suspected activity. Attribution may require information beyond blockchain visibility, including account records, access information, communications and other corroborative evidence available through lawful investigative processes. Investigators should be equally cautious about assuming that the holder of a named account necessarily controlled every transaction associated with it. The US case illustrates how stronger attribution emerges when financial tracing and evidence of control are analysed together. That distinction is essential where an investigation is expected to progress from intelligence assessment towards an evidential finding.
European Case Study: From One Intervention to Network Infrastructure
Europol’s Operation PANDORA provides a different practitioner lesson because it demonstrates how an apparently individual fraud event can expose infrastructure associated with activity at much greater scale. The investigation originated in Germany after a bank employee became suspicious when a customer attempted to withdraw more than €100,000 in cash following contact from a purported police officer. Police intervention prevented the money from being handed over, and investigators subsequently examined the telephone infrastructure associated with the attempted fraud. Europol reported that numbers used by the perpetrators could be linked to more than 28,000 scam calls in only 48 hours. As the investigation expanded, authorities examined telephone numbers, owners, servers and locations and ultimately targeted call-centre infrastructure operating across multiple countries. The operation illustrates the investigative transition from protecting one potential victim to identifying infrastructure capable of supporting large-scale fraud activity.
PANDORA should not be misrepresented as a romance-investment-fraud operation. Europol reported that the call centres supported multiple forms of telephone fraud, including impersonation techniques, shock calls and fake investment opportunities, and the operation therefore provides a network-investigation analogy rather than a romance-only case. That limitation is analytically useful because it prevents a common error in fraud research: selecting a large enforcement operation and attributing all its results to the typology being discussed. What PANDORA demonstrates is the investigative value of pivoting from a victim event to reusable identifiers and then testing whether those identifiers expose shared infrastructure. The same reasoning can be applied to relationship-based fraud where beneficiaries, telephone numbers, domains, wallets or other identifiers recur across apparently separate cases. The typology differs, but the intelligence principle remains relevant.
The European practitioner lesson is therefore about investigative scale. A victim report can be resolved as an individual event, or information within that report can be assessed for its potential relevance to other cases. When a telephone number, beneficiary, wallet, domain or corporate entity is treated as a reusable intelligence object, the investigation gains the ability to test relationships beyond the originating complaint. That does not mean every repeated identifier establishes common criminal control. It means repeated infrastructure can justify proportionate enrichment and cross-case comparison. The operational transition is from case handling towards network assessment, with evidential discipline determining how far that transition can legitimately go.
What the Three Case Studies Show Together
The UK, US and European examples address different parts of the investigative problem. The FCA evidence shows why behavioural chronology and customer explanation must be assessed together rather than in isolation. The US prosecution demonstrates why transaction position, account ownership, operational control and criminal knowledge should not be collapsed into a single inference. Operation PANDORA demonstrates how information emerging from one victim event can expose infrastructure with relevance beyond the original case. Taken together, the cases support a progression from victim narrative to financial tracing and then to network assessment. They also demonstrate that moving towards network analysis increases the need for evidential discipline rather than reducing it.
There is also an important difference between these examples that practitioners should preserve. The FCA review is regulatory evidence about firms’ controls and confirmed fraud cases, the US example is a concluded criminal prosecution, and PANDORA is a multi-jurisdictional law-enforcement operation covering several fraud typologies. Their evidential and procedural contexts are therefore not interchangeable. A regulatory finding about missed monitoring opportunities cannot automatically establish how a criminal prosecution should be proved, while an enforcement operation does not necessarily demonstrate that every identified network association would satisfy an evidential threshold in court. Comparative analysis is useful only when those distinctions remain visible. The purpose of the comparison is to extract investigative principles, not to manufacture uniformity between different legal and operational settings.
The Investment Platform May Be Part of the Evidence
A professional-looking investment interface can create the impression that financial activity exists independently of the relationship. Investigators should establish whether the purported investment service is genuine, independently verifiable and connected to the transactions represented to the victim. Balances displayed on a screen should not automatically be treated as assets held on the victim’s behalf. Apparent trades, profits and withdrawal restrictions may instead form part of the representation used to induce further payments. The FBI describes cryptocurrency investment schemes in which fraudulent investment environments can display apparent gains while victim funds remain under criminal control. The analytical requirement is therefore to distinguish what the victim was shown from what actually occurred financially.
Digital material should be preserved and assessed according to what it can establish. Screenshots, communications and account displays may provide evidence of representations made to a victim when properly preserved and authenticated. They do not necessarily establish that the assets, trades or returns represented on screen existed. Relevant enquiries may include platform identity, regulatory status where applicable, domain history and other lawfully obtainable information that tests the platform’s claimed legitimacy. Investigators should avoid allowing the apparent investment interface to dictate their understanding of the underlying financial reality. The stronger approach is to reconstruct the real movement of value independently and compare it with the investment narrative presented to the victim.
A March 2026 US Department of Justice civil-forfeiture action provides a current illustration of the relationship between online contact, investment representations and cryptocurrency tracing. The action seeks recovery of approximately 327,829 USDT alleged to have been involved in laundering funds originating partly from an online romance-fraud scheme targeting a Massachusetts resident. According to the filed case description, the resident was approached through a dating application and later introduced to a purported cryptocurrency investment opportunity. Investigators alleged that victim funds passed through intermediary wallets, with cryptocurrency subsequently traced to wallets seized in August 2025. Because the matter is a civil-forfeiture action, the allegations should not be presented as adjudicated criminal findings. Its practitioner value lies in demonstrating how relationship evidence, investment representations and cryptocurrency tracing can become parts of the same financial investigation.
Alternative Explanations Must Remain Live
Network analysis becomes unreliable when every connection is interpreted in favour of the investigator’s preferred hypothesis. Shared infrastructure can have legitimate explanations, particularly where payment providers, virtual offices, hosting services, cryptocurrency services or professional intermediaries serve many unrelated customers. A common address may reflect a registered-office provider rather than shared operational control. A transaction involving a cryptocurrency service establishes a financial relationship with that service but does not by itself identify the ultimate controller of subsequent assets. Even repeated identifiers can be misleading if data quality, attribution or account compromise has not been examined. Investigators should therefore ask what evidence would weaken the suspected connection as deliberately as they ask what evidence would strengthen it.
Alternative hypotheses should be documented rather than held informally in the investigator’s mind. If two victims paid the same account, the possibilities might include common fraud infrastructure, a money mule, a merchant, an intermediary or another victim being manipulated to move funds. If companies share an address, investigators should determine whether the address is operationally meaningful or merely a common corporate-service address. If a wallet receives funds associated with several complaints, the critical issue becomes whether reliable attribution or control evidence can be developed. This approach makes refutation an investigative achievement rather than a failure to confirm suspicion. Eliminating a false connection can be as important as discovering a genuine one.
The F.I.L. Evidential Escalation Test
The central evidential problem in network investigation is the distance between observing a connection and establishing its significance. Fraud Intelligence Lab therefore proposes an escalation test that forces the investigator to identify which stage has actually been reached. An observation records the directly available information without assigning criminal meaning. An association records a relationship revealed by that information, while an investigative hypothesis proposes an explanation that can be tested. Corroboration or refutation then determines whether independent evidence strengthens, weakens or eliminates the proposed explanation. Only after that process should the investigator formulate an assessed finding proportionate to the available evidence.
Source: Fraud Intelligence Lab original analytical framework. The model is designed to support disciplined investigative reasoning and is not a statutory evidential test.
Consider two victims who have transferred money to the same beneficiary account. The observation is that both payments reached the same account, while the association is the common beneficiary. A reasonable hypothesis might be that the account forms part of infrastructure supporting a common fraud operation. Investigators would then seek information capable of corroborating or refuting that explanation, including relevant account activity, communications, attribution and other independent identifiers where lawfully available. The assessed finding should reflect what that evidence actually establishes rather than what the initial pattern appeared to suggest. This prevents analytical confidence from increasing faster than evidential support.
Practitioner Implications: From Relationship Narrative to Network Investigation
The first practitioner implication is that payment analysis should examine sequences rather than isolated transactions. New beneficiaries, first-time cryptocurrency purchases, abrupt increases in payment values, overseas transfers, borrowing and rapid onward payments may become more informative when compared with the customer’s historical behaviour and relevant communications. The FCA review found missed opportunities involving several of these characteristics and demonstrated the importance of effective monitoring calibration and investigative response. An alert should therefore be understood as the beginning of an enquiry rather than its conclusion. Detection identifies activity requiring attention, while investigation determines what that activity means.
The second implication is that investigators should distinguish the customer’s stated payment explanation from the underlying payment purpose. A customer may repeat an explanation provided by the person influencing them, or may withhold information because they fear intervention will damage a relationship they believe to be genuine. Equally, an unusual explanation may be completely legitimate. Investigative questioning should therefore seek corroboration and context rather than treat inconsistency as proof of deception by the customer. This is especially important where emotional manipulation has developed over weeks or months. The quality of the investigative conversation can determine whether an alert produces useful intelligence or simply another transaction decision.
The third implication concerns the scope of financial analysis. Investigators should establish the relevant loss and payment chronology across available channels rather than assume one payment rail captures the whole event. Transfers, cryptocurrency purchases, cash withdrawals, card payments and movement between a customer’s own accounts may each contribute different information to the chronology where they are relevant to the case. A wider analysis can identify escalation, changes in funding sources and attempts to continue payments after intervention. It can also expose the point at which the customer’s established financial behaviour began to change. A fragmented payment review risks producing a fragmented understanding of the fraud.
The fourth implication is that investigators should extract reusable intelligence from individual cases. Beneficiary accounts, wallet addresses, telephone numbers, domains, email addresses, usernames, companies and other relevant identifiers should be assessed for their potential relevance beyond the originating complaint, subject to applicable law, governance and data-protection requirements. Reappearance in another case can increase intelligence value but should not automatically increase evidential certainty. Entity resolution and validation remain necessary because reused services, compromised accounts and coincidental similarities can produce false connections. The objective is to make cross-case comparison possible without converting correlation into accusation. That is the point at which case information begins to function as fraud intelligence.
The fifth implication is that investigators should record refutation as deliberately as corroboration. A network hypothesis that survives serious attempts to identify alternative explanations is analytically stronger than one constructed solely from confirming information. Investigative notes and disposition rationales should therefore identify what was observed, what relationship was inferred, what hypothesis was tested and what evidence strengthened or weakened it. Significant intelligence gaps should remain visible rather than being concealed by confident language. This approach improves reviewability and reduces the risk that subsequent investigators inherit assumptions as though they were established facts. Evidential discipline is particularly important when network analysis connects individuals or organisations to suspected criminal activity.
What Control Owners and MLROs Should Ask
Control owners should ask what behaviour their monitoring is actually capable of detecting. A system designed primarily around single-transaction thresholds may struggle with a fraud process that begins with smaller payments and escalates as trust develops. The FCA found that successful controls could draw on combinations of information while other reviewed cases exposed significant missed opportunities. The relevant control question is therefore not whether romance fraud appears somewhere in a rule library. It is whether the system can identify meaningful behavioural change early enough to create an effective intervention opportunity. That question moves control assessment from nominal typology coverage towards actual detection capability.
False-positive analysis should also form part of that assessment. Increasing sensitivity without improving investigative relevance can generate larger alert volumes while overwhelming the staff expected to interpret them. Controls should therefore be evaluated against the quality and actionability of the signals they generate, the information available to investigators and the outcomes of previous interventions. Confirmed fraud can identify patterns that deserve consideration in future detection, while false positives can reveal where calibration is too broad or contextual information is missing. Investigation should feed control improvement rather than operate as a separate downstream function. That feedback loop is one of the practical connections between fraud intelligence and fraud detection.
