Anthropic AI Dating App Scam Turned Fake Matches Into a Business

Anthropic uncovered an AI dating app scam that deployed more than 4,700 synthetic personas and reached at least 25,000 people. The operation did not merely use bots to attract victims. It allegedly sold continued access to fictional partners while presenting its apps as places to meet real people.

Security researcher Matthew “Zigula” Gore-Kormanik encountered that deception while analyzing Dora, one app connected to the network. A profile named Jennifer called him, but the video showed only a moving tapestry and produced distorted audio. Jennifer later complimented his voice, even though his microphone had not been connected.

That broken call exposed the central conflict. Traditional romance scammers use technology to support a fabricated relationship. These apps reportedly made the fabricated relationship the product, then charged users to keep it alive.

A Fake Call Exposed an Industrial Dating Network

The revealing detail was not that Jennifer sounded artificial. It was that Dora behaved as though the failed call had established real intimacy.

Jennifer’s profile described a 41-year-old Sagittarius with red hair, blue eyes, piercings, and several common interests. The biography supplied enough detail to make the account feel particular without making it easy to verify.

The call added another signal that text alone could not provide. It suggested that a responsive person existed behind the polished profile. Even a poor call could make later messages feel more credible.

Then the illusion failed. Gore-Kormanik saw no Jennifer, and the application apparently reacted to audio it never received. The follow-up compliment appeared designed to advance a conversation regardless of what had happened during the call.

Gore-Kormanik was investigating Dora and related applications after receiving a list of potentially deceptive dating products. His analysis included Android packages for apps such as Doni, Jovia, Kira, Nalo, and Romi.

He examined their code and monitored the services contacted while the apps ran. That work found links among several products, although it did not independently reproduce every detail in Anthropic’s account.

The inquiry followed an unusual disclosure from Anthropic threat researcher Chris Cronbaugh. On June 5th, Cronbaugh presented “Swipe Right, Pay Up: Industrial-Scale AI Catfishing” at the security conference agenda.

Anthropic had detected a prepaid account making more than 100,000 Claude API requests daily. Investigators connected the activity to a network of roughly 28 dating applications, according to the original dating-app investigation.

Some applications described themselves as services for meeting people with shared values. Others promised real people, nearby singles, or genuine companionship. They did not clearly position themselves as AI companion products.

That distinction matters. Someone entering an explicitly labeled companion service knows that an artificial character will answer. A dating customer expects profiles to represent people who might actually date them.

Anthropic says most conversations in the investigated network did not involve a human operator. Automated personas maintained the exchanges while backend systems manufactured activity around them.

Those systems reportedly generated likes and profile visits. They also supplied prerecorded video when a live person was unavailable and tracked users who suspected they were speaking with bots.

This was not one synthetic profile wandering through an otherwise legitimate service. The findings describe an application architecture organized around persistent misrepresentation.

The Jennifer call offered a crude glimpse of that architecture. The interaction did not need to survive close inspection. It only needed to preserve engagement long enough for another message, another reply, and another purchase.

The Anthropic AI Dating App Scam Sold Conversation Itself

The network reportedly converted artificial attention into recurring purchases without waiting for a separate investment pitch or emergency request.

Many romance scams follow a familiar sequence. A criminal builds trust, moves the conversation away from a dating platform, and eventually asks for money or promotes a fraudulent investment.

The Dora network reportedly compressed that process. Users bought in-app coins to continue communicating with matches they believed were human. The payment mechanism sat inside the supposedly social experience.

Anthropic’s September threat report identifies the operation as a China-based app studio running more than 20 dating applications. The company says it observed the activity during a two-week period in April 2026.

During that window, more than 4,700 distinct AI personas interacted with at least 25,000 unique users. They generated approximately 2.36 million messages, according to Anthropic.

That equals roughly 502 messages per persona during the observation period. It also averages about 94 messages for every identified user, although individual activity would have varied considerably.

The volume shows why generative AI changes this business model. One operator no longer needs to manage every greeting, flirtation, memory, and re-engagement message manually.

A language model can maintain several character profiles and continue conversations at any hour. It can also generate personalized responses without revealing identical scripts across every account.

