Romance Scams and Cybersecurity: When the Customer Authorizes the Loss

Romance scams are usually discussed as consumer fraud or elder financial exploitation. Both labels are accurate, and both are incomplete. At their core, romance scams are a form of social engineering: the scammer builds trust over days, weeks, or months, then uses that trust to obtain money, personal information, or account access. Inside a financial firm, a single romance scam can pass through fraud monitoring, cybersecurity, AML, supervision, and client service before anyone recognizes it as one event. By then, the money has often left the firm.

The losses continue to grow. According to its 2025 Internet Crime Report, the FBI's Internet Crime Complaint Center (IC3) received 23,159 confidence and romance fraud complaints in 2025, with reported losses of approximately $929 million, up from approximately $672 million in 2024. Victims age 60 and older reported approximately $584 million of those losses. Because many relationship-driven schemes end in a fraudulent investment opportunity, the romance category alone likely understates the problem.

The Customer Is Not the Intruder

Most cybersecurity controls answer one question: Is this person who they claim to be? Multifactor authentication, device recognition, and login monitoring exist to keep outsiders out of customer accounts.

A romance scam usually defeats that design without breaking it. The person who logs in, passes authentication, and requests the wire or the cryptocurrency purchase is the actual customer. The social engineering happened earlier, often over weeks or months on a dating app or social media platform, where the scammer built trust and then turned it into a request for money. FinCEN's 2023 alert on “pig butchering” describes the same pattern in investment form: scammers build a relationship through text messages or social media, then steer the victim to virtual currency platforms that look legitimate but are controlled by the scammers.

The most useful signals are therefore behavioral and financial. FinCEN's alert flags customers with no virtual currency history suddenly converting large sums, early liquidation of savings or certificates of deposit to fund transfers to virtual asset service providers, and customers who appear anxious to meet an investment deadline. Bates Group's 2023 article, Spotting and Reporting Romance Scams, identified similar red flags, including payments to third parties with no apparent connection to the account holder.

Where a Romance Scam Becomes a Cyber Event

The line between romance fraud and a cybersecurity incident is thinner than many programs assume. IC3's own definition of confidence and romance fraud includes victims tricked into sending personal and financial information, not only money. As a scheme matures, the same social engineering tactics that produced the payments can be used to obtain access: login credentials, one-time passcodes, remote-access software, or a trading application the scammer controls. At that point, a customer-authorized fraud can become an account takeover.

Three implications follow:

• Scam detection and account takeover controls should share information. Contact-information changes, new devices, and unexpected account-change notifications can appear late in a romance scam, once the perpetrator has direct control.
• The victim may also be a money mule. IC3's definition also covers victims manipulated into laundering funds for the perpetrator, which adds AML and suspicious activity reporting considerations to the fraud loss.
• AI makes the relationship more convincing. IC3 reported more than $19 million in 2025 romance losses with a likely AI nexus, a risk Bates Group's 2025 anti-financial crimes (AFC) risk outlook anticipated in its discussion of deepfake voice and video.

For broker-dealers and investment advisers, amended Regulation S-P adds a governance question. Covered institutions must maintain an incident response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, and both compliance dates have now passed. When a scam escalates into credential compromise or account takeover, firms should be able to assess the event under that program, and their information security protocols should be designed to mitigate the activity and prevent further loss once it is identified. Each of those steps should be documented.

The Regulatory Direction Favors Earlier Intervention

Regulators are increasingly focused on giving firms tools to act before funds leave. On August 20, 2026, FINRA filed a proposed rule change with the SEC (SR-FINRA-2026-018) that would:

• Adopt new Rule 2166, permitting a member firm to place a temporary delay of up to 10 business days on a disbursement or transaction when it reasonably believes fraud is targeting a customer of any age. FINRA describes the proposed definition of fraud as broad enough to include identity theft and account takeovers.
• Extend the maximum temporary hold under Rule 2165 for Specified Adults from 55 to 145 business days, through three 30-business-day extensions conditioned on follow-up with the relevant authority, notification, and documentation.
• Amend Rule 4512 to permit firms to use “emergency contact” as an alternative to “trusted contact person,” with the goal of increasing adoption.

FINRA lengthened the Rule 2166 delay from the five business days proposed in Regulatory Notice 26-02 after commenters said five days was too short to reach customers away from the perpetrator's influence. Both rules are permissive safe harbors, and the proposal remains subject to SEC action. For broker-dealers, the immediate question is readiness: who can authorize a delay, what supports a reasonable belief of fraud, how quickly the customer is contacted, and what is documented.

Investment advisers are not FINRA members, so these rules would not apply to them and state law carries more weight. Many states have adopted legislation based on NASAA's model act, which permits broker-dealers and investment advisers to delay disbursements when they reasonably believe an eligible adult is being exploited. State versions vary, and dually registered firms will need procedures that account for both frameworks.

For banks, fintechs, and money services businesses, the Bank Secrecy Act framework already provides tools. FinCEN asks SAR filers to use the key term “FIN-2023-PIGBUTCHERING” for suspected pig butchering activity, and its June 2026 Section 314(b) fact sheet clarified that real-time information sharing among institutions, including fraud-related information, is permissible. Our 2025 AFC risk outlook urged firms to formalize communication between InfoSec and AML teams.

When Losses Become Disputes

Romance scam losses can lead to customer complaints, arbitration claims, and regulatory inquiries. FINRA acknowledged in its filing that firms face competing risks: acting to protect a customer can generate complaints about delayed transactions, while declining to act can generate claims that the firm should have intervened.

The central questions are usually factual. What did the firm see, and when? Did the activity depart from the customer's history? Were escalation procedures followed? Was the firm's own environment compromised, or did the customer authorize each transaction? Answering them depends on the maturity of the firm's information security program, including defensible preservation of login activity, newly added devices, customer communications, transaction records, and other log data, and the ability to trace funds once a fraudulent transfer is confirmed.

Bates Group's Perspective

Romance scams expose a gap between how firms organize their controls and how the threat actually unfolds. Fraud, cybersecurity, AML, supervision, and client services each see part of the picture. The firms best positioned to prevent losses are the ones that connect those views before an incident, not during one. Some questions worth asking now are:

• Can your monitoring identify unusual activity by the customer, not only access by someone other than the customer?
• Is there a clear decision path, with named authority, for delaying a disbursement, and would it support proposed Rule 2166 if approved?
• How does your incident response program treat a scam that escalates into credential compromise or account takeover?
• Are trusted or emergency contacts collected in a way that makes them usable when they are needed?
• If a loss leads to a dispute, could you reconstruct what the firm knew and when it knew it?

When a romance scam reaches a customer account, firms can face financial loss, regulatory scrutiny, and litigation at the same time. Bates Group helps broker-dealers, investment advisers, banks, fintechs, and their counsel build readiness before those moments and respond with precision when they arrive.

• Compliance Consulting: Review and testing of senior investor protection, trusted contact, temporary hold, and escalation procedures, including preparation for FINRA's proposed changes.
• Fintech and Banking: Transaction monitoring tuned for scam typologies, investigation and SAR support, and staff training on behavioral red flags.
• Technology Advisory: Incident response and Regulation S-P program design/testing; digital forensics, including defensible evidence preservation, user-access analysis, and cryptocurrency tracing; and expert testimony on cybersecurity, digital forensics, and information security standard of care.
• Litigation and Regulatory: Expert analysis and testimony in disputes involving fraud, senior investors, and financial exploitation.

To discuss how these issues affect your firm, reach out to Bates Group today.