Awareness Resource

Scam Script Library

Annotated message examples from confirmed fraud cases, shown week by week. See exactly how scripts escalate from first contact to financial extraction — and the specific signals present at each stage.

By Michael Muinov, Founder and Lead Investigator · AllRussian.com ·

All names, locations, and identifying details have been changed or removed. The language, phrasing, escalation timing, and specific requests reflect real patterns from confirmed cases. Scripts are not reproduced to teach fraud; they are reproduced so that the next person who receives these words knows exactly what they are reading.
Military Romance Scam
Case 1 — The US Army Engineer

Met on a dating app. Persona: US Army civil engineer, 52, stationed in Syria, widower with one teenage daughter. Case confirmed as fraud in Week 5 following identity verification. No money was sent.

Duration before money request: 5 weeks
First financial request: $850 satellite phone
Total requested: $850 (refused)
Investigation outcome: Identity fabricated; photos stolen from a US contractor's LinkedIn
Week 1 — Establishing contact and backstory
Them — Day 1
Hi there. I came across your profile and I liked what I saw. I am David. I am a civil engineer with the US Army, currently deployed to Syria. I know that sounds unusual but I would love to get to know you if you are open to it.
Day 1, 9:14am
Investigator note Unsolicited first contact from someone with an immediately unusual backstory is the standard opening. "I know that sounds unusual" is scripted — it preempts scepticism before it forms. The deployment provides a built-in reason for everything that follows: no meetings, restricted communication, and eventual financial need.
Them — Day 2
I lost my wife four years ago. Cancer. It was very hard. I have been raising my daughter alone since then. I am telling you this because I do not like to hide things. I want you to know the real me from the start.
Day 2, 7:42am
Investigator note The widower detail is introduced on Day 2, not Day 10. Its purpose is not to share genuine grief but to generate sympathy quickly and establish a "real me" framing that discourages verification. "I do not like to hide things" is a near-universal scripted phrase in this fraud type.
Signals this week: Unsolicited contact
Signals this week: Deployment backstory
Signals this week: Widower narrative
Risk at end of week: Medium
Week 2 — Emotional escalation
Them — Day 9
Good morning my dear. I was thinking about you before I even opened my eyes this morning. I have not felt this way about anyone since my wife. You have something special about you. I cannot explain it but I feel like God put you in my path for a reason.
Day 9, 6:03am
Investigator note "God put you in my path" and "I have not felt this way since my wife" are among the most frequently occurring phrases across military romance script databases. Daily morning messages are standard — they create routine dependency. The emotional escalation at Day 9 is early by any normal relationship standard.
Them — Day 11
I wish I could video call you. The base internet here is terrible and they monitor everything. The army has strict rules about personal calls. I hope you understand. It does not change how real this feels to me.
Day 11, 2:18pm
Critical signal This is the video call block — introduced at Day 11, before it is requested. The pre-emptive framing ("I hope you understand") prevents the victim from viewing it as suspicious. Both claims are false: the US Army does not prohibit personal video calls, and base internet is routinely available. This excuse will be maintained for the entire relationship.
Signals this week: Love bombing
Signals this week: Video call block established
Risk at end of week: High
Week 3 — Deepening commitment
Them — Day 16
I have been thinking about what happens when my deployment ends in February. My daughter has always wanted to go to Disneyland. I would love for you to come with us. I know it is early to say this but when something feels right it feels right.
Day 16, 10:44am
Investigator note Future planning is introduced three weeks in. The specific inclusion of the daughter in the plan is deliberate — it creates an emotional obligation that extends beyond the romantic relationship. The "I know it is early" phrasing acknowledges the timeline is unusual while dismissing that observation simultaneously.
Them — Day 19
My daughter asked me today if I had found someone special. I told her I think so. She said she hopes she is kind. I said she is the kindest person I have spoken to in years. I hope that is okay to share with you.
Day 19, 8:27pm
Investigator note Involving the daughter as a "witness" to the relationship increases emotional investment significantly. The victim now feels a connection not just to the contact but to a child. This is a calculated escalation, not a genuine family moment.
Signals this week: Future-planning pressure
Signals this week: Child used as emotional anchor
Risk at end of week: High
Week 4 — Isolation and urgency building
Them — Day 24
Have you told your family about us? I hope you have not. Not yet. People do not understand relationships that form online. They will only have opinions before they know me. I want to be the one to make the right impression when the time comes.
Day 24, 11:56am
Critical signal Direct request for secrecy from family. The justification ("people do not understand") is designed to sound reasonable while achieving the same outcome as an explicit instruction: removing external perspective. Family members would recognise the fraud script. Isolating the victim from them is a necessary step before the financial request.
Them — Day 27
I have never told anyone this but I have been saving for years to buy a place when I leave the army. I want a real home. Somewhere stable for my daughter. I am telling you this because I want you to know I am not a man without a future. I am a man building one.
Day 27, 9:05pm
Investigator note Financial credibility is established before the financial request. The framing ("a man building a future") positions him as responsible and serious. This message typically precedes the first money request by 7 to 14 days.
Signals this week: Secrecy request
Signals this week: Pre-request credibility building
Risk at end of week: Very high
Week 5 — First financial request
Them — Day 32
I have something to ask you and I want you to know it pains me to ask. The base communication has been cut back. I found out I can get a secure satellite phone but it costs $850. I know this is a lot. I would not ask if there was any other way. Once I have it we can talk any time, no restrictions. I will pay you back the moment I am back on US soil. I promise you that on my daughter's life.
Day 32, 4:17pm
Critical signal — first financial request Every element of this message is scripted: the reluctance framing ("it pains me to ask"), the promise of a reward (unrestricted calls), the repayment guarantee ("on my daughter's life"), and the specific dollar amount. The satellite phone is a documented signature request of military romance fraud. The US Army provides communication equipment to personnel. This request has no legitimate basis.
Victim — Day 32
I'm not sure about this. Can we video call first? I just want to see your face before I do anything like this.
Day 32, 6:44pm
Them — Day 32
I understand. I wish I could. You know the situation here. If I could give you a video call I would do it in a heartbeat. All I can tell you is that what I feel for you is real. I cannot prove it with a camera but I can prove it every day with my words and my actions. Please trust what you feel.
Day 32, 7:02pm
Critical signal The request for a video call is refused using the established video block. "Please trust what you feel" is a direct appeal to override rational caution with emotional investment. This is the moment a legitimate person would find a way to verify themselves. A fraud operation cannot.
Signals this week: Satellite phone request
Signals this week: Video call refused again
Signals this week: "Trust what you feel" override
Risk at end of week: Confirmed fraud pattern
Investigation outcome: The client used AllRussian's Red Flag Decoder on Week 5 messages before sending money. Identity verification confirmed no US Army personnel matching the described profile. Photos were traced to a civilian contractor's LinkedIn account. The persona was entirely fabricated. No funds were lost.
Pig-Butchering Crypto Fraud
Case 2 — The Hong Kong Finance Analyst

