Operation Seraphim: How Organised Networks Enable Romance Fraud

Operation Seraphim demonstrates that romance fraud is not always committed by one individual working alone. It may involve organised networks in which different people provide false identities, stolen information, technical tools, bank accounts and money-laundering services.

The City of London Police reported that 31 arrests had been made across Europe and Africa as part of the operation. The activity involved UK policing teams, the Nigeria Police Force and other specialist partners working to disrupt groups suspected of using online platforms and private messaging channels to facilitate fraud.

Police said the groups shared tools, techniques and services connected with criminal activity, including methods for deceiving victims and moving illicit funds. Suspected offences included romance fraud, impersonation fraud, account takeover and money laundering.

The operation is important because it shows why investigating only the person communicating with a victim may not reveal the full structure behind the fraud.

What was Operation Seraphim?

Operation Seraphim formed part of a coordinated effort to identify and disrupt individuals using online platforms and enabling technologies to commit fraud.

According to the City of London Police, suspected offenders operated through anonymous online identities and private messaging groups. These spaces were allegedly used to exchange criminal tools, information and services.

The operation reportedly targeted activity including:

• Romance fraud;
• Impersonation fraud;
• Account takeover;
• Money laundering;
• The sale or exchange of compromised data;
• Spoofing tools and other technical services;
• Methods for moving criminal proceeds.

Police also reported the seizure of two Rolex watches and £3,000 in cash during one of the enforcement actions.

Arrests do not establish guilt. The individuals involved remain subject to investigation and any subsequent legal proceedings.

Why romance fraud may involve several offenders

The person communicating with a victim may be only one part of a broader operation.

Different participants may be responsible for:

• Creating false dating or social-media profiles;
• Obtaining stolen photographs and identity information;
• Writing messages or maintaining conversations;
• Impersonating professionals, celebrities or military personnel;
• Producing false documents;
• Providing bank accounts or payment facilities;
• Receiving and transferring funds;
• Converting money into cryptocurrency;
• Moving proceeds between jurisdictions;
• Recruiting or controlling money mules;
• Selling technical tools or compromised account details.

This division of roles can make the fraud appear more convincing.

For example, a victim may communicate with a supposed romantic partner, a claimed lawyer, a bank representative and a family member without realising that the identities are controlled by the same network or by connected offenders.

The role of private messaging groups

Private messaging channels can provide a marketplace for fraud-enabling services.

Police said groups linked to Operation Seraphim were used to share tools, techniques and services associated with deception and the movement of illicit funds.

Participants may use such groups to obtain:

• Stolen personal or financial data;
• Compromised social-media accounts;
• Fake identity documents;
• Spoofed telephone numbers or email addresses;
• Phishing materials;
• Scripts for communicating with victims;
• Bank or payment accounts;
• Cryptocurrency services;
• Advice on avoiding detection;
• Contacts willing to receive or transfer money.

This has sometimes been described as fraud-as-a-service: one offender may purchase the tools or assistance needed to commit fraud without developing every capability independently.

Why false identities can appear convincing

An organised network may have access to more information and resources than a lone offender.

A false profile may include:

• Stolen photographs;
• A detailed employment history;
• Fabricated identity or travel documents;
• A convincing social-media presence;
• Telephone numbers from the claimed country;
• Websites supporting a false business;
• Other people confirming the invented story;
• Bank accounts in names that appear legitimate.

The presence of several apparently independent sources does not necessarily prove that the person is genuine. The accounts, websites and documents may all be controlled or supplied by connected individuals.

For practical identity and payment warning signs, read How to Spot a Romance Scam: Warning Signs and Practical Steps.

How money may move through the network

Money sent by a victim may not travel directly to the person communicating with them.

It may pass through:

• Personal bank accounts;
• Business accounts;
• Money-mule accounts;
• Payment platforms;
• Cryptocurrency exchanges;
• Digital wallets;
• Cash-withdrawal networks;
• Companies with no genuine connection to the relationship;
• Accounts in several countries.

Funds may be divided into smaller amounts or moved quickly through several recipients.

This can make recovery more difficult and explains why the name on a recipient account may not identify the principal offender.

A person receiving the money may be:

• A knowing participant;
• A recruited money mule;
• Another fraud victim being manipulated into forwarding funds;
• An intermediary providing laundering services;
• A company controlled by someone connected to the network.

Understanding those relationships can be central to any financial investigation.

What victims should preserve

Where organised fraud is suspected, apparently minor details may help identify links between different people or accounts.

