Romance fraud is not only a story problem. It is an infrastructure problem.
The case began when concerned individuals reached out after family members were targeted by romance scams linked to West African operating patterns. They had scattered clues, emotional urgency, and no clear way to understand whether the accounts were isolated or coordinated.
Stratir treated the inquiry as an attribution and evidence problem: preserve the original observations, resolve selectors across platforms, map the network, label confidence, and package the findings for people who needed to act.
The investigation produced a usable map, not a pile of screenshots.
17
Connected fraudulent accounts
Profiles were linked through repeated imagery, behavioral overlap, and shared operational patterns.
72h
Investigation window
Collection, correlation, review, and client delivery were completed inside a three-day sprint.
5+
Platforms mapped
The inquiry moved across social surfaces, archive traces, public records, and supporting selector context.
47
Profile captures preserved
Screenshots and source observations were retained so the final findings could be reviewed and escalated.
Project Cerberus findings
Romance-fraud reports became reviewable intelligence.
Project Cerberus began with scattered family concerns, suspicious profiles, and repeated romance-fraud behavior across platforms. Stratir turned that uncertainty into a structured intelligence package.
The work connected profile imagery, account behavior, communication patterns, payment clues, and source captures so readers could understand how the operation worked and what evidence supported each conclusion.
Victim reports preserved
Screenshots, profile links, chat context, and source observations were captured before accounts could be renamed, deleted, or hidden.
Persona clusters mapped
Repeated faces, handles, scripts, timing patterns, and payment references were correlated into a clear view of related accounts.
Confidence clearly labeled
Observed facts, high-confidence links, and analytic judgments were separated so every reader could see what was known and why.
Escalation made practical
The final package gave families, platforms, and investigators the context needed to report, review, and act without starting over.
Attribution was built as a chain, not a leap.
01
Family concern becomes a requirement
Clients arrived with names, social profiles, and concern for relatives being targeted. The first task was to convert worry into a scoped intelligence requirement.
02
Profile images become selectors
Repeated visual identity material was treated as a selector. Face-image correlation helped expose accounts that appeared separate to victims but linked in the evidence record.
03
Accounts become a network
Profiles, handles, payment hints, communication threads, and timing patterns were mapped as relationships rather than isolated screenshots.
04
Findings become an evidence package
The final output separated observed facts from analytic judgments and gave clients a structured package for platform reporting and law-enforcement engagement.
Signals that made the network visible.
01
Shared profile imagery across multiple personas
02
Central hub account behavior managing peripheral identities
03
Reusable payment and communication infrastructure
04
Timing overlap between outreach, grooming, and payment pressure
05
Common language patterns across supposedly separate accounts
06
Account clusters that converged around the same victim pathway
Evidence was classified by type and confidence.
Profile screenshots
47
Verified
Communication threads
12
Verified
Payment references
3
High confidence
Face-image matches
17
High confidence
Device or behavior clues
2 clusters
Medium confidence
02 / 72-hour rhythm
Fast work still needs gates.
01
0 to 24 hours
Collect and preserve
Initial targets were recorded, profile material was captured, and early account links were preserved before content could be deleted or renamed.
02
24 to 48 hours
Correlate and map
Image reuse, handles, communication artifacts, payment clues, and platform overlap were connected into a network model.
03
48 to 72 hours
Review and deliver
Findings were checked, confidence was labeled, and the evidence package was prepared for client action.
Case outcome
The network was documented clearly enough for clients to act without becoming investigators themselves.
Cerberus demonstrates Stratir's practical value in fraud intelligence: reduce uncertainty, preserve the record, expose coordination, and turn scattered public signals into a defensible evidence package.