Back

She Thought She Had Found Love Online. Our Investigators Found a Cybercrime Syndicate.

Terrance Private Investigator

Case Overview

If you have ever had a feeling about someone that turned out to be wrong, you understand something about the particular kind of pain this client carried when she came to us. The difference is that most people who have a bad feeling about someone are dealing with a person. Dana was dealing with a production.

She had met him online. His name, he said, was Dominic. He was in the military, stationed abroad, counting down the days until he could come home to her. He had photographs, credentials, a story, and a warmth in his messages that had convinced her over the course of their relationship that he was genuine. Then the money entered the picture: a family inheritance being held up overseas, legal fees that needed to be covered, wire transfers that he promised would be returned as soon as the funds were released, and a meeting scheduled at a local tire shop in Texas City that he never showed up for.

She came to Terrance Private Investigator & Associates not fully certain she had been apart of a romance scam. She was still hoping there was an explanation. She asked us to find out who Dominic actually was.

Our investigators spent ten days pulling every thread of the operation apart and found that the identity was entirely fabricated, the photographs had been stolen from a real, living person who had no knowledge of any of this, the military credentials contained errors that proved they were manufactured, the law firms were fake, the LLC he had used to receive her wire transfer was legally terminated, and the money she had sent was already moving through an automated cryptocurrency laundering pipeline operated by an organized West African cybercrime syndicate. What existed in Dominic’s place, was one of the most sophisticated romance fraud operations our investigators had documented in the Houston market. Here is exactly what we found.

Romance Scam

The Challenge

Romance scam investigations require a fundamentally different investigative toolkit than surveillance cases. There is no subject to follow. There is no vehicle to track. There is a persona, a set of communications, a series of financial transactions, and the question of whether any of it connects to a real, identifiable human being or to something considerably more organized and deliberately untraceable.

Our investigators needed to:

  • Verify whether the identity presented to Dana corresponded to any real, living individual or was entirely fabricated.
  • Confirm or disprove the subject’s claimed military affiliation and the legitimacy of his credentials and photographs.
  • Trace the financial infrastructure behind the wire transfer Dana had already completed, including the LLC account used to receive funds.
  • Investigate the law firms and legal documents provided to Dana as part of the inheritance narrative.
  • Map the cryptocurrency pipeline used to move funds after collection and identify the scope of the operation.

10

Days Of Investigation   

0

Real People Behind the Persona

2

Fake Law Firms With Fabricated Addresses

$86M+

Combined Cryptocurrency Wallet Balance

The Investigation

Ten days of work peeled back every layer of Dominic’s story, checked every address, examined every document, and traced every financial thread to where it actually led. What our investigators assembled was not a picture of a man. It was a picture of a machine, professionally built, actively running, and currently operating against multiple victims at the same time Dana came to us.

Here is what the investigation found at every level of the operation.

The first and most fundamental question in any romance scam investigation is whether the person presenting the identity actually exists. Our investigators ran a comprehensive reverse-image analysis on every photograph Dominic had sent Dana.

Every single image had been stolen from the public social media profile of a real, living individual who had no knowledge of, no connection to, and no involvement in anything Dominic had described. That person is a private individual living an ordinary life who became the unwitting face of a criminal operation without ever being asked or informed. Our investigators confirmed through public records that no individual matching the fabricated persona existed anywhere in the legal, asset, or probate record systems. The name had been invented, the photographs had been stolen, and the persona existed only as a vehicle for fraud.

The modus operandi matched a documented pattern used by organized West African cybercrime syndicates. The same stolen photographs and the same inheritance script our investigators found in Dana’s case were being used concurrently against at least one other identified victim, with identical emotional manipulation language, identical financial requests, and a different name inserted into the same template. Dana had not been individually targeted by a person with feelings for her. She had been individually targeted by a script with a slot where her name went.

Dominic had presented himself as a military man. He had a uniform in his photographs. He had training certificates with his name on them. He had a story about being stationed abroad and a base that tied him to Texas. Our investigators subjected every piece of that documentation to forensic review.

