Experts warn of rising Valentine's Day cyber scams

Cybersecurity specialists warn that Valentine's Day brings a spike in online scams, as criminals use fake dating profiles, lookalike websites, and phishing messages to steal login details and money.

Romance and online shopping activity typically rise around the holiday, and security researchers say attackers exploit Valentine-themed lures and time pressure to push people to click links, download apps, or share sensitive information. Similar tactics target gift buyers, delivery bookings, and promotions spread via email, text messages, and social media.

Anne Cutler, a cybersecurity expert at Keeper Security, said romance scams often work because interactions can seem normal at first and build gradually. "Valentine's Day is one of the easiest moments of the year for romance scams to succeed, largely because people are more open to connection," she said.

Scammers may build trust before introducing a link or a request that appears routine. "What tends to catch people off guard is how ordinary these interactions feel at the start. The profile looks believable, the conversation flows naturally, and the attention feels steady rather than intense," Cutler said.

The critical moment may arise when a victim is directed to a site that appears to be a legitimate service. "Instead, the shift happens almost unnoticed. A link is shared in the course of a conversation. There's a reason to log in to something familiar. The page looks like a service you recognise and may have used many times before, but it's actually a lookalike site designed to capture information the moment it's entered," she said.

These lookalike pages often mimic the branding and layout of popular platforms. Attackers may register domains containing Valentine-themed terms or slight variations of well-known names. Security teams frequently track short-lived domains created around major shopping events, which can disappear quickly after campaigns end.

Phishing patterns

Check Point Research, part of Check Point Software, warned consumers to expect an increase in phishing attempts across channels. It cited fake online stores, impersonation of dating services, and a rise in newly registered domains linked to Valentine's terms.

The group advised shoppers to stick with well-known retailers and be cautious of seasonal or unfamiliar domain names. It also urged users to look for minor spelling changes that can signal impersonation. Typing a website address manually remains a basic safeguard when a link arrives in a message or chat.

Payment methods are another common pressure point. Check Point Research said requests for cryptocurrency, gift cards, or wire transfers should be treated as warning signs, because they are difficult to reverse and can be moved quickly.

Researchers also advised users to download dating apps only from official app stores and to avoid installation links sent by email, text messages, or social media posts. This reduces the risk of installing tampered software or being redirected to credential-collection pages.

Another recommended step is to ignore unsolicited messages advertising Valentine's deals. Phishing campaigns often rely on volume and novelty, and attackers expect some recipients to react quickly to discounts, last-minute delivery promises, or "exclusive" offers.

Account defences

Multi-factor authentication remains a key defence against stolen passwords. Check Point Research said that enabling MFA adds protection even if attackers capture a username and password via a phishing page. Users can also reduce exposure by changing weak or reused passwords and avoiding logging in to devices or networks they do not control.

Cutler highlighted password managers as a practical way to reduce the risk of entering credentials on a fake page. "This is where everyday security habits can make a meaningful difference without requiring people to second-guess their emotions in the moment. A password manager won't fix a bad relationship, but it can stop a bad interaction from becoming account takeover, identity theft, or financial loss," she said.

Password managers can also reduce the risk of reused passwords by generating unique credentials for each site. They typically autofill only on recognised domains, which can help signal when a lookalike site is trying to capture credentials. Users should still verify the web address and stop if a page behaves unexpectedly.

Security teams also encourage people to move slowly in new online relationships, especially if the other person pushes to take conversations off-platform quickly or introduces financial requests. Cutler said pressure and isolation can indicate manipulation.

"Valentine's Day should be about connection, not getting caught off guard by cyber criminals. With polished fake stores, lookalike dating sites, and a surge in unclassified Valentine's domains, staying alert is key. Enjoy the season, shop thoughtfully, and swipe with care," said Cutler.