The 'Rent Boyfriend' Trap: Inside India's Newest Loneliness-Targeted Cyber Scam
Introduction
On August 8, 2026, Hyderabad Police Commissioner V.C. Sajjanar posted an unusual warning on X: colourful posters offering a "handsome guy" to join you for coffee or a movie at 50% off: it was not a quirky dating startup but a calculated cyber fraud. Within hours, the "Rent Boyfriend" alert had gone viral, pulling back the curtain on a scam that blends India's growing loneliness economy, classic confidence tricks, and AI-generated imagery. Here is what's actually happening, why it works, and how to protect yourself.
A Trend Growing Fast: In India and Worldwide
Paid-companionship culture itself isn't new. "Rent a friend" services began in Japan and later China, where apps let people hire a company for a movie, a walk, or a family event without romantic or sexual expectations. The idea reached India as early as 2018, when Mumbai's "Rent A Guy" app began recruiting men for casual outings; by 2022, similar pages like "Toy Boy" and "Hire a Friend" had spread to Bengaluru, and Valentine's Day 2025 saw ₹389 "rent a boyfriend" posters plastered across the city. Fraudsters have now hijacked this recognisable, socially normalised idea and weaponised it: the Hyderabad ads promised specific packages, ₹499 for a coffee date, ₹1,249 for a movie, ₹1,999 for a wedding, and ₹4,499 for ten hours collected via QR codes and wallets, then vanished.
The underlying numbers show why this template is so attractive to criminals. Complaints filed on India's National Cyber Crime Reporting Portal jumped from roughly 4.5 lakh in 2021 to about 2.3 million by 2026, and the country now logs an estimated 4,000-plus cybercrime complaints a day. Globally, romance and "confidence fraud" are some of the costliest online crimes: the FBI's Internet Crime Complaint Center recorded 23,159 romance-fraud complaints in 2025 worth $929.3 million, which is a 38% jump over 2024, while the UK logged over £102 million in losses and Australia and Canada reported tens of millions more. Crucially, IC3's 2025 report flagged AI as an accelerant for the first time, attributing roughly $19 million in romance-scam losses directly to AI-generated profiles, images and chat exactly the "AI-generated photographs" Hyderabad Police say the Rent Boyfriend network used.
Case Studies
The Rent Boyfriend network is one data point in a wider, well-documented pattern in India:
- Hyderabad, August 2026: Fraudsters ran Instagram, Telegram and Facebook pages using stock or AI-generated photos of "attractive men", collected advance payments and security deposits, and then blocked victims, the case that prompted this advisory.
- Jaipur, 2026: A honey-trap and extortion ring allegedly used AI-manipulated videos and images to blackmail a businessman out of nearly ₹90 lakh, with police examining how far synthetic media was used to fabricate compromising content.
- Mumbai: A gang was arrested for cheating a woman out of ₹16.18 lakh in gold and cash after promising to "reunite" her with a lost partner, a variant that exploits the same emotional vulnerability through a different pretext.
- Gujarat, 2025: A social media influencer with over 10 lakh followers was arrested for allegedly honey-trapping and blackmailing a builder, illustrating how organised such rackets have become.
These sit alongside a global backdrop where FBI data shows confidence and romance fraud disproportionately drains people over 60 (63% of US losses in 2025) even as India's version increasingly targets young women and students, a sign the tactic is being localised for different demographics rather than disappearing.
Why It Works: The Psychology of Loneliness and Grooming
Researchers who study romance-fraud victims consistently find that loneliness, a tendency toward idealised romantic beliefs, and a need for social connection are the strongest predictors of victimisation. Scammers exploit this through a well-rehearsed grooming arc: rapid, excessive flattery ("love bombing") to create instant intimacy; mirroring the target's interests and values to seem like a perfect match; gently discouraging outside opinions so doubts don't surface; and only then introducing a financial ask, framed as something small and reasonable — a booking fee or a security deposit precisely because it feels low-stakes compared to a direct cash demand. The "package" pricing in the Rent Boyfriend ads (₹499 for coffee, scaling up to ₹4,499) mimics legitimate e-commerce, which lowers a target's guard further. Once payment is made and blocked, many victims feel too embarrassed to report it — a shame response researchers and police repeatedly flag as the biggest reason such scams are under-reported.
Red Flags and What To Do?
Red flags to watch for:
- Companionship or dating offers with attractive stock/AI-style photos and steep "discounts"
- Contact only through DMs, with no verifiable business identity, address or reviews.
- Requests for advance payment, "security deposits", or booking fees via UPI/QR code before any service is delivered.
- Reluctance to do a video call or a video call that looks slightly off (a common AI/deepfake tell).
- Pressure to move fast, share personal photos, or keep the interaction secret from friends and family.
Precautions:
- Never send money to confirm a booking with an unverified individual or page.
- Avoid sharing personal photographs, phone numbers, addresses or financial details with strangers online.
- Don't meet anyone in person whom you've only interacted with through such ads.
- Parents should stay engaged with what their children see and who they talk to on social media.
If you suspect a scam or have lost money: Don't panic and don't pay more to "fix" it. Stop all contact, save screenshots and payment records, and call the 1930 cybercrime helpline or file a complaint at cybercrime.gov.in immediately — reporting within the first "golden hour" significantly improves the chance of freezