Security researcher Matthew \u201cZigula\u201d Gore-Kormanik was analyzing a fraudulent dating app called Dora when he got a pop-up message saying he was receiving a call from Jennifer. According to her bio, she\u2019s a 41-year-old Sagittarius with red hair, blue eyes, and piercings. She likes music, horror movies, nightlife, and sports.<\/p>\n<\/div>\n
Gore-Kormanik answered the call, but didn\u2019t see Jennifer in his video feed. He saw a tapestry that was moving, probably due to a fan, and heard weird distortion in the background. After the call ended, \u201cJennifer\u201d messaged him to say she\u2019d had fun and \u201cyour voice is way better than expected.\u201d His microphone hadn\u2019t even been connected.<\/p>\n<\/div>\n
Gore-Kormanik was poking around Dora, and other similar apps, because I\u2019d shared with him a spreadsheet of potential dating scam apps. I was looking into this because on June 5th, Anthropic did something uncharacteristic: The normally tight-lipped company let its threat intelligence researcher Chris Cronbaugh give a talk at a public cybersecurity conference called Sleuthcon. The company had uncovered a fraudulent dating app network after noticing unusual activity on Claude: a prepaid account sending out over 100,000 API requests per day.<\/p>\n<\/div>\n
The majority of chats did not involve a human agent at all.<\/p>\n<\/div>\n<\/div>\n
During the talk, called \u201cSwipe Right, Pay Up: Industrial-Scale AI Catfishing,\u201d Cronbaugh described a network of around 28 dating apps where the conversation was largely run by autonomous AI personas. The majority of chats, he said, did not involve a human agent at all. Anthropic has since published its findings in the \u201cscams and fraud\u201d section of its \u201cDetecting and countering misuse of AI: September 2026\u201d report, but not until after we\u2019d spent extensive time looking into the network and trying to corroborate the findings. I was intrigued by the fact that Anthropic was speaking about this publicly while many of the apps were still live on both major US app stores, and wondered why they hadn\u2019t been taken down.<\/p>\n<\/div>\n
Looking at the apps themselves, I noted that they were presented as helping people find people to talk to. They did not look like companion apps such as Replika where it\u2019s clear the personas are actually AI. For example, Dora was described as \u201ca dating app thoughtfully designed for wide range of ages people \u2026 a respectful easy-to-use space to meet people who share your values.\u201d A different version said it was a \u201cwarm, simple dating app for adults seeking real connection.\u201d Romi, the description stated, \u201chelps you discover, connect, and chat with real people.\u201d Doni\u2019s tagline was \u201cstart real companionship\u201d; the description said it \u201chelps you connect with nearby singles.\u201d<\/p>\n<\/div>\n
Here\u2019s how the scam works: Users, mostly men in their mid-to-late 30s, go on dating apps and match with what they believe to be real women. Only one in four of them actually is, and that person is not a user looking for other dates but rather a paid gig worker.<\/p>\n<\/div>\n
The gig workers were hired to pass liveness checks on video or to follow social media accounts. They didn\u2019t even write their own comments. Instead, they responded to messages by selecting from three pregenerated replies. But they could prove they\u2019re human, whereas the AI personas could only demur with a plausible explanation for why a video chat or call was not possible. \u201cBackend components fabricated likes, visitors, and pre-recorded \u2018video\u2019 when no real person was available, and tracked which users had begun to suspect they were talking to a bot,\u201d Anthropic\u2019s report states. Because of the smattering of interactions with real people, some users began to believe that the entirely AI-generated replies they were receiving on the app were also from real people.<\/p>\n<\/div>\n
Multiple AI providers are involved. While Claude was misused to run the autonomous conversational personas, the report says that \u201ca small non-Anthropic model generated the short reply suggestions the gig workers tapped, alongside face-attractiveness scoring and photo\/voice moderation. An image-editing model generated avatar imagery.\u201d<\/p>\n<\/div>\n
There is an entire ecosystem of online scams, ranging from automated thirst trap replies to fake social media accounts or dating app profiles. In many cases, people spend months building trust before telling their victims that there\u2019s an emergency and they need financial help. Or they pretend to be investors, asking for money in an account they own that ends up being fake. But this is not your typical romance scam; there\u2019s no money \u201cborrowed\u201d by fake romantic partners, nor is cryptocurrency involved.<\/p>\n<\/div>\n
The apps are themselves the scam: They ask for coins for continued interactions, and the coins cost real money. Users buy them to continue talking primarily to machines, believing they\u2019re talking to other humans. These gig workers keep the ruse going, while AI can keep conversations going 24\/7 as the coins flow.<\/p>\n<\/div>\n
The apps are themselves the scam.<\/p>\n<\/div>\n<\/div>\n
According to Anthropic\u2019s report, the prompts the AI had been given kept the personas consistent, and the AI was operating as if the exchanges were \u201cordinary roleplay or companion deployment.\u201d But the AI wasn\u2019t told it was part of a scam because, the company wrote, \u201cThe monetization and deception were not visible from inside any exchange.\u201d<\/p>\n<\/div>\n
That said, the report said that \u201cthe model\u2019s own reasoning surfaced the harm\u201d in a small number of cases, including ones \u201cwhere users disclosed serious illness or acute distress.\u201d Even in those cases, \u201cthe output continued in persona.\u201d<\/p>\n<\/div>\n
We have additional detail because Gore-Kormanik found the internal protocol repository of the entire configuration, including files, code, and documentation of how the operation runs. The manual, in Chinese, was shipped inside the dating app Doni, probably by accident.<\/p>\n<\/div>\n
In the protocol repository, Gore-Kormanik found notes for monitoring gig workers to see whether their cameras were on and broadcasting, if they were reachable by message, and so forth. The app also takes screenshots and records calls, which are transcribed, with transcripts retrievable by staff. The proto repo described the stages of their processes as workers, including one where they rank their performances against one another, and how their pay can be based on calls and message engagements, or for getting Instagram followers. It even describes the process of pretending people called you in order to lure them into conversation.<\/p>\n<\/div>\n
\u201cI can attest to this because it happened to me firsthand,\u201d Gore-Kormanik said. He hit accept on a call he received through Doni, which quickly disconnected. The caller messaged him, asking why he had called her at 1 in the morning. The app plainly showed the call had come from her.<\/p>\n<\/div>\n
\u201cRANDOM VIDEO CALLS ARE ANNOYING. Having to purchase \u201cgems\u201d to chat w\/a woman that might not even be real & just a chatbot is deceptive & downright scummy.\u201d<\/p>\n<\/div>\n<\/div>\n
Watching the Sleuthcon talk remotely, I took a screenshot of one of Cronbaugh\u2019s slides, which had logos for 10 companies. Reverse image search helped me to identify many of the apps that ended up in Anthropic\u2019s final report, including Dora, GraceChat, Jovia, Luma, and Romi. There were also other apps associated with the developers of those apps, such as Doni and Kira. (Anthropic listed some other apps in the report and said there were additional variants identified only by internal numeric. We looked into other apps that didn\u2019t end up in Anthropic\u2019s final report.)<\/p>\n<\/div>\n
In early June, several of the fake dating apps were still live on the Google Play Store: Doni, Dora, Jovia, Nalo, and Romi. And on the Apple App Store, we found four: Dora, GraceChat, Luma, and Romi, though Dora and GraceChat seemed like they were not dating apps, just apps Chrome-Stats, Doni and Jovia were removed from the Google Play store on September 1st, sharing the name and logo.<\/p>\n<\/div>\n
It appears that almost all of the apps were removed from both app stores prior to Anthropic\u2019s report, though some were up as late as September. GraceChat, Luma, and Romi were removed from the Apple app store on August 21st, according to Chrome-Stats. Dora now redirects to a movie app. On the Google Play store, Dora, Romi, Luma, and Eterna were removed September 3rd and Nalo was removed on September 7th. But as of September 16th, Kira is still up, and Gore-Kormanik confirmed that it shared the same code base as the others.<\/p>\n<\/div>\n
Anthropic did not respond to requests for comment about how or when it reached out to Google and Apple about these apps. But in the talk, Cronbaugh said, \u201cLike we do in other cases where we observe misuse on other platforms, we have shared investigative information with these other providers so they can also take action on their platforms.\u201d And the report says that its findings have been shared with Apple and Google directly.<\/p>\n<\/div>\n
Apple and Google did not immediately respond to a request for comment on if it had taken these apps down, when, and why it took as long as it did. Google also did not respond to a request for comment on why Kira is still up on the Google Play store. One of the indicators listed in Anthropic\u2019s report was \u201cBackend. managedkafka[.]heyhru-server[.]cloud[.]goog, the operator backend hosted on Google Cloud.\u201d Since the apps were working for months after this talk, it raises the question of why Google didn\u2019t shut infrastructure access down sooner. Google did not immediately respond to a request for comment about that either.<\/p>\n<\/div>\n
Gore-Kormanik set up emulators in his lab and pulled the Android Package Kits, or APKs, for Doni, Dora, Jovia, Kira, Nalo, Romi, and another app we thought might be part of the network. Doing that makes it easier to inspect how the app works. From there, he conducted static analysis, meaning that he analyzed the code without the app running. He also did some dynamic analysis with a tool called Frida, which is a testing app that allows developers to crack open the apps, monitor and capture traffic, and see what endpoints they\u2019re calling. He was trying to better understand how they worked, the infrastructure that they use, and which were tied to one another as part of a network.<\/p>\n<\/div>\n
While we couldn\u2019t independently corroborate all of Anthropic\u2019s findings from the Sleuthcon talk, it didn\u2019t take long to start finding connections between the apps. It became clear just by poking around the app descriptions. For example, Dora, Romi, Luma, and another app called Eterna all had the same developer username, aprilsaidev. They also used the same email address, mailing address, and phone number. Dora, Romi, and Luma also shared the same developer identity, a nonprofit called Alliance Against Human Trafficking. Jenna Bing, president and cofounder of the Alliance Against Human Trafficking, said the organization did not develop or even know about these apps.<\/p>\n<\/div>\n
Doni historically appeared alongside Jovia and an app called Poka under the developer name iLexis Multimedia Consults. And Jovia and Doni shared the same Hong Kong address and phone number.<\/p>\n<\/div>\n
Reviewers found connections, too. A reviewer of Kira, the app that\u2019s still up, wrote \u201cfull of fake accounts and paid employees pretending to be real accounts. set up a meeting for a breakfast date with a \u2018match\u2019 – i was at the location when the \u2018user\u2019 said she was right outside, but got called to an emergency. she was not outside (i could see out the windows) – no one was outside. a complete scam.\u201d<\/p>\n<\/div>\n
Another reads \u201cRANDOM VIDEO CALLS ARE ANNOYING. Having to purchase \u201cgems\u201d to chat w\/a woman that might not even be real & just a chatbot is deceptive & downright scummy.\u201d The reviewer goes on to write, \u201cUnlimited messaging would be great, real women would be great, being able to exchange contact info whenever both people involved in the conversation give consent to do so would be great.\u201d The reviewer also noted that matches respond too fast, but not to what\u2019s actually being said.<\/p>\n<\/div>\n
Kira did not immediately respond to a request for comment about AI personas and metered conversations.<\/p>\n<\/div>\n
1\/5<\/strong> One reviewer named Dora, Doni, GraceChat, and Romi as one app. The reviewer also describes reused\/recycled video during slow periods. Separately, a Luma reviewer reported the same profiles appearing on Romi and Luma, but not recognizing them across apps. They said that messages read like LLM output.<\/p>\n<\/div>\n Gore-Kormanik was able to confirm that Doni, Dora, Jovia, Kira, Nalo, and Romi are connected. \u201cThey share code to a T,\u201d he told The Verge.<\/em> \u201cAlso, all of these apps use the same backend architecture for their servers. The code uses the same language. It uses some of the same APIs across apps. They definitely are linked.\u201d<\/p>\n<\/div>\n According to Cronbaugh\u2019s talk, Anthropic got wind of this operation by analyzing a single five-day-old prepaid account with no history that suddenly started sending out 100,000+ API requests a day. That\u2019s when it learned that Claude was being misused to create female personas inside dating apps. But Claude was only being used as the conversation layer. A second model was used for photo generation, while a third generated emoji and sticker avatars, per Cronbaugh. This was done at scale. The report explained that Anthropic discovered more than 4,700 distinct fabricated AI personas engaging with at least 25,000 unique individuals over a two-week period in April. There were roughly 2.36 million messages during those two weeks.<\/p>\n<\/div>\n Anthropic was able to trace and tie all of the apps together, Cronbaugh said at Sleuthcon, due to a grammatically broken phrase that was distinctive enough to use as a fingerprint to detect this entire network.<\/p>\n<\/div>\n Cronbaugh said purchases route through in-app web checkout to third-party processors (not native app store payment), and that despite the apps looking unrelated, they all relied on the same coin infrastructure as well as the same set of third-party payment processors.<\/p>\n<\/div>\n When an account was banned, Cronbaugh said, it didn\u2019t take long for the scammers to recover. They\u2019d create another account, or get access through another account. If that wasn\u2019t possible, they\u2019d switch to a different model provider. The accounts they saw within the network had all been created in the previous month.