ST. LOUIS — Valentine’s Day is nearly here — but with romance comes romance scams, and they’re here to stay. One cybersecurity professional and Metropolis native is sharing how to spot scammers — and how AI is changing these scams.
Zach Lewis, a Massac County High School and Southern Illinois University Edwardsville graduate, is the chief information officer and chief information security officer at the University of Health Sciences and Pharmacy in St. Louis. He works with InfraGard, a nonprofit organization that aims to protect critical infrastructure by working with and connecting people to the FBI.
Zach Lewis
Part of the organization’s work includes educating the public on topics like romance scams.
According to the FBI, criminals who engage in romance scams will use a fake online identity to gain trust and start a relationship with the victim as quickly as possible. They may propose marriage or make plans to meet in person, but the plans always fall through. Eventually, the FBI says, the romance scammer will ask for money.
Lewis shared some of the tactics and strategies some romance scammers use to target vulnerable people.
“A lot of grooming,” he said. “Trying to be friends, trying to be flirty, build that relationship. A lot of early conversations about marriage and destiny and how we’re meant to be together. And then they start, you know, asking for money in different ways. Maybe they’re traveling over somewhere and they’re stranded and they need some money sent to them, or there’s an emergency or a robbery, or whatever else. And then it’s just, you know, trickle, trickle, trickle, pulling all the money from you until you’re dry.”
Lewis said romance scammers often target older adults, who make up a large portion of people impacted by these scams — and the endeavor is lucrative for scammers. He said in 2024, about $672 million was extorted through romance scams, and adults age 60 and older contributed well over half the dollar amount at $390 million.
Lewis elaborated on the steps people can take to keep themselves safe from romance scammers, like hanging up on an unknown caller and not responding to an unknown texter. He echoed the FBI’s warning that a romance scammer asking to meet up will always have a reason why they can’t, or will break travel plans at the last minute, often claiming a lack of funds.
Romance scammers also often encourage their victims to keep the relationship a secret, claiming others won’t understand, Lewis said.
“I always am an advocate of just cutting off the communication entirely,” Lewis said. “It’s probably best to just, if you’re like, ‘Something doesn’t feel right here,’ it’s best probably just to exit completely… Cutting off communication, separating entirely, seems to be your best bet.”
Even as technology continues to change, one tactic he recommended to catch a scammer — also recommended by the FBI — is to invite the suspected scammer on a video call and ask them to show an electrical outlet in the room. He noted that many scammers operate overseas, and overseas outlets look different from American outlets.
“So that’s kind of a ‘gotcha’ we’re using right now,” he said.
He said anyone who claims they can’t participate in a video call should raise red flags — but artificial intelligence is quickly changing how different kinds of scammers operate.
With the rise of deepfakes — videos altered with the goal of misrepresenting someone — and AI-generated videos and images, scammers can impersonate a familiar person’s voice and likeness.
“A threat actor, a bad guy, has gotten on as an AI, and it looks like the CFO of a company or the CEO of a company, and they’re like, ‘Oh, I need a wire transfer. I need you to move these funds,'” Lewis said. “And then they turn their video off, because, I don’t know, they say their internet connection is bad. So you’ve seen what you think is your, you know, your executive, your authorizer. So you go and do this, and it’s not actually them.”
“We’ve seen examples in St. Louis, specifically, of threat actors calling people and saying that they’ve kidnapped their child,” Lewis continued. “And you can hear their kid in the background, and they’re like, ‘You can’t get off the phone. If you get off the phone with me, you know, like, bad things will happen. You need to wire me this money.’ And come to find out, the kid’s fine… But [the scammers] have a voice, and they’ve duplicated it, and it’s very hard to verify that.”
Lewis urged people to trust their instincts — if someone they know tries to get in touch through an unknown communication method, they should get in touch directly, whether it’s via a phone call or an in-person visit.
He encouraged families to come up with a safe word that they can exchange to verify each others’ identities.
“If someone is, you know, heaven forbid, you know, kidnapped or something, and you have a phone call with them… Well, what’s the safe word?,” Lewis said. “And the AI is not going to be able to duplicate that because it doesn’t know it. So that’s a big red flag for you that, you know, you need to jump off that call and get away from it.”
He outlined steps someone can take if they believe they’re a victim of a romance or another scam.
“If you have sent money or done anything there, you need to contact your bank. Probably law enforcement,” Lewis said. “I would also recommend filing a report with IC3.gov. It’s a Internet Crime Complaint Center where you can, anything that’s happened via text or over the internet can be reported, and the FBI can look into that.”
Lewis encouraged anyone interested in learning more about romance scams, deepfakes and other cybersecurity threats to read his book, “Locked Up: Cybersecurity Threat Mitigation Lessons from A Real-World LockBit Ransomware Response.” The book details the real-life ransomware attack at the university he works for, and walks the reader through every decision made, why he made it, and how he and his team got through the attack.
“It’s a crazy world out there,” Lewis said. “I want people to be as safe as they can. I’d hate to see this happen to my family or my parents or kids or anything like that.”