Preserve:

• Full message histories;
• Profile names and URLs;
• Telephone numbers;
• Email addresses;
• Photographs and videos;
• Voice messages;
• Bank-account details;
• Payment references;
• Cryptocurrency wallet addresses;
• Transaction hashes;
• Company names;
• Website addresses;
• Documents supplied by the suspected fraudster;
• Courier and parcel information;
• Names of supposed lawyers, doctors, relatives or business partners;
• Dates and details of each payment request.

Do not preserve only the final demand for money. Earlier conversations may show how the identity was constructed, when different participants became involved and how the victim was moved between payment methods.

Why patterns across victims matter

One report may appear to involve a single false relationship. Several reports may reveal repeated names, photographs, telephone numbers, bank accounts or methods.

Connecting those reports can help establish:

• Whether the same profile targeted several victims;
• Whether one bank account received multiple payments;
• Whether different identities used the same contact details;
• Whether several companies share directors or addresses;
• Whether cryptocurrency wallets are connected;
• Whether the same scripts or documents were reused;
• Whether a money mule or intermediary supports several frauds.

Operation Seraphim illustrates the importance of looking beyond individual incidents and examining the infrastructure that enables them.

What an investigation may examine

Depending on the evidence available, a romance-fraud investigation may include:

• Identity and alias research;
• Social-media and open-source enquiries;
• Telephone and email analysis;
• Company and address research;
• Domain and website examination;
• Financial intelligence;
• Cryptocurrency tracing;
• Link analysis between recipients and entities;
• Identification of possible money mules;
• Cross-border investigative enquiries;
• Evidence collation for banks, lawyers or police.

A private investigation does not provide the same powers as law enforcement. Investigators cannot compel banks, platforms or exchanges to disclose confidential records without the appropriate legal process.

Their role may be to identify useful leads, organise available evidence and support legal or law-enforcement action.

What to do after sending money

Take the following steps promptly:

1. Stop further payments.
2. Contact the bank or payment provider.
3. Ask whether recent transfers can be recalled or reviewed.
4. Report the fraud through the relevant police or fraud-reporting service.
5. Preserve the complete evidence trail.
6. Secure email, banking and social-media accounts.
7. Notify the platform where contact began.
8. Avoid confronting suspected network members.
9. Do not pay anyone promising guaranteed recovery.
10. Consider whether specialist investigation or legal advice is proportionate.

For more detailed guidance, read Romance Fraud Investigation and Asset Recovery: What Victims Should Do.

Why international cooperation matters

Organised fraud networks may operate across several countries.

A victim may be in the UK while:

• The false profile is managed overseas;
• The recipient account is held in another jurisdiction;
• A money mule is based in the UK;
• Cryptocurrency passes through international exchanges;
• A website is registered elsewhere;
• The principal organisers are located in a different country.

Operation Seraphim involved cooperation between UK and Nigerian authorities and enforcement activity across Europe and Africa. This reflects the cross-border nature of many online fraud investigations.

International cases can require coordination between police forces, banks, exchanges, investigators and legal advisers.

Disruption is not the same as victim recovery

Arrests and seizures may disrupt a network, but they do not automatically return money to every victim.

Recovery may depend on:

• Whether the victim’s payments can be connected to identified suspects;
• Whether funds or assets remain available;
• Whether accounts can be frozen;
• The jurisdictions through which the money moved;
• The availability of criminal compensation;
• Whether civil proceedings are proportionate;
• The number of competing victims or creditors;
• The quality of the preserved evidence.

Victims should avoid assuming that an arrest means compensation will follow automatically.

They should also be cautious of recovery scammers who use reports of police operations to claim that funds have already been found.

Lessons from Operation Seraphim

The operation demonstrates that:

• Romance fraud may be supported by organised networks;
• Different offenders may control different parts of the deception;
• Private messaging groups can facilitate the exchange of criminal tools and services;
• False identities may be supported by websites, documents and additional personas;
• Recipient accounts may belong to intermediaries rather than the main offender;
• Money laundering is central to the operation of many fraud networks;
• Evidence from several victims may reveal links that are not visible in one report;
• International cooperation may be necessary to disrupt the wider infrastructure;
• Arrests do not guarantee that victim losses will be recovered.

The case supports a network-based approach to investigation rather than treating every romance-fraud report as an isolated relationship.

Fraud-investigation support

Conflict International assists individuals, families and legal advisers with fraud matters involving false identities, organised networks and cross-border financial activity.

Depending on the circumstances, our work may include:

• Identity and background enquiries;
• Open-source and digital investigation;
• Company and address research;
• Financial intelligence;
• Cryptocurrency analysis;
• Asset tracing;
• Link analysis;
• Evidence collation;
• International investigative support.

Learn more about our Fraud and Financial Investigation Services, or contact us in confidence to discuss the available evidence and realistic next steps.

Where money has recently been sent, contact the bank and report the fraud before waiting for a private investigation.