MLROs and senior financial-crime leaders should also examine whether organisational boundaries fragment the intelligence picture. Fraud, AML, transaction monitoring, vulnerable-customer, complaints and payment teams may each hold information relevant to the same event. Relationship-based investment fraud can expose the cost of treating those information streams as separate operational problems. A payment team may see the transfer, a fraud investigator may see the victim narrative, an AML function may see onward movement, and a vulnerable-customer team may understand circumstances affecting the intervention. Appropriate information integration can therefore improve both customer protection and financial-crime assessment. Governance should make those connections possible without eroding legal, privacy or evidential safeguards.
From Victim Protection to Network Disruption
Protecting the victim and attempting recovery are immediate priorities, but they do not necessarily exhaust the investigative opportunity. A successful payment intervention can prevent one transfer while leaving beneficiary accounts, digital infrastructure and other components supporting the suspected fraud operational. Conversely, money may already have left the victim’s account while intelligence generated from the transaction remains useful for identifying other activity. Investigative strategy should therefore consider both the individual outcome and the wider intelligence value of the information obtained. Those objectives are complementary when one victim’s evidence helps identify infrastructure capable of affecting others. The transition from case resolution to network disruption begins when information from the individual case is assessed for relevance beyond that case.
The financial trail can expose activity that victim-facing communications cannot. Beneficiary accounts may reveal other relevant payments, onward dispersal or relationships with entities not visible in the original conversation. Cryptocurrency tracing may generate additional investigative leads where attribution can be developed appropriately. Corporate records may provide contextual information about entities appearing in the payment chain, while cross-victim comparison can identify repeated infrastructure. None of these sources independently proves the existence of an organised fraud network. Their value comes from connection, corroboration and their capacity to generate testable lines of enquiry.
This is also why disruption should be evidence-led rather than diagram-led. A visually impressive network map can create a false sense that every node and connection carries equal evidential weight. In practice, one relationship may be supported by verified financial records while another is based only on a common address or similar username. Investigators should therefore record the source, reliability and significance of material connections and identify unresolved intelligence gaps. High-value disruption opportunities should emerge from the strength and relevance of the evidence, not simply from the number of connections visualised. Network analysis is a method for prioritising investigation, not a substitute for investigation.
Practitioner Guide
The practical investigative unit in relationship-based fraud may be larger than the victim–fraudster relationship. The victim’s account can explain the deception, but investigators should also reconstruct the payment chronology, identify the receiving infrastructure, examine onward movement where evidence and authority permit, and determine whether relevant identifiers appear in other cases. Shared beneficiaries, wallets, domains, companies or communications identifiers can increase intelligence value without proving common criminal control. Every material connection should therefore progress through observation, association, hypothesis and corroboration or refutation before it becomes an assessed finding. The practitioner objective is to move from victim to transaction, from transaction to infrastructure and from infrastructure to a defensible network assessment. That progression turns relationship-based fraud from a narrative of persuasion into a structured financial-intelligence enquiry without allowing analytical association to outrun evidential weight.
Conclusion
Relationship-based fraud presents investigators with two interconnected stories. The first is the story experienced by the victim: contact, trust, emotional investment, financial proposition and eventual loss. The second is the infrastructure story: beneficiary accounts, companies, cryptocurrency wallets, platforms, digital identifiers and onward movement of value. The first can help explain why the payment occurred, while the second may help establish how the fraud was organised and whether other cases are connected. Investigative quality depends on bringing those stories together without confusing suspicion, association and proof. Neither story is complete when examined entirely in isolation.
The most important analytical shift is therefore from persona-centred investigation towards relationship-and-network investigation. The fraudulent profile remains relevant, but it should be treated as one potential node within a wider evidential picture. Payment chronology can reveal escalation, cross-victim analysis can expose reusable infrastructure and financial tracing can identify relationships invisible within the original communications. At every stage, investigators should ask whether a connection is corroborated, whether another explanation remains credible and what additional evidence would change the assessment. A methodology capable of disproving the investigator’s preferred hypothesis is stronger than one designed only to accumulate supporting indicators. Refutation is part of good fraud intelligence.