The uniform failed the forensic review immediately: the rank insignia displayed on the chest of the Operational Camouflage Pattern uniform was rotated 180 degrees, with the chevrons pointing downward. Per United States Army uniform regulations, chevrons must point upward. No active or veteran service member would wear an inverted rank patch. The patch had been placed on the uniform by someone who did not know which direction it was supposed to go.

The rank itself was also wrong. The training certificate named the subject as a Staff Sergeant, a rank requiring three upward chevrons over one curved rocker bar. The patch on the uniform showed only three plain chevrons, which is the configuration for a Sergeant, one full rank lower. The certificate and the uniform did not match each other, because neither of them was real. These were not minor discrepancies. They were the kind of errors that only appear when someone is assembling a military costume from online image searches rather than from actual service.

When Dominic asked Dana to send money, he directed her to wire funds to a business checking account under the name of a Texas LLC, explaining that a named registered agent was handling the transaction on his behalf due to shared Texas ties. The explanation was designed to sound local and legitimate.

Our investigators ran a corporate registry check with the Texas Comptroller of Public Accounts. The LLC was real, in the sense that it had once existed as a registered entity in Texas. Its taxpayer number was on file. Its registration history was searchable. What the registry also confirmed was that the LLC had been involuntarily terminated. Its right to transact business in Texas had been officially ended by the state. Its Secretary of State registration status was inactive.

Dana had wired money to a bank account held by a company that Texas had already formally shut down. The account had received her funds. Those funds were no longer there.

The inheritance narrative required legal infrastructure, so the syndicate built some. Two separate law firms had provided Dana with official-looking correspondence as part of the inheritance documentation.

The first, presented as a London-based chambers, had sent correspondence from a domain that did not belong to any registered legal entity. Our investigators confirmed with the UK Solicitors Regulation Authority that no such firm or attorney existed in their records. The physical address listed for the firm was the location of a well-known local British sports bar. The syndicate had apparently copy-pasted a London address from a search result without verifying what was actually at that location.

The second, presented as a Philadelphia law firm, listed an address that physical mapping confirmed was a neighborhood Baptist church. The firm’s website returned a dead domain. The legal will the firm had provided contained template errors significant enough to invalidate it on their face: the document referred to the male decedent using female legal terminology, and it listed the place of execution as a city and state combination that does not exist. The syndicate had produced documents that looked, at first glance, like legal paperwork. On closer examination, they were templates filled in by people who had never read an actual legal document.

The Results

The final layer of the investigation traced what happened to the money after it entered the system. Blockchain analysis confirmed that funds collected through the syndicate’s domestic infrastructure were processed through an automated laundering operation.

Incoming funds arrived at a deposit address programmed to maintain a permanent balance of zero. The wallet was set to automatically sweep any received funds to a set of protection wallets immediately upon transaction confirmation, leaving no traceable balance and no delay that would allow a freeze or reversal.

From there, funds were aggregated into three destination wallets representing what blockchain analysis characterized as industrial-scale enterprise networks. At the time of our investigation, the combined active balance across the three wallets exceeded eighty-six million dollars in Bitcoin. This was not a single person running a scam from a laptop. This was an organized operation with automated financial infrastructure, active simultaneously against multiple victims, processing funds at a scale that placed it firmly in the category of organized international financial crime.

  • The persona used to target Dana was entirely fabricated, with photographs stolen from a real private individual who had no connection to the operation, no matching public records in any legal or asset database, and a documented pattern of identical scripts being deployed against multiple victims simultaneously.
  • The military credentials presented to Dana contained two separate uniform regulation violations, a rank mismatch between the training certificate and the physical insignia, and errors consistent with a fabricated costume assembled without any actual knowledge of military dress standards.
  • The wire transfer Dana completed was directed to a bank account held by a Texas-registered LLC that had been involuntarily terminated by the state, with no legal right to transact business, and funds confirmed as having already moved out of the account.
  • Both law firms referenced in the inheritance documentation were confirmed as nonexistent by their respective regulatory bodies, with physical addresses corresponding to a sports bar and a church respectively, and the will itself contained fatal template errors including incorrect legal gender designation and a nonexistent place of execution.
  • Blockchain tracing confirmed that collected funds were processed through an automated sweeping mechanism into three high-volume destination wallets with a combined active balance exceeding eighty-six million dollars, consistent with an organized West African cybercrime syndicate operating at industrial scale.