Met on LinkedIn, moved to WhatsApp. Persona: Chinese-American woman, 34, works in Hong Kong asset management, introduced crypto trading platform. $31,000 deposited before withdrawal blocked. Case confirmed as fraud in Week 9.

Duration before investment push: 3 weeks
First deposit: $1,000
Total deposited: $31,000
Platform: Cloned exchange, no regulatory registration
Week 1 — LinkedIn connection, professional framing
Them — Day 1
Hi! I came across your profile and noticed we have a few connections in common. I work in asset management in Hong Kong. Always interesting to connect with people in related fields. Hope you don't mind the message.
Day 1, 2:31pm
Investigator note LinkedIn is the preferred entry point for pig-butchering fraud targeting higher-income professionals. The professional framing ("we have connections in common") creates instant credibility. The contact typically has a polished profile with plausible employment history. The opening message is non-romantic — romance is introduced gradually, after trust is established through professional conversation.
Them — Day 3 (WhatsApp, after LinkedIn conversation)
I'm actually based between Hong Kong and San Francisco. My uncle runs a trading firm here — I learned a lot about markets from him growing up. Finance is in my blood I suppose! What do you do when you're not working?
Day 3, 7:18pm
Investigator note The "uncle in finance/trading" detail is a documented seed phrase in pig-butchering scripts. It establishes a family connection to finance that will be referenced when the investment platform is introduced later. Moving to WhatsApp is standard — it removes the LinkedIn profile from the conversation and prevents the victim from easily re-checking the contact's credentials.
Signals this week: Professional platform approach
Signals this week: "Uncle in finance" seed phrase
Signals this week: Move to private messaging
Risk at end of week: Low-medium
Weeks 2–3 — Relationship building, lifestyle signals
Them — Day 10
Had an exhausting day but good — closed a position my uncle recommended. These small wins add up. I know trading isn't for everyone but I genuinely love it. It gave me a level of financial freedom I never expected in my 30s. Anyway, enough about work. How was your evening?
Day 10, 9:04pm
Investigator note "Financial freedom I never expected" is designed to create aspiration without a direct pitch. Mentioning the uncle again connects the success back to the seed phrase. The quick pivot ("enough about work") prevents the topic from feeling like a sales pitch. This pattern — mention trading, claim success, deflect — repeats several times before the direct introduction of the platform.
Them — Day 18
I hope this isn't too forward but I feel like I can be honest with you. I really like talking to you. More than I expected when we first connected. Is that strange to say?
Day 18, 10:37pm
Investigator note The romantic pivot arrives at Day 18, after three weeks of professional conversation. This is the "warmup complete" signal in pig-butchering scripts — emotional investment has been established enough to support the investment ask. Note that no financial topic has been introduced directly yet; this message marks the transition into the relationship phase.
Signals this week: Repeated trading success mentions
Signals this week: Romantic pivot after warmup
Risk at end of week: Medium
Week 4 — Trading platform introduced
Them — Day 22
My uncle just sent me a trading signal that paid out really well this week. I made about $4,200 in four days. I don't usually share things like this but I feel like we're close enough now. Would you be interested if I showed you how it works? No pressure at all — I just thought of you when I saw the return.
Day 22, 6:55pm
Critical signal — platform introduction This is the pivot point. The specific return ($4,200 in four days) is plausible enough to be credible but high enough to generate interest. "No pressure at all" is scripted — it reduces resistance by making refusal easy, while the emotional frame ("I thought of you") creates an obligation to engage. The platform will be introduced in the next message or two.
Them — Day 24
So I set up a small account to show you. The platform is called PrimeTrade — it's not well known publicly but institutional investors use it. My uncle got me access. Here's a screenshot of my account. See the current position? That's running at about 22% since Monday. I can walk you through how to open your own account if you want to try.
