Published: June 5, 2026
Read time: ~11 min
Tags: Safety, Scams, OSINT
Slug: how-scammers-research-targets
The first message from a romance scammer rarely feels like a scam. It feels like someone paying genuine attention — someone who noticed something specific about you, shares your values, and seems almost too compatible to be coincidence. That feeling is not an accident. It is the product of research done before you ever appeared in their inbox.
Understanding how scammers work the targeting phase — where they look, what they collect, and how they use it — is the most effective way to protect yourself. Most prevention advice focuses on what happens after contact. This guide covers what happens before.
What a Scammer Can Learn About You in Under 10 Minutes
- Your relationship status and recent heartbreaks
- Your approximate income from employer and lifestyle posts
- Your family structure — children, grandchildren, parents
- Your religious or political identity
- Every platform where you use the same profile photo
- Your home city or neighbourhood from location tags
- Your daily routine from post timestamps
- Whether you live alone or with family
Phase 01 — Where Scammers Find Potential Victims
Scammers do not pick targets at random. They work platforms and communities where vulnerable people are concentrated and where public profile data is easy to harvest. Dating apps are the obvious hunting ground, but they are far from the only one. Grief support groups, divorce forums, military spouse communities, and Facebook groups for retirees are all actively targeted because they signal emotional availability, loneliness, and — in some cases — financial assets.
Dating apps — Tinder, Hinge, Bumble, and older platforms like Match and eHarmony. Photos, age, rough location, and opening line all visible without matching. Some scammers run bots that swipe right on every profile and collect data at scale.
Facebook groups — Grief support, expat communities, military families, investment discussion, and religious groups. Membership signals emotional state, financial interest, and community trust.
Instagram and TikTok — Public accounts expose a continuous feed of personal content — location, relationships, lifestyle, and emotional state. Scammers follow, like, and comment to initiate contact organically.
LinkedIn — Job title, employer, career history, and education are all public by default. Used to tailor a fake persona that looks plausibly compatible — same industry, similar background.
WhatsApp and Telegram groups — Crypto investment groups, business networking channels, and community groups are prime sourcing grounds. Phone numbers are often visible to all members.
Phase 02 — How They Build a Profile Before the First Message
Once a scammer identifies a potential target, they spend time — sometimes days — researching them before making any contact. This research phase is what makes the eventual approach feel uncannily personal.
Cross-platform username search — The same username across Instagram, Reddit, and a forum links your professional identity to comments you thought were anonymous. Tools like Sherlock automate this in seconds.
Reverse image search on profile photos — Running your profile photo through a face search engine surfaces every other platform where you use the same image — giving the scammer a complete map of your online presence from a single photo.
Google name + city search — Searching "First Last" + city surfaces data broker listings, news mentions, court records, and business filings. Home address, phone number, and employer can all be found this way for free.
Social media post analysis — Reading months of posts reveals your relationship history, financial situation, travel patterns, family structure, and emotional flashpoints.
LinkedIn career history — Job title and employer reveal income bracket. Career trajectory reveals ambition and stress points. Mutual connections create a plausible "how we could have met" story.
Phase 03 — The Data They Collect and What They Do With It
Every piece of information feeds directly into the manipulation script. The goal is to construct a persona that feels like fate.
Relationship status and history — Widowed, divorced, or recently single all signal emotional availability. References to a past relationship tell the scammer what went wrong and what emotional needs are unmet.
Financial indicators — Home ownership, travel photos, car, employer, and profession all suggest income bracket. Scammers target people with disposable income — enough to send money without going bankrupt on the first transfer.
Family structure — Children and grandchildren are mentioned to build trust and later used as emotional leverage in crisis scripts.
Religious or political identity — Shared values create instant rapport. A scammer who knows you are deeply religious will construct a persona with matching faith.
Geographic isolation — Living alone, working remotely, or having moved to a new city all reduce the chance of a friend or family member noticing something is wrong.
Phase 04 — How They Build the Fake Identity to Match
The persona is constructed to fit the target. A scammer who has identified that you work in healthcare, value travel, and recently lost a spouse will not approach you as a local plumber. They will be a widowed doctor working abroad, recently retired from volunteering in conflict zones, with a teenage child they are raising alone.
The stolen photo — Photos are taken from real people — often military personnel, doctors, engineers, or models — whose public Instagram or LinkedIn provides a convincing backstory. The real person rarely knows their face is being used.
The backstory — Widowed, with children, working abroad in a respectable profession. The abroad detail explains why they cannot meet in person.
The mirroring — Early conversations are designed to find and reflect back your values, interests, and opinions. "I feel the same way" is engineered to create a sense of deep connection quickly.
The timeline compression — Real relationships develop slowly. Scammers accelerate artificially — declarations of love within days, talk of a future together within weeks. The goal is to build emotional commitment before the target has time to think critically.
Phase 05 — Why the First Message Feels So Personal
After completing their research, a scammer's opening message is not generic — it is tailored. This specificity is what separates a skilled scammer from a bot.
Referencing specific content — Mentioning a photo you posted, a place you visited, or a book in your bio makes the approach feel personal and observant.
Opening with vulnerability — Sharing something "personal" early triggers reciprocal disclosure. Once you share something vulnerable in return, the emotional bond begins.
Moving off-platform quickly — Dating apps have fraud detection. Moving to WhatsApp or Telegram within the first few messages puts the conversation outside platform monitoring.
The consistency of contact — Good morning messages, check-ins throughout the day, and long late-night conversations create the feeling of an attentive partner. This consistency is often scripted and managed across dozens of targets simultaneously.
How to Make Yourself a Harder Target
Remove the signals scammers rely on most
- Set social media profiles to private. A private account forces a follow request — you can vet who is asking before granting access to your content history.
- Use different photos across platforms. The same profile photo lets anyone run a reverse face search and immediately find every platform you are on. Use distinct photos per context.
- Remove or restrict location data. Turn off location tagging on posts. Delete old check-ins.
- Do not list your relationship status publicly. Widowed, divorced, or "single" are the flags scammers scan for.
Recognize the approach when it happens
- Slow down if the first message is unusually specific. Genuine cold approaches are generic. Specific openers that feel personal are a signal worth noticing.
- Reverse image search any profile photo immediately. Before investing any emotional energy, run their profile photo through FaceSift or Google Images.
- Be suspicious of any request to move off-platform quickly. Legitimate people do not need to urgently exit the platform where you met.
- Talk to someone you trust before money enters the picture. If you find yourself hiding an online relationship or defending it defensively, that reaction itself is worth examining.
Early Warning Signs the Research Phase Is Already Complete
- They referenced something specific from your profile in the first message
- Their backstory matches your stated interests and values almost perfectly
- They want to move to WhatsApp or Telegram within the first few days
- Declarations of strong feelings arrive within the first week
- Their profile photo appears on other platforms under a different name
- They are always abroad, always with a reason they cannot video call clearly
- Any mention of money — even indirect — before you have ever met in person
Top comments (0)