Love by Script: Inside the 120-Person Scam Operation Busted in Makati

Philippine authorities say they uncovered an alleged large-scale love-scam operation in Makati City involving 120 suspects working from a single office and using scripted conversations to cultivate relationships with victims.

According to the National Bureau of Investigation, suspects were found working on computers inside an office resembling former POGO-style operations. Investigators recovered scripts, photographs of women, private conversations with victims and screenshots showing what appeared to be tiered online dating services.

The scale makes this case particularly notable. Rather than one scammer improvising a fake relationship with one victim, the alleged operation appears to have used a structured approach to manufacture trust across multiple conversations.

For financial institutions, that matters because organised deception can eventually create organised financial patterns. Multiple victims may believe they are making personal payments, while the money ultimately flows into a smaller network of accounts, beneficiaries or intermediaries.

What Happened in Makati?

The NBI said suspects allegedly posed as potential romantic partners, cultivated online relationships and eventually solicited money from victims. Authorities said both Filipino and foreign victims were targeted.

Investigators reportedly found materials suggesting that the interactions followed a structured process, including conversation scripts, photographs, private chats and different levels of online dating services. Such an approach could allow operators to manage multiple victims while maintaining the appearance of individual relationships.

Authorities are also examining possible connections between emerging cyber-scam operations and individuals previously associated with offshore gaming businesses. However, the available reporting does not establish such a connection for every person arrested in the Makati case.

From an AML perspective, the more important question is what happens when a highly organised social-engineering operation reaches the payment stage. If many victims are being approached using similar methods, the resulting transactions may eventually reveal connections that are invisible when each customer is viewed separately.

When Romance Fraud Becomes a Payment Problem

Love scams are particularly difficult for financial institutions because victims often authorise the transactions themselves. There may be no stolen credentials, account takeover or unauthorised login. The customer believes the relationship is genuine and voluntarily sends the money.

This means that authentication alone cannot determine whether a payment is safe. In many cases, the stronger signals may emerge from the beneficiary receiving the funds.

A personal account receiving payments from several unrelated individuals can warrant closer examination, particularly if the funds are quickly withdrawn or transferred onwards. The risk becomes stronger when institutions identify repeated payments to new beneficiaries, escalating transfer values, multiple unrelated senders or common connections across different accounts.

Viewed individually, each payment may appear personal and legitimate. Viewed as a network, the activity can tell a very different story.

What Financial Institutions Should Watch

The Makati case reinforces the importance of looking beyond whether a transaction was technically authorised. A customer can complete every authentication step correctly while still acting under social engineering or emotional manipulation.

Beneficiary monitoring is therefore critical. Accounts receiving money from multiple unrelated customers should be assessed against the expected activity of the account holder. Sudden increases in third-party payments, followed by rapid withdrawals or onward transfers, can be particularly relevant.

Network intelligence adds another layer. Shared devices, phone numbers, addresses, beneficiaries or transaction patterns can expose relationships between accounts that appear unrelated when monitored independently.

Fraud and AML teams also need a connected view of these signals. A customer's complaint may initially appear to be a fraud issue, but once proceeds are collected and moved through mule accounts or other intermediaries, the activity becomes relevant to money-laundering investigations as well.

How Tookitaki Helps Detect Scam and Mule Networks

Tookitaki helps financial institutions connect risk signals that may appear harmless when viewed individually.

FinCense brings together customer risk, transaction monitoring, screening, alert management and investigations, helping compliance teams analyse activity across customers, accounts, beneficiaries and connected networks.

In romance-scam cases, suspicious patterns may emerge through combinations of unusual customer payments, repeated inflows from unrelated individuals, rapid onward movement, mule-account behaviour and shared identifiers across multiple accounts. Connecting these signals can help investigators identify when apparently separate transactions form part of a larger scam network.

Through the AFC Ecosystem, financial institutions can also stay closer to emerging typologies involving social engineering, romance fraud and mule networks, helping detection approaches evolve as scam models change.

The objective is not simply to identify one suspicious transaction. It is to recognise when multiple individual payments are connected to the same underlying financial crime pattern.

The Bigger Lesson: Scam Operations Are Scaling. Detection Must Too.

The Makati case challenges the traditional image of romance fraud as a lone scammer operating behind a fake profile. Authorities instead allege an office-based operation involving 120 suspects, scripted interactions and structured online dating services designed to cultivate relationships with victims at scale.

For financial institutions, the detection challenge follows the same logic. A victim may see a personal relationship and a bank may see an ordinary payment, while the wider transaction network may reveal something much more organised.

As scam operations become more systematic, detection must move beyond isolated transactions and individual accounts. The real financial crime pattern emerges when institutions connect the people, beneficiaries and payments behind the deception.