Day 24, 3:12pm
Critical signal The platform is "not well known publicly" — this is standard scripting to explain why the victim cannot verify it independently. "Institutional investors use it" adds false credibility. The screenshot shows artificial returns on a fraudulent platform designed to display whatever figure is needed. The offer to "walk you through" setting up an account is the conversion moment.
Signals this week: Displayed investment returns
Signals this week: "Private/institutional" platform framing
Signals this week: Account setup offer
Risk at end of week: Very high — confirmed pig-butchering entry
Weeks 5–6 — First deposit and artificial gains
Them — Day 32
You should start with something comfortable — even $500 or $1,000. Watch how it performs for a week before you decide anything else. I will be here to explain everything. Think of me as your teacher.
Day 32, 11:23am
Investigator note The low starting deposit is deliberate. It reduces resistance and creates a successful first experience. The "teacher" framing establishes dependency — the victim is positioned as a student who needs guidance, making it harder to question or reject further instructions.
Them — Day 38 (after $1,000 initial deposit)
Look at your account! You made $340 in six days. That is a 34% return. Now imagine if you had put in $10,000. The position I am watching this week could do even better. You have to think bigger to get bigger results. I believe in you.
Day 38, 8:44pm
Critical signal — escalation push The artificial gain (34% in six days — impossible in any legitimate market) is designed to create urgency for a larger deposit. "Imagine if you had put in $10,000" is the direct escalation pitch. The balance shown is entirely fabricated by the platform — no actual investment has taken place. The victim's $1,000 was transferred to the fraud operation on day of deposit.
Signals this week: Artificially high returns shown
Signals this week: Escalation push to larger deposit
Risk at end of week: Confirmed fraud — do not deposit further
Weeks 8–9 — Withdrawal attempt and fee block
Victim — Day 52
I'd like to withdraw $5,000 to test the process. My account is showing $42,000 now. How do I initiate a withdrawal?
Day 52, 3:07pm
Platform support message — Day 52
Your withdrawal request has been received. Please note that per platform compliance regulations, a tax clearance fee of 20% of the total account balance ($8,400) must be submitted before funds can be released. This is a regulatory requirement and cannot be waived. Once payment is received, funds will be transferred within 3 business days.
Day 52, 3:44pm
Critical signal — withdrawal fee block This is the final extraction mechanism. No legitimate trading platform requires a tax payment before releasing funds — taxes are paid to government authorities, not platforms. The 20% figure is chosen to be just plausible enough to consider paying. This fee does not release the funds; it produces a second fee, then a third. The $42,000 balance does not exist. Total funds deposited were $31,000.
Them — Day 53 (WhatsApp)
I know it is frustrating. I had the same thing when I first tried to withdraw. But this is how the platform works — it is compliant with international regulations. Once you pay the fee your money is yours. I have been through this. Just pay it and it will be over. I would not steer you wrong.
Day 53, 10:12am
Critical signal The contact vouches for the fee and claims personal experience with it — this is scripted reassurance designed to overcome the victim's (correct) instinct that something is wrong. "I would not steer you wrong" directly appeals to the established romantic trust. At this stage, every further payment disappears. The original $31,000 is unrecoverable.
Signals this week: Fabricated withdrawal fee
Signals this week: Contact vouches for fee
Risk at end of week: Active fraud confirmed — stop all payments
Investigation outcome: Client contacted AllRussian after receiving the withdrawal fee notice. The platform domain was registered 47 days before first contact. No regulatory registration in any jurisdiction. The contact's LinkedIn profile photos were sourced from a Taiwanese model's Instagram. The $31,000 cannot be recovered. The case was filed with the FBI IC3 and FTC.
Advance-Fee Inheritance Fraud
Case 3 — The Russian Estate

