Most people who raise this with us have already done the arithmetic in their head and do not like the answer. They are not asking whether something is wrong. They are asking how to find out for certain, quickly, and usually without telling anyone yet.
Read this as a procedure, not a verdict. The people running these operations are trained, patient, and working from scripts refined across thousands of conversations. Being taken in is not a measure of your intelligence, but of how much professional effort was pointed at you.
Short answer: you can do most of the useful verification yourself tonight, for free, in about an hour. Reverse image search every profile photo separately across more than one engine. Search the name, phone number, and email in quotation marks against the claimed employer and city. Insist on a short, live, unscripted video call, and treat continued evasion as a finding rather than an inconvenience. Confirm the employer and professional history against registries. And if there is any investment component, check registration through the Canadian Securities Administrators’ National Registration Search and the CSA and OSC warning lists before a single dollar moves. If money is already gone, the first 24 hours matter most.
Because this touches criminal and securities law, treat it as orientation. If a meaningful amount is gone, or a recipient in Canada can be named, have a lawyer look at your situation early.
How romance fraud and investment fraud became the same crime
They used to be separate. Romance fraud meant a fabricated partner and an emergency: a customs fee, a hospital bill, a stranded contractor needing a flight home. Investment fraud meant a cold call, a boiler room, a share certificate that did not exist.
The dominant model is both at once. The Canadian Anti-Fraud Centre describes it directly: victims are contacted on dating apps or social media by fraudsters who develop a relationship to gain trust, then claim success with cryptocurrency and offer to help the target get rich through what turn out to be fake trading platforms. The pattern is often called “pig butchering,” the operators’ own term for fattening a target before the loss.
What makes it work is the sequencing. Nothing is asked for during the phase when you would be suspicious. There is no emergency in week three. There is a person who texts good morning, remembers your sister’s surgery, and is unremarkably present for months. The investment arrives later, casually: mentioned as something they do, declined when you ask, then reluctantly explained. By then you are not responding to a stranger’s offer. You are asking someone you trust for a favour.
The platform then behaves as a real one would. The CAFC notes these operations show fake financial records demonstrating returns and often allow small withdrawals to succeed. That first successful withdrawal is the hinge: it converts scepticism into confidence, and it is when most people deposit seriously.
Why these operations feel so professional
Because many of them are industrial. INTERPOL reported on 30 June 2025 that human trafficking-fuelled scam centres have expanded from a regional problem into a global one, and that as of March 2025 victims from 66 countries had been trafficked into online scam centres, 74 percent of them brought to the original hub region of Southeast Asia. INTERPOL had issued an Orange Notice in 2023 warning that this fraud was a serious and imminent threat.
That dissolves the shame faster than anything else I can tell you. The person typing to you may be working a shift, to a script, under a quota, in a compound they cannot leave. The polish is not one talented liar; it is a workflow of recruiters, scriptwriters, photo libraries, developers, and laundering channels. Patience is cheap when it is someone else’s forced labour.
The Canadian losses match that scale. The CAFC reported Canadians lost over $704 million to fraud in 2025, with reported losses since 2022 surpassing $2.4 billion, investment and romance fraud among the highest-impact types, and only 5% to 10% of frauds reported at all.
What you can verify yourself tonight
Do these in order. Each is free.
1. Reverse image search every photo, properly
Most people do this badly and conclude wrongly.
- Capture first. Screenshot every photo, the profile page with its URL and handle, and the bio. Profiles are deleted quickly once an operator senses checking.
- Search each photo separately, and use more than one engine. Google Lens, TinEye, and Yandex Images index different corners of the web. TinEye can sort by oldest match, showing where an image first appeared.
- Crop before you search. Crop tightly to the face or a distinctive object and search again. Backgrounds and filters defeat naive matching.
- Read a null result correctly. Finding nothing is not clearance: AI-generated photos, and photos lifted from private accounts, frequently return no matches. It moves you to the next check, not to the end of the inquiry.
2. Check whether the name and the photo belong to the same person
This catches the most and is the least used. It is ordinary open-source research: search the name in quotation marks with the claimed employer, city, and profession, then the phone number and email address.
In a large share of cases the photographs are real and belong to a real person, often a serving military member, a physician, or a small-business owner whose public images were harvested wholesale and who has no connection to the person messaging you. Check account age too: a recent profile with a thin history and connections that overlap no real professional community is telling you something even when each element looks plausible.
3. Insist on a live, unscripted video call
Ask for ten minutes. Not a recording, not a voice note, not a photo holding a sign.
Request something that cannot be prepared in advance: hold up a number of fingers you choose in the moment, say a phrase you pick, turn the camera slowly around the room, pass a hand in front of the face. Real-time synthetic video still degrades badly under those conditions. One caveat: a call that goes well is not proof, because face-swapping and injected video are within reach of organized operations.