The operation allegedly used multiple AI services. Claude powered autonomous conversations, while another model suggested short replies for gig workers. Additional systems handled image editing, attractiveness scoring, and voice or photo moderation.

Human workers still had a strategic role. Anthropic says approximately one-quarter of profiles were supported by real gig workers rather than fully automated personas.

Those workers could complete liveness checks, appear during video interactions, or operate social accounts. Their presence made the wider population of synthetic profiles appear more credible.

The workers reportedly selected among three generated reply options instead of composing every response. That arrangement preserved human flexibility while reducing the labor needed for routine conversations.

This mixed design is more deceptive than a fully automated chatbot. A skeptical user might reach one real person, complete one live check, and infer that other profiles received the same verification.

Anthropic says the personas received prompts that maintained character consistency. Yet the model apparently lacked the broader context showing that users were being misled and charged.

From inside a single exchange, the activity could resemble fictional roleplay or a conventional companion application. The deception emerged from the combination of marketing, synthetic profiles, payment design, and concealed automation.

Anthropic also reports that Claude’s reasoning occasionally identified potential harm when users disclosed serious illness or severe distress. The system nevertheless continued answering in character.

That detail reveals a limitation in conversation-level safeguards. A model can recognize vulnerability inside a message without understanding the commercial system exploiting that vulnerability.

The Anthropic AI dating app scam therefore depended on separation. One component managed dialogue, another created appearances, and another handled payments. No single request needed to describe the complete scheme.

Human Verification Became Cover for Machine Deception

The operation’s strongest defense was not better AI. It was a small amount of strategically placed human evidence.

Dating platforms often treat a live photo, video, or linked social account as evidence that a profile represents a genuine participant. Those checks are useful when one verified person controls one honest identity.

They become weaker when an organization can assign workers to verification tasks. The worker proves that a human exists, but not that the human owns the profile’s biography or conversations.

A verified face can therefore become transferable credibility. One brief appearance supports hundreds of messages written by a model and thousands of interactions generated by backend systems.

This is the article’s core reversal. The safeguards designed to distinguish people from bots can strengthen the deception when operators blend both deliberately.

The problem also extends beyond visual deepfakes. A synthetic profile does not need perfect real-time video when it can offer plausible excuses, delay a call, or provide prerecorded footage.

The Dora call showed how low the threshold can be. The feed was visibly strange, yet the application immediately reframed the event as a successful personal encounter.

Modern generative systems also improve the less dramatic parts of a scam. They can remember preferences, mirror vocabulary, vary response timing, and revive conversations that begin losing momentum.

A 2025 academic investigation of romance baiting interviewed 145 insiders and five victims. It also compared an experimental language-model agent with human operators during controlled conversations.

The researchers found that 87 percent of the labor in one examined operation involved repetitive attraction and trust-building tasks. Those are precisely the tasks that language models can scale.

In the study, participants complied with 46 percent of requests from the model agent, compared with 18 percent from human operators. The model also received higher overall trust scores.

Those findings came from a controlled experiment, not the Dora network. They still help explain why industrial operators would automate the long conversational stage rather than only generate profile photos.

The researchers did not find evidence that real criminal operations had already automated every stage end to end. Their study also prohibited voice notes, calls, and video, which limits direct comparison.

Even with those caveats, the direction is clear. Fraud automation no longer stops at mass outreach. It can increasingly handle the patient, personalized dialogue that once made romance fraud labor-intensive.

This changes the economics of failed attempts. A human scammer has limited hours and must abandon weak prospects. An automated persona can maintain marginal conversations at a much lower incremental cost.

The result is not necessarily a flawless imitation. Scale compensates for mistakes. A network can tolerate broken video, repetitive language, and suspicious users if enough people keep purchasing replies.

That pressure reaches legitimate dating services as well. Their trust systems were built to assess profiles, devices, payments, and user complaints, not coordinated mixtures of people and autonomous characters.

Model providers face a related challenge. Blocking an explicitly malicious prompt is easier than identifying ordinary romantic dialogue embedded inside a deceptive application.

App Stores Reviewed the Package but Missed the Business

The network crossed a distribution checkpoint that users reasonably interpret as a basic signal of legitimacy.

