Dating Scam

Introduction

Your goal as a penetration tester is to realistically mimic the clever tactics employed by adversaries in the wild. The “Dating Scam” is a potent type of phishing attack that preys on the built-in emotional instincts of individuals. This tactic involves luring targets into a false sense of intimacy and trust, eventually leading them to reveal personal details or transfer funds. By analyzing the key elements of this scam, you can understand how to craft compelling simulations that teach valuable lessons on digital caution.

Subject Line Crafting

In the context of a dating scam, the subject line plays a critical role. It must immediately capture attention and convey a sense of personal connection. Here are some examples:

Subject Line: “Hey [First Name], it’s Me – Remember?”
Subject Line: “I’ve missed you! Let’s Catch Up”
Subject Line: “A Special Connection Awaits You”

Each of these subject lines implies a pre-existing relationship or the possibility of forming one, enticing the recipient to open the email. The specificity (using the target’s first name) increases the odds of engagement by appearing more personal and less generic.

Sender Address Patterns

The appeal of the sender address is equally important. It must sound plausible and relate to either a person or a recognizable platform.

Sender Pattern: “jane.sweet@romantica.net”
Sender Pattern: “michael.dreams@heartsunited.org”
Sender Pattern: “noreply@heartfelt.co”

A well-constructed sender address mirrors legitimate dating sites or individual names that feel familiar and trustworthy. Domain names like “romantica.net” or “heartsunited.org” effectively mimic real services that promise connection and romance.

Domain Construction

Choosing a compelling domain is essential for legitimacy. The domain should evoke romance or denote an official service to add a layer of authenticity:

Domain Example: “hearts-unlocked.com”
Domain Example: “love-link.org”
Domain Example: “connection-zone.net”

These domains maintain a theme consistent with dating and relationships, thereby reinforcing the trust factor.

Email Body Content

Your email body is where you build the narrative. Here’s an example:


Hey [First Name],



I've been thinking about you since our last exchange. I've finally found the time to get back to you. How's everything with you? Let's reconnect; I'd love to catch up.



Check out some new photos I uploaded just for you. Click on the link here: [URL]



Looking forward to hearing from you.



Love,

[name]

This email body works because it stimulates curiosity and promotes interaction. It feels personal, yet inviting, encouraging the recipient to take action without suspicion.

URL Structure

The URLs must appear ordinary and trustworthy. Here are examples:

URL Format: “https://hearts-unlocked.com/photos/[unique_id]”
URL Format: “https://love-link.org/profiles/[target_username]”
URL Format: “https://connection-zone.net/messages/[random_string]”

These URLs are crafted to mimic those of legitimate services, offering no immediate red flags to the wary user.

Good / Better / Best

Good

At a basic level, using generic subject lines like “Hey, check this out!” and sender patterns like “info@love.com” can still ensnare unsuspecting targets. This approach relies on sheer volume and less sophistication.

Better

A more successful approach involves incorporating personal details, such as names in subject lines and more tailored email bodies. Utilizing domain names that closely resemble popular dating websites also adds credibility.

Best

The pinnacle of this scam leverages organizational social engineering by blending personal details with contextual understanding — referencing recent events or discussions and using highly convincing domains and URL structures. This variant appears exactly like legitimate correspondence, often fooling even vigilant users.

Do’s and Don’ts

Do’s

Use realistic sender names and domain formats
Incorporate personal data like first names for personalization
Align your narrative with real-world timelines and events

Don’ts

Don’t use generic phrasing or easily identifiable spoofing signals
Don’t overlook grammar and spelling — they betray scams
Don’t use overly complex or phishy-looking URLs

Related Concepts

Understanding related social engineering tactics, such as leveraging public social media information for more customized phishing emails, is crucial. This knowledge further enhances the believability of your campaigns.

References

For further reading on phishing techniques and the psychology behind them, consider these resources:

Social-Engineer.org – Deep dives into social engineering methodologies.
PhishLabs – Resources on phishing tactics and training.