Safely Exiting a Confirmed Romance Scam Involving a Russian or CIS Contact

← Back to Library

Receiving confirmation that a relationship has been a romance scam is deeply distressing, regardless of how long the relationship lasted or how much money was sent. The period immediately following confirmation is also practically significant: decisions made in the first hours and days affect both the safety of disengagement and the quality of evidence available for any subsequent reporting or legal action.

The Immediate Priority: Safety

The first priority in disengaging from a confirmed scam is not evidence collection or confrontation — it is safety. In the overwhelming majority of romance fraud cases the risk is purely financial and emotional, not physical. However, certain patterns indicate elevated concern: a relationship that has evolved to involve the victim holding cryptocurrency wallets or financial accounts on behalf of the scammer (potentially making the victim an unwitting money mule), situations where the victim has shared significant personal data including address, financial account details, or identity documents, and rare but documented cases where in-person meetings have been arranged.

Where personal data has been shared, immediate steps include reviewing which accounts may be compromised, changing passwords, enabling two-factor authentication on financial accounts, and where an address has been shared with a potentially criminal organisation, considering whether to notify local police as a precautionary measure.

Evidence Preservation Before Disengagement

Before severing contact, preserving the evidence of the interaction is important. Screenshots of conversations, photographs received, email chains, payment receipts and confirmations, and any documents provided by the scammer should be saved to a secure location — ideally both locally and in a cloud backup. Many messaging platforms do not allow access to conversation history after a contact is blocked, so preservation should precede any blocking action.

The specific identifiers used in the fraud — the phone number, the platform username, the email address, the banking details used to receive transfers — should be documented in a single organised file. This becomes the basis for any report to financial authorities, law enforcement, or consumer protection bodies, and for any investigative work aimed at tracing the fraud operation.

Disengagement Without Confrontation

Confronting a confirmed scammer with evidence of their fraud serves no useful purpose and can trigger retaliatory behaviour — publication of personal information, harassment campaigns using other accounts, or attempted financial manipulation using threats of disclosure. The professional recommendation is simple disengagement: cease communication, block across all platforms simultaneously, and do not respond to any subsequent contact from the same or associated identities.

Investigative Support After Disengagement

Post-disengagement investigative support serves two purposes: understanding what actually happened, and generating evidence usable in reporting or potential legal proceedings. Investigators can attempt to trace the origin of the fraud operation — identifying whether the contact originated from a known fraud-linked number pool, establishing approximate geographic origin, and determining whether the photographs used belong to an identified person being impersonated. Where an innocent person's photographs have been misused, this allows that person to be alerted. Financial recovery is rarely achievable but is not always zero. Where funds were transferred through platforms with consumer protection provisions, prompt reporting can sometimes result in partial recovery.