Email approach. Sender: law firm claiming to represent estate of a deceased distant relative. Promised inheritance: $1.8 million. Total fees requested across 6 weeks: $19,400. Case confirmed as fraud at Week 2; client had already paid $3,500 before contacting AllRussian.

First contact method: Email
Initial fee requested: $3,500 (notary processing)
Total fees requested: $19,400 across 6 separate requests
Amount already paid: $3,500 before AllRussian was contacted
Week 1 — Initial notification email
Email from "Novikov & Partners Law Offices, Moscow" — Day 1
Dear Sir/Madam,

We represent the estate of the late Mr. Anatoly V., a Russian national who passed away intestate on 14 March of this year. Following exhaustive enquiries, our office has identified you as a potential beneficiary and the sole surviving relative eligible to make a claim under Russian civil inheritance law.

The net value of the estate is USD $1,800,000. To proceed, we require written confirmation of your interest within 14 days, after which we will provide full documentation. We draw your attention to the statutory deadline: if no claim is received within 30 days, the estate passes to the state.

This matter is entirely confidential. We ask that you not discuss it with third parties until formal claim has been filed, as this could jeopardise the transfer.

Sincerely,
A. Novikov, Senior Partner
Day 1
Investigator note — multiple signals in one message Four documented fraud signals in the initial email: (1) unsolicited notification of an unexpected large inheritance; (2) artificial urgency ("14 days", "30-day statutory deadline"); (3) pre-emptive confidentiality instruction that isolates the victim from any outside advice; (4) the estate value is large enough to justify fees but not so large as to seem impossible. The firm name, address, and contact details are fabricated. No such estate exists.
Email — Day 4 (follow-up after victim expressed interest)
We are pleased to confirm receipt of your response. Attached please find the Preliminary Estate Certificate, notarised by the Moscow City Notary Chamber, confirming your status as sole heir. To proceed to the transfer phase, we require certified copies of your passport and proof of address. Our office will then file the formal claim with the Federal Tax Service on your behalf.