What is not ambiguous is a pattern. Someone who has spoken with you daily for two months and has an answer ready every single time, whose camera is broken, whose connection is poor, whose posting is secure, is not shy. Persistent evasion of a short live call is one of the strongest indicators there is. Treat it as a finding.
4. Confirm the employer and the professional history
Claims are checkable. Take the most specific ones and test them.
- Does the employer exist, in the form described? Corporate and business-name registries are public in most Canadian and many foreign jurisdictions.
- Does the person appear on the employer’s own website or in independent coverage?
- Does the claimed profession require a licence, and does the register show them? Physicians, engineers, lawyers, nurses, and securities professionals are all publicly searchable in Canada.
- How old is the platform’s domain? A WHOIS lookup shows the registration date. A platform claiming a decade of history on a domain registered four months ago has answered your question.
Where this exceeds what you can do from a laptop, particularly confirming an identity belongs to a real, locatable person, that is locate and research work.
Before you send a dollar: check registration
This takes five minutes and it is not optional. Anyone in the business of trading in or advising on securities in Canada must be registered with the regulator in each province or territory where they do business, unless an exemption applies.
- CSA National Registration Search. Go to aretheyregistered.ca, the Canadian Securities Administrators’ entry point to the National Registration Search, and search both the firm name and the individual’s name. If neither is registered, you have your answer.
- CSA investor alerts. The CSA maintain a national, searchable archive at securities-administrators.ca/investor-alerts/, aggregating warnings from regulators across the country about persons and companies that appear to be engaging in securities activity posing a risk to investors.
- OSC investor warnings. In Ontario, the Ontario Securities Commission publishes a searchable list at osc.ca/en/investors/investor-warnings-and-alerts.
One caution: absence from a warning list is not an endorsement. Those lists are reactive and trail operators, who cycle platform names constantly.
The red flags, stated plainly
None alone proves anything. Two or three together is a pattern.
| Signal | What it usually means |
|---|---|
| Declarations of love within days or weeks | A compressed trust timeline is a technique, not a temperament. The RCMP names this specifically. |
| Moving to a private or encrypted channel early | Platform moderation and reporting go off the table, along with the record. |
| A reason they can never video call, every time | The most reliable behavioural indicator here. |
| An emergency requiring money: customs, medical, legal, travel | The classic form, often deployed after an investment relationship stalls. |
| An investment introduced by someone you have never met | Regardless of how organically it comes up. |
| Small withdrawals succeed, then pressure to deposit more | Documented by the CAFC. Engineered confidence, not proof of a real platform. |
| A fee or tax demanded before you can withdraw | Definitive. No legitimate platform needs new money to release your own funds. |
| Payment in cryptocurrency, gift cards, or wire transfer | Chosen because they are fast and effectively irreversible. |
What a licensed investigator adds, and where the limits are
I would rather set expectations correctly than sell you something that cannot work.
What is genuinely useful is a structured open-source profile: photo provenance across multiple engines and archives, domain and platform history, corporate registry checks in more than one jurisdiction, and account-age analysis, in one dated document. This is OSINT work; our overview of what OSINT means in practice explains the method. Alongside it, evidence preserved with accurate timestamps and an intact chain of custody before the other side deletes the account, since casual screenshots are far weaker than properly captured digital evidence. And locate and research work on the domestic end, because the money often passes through someone local who is identifiable.
Where the limits are:
- Offshore actors are frequently unidentifiable. When an operation runs from a compound in another country behind stolen identities and rented infrastructure, no licensed Ontario investigator is going to name the person who typed the messages. Anyone who says otherwise is selling.
- Cryptocurrency sent abroad is usually not recoverable. Tracing can sometimes show where funds moved and whether they reached an exchange. Turning that into money back in your account needs a foreign exchange to cooperate, a court with jurisdiction, and funds not already laundered. Plan on it not happening.
- A private investigator has no compulsion powers. We cannot subpoena bank records, compel an exchange to name an account holder, or freeze anything. Where a domestic recipient with assets is identified, a lawyer may be able to seek court orders compelling disclosure or preservation of funds. That is a legal remedy, not an investigative one, and the window is short.
- Sometimes the honest advice is not to spend more. If the loss is modest and the trail is plainly offshore, an investigation can cost more than it recovers. We will say so. See hiring a private investigator in Ontario.
The second scam: fake recovery services
Victim lists circulate. Within weeks of a loss, many people are approached by someone offering to recover the funds: a “blockchain recovery specialist,” a “fund recovery agency,” someone claiming to be a lawyer, an investigator, or a police officer. The CAFC has warned about exactly this, including fraudsters impersonating CAFC representatives and claiming to help get money back from a previous incident.