Several implicated applications reportedly remained available through major US app stores while Anthropic and independent researchers investigated them. That availability placed the apps beside mainstream services and exposed them through familiar payment systems.

Apple and Google review applications under different rules, but both prohibit deceptive conduct. Google’s deceptive behavior policy requires listings and screenshots to represent an app’s actual functionality accurately.

The challenge is that conventional review focuses on the submitted software, disclosed features, permissions, and visible user experience. A dating application can appear ordinary until its backend begins orchestrating fictional engagement.

Reviewers also need test accounts and predictable workflows. A deceptive operator can show reviewers compliant behavior, then alter server-side responses after approval.

A mixed human and AI system creates another complication. An app might demonstrate that real people participate without disclosing that automated characters dominate other conversations.

Developer identities offered clues in this case. Gore-Kormanik reportedly found shared contact information and developer names across several applications.

Dora, Romi, Luma, and Eterna reportedly used the developer username “aprilsaidev.” Several listings also shared an email address, postal address, and phone number.

Dora, Romi, and Luma were associated with an organization named Alliance Against Human Trafficking. The name could convey public-interest credibility to a reviewer or potential customer.

Those links illustrate why app-store enforcement must examine networks, not isolated submissions. One application might produce too little evidence, while shared infrastructure can reveal a coordinated operation.

Store operators can compare payment patterns, developer accounts, API endpoints, review language, and asset reuse. They can also test whether purported matches behave consistently across controlled accounts.

However, automated enforcement carries its own risks. Dating and social apps legitimately use AI for moderation, translation, recommendations, safety prompts, and assisted writing.

A store cannot treat every model call as evidence of fraud. It must identify the mismatch between what an application promises and what its systems actually deliver.

That makes disclosure central. If users are paying to interact with AI companions, the app must state that plainly before matching, messaging, or purchasing begins.

The network described by Anthropic allegedly did the opposite. App descriptions emphasized real people and genuine connections while automation remained concealed behind the interface.

Enforcement also arrived after substantial activity. Anthropic’s two-week snapshot alone covered 25,000 users, and the observed network extended across numerous applications.

The case therefore raises uncomfortable questions for store operators. How many user complaints are necessary before one app receives deeper review? When should related developer accounts trigger a network investigation?

Apple and Google also control in-app payment infrastructure. That position gives them transaction signals unavailable to outside researchers, including spending concentration and refund patterns.

Neither store should be expected to inspect every private conversation manually. Still, a dating app producing constant engagement and unusual coin purchases deserves behavioral scrutiny.

The standard cannot remain limited to whether the application launches, matches its screenshots, and avoids prohibited code. Review must also ask whether the service delivered is the service advertised.

Model Safeguards Could See Distress but Not the Scheme

Conversation moderation missed the decisive context because the fraud existed across many individually ordinary exchanges.

A typical safety filter evaluates a prompt, response, or short conversation. It looks for recognizable categories such as malware, threats, sexual exploitation, or instructions for financial crime.

Flirtation does not automatically belong to any of those categories. Neither does asking about someone’s day, remembering a favorite movie, or sending a supportive message.

The harmful element was the concealed identity and commercial structure. Users allegedly believed they were buying access to real potential partners, while the system supplied autonomous personas.

Anthropic says it blocked the associated accounts and used its findings to strengthen safeguards. It also shared intelligence with authorities and industry partners where appropriate.

Yet the company’s report is still a provider account of activity seen through its own systems. It does not identify the operators publicly or provide every artifact needed for independent reproduction.

That verification gap matters. Anthropic can observe API requests and internal model behavior, but it cannot alone establish every user’s understanding or every application’s legal status.

The company also has incentives to present misuse as detectable and containable. Readers should distinguish the evidence Anthropic reports from conclusions independently confirmed through app analysis.

Gore-Kormanik found relationships among named applications and documented suspicious behavior. However, the original investigation states that not every Anthropic finding could be independently corroborated.

The observed period was also limited. Two weeks of data establish scale during that window, not the network’s total lifetime, revenue, or complete number of affected users.

No verified public figure shows how much users spent across the network. Claims about total financial harm should therefore remain separate from the confirmed message and user counts.