Once documentation is verified, we anticipate full transfer within 10 business days. We will advise on associated fees at the next stage.
Day 4
Investigator note Fabricated official documents are sent before any money is requested. This is standard practice — the documents establish a false legitimacy before the fees are introduced. "We will advise on associated fees at the next stage" is the delayed fee reveal. The victim has now submitted passport and personal documents, creating a personal data exposure risk alongside the financial one.
Signals this week: Unsolicited inheritance notification
Signals this week: Artificial deadline pressure
Signals this week: Confidentiality instruction
Signals this week: Fabricated official documents
Risk at end of week: Confirmed fraud pattern
Week 2 — First fee request
Email — Day 8
Your documentation has been reviewed and accepted. We are now in a position to file the formal inheritance claim with the Federal Tax Service. However, before we can proceed, Russian law requires the payment of a notary registration and tax processing fee of USD $3,500. This fee is payable directly to the Federal Notary Chamber and is non-negotiable under Russian inheritance regulations. Payment must be received within 7 days to preserve your claim priority.

Once paid, the estate transfer will be initiated. We can accept payment via wire transfer to our client account. Details attached.
Day 8
Critical signal — first fee The first fee is introduced as a legal requirement ("Russian law requires"), payable to a government body ("Federal Notary Chamber"), with a 7-day deadline. None of this is accurate. No legitimate inheritance process requires upfront payment of fees by the beneficiary — such costs are deducted from the estate. The wire transfer instruction is to a fraud operation account. Paying this fee does not initiate any transfer; it triggers the next fee request.
Email — Day 11 (after $3,500 payment received)
We confirm receipt of your processing payment. Your claim has been registered with the Federal Tax Service. We have encountered an unexpected complication: the estate includes a foreign currency holding that requires separate Central Bank of Russia clearance. The fee for this clearance is USD $4,200. We apologise for this additional requirement — it was not anticipated at the outset. This must be paid within 5 days or the clearance window closes.
Day 11
Critical signal — second fee immediately follows first The second fee arrives three days after the first. This is the standard pattern: each payment produces another "unexpected complication" that requires another fee. The amounts escalate slightly with each request. The total amount requested across all fees typically exceeds the initial fee by a factor of five to six. The client stopped here and contacted AllRussian.
Signals this week: Fee framed as legal requirement
Signals this week: Second fee immediately follows first
Signals this week: "Unexpected complication" scripting
Risk at end of week: Active fraud — stop all payments
Weeks 3–6 — Projected fee escalation (reconstructed from case pattern)
Note The client stopped at Week 2 after contacting AllRussian. The following messages were not sent to this client. They are reconstructed from the documented pattern in confirmed cases of this type where victims continued paying.
Projected Week 3 — Anti-money-laundering compliance fee
Your transfer has been flagged by the receiving bank's AML compliance department. A compliance clearance fee of USD $5,800 is required before the transfer can be authorised. This is a banking regulation requirement, not a legal fee. It is refundable upon successful transfer completion.
Pattern note AML compliance fees are a documented third-stage request in inheritance fraud. "Refundable upon transfer" is scripted — the refund never occurs. Framing it as a banking requirement shifts the apparent responsibility from the law firm to an independent institution.
Projected Week 4 — Tax certificate fee
The Federal Tax Service requires a certificate of tax compliance before releasing funds to a foreign account. This certificate costs USD $3,100. We understand you have already invested significantly in this process and want to assure you the transfer is imminent.
Pattern note "We understand you have already invested significantly" is a sunk-cost appeal — it acknowledges the victim's frustration while using prior payments as a reason to continue. This phrase appears in the majority of advance-fee cases where the victim has made multiple payments.
Projected Weeks 5–6 — Insurance and final transfer fees
Transfer insurance (USD $2,800) required by SWIFT regulations. Transfer activation fee (USD $4,200). All fees are now settled after this final payment and the full $1,800,000 will be in your account within 48 hours.
Pattern note — "final payment" scripting "Final payment" language is introduced at approximately Week 5 in most cases, when victim fatigue and scepticism are high. The "48 hours" promise creates urgency for one more payment. There is no final payment. After this fee, either another fee appears or contact ceases entirely.
Total projected across 6 weeks: $19,400
Inheritance received: $0
Amount paid (this case): $3,500
Amount saved by stopping: $15,900
Investigation outcome: AllRussian confirmed within 24 hours: no law firm named Novikov & Partners is registered at the provided Moscow address. The notary document serial number does not correspond to any issued by the Moscow City Notary Chamber. The wire transfer account was registered in a third country. The $3,500 first payment is unrecoverable. All further communication was ceased.