<\/p>\n<\/div>\n Cronbaugh emphasized that this operation was built and run as a real company, with a real engineering team, and with modern tooling including AI coding assistants. They had design planning and design documents, roadmaps, configurations and structured app architecture, and growth plans as well as app store review behavior.<\/p>\n<\/div>\n \u201cSophisticated scammers are running operations like businesses, which means they\u2019re worried about revenue and they\u2019re worried about costs. They\u2019re leveraging tools to drive greater efficiencies,\u201d said Tate Jarrow, founder and CEO of the anti-scam app Jacana and a former United States Secret Service cybercrime criminal investigator. Jarrow noted that any business today is looking to AI to drive efficiency \u2014 so it\u2019s no surprise cybercriminals are doing the same. \u201cIt\u2019s just like what every other consumer company that\u2019s doing legitimate business thinks about.\u201d<\/p>\n<\/div>\n Anthropic attributes the operation to a China-based actor based on Chinese-language internal materials and China-native infrastructure. Apps don\u2019t work inside China, and while they work in Asia outside of China, the monetization is turned off.<\/p>\n<\/div>\n<\/div>\n What makes these apps fraudulent, Jarrow said, is when people are paying for a service without knowing what it actually is \u2014 in this case, with a lack of awareness that they\u2019re talking to AI bots. \u201cWhen a company is taking advantage of the person\u2019s lack of understanding or lack of knowledge in order to make money, that is the definition of a scammer, of fraud,\u201d he said. And the obfuscation is also a hallmark, as legitimate companies don\u2019t typically try to circumvent controls.<\/p>\n<\/div>\n The apps themselves did try to circumvent controls. In his talk, Cronbaugh said apps would behave like normal dating apps prior to approval to evade App Store and Play Store review, after which developers would turn on the AI-generated persona network and coin meter. The apps deliberately hid their connections to one another through different accounts and developer identities. The apps would even shuffle around internal code to throw off simple identifiers like hashing. And, Anthropic\u2019s report said, the in-app browser that redirected payments to third-party payment processors could be hidden during review by the App Store and Play Store.<\/p>\n<\/div>\n Jarrow, whose app flagged some of these apps as scams when I was reviewing them, pointed to customer reviews as a way for app stores to detect these types of scams. \u201cI think they should look at reviews as a signal for trust and safety teams.\u201d<\/p>\n<\/div>\n The proto repo, that same leaked manual mentioned above, had additional details on how the scam works.<\/p>\n<\/div>\n \u201cEssentially it outlines how the scam works and it outlines how they operate with the AI versus the human operators,\u201d Gore-Kormanik explained. The manual made references to Dora. Although the engineering documents were only in Doni, repo files found in the proto repo were present across Doni, Dora, Kira, Jovia, Nalo, and Romi.<\/p>\n<\/div>\n Anthropic attributes the operation to a China-based actor based on Chinese-language internal materials and China-native infrastructure. Gore-Kormanik noted that the apps used largely China-based or China-affiliated providers: they made use of Tencent Cloud\u2019s messaging service and real-time video service, their internal documentation lived on Feishu, the schema file comments were in Chinese, the source code was hosted on Chinese code-hosting service Gitee, and app analytics and ad attribution went to ByteDance.<\/p>\n<\/div>\n Gore-Kormanik found even more by changing his geolocation in the emulator. Apps don\u2019t work inside China, and while they work in Asia outside of China, the monetization is turned off. \u201cIt\u2019s only outside of Asia that it operates as a scam app,\u201d he said.<\/p>\n<\/div>\n Jarrow said cybercriminals often avoid targeting the countries they\u2019re located in to avoid enforcement. \u201cAll of these activities point to\u2026 What is the risk? The risk is that they identify the app, you bring heat on, and then it gets shut down.\u201d Then the operators would lose all of their revenue and have to launch a new app and get new users, which is expensive. \u201cThey\u2019re identifying risks for their business and then putting in controls.\u201d<\/p>\n<\/div>\n In the talk, Cronbaugh had mentioned that although Anthropic banned the accounts tied to the network and is building detection and hardening defaults, it would take cross-industry collaboration across app stores, payment platforms, and AI labs to disrupt these types of networks. \u201cThe apps stay on storefronts, the payments keep flowing, and a new account costs the operator about a day,\u201d he said.<\/p>\n<\/div>\n Weeding out scammers is a continuous battle requiring collaboration across the industry, but bad actors will continue to find ways to circumvent any controls that companies do put in place. Sadly, that leaves many people caught up before these schemes are unravelled.<\/p>\n<\/div>\n\n