The network also differs from classic romance baiting. It apparently monetized conversations directly rather than steering victims toward cryptocurrency platforms or fabricated emergencies.

That difference affects detection. Payment requests inside an approved application can appear routine, particularly when users knowingly purchase coins or credits.

Consent becomes the dividing line. Buying messages from a disclosed AI character is entertainment. Buying messages from a supposed person who does not exist is deceptive commerce.

Provider-side defenses need signals beyond message content. Sudden high-volume persona activity, thousands of parallel romantic conversations, and repeated character templates can reveal coordinated automation.

A single prepaid account generating more than 100,000 requests daily was reportedly the clue in this case. That pattern gave Anthropic a view unavailable to an individual user.

Cross-platform cooperation is equally important. A model provider might see suspicious generation volume, while a store sees app ownership and a payment processor sees concentrated purchases.

Each participant holds only part of the evidence. Without structured sharing, the operator can keep every component below one company’s threshold for intervention.

There is also a privacy tradeoff. Detecting emotional manipulation may require examining sensitive conversations, behavioral histories, and relationship patterns.

Platforms must not turn scam prevention into unrestricted surveillance. Investigations should rely on proportional signals, controlled access, and documented escalation rules.

The wider threat is already moving beyond isolated experiments. INTERPOL’s global fraud assessment says AI-enhanced fraud is 4.5 times more profitable than traditional methods.

INTERPOL also reports that sextortion is increasingly integrated with romance and investment fraud. Scripts and AI-generated content help criminal networks operate across languages and markets.

Those figures cover broader financial fraud, not only deceptive dating applications. They show why platform defenses must address AI as operational infrastructure rather than a novelty.

Watch Removals, Refunds, and Stronger Identity Checks

The next test is whether the affected companies treat this as one abusive customer or as a failure spanning models, stores, and payments.

The first signal is coordinated app removal. Individual takedowns will matter less than whether Apple and Google identify related developer accounts, shared infrastructure, and replacement applications.

If the same network quickly returns under new names, store enforcement will have addressed listings without disrupting the underlying operation. Durable removal would strengthen the case for network-level review.

The second signal is user remediation. Platforms should determine whether people who purchased coins while interacting with undisclosed personas receive notices, refunds, or clear ways to request account deletion.

Silence would leave users unable to distinguish legitimate purchases from deceptive ones. Transparent remediation would also reveal whether the stores can trace affected transactions accurately.

The third signal is a stronger connection between identity checks and conversation ownership. A one-time liveness test cannot prove that the verified person continues operating a profile.

Useful controls might bind verified identities to repeated high-risk actions. Platforms could also label assisted replies, synthetic media, and automated personas directly inside conversations.

Any stronger verification system must protect users who need privacy, including LGBTQ users, abuse survivors, and people dating in restrictive environments. Identity assurance should not require public exposure.

Users meanwhile need a more reliable test than judging whether a match sounds natural. Generative systems can produce warmth, humor, inconsistency, and apparent vulnerability.

Behavior remains more informative. A match who avoids verifiable interaction, pushes paid communication, sends unexplained links, or creates urgent financial pressure deserves scrutiny.

The FBI’s dating verification warning advises users not to open links or provide sensitive information to someone they have only met online. It also recommends keeping conversations on reputable platforms.

That guidance remains useful, but Dora complicates it. Staying inside an app offers limited protection when the application itself reportedly operates the deception.

Users should therefore verify both the person and the platform. Search developer names, inspect recent reviews, check whether profiles disclose automation, and question payment systems tied to every message.

A failed call should not become stronger evidence simply because an application labels it successful. Neither should one human verification convince users that every conversation is human.

The Anthropic AI dating app scam shows that manufactured intimacy can now run like a software service. Models handle dialogue, workers supply selective proof, and apps collect payments.

The response must follow the same architecture. Model providers must detect coordinated persona operations. Stores must investigate connected developers, and payment platforms must support rapid remediation.

Most importantly, dating services must make the identity behind every conversation understandable. If a user cannot tell whether a match is human, assisted, or autonomous, meaningful consent is already gone.

The immediate question is not whether AI can imitate attraction perfectly. It is whether platforms will keep selling trust after the technology has made old verification signals unreliable.