Recognised a pattern in messages you have received?

Use the Red Flag Decoder to analyse specific messages instantly, or take the Scam Risk Calculator for a broader assessment of your situation. If the results concern you, a professional Scam-Risk Review can confirm or rule out active fraud within 48 hours.

Why fraud scripts are so consistent

Romance fraud is not opportunistic crime. The operations behind it — predominantly based in Southeast Asia, West Africa, and Eastern Europe — are structured businesses with documented playbooks, training materials, and performance targets. Individual operators follow tested scripts because the scripts work. They have been refined over years of real-world use, with variations discarded when they underperform and phrases retained when they convert at high rates.

This is why military romance scripts sound nearly identical across cases separated by years and continents. The "God put you in my path" phrase, the widower backstory, the satellite phone request — these are not coincidences. They are industrially optimised. Recognising the script does not require deep expertise; it requires having seen it once before. That is what this library is for.

The three fraud types documented here differ in their mechanics but share a common structure: establish trust, deepen emotional or financial investment, introduce a reason money is needed, use that investment to overcome rational caution, and extract as much as possible before the victim realises what has happened. The specific backstory, platform, or legal scenario is interchangeable. The structure is constant.

Frequently asked questions

Why do romance scam scripts follow such predictable patterns?

Romance fraud is operated as an industry, not by individual opportunists. Fraud operations use documented scripts, training materials, and role assignment. Scripts are refined based on conversion rates — meaning the rate at which victims send money. Predictability is a feature of industrial fraud, not a bug.

How long does a romance scam typically take from first contact to money request?

Military romance scams average 3 to 6 weeks before the first financial request. Pig-butchering crypto fraud typically takes 4 to 8 weeks, with the investment platform introduced in weeks 2 to 4. Advance-fee inheritance schemes move faster — sometimes within days — because they rely on urgency rather than emotional investment.

Are these real messages?

The messages are representative composites drawn from confirmed fraud cases investigated by AllRussian. All personally identifying details have been changed or removed. The language, phrasing, escalation timing, and specific requests reflect real patterns documented across dozens of confirmed cases of each type.

What should I do if messages I have received match these patterns?

Do not send any money. Use the Red Flag Decoder or Scam Risk Calculator on this site for an immediate assessment. For a definitive answer, commission a professional Scam-Risk Review or Identity Verification. AllRussian delivers reports within 48 hours for most CIS-region cases.

Can I submit messages for review?

Yes. The Red Flag Decoder handles instant pattern analysis for text you paste directly. For a professional investigation that goes beyond pattern matching — verifying the actual identity behind the messages, checking records, and producing a written report — use the order form or write to allrussian@allrussian.com.

Related resources

More tools and guides on these fraud types

Free tool

Red Flag Decoder

Paste any message for instant pattern analysis. 200+ fraud signals across 12 categories.

 Free tool

Scam Risk Calculator

12 questions. Weighted risk score and category breakdown based on 27 years of casework.

 Guide

Military Romance Scam: 15 Red Flags

The 15 most reliable behavioural indicators of military romance fraud.

 Guide

Pig Butchering: 9 Signs the Platform Is Fake

Identify a fraudulent trading platform before you deposit.

 Guide

Advance-Fee Inheritance Scam Guide

How the fee cascade works and the one document check that confirms fraud instantly.

 Case study

Crypto Romance Scam Case Study

$23,000 traced through six wallets. How the investigation was conducted.

Something in your messages matches what you read here? Get a definitive answer.

Order a Professional Scam-Risk Review