The Engineer on the Rig

A case story from K3K's files — an anonymised composite. Names, platforms, sums and identifying details have been changed or merged so that no client can be identified. The scam's mechanics are real, and currently operating on someone you know.

The call came not from the victim but from her son, which is how romance fraud cases usually reach us — the victim is the last to call, because the victim is in love.

His mother, widowed three years, had met "Daniel" on a dating app: a Scottish structural engineer, 58, working a long contract on a rig off West Africa. Eight months of daily messages, good-morning texts, voice notes with a soft Aberdeen accent. He'd sent flowers on her birthday. He also had, in eight months, never once managed a video call — the rig's bandwidth, he explained, and the time zones, and once, movingly, a broken camera he apologised for at length.

She had sent him £4,300 — a customs fee to release his tools, a hospital bill after an accident on the rig. The son found out when she asked to borrow against her car. What triggered the call to us: Daniel had begun talking about the end of his contract, coming home to her, and a "transfer agent" who needed £68,000 in fees to release his final settlement of £1.4 million — money he promised would be theirs.

The investigation

The son wanted one thing: proof his mother could not argue with, because she had argued with everything else. Gently, and correctly — an accusation without evidence just makes the scammer the only person who's "always believed in her".

Our cyber team treated it like any fraud: preserve first, then verify. Every profile, message thread and voice note was captured to evidential standard through K3K Intelligence before anyone touched anything — scammers delete fast when challenged.

The verification took four days. The profile photos traced to a real man: a retired engineer in another country entirely, whose public photos have been stolen for hundreds of fake profiles — one of the strange, sad constants of this crime. The "rig" could not have been where the metadata said his photos came from. The Aberdeen accent in the voice notes was consistent with voice-generation tools now standard in these operations. The "transfer agent's" website had existed for seven weeks, its company number belonged to a dissolved shelf company, and its payment details led to a UK money-mule account. Daniel was not a person. Daniel was a workflow — probably a rota of operators working many women at once from the same script.

The hard part

Evidence doesn't break the spell by itself; we've learned to deliver it with care. We prepared a short, factual report — written for her, not for a court, though a court-ready version existed too — and walked her through it by phone at her son's side. The moment it landed wasn't the photos or the shelf company. It was when we showed her the same "customs fee" script, word for word, in a fraud-warning forum post from eighteen months earlier. Other women, same sentences. She stopped arguing then.

The £68,000 never left her account — that was the case's real result. Of the £4,300 already sent, her bank recovered a portion under the reimbursement rules for authorised push-payment fraud after we supplied the evidence pack, and the rest was reported to Action Fraud with the full file. We are always honest about recovery: money that has moved on from a mule account is usually gone, and anyone guaranteeing its return is running the second act of the same scam.

She asked us at the end whether she'd been stupid. She hadn't. She'd been targeted by professionals who do this to intelligent, warm people every single day — warmth is the vulnerability, and it is nothing to be ashamed of.

Worried about an online relationship — yours or a parent's? We verify identities discreetly, often within days, and the person checked never knows. Cyber investigations · Fraud investigations — or call 020 3343 7007, 24 hours, in confidence.