A firm that guarantees recovery of your funds for an upfront fee is the second scam. No legitimate investigator, lawyer, or agency can guarantee recovery, because none controls the foreign exchange, the receiving bank, or the court. The CAFC and police will never ask you to transfer funds or make a payment. Anyone who contacts you unprompted about money you lost has told you where they got your name.
Before engaging any Canadian firm, confirm it holds a current licence: our guide on verifying a private investigator’s licence sets out the steps.
The first 24 hours after you realize
Speed matters, and so does not destroying the record in a moment of humiliation.
- Stop sending money, including for fees, taxes, or “unlocking” a balance. Especially those.
- Stop contact, but delete nothing. Not the chat, the profile, the app, the emails, or the photos. The instinct to erase it all is understandable and it destroys your only evidence.
- Preserve the whole record. Export or screenshot the entire chat history. Capture the profile with its URL and handle. Save the platform’s website and your displayed balance. Keep bank and transfer confirmations, wire details, and any cryptocurrency wallet addresses and transaction hashes. Those last two are the most useful technical artifacts you can hand anyone.
- Call your financial institution immediately. Wires and transfers are sometimes recallable within a window that closes in hours. If an exchange was involved, notify it too.
- Report to local police and get an occurrence number. You will need it for the bank, for any insurer, and for whatever follows.
- Report to the Canadian Anti-Fraud Centre, online at reportcyberandfraud.canada.ca or by phone at 1-888-495-8501, Monday to Friday, 10 am to 4:45 pm Eastern. The CAFC is Canada’s central repository for fraud information and supports police investigations.
- If an investment platform was involved, report to your securities regulator, in Ontario the OSC.
- Secure your accounts. If you shared identity documents or credentials, change passwords, turn on app-based two-factor authentication, and consider a fraud alert with both credit bureaus.
- Tell one person. Not for the investigation. For you.
The Canadian legal context
Under Criminal Code section 380(1), everyone who “by deceit, falsehood or other fraudulent means” defrauds the public or any person of property, money, or a valuable security is guilty of an offence. Where the value exceeds $5,000, section 380(1)(a) makes it indictable, carrying up to fourteen years. Where it does not, section 380(1)(b) provides for a lesser indictable offence or summary conviction. Section 380(1.1) imposes a two-year minimum on indictment where the total value exceeds one million dollars.
The difficulty is never whether an offence occurred. It is jurisdiction and identification, which is exactly why reporting still matters when a single case looks hopeless: aggregation is what makes coordinated action possible. In Ontario, the investigation work described here is itself licensed under the Private Security and Investigative Services Act, 2005 and O. Reg. 363/07.
This article is general information about investigative practice in Ontario, not legal advice. Laws change and every situation is different. For advice about your specific circumstances, consult a licensed Ontario lawyer or contact a licensed investigator directly.
What to do next
If you are still in it and unsure, run the four checks tonight, in order, before making any decision about the relationship. If money is already gone, work the 24-hour list from the top, today.
And on the hardest part. The embarrassment is the mechanism. These operations rely on the near-certainty that a person will absorb the loss privately rather than say it out loud, and that silence protects the next target. Being deceived by a professional, well-resourced operation says something about the operation, not about you.
If you want a second set of eyes on the verification, or a documented record before it disappears, contact us or assign a case. We will tell you honestly whether an investigation is worth the money, including when it is not.
Frequently asked questions
How do I verify someone I have only met online?
Reverse image search every profile photo separately, using more than one engine. Search the name, phone number, and email in quotation marks against the claimed employer and city. Insist on a live, unscripted video call. Confirm the employer and professional history against public registries. If investing is involved, check registration first.
How do I check whether an investment platform is legitimate in Canada?
Anyone in the business of trading or advising on securities in Canada must be registered with the securities regulator in the province where they do business, unless an exemption applies. Use the Canadian Securities Administrators National Registration Search at aretheyregistered.ca, then the CSA investor alerts list and, in Ontario, the OSC investor warnings page.
Can a private investigator get my money back from a romance or crypto scam?
No, and any firm guaranteeing recovery for an upfront fee is running a second scam. An investigator can preserve evidence, verify or disprove an identity, trace a domestic recipient, and produce a report a bank, police service, or lawyer can act on. Recovering cryptocurrency sent offshore is usually not realistic.
What should I do in the first 24 hours after realizing I have been defrauded?
Stop sending money and stop contact, but delete nothing. Preserve the profile, the chat history, transaction records, and any wallet addresses. Call your bank immediately, because speed matters most on wires and transfers. Report to local police for an occurrence number, then to the Canadian Anti-Fraud Centre at reportcyberandfraud.canada.ca or 1-888-495-8501.
Is romance fraud a crime in Canada?
Yes. Defrauding a person of money or property by deceit or falsehood is an offence under section 380 of the Criminal Code, indictable and carrying up to fourteen years where the value exceeds $5,000. The difficulty is not whether a crime occurred but whether an offshore offender can be identified and reached.