Dana came to us still hoping there was an explanation. Ten days of investigation gave her one. The man she had been talking to did not exist. The photographs were stolen, the law firms were fake, the LLC was dead, and the money was already gone. What existed in Dominic’s place was a professional criminal operation running the same script against multiple victims at the same time. She deserved to know the full truth of what she had been dealing with, and now she does.

Terrance Private Investigator & Associates

Looking Ahead

We want to say something directly to anyone reading this who has had a conversation online that felt real, felt warm, felt like the beginning of something, and has since started to wonder. You are not foolish for having believed it. The people who build these operations are professionals. They use real photographs of real people. They write scripts that have been tested against dozens or hundreds of victims before they ever reached you. They know which emotional notes to play and in what order. The fact that the manipulation worked does not say anything about your intelligence or your judgment. It says something about the sophistication of the people running the operation.

What we want you to know is that there is something you can do. If you are in a situation that has started to feel wrong, if the requests for money have begun, if the in-person meeting has been cancelled once or twice, if the story keeps developing new complications that always require something from you before the situation can resolve, please reach out. Our investigators can tell you within days whether the person you are talking to is who they say they are. In Dana’s case, the answer was clear within the first day of investigation. Ten days gave her the complete picture.

At Terrance Private Investigator & Associates, we document the truth about who someone is before the damage is irreversible. For Dana, some of the financial damage was already done. The investigative findings gave her everything she needed to pursue federal reporting and banking escalation. They also gave her something harder to measure and just as important: the certainty that she had not misjudged a person. She had been targeted by a machine.

Contact us

If you have met someone online whose story has started developing inconsistencies, who has never been able to meet you in person, who has introduced a financial request tied to an inheritance, a military situation, a legal fee, or an emergency, or who has simply given you a feeling you cannot quite name, our investigators know how to find out who you are actually talking to. We have the tools to verify identities, trace financial infrastructure, examine documents for authenticity, and deliver a complete picture of what is real and what is not. You do not have to keep wondering.

Terrance Private Investigator and Associates

Learn more about our background investigations

GetAnswers@piterrance.com

(832) 404-3400

Resources

FBI Internet Crime Complaint Center (IC3)
The official federal reporting portal for internet fraud, romance scams, and cybercrime. Filing a report creates a federal record and can initiate financial intervention.
https://www.ic3.gov/

Federal Trade Commission: Report Fraud
Report romance scams and online fraud directly to the FTC. Reports contribute to national enforcement action against fraud networks.
https://reportfraud.ftc.gov/

AARP Fraud Watch Network Helpline
Free helpline and resources for fraud victims of all ages. Counselors are available to help you understand what happened and what to do next.
https://www.aarp.org/money/scams-fraud/

Psychology Today – Find a Therapist
Search licensed counselors in Houston specializing in trauma recovery, betrayal, and the emotional aftermath of fraud victimization.
https://www.psychologytoday.com/us/therapists

Insights

If something about an online relationship has started to feel wrong, our fraud and background investigation insights may help you understand what the warning signs actually look like.
piterrance.com/insights-category/background-investigations

  • Head office

    Houston
    11811 North Freeway #811
    Houston, Texas 77060
    United States

  • Contact info

    Toll-free: 833 495 0003
    E-mail: getanswers@piterrance.com
  • Follow us on

    Facebook
    Instagram
    TikTok
    Linkedin
    X
  • Copyright © 2026 Terrance Private Investigator & Associates. All rights reserved.