Telegram Dating Bot Used for Romance-to-Arson Scam

How the attack unfolded

This case describes a two-phase social engineering operation that allegedly began on a Telegram dating chatbot. Agents posed as young women to build romantic relationships with targets, then asked them to share their geolocation for a meeting and to pay for movie tickets, concert tickets, or gifts through phishing links. This first phase relied on trust built through ordinary romantic chat, making the payment request feel like a normal next step rather than a scam.

The second phase shifted the pretext entirely. Impostors posing as Russian law enforcement authorities or officials from Rosfinmonitoring contacted the same targets through messaging apps, claiming that the money they had sent earlier had ended up funding hostile military activity. Under threat of criminal prosecution, targets were allegedly coerced into pseudo-operational tasks, including arson and armed attacks.

Why this approach succeeded

The scheme worked by combining two very different manipulation styles in sequence. The romance phase lowered defenses through emotional investment, making a request to click a link or share a location feel routine. The authority-impersonation phase then used fear and legal threats to override critical thinking. Targets were reportedly left unable to critically assess the situation due to psychological pressure, which is a common outcome when urgency and intimidation are layered on top of an existing relationship of trust.

What to watch for

• A new online romantic contact who quickly asks for payment through a link rather than a known, trusted site
• Requests to share a precise location for a first meeting with someone known only online
• Unexpected contact from someone claiming to be law enforcement or a financial authority over a messaging app
• Threats of prosecution used to force immediate compliance or continued "cooperation"
• Claims that a routine past action, like buying a gift or ticket, is now tied to terrorism financing or criminal activity

Building resistance to this pattern

Awareness efforts should emphasize that legitimate authorities do not conduct financial investigations through casual messaging apps and do not threaten immediate prosecution to compel action. People should be encouraged to pause before clicking payment links shared by online contacts and to verify any claimed law enforcement contact through channels they look up themselves, not ones provided by the person contacting them. Training should also highlight that emotional pressure, whether romantic or fear-based, is a manipulation signal in itself. When a conversation moves from small favors to high-stakes demands, that shift is worth treating as a red flag rather than a natural escalation of trust.

How did the Telegram dating bot scam start?

Agents allegedly posed as young women on the Daivinchik/Leo dating chatbot to build romantic relationships with targets, then asked for their location and pushed them to pay for gifts or tickets through phishing links.

How did the scam escalate to arson or armed attacks?

After the romance phase, impostors allegedly posed as Russian law enforcement or Rosfinmonitoring officials and claimed the targets' payments had funded a hostile military, then used threats of criminal prosecution to coerce them into pseudo-operational tasks including arson and armed attacks.

What red flags should people watch for in this type of scam?

Warning signs include a new online romantic contact quickly asking for payment via an unfamiliar link, requests to share a precise meeting location, and unexpected messages from people claiming to be authorities who threaten prosecution to force immediate compliance.

Who is most at risk from this kind of manipulation?

The scenario targeted young Russian men through a dating chatbot, but the underlying tactics apply broadly to students, young adults, and general users of messaging apps who interact with unknown online contacts.