The UK, US and European examples reinforce that proposition from different professional perspectives. The FCA evidence demonstrates the value of behavioural context and transaction chronology, the US prosecution demonstrates the need to distinguish transactional position from control and knowledge, and the European operation demonstrates how one fraud event can generate intelligence about wider infrastructure. None provides a universal template for every relationship-based fraud investigation. Together, however, they demonstrate why the individual complaint should be examined both as a case requiring resolution and as a possible source of intelligence about activity beyond itself. That dual perspective is central to moving from fraud case handling towards fraud intelligence.
For control owners, the same principle changes what effective detection looks like. A high-value payment alert may occur late in a process that began weeks or months earlier through relationship development, new beneficiaries, smaller transfers, borrowing or changes in payment behaviour. Detection becomes more valuable when it recognises meaningful sequences and creates opportunities for informed human intervention. Investigation becomes more valuable when the resulting information is enriched, compared with other cases and converted into intelligence that can improve controls. Intelligence becomes operationally useful when it supports proportionate prevention, recovery, disruption or better-targeted enquiry. The objective is not simply to generate more alerts, but to understand more of the activity behind them.
The relationship explains how trust may have been weaponised, but it should not define the outer boundary of the investigation. Investigators should ask who received the money, what infrastructure supported the representations, where value moved next, what other victims or identifiers are connected and which of those connections survive evidential testing. Those questions transform an apparently self-contained romance or investment complaint into a structured intelligence opportunity without presuming the answer. They also preserve the distinction between what is observed, what is suspected and what can ultimately be established. That distinction is central to defensible fraud investigation. The strongest investigation does not merely identify more connections; it determines which connections actually matter.
Methodology and Evidential Note
This article uses primary and official material from the Financial Conduct Authority, City of London Police, UK Finance, INTERPOL, the Federal Bureau of Investigation, the United States Department of Justice and Europol to examine relationship-based fraud from an investigative perspective. Statistical figures have been retained within the populations and reporting frameworks used by their originating organisations and have not been combined into an unsupported estimate of total romance or investment fraud. Criminal cases, regulatory reviews, law-enforcement operations and civil proceedings are described according to their procedural and evidential status, with allegations distinguished from concluded criminal findings. References to accounts, wallets, companies, digital infrastructure and network associations describe potential investigative leads whose significance depends on corroboration and the circumstances of the individual case. The three F.I.L. models are original Fraud Intelligence Lab analytical constructs and are not represented as statutory, regulatory, judicial or law-enforcement standards. The article is intended for professional fraud-intelligence, investigation and financial-crime analysis and does not provide instructions for committing, concealing or facilitating fraud.
Primary References
Financial Conduct Authority — Combating romance fraud: prevention, detection and supporting victims. Multi-firm review, published 17 October 2025 and updated 14 July 2026.
INTERPOL — Global Financial Fraud Threat Assessment 2026.
UK Finance — Fraud remains a national security threat as criminals steal almost £1.3 billion. Fraud Report 2026 release.
City of London Police — A wrong turn on Love Lane: more than £106 million lost to romance fraud, 16 June 2025.
Federal Bureau of Investigation — Cryptocurrency Investment Fraud.
United States Department of Justice, District of Massachusetts — Nigerian National Sentenced to Two Years in Prison for Romance Scam and Money Laundering Scheme, 24 September 2025.
United States Department of Justice, District of Massachusetts — United States Attorney’s Office Files Civil Forfeiture Action to Recover Cryptocurrency Involved in Money Laundering Scheme, 2 March 2026.
Europol — Operation PANDORA shuts down 12 phone fraud call centres.
Europol — Online fraud schemes: a web of deceit. IOCTA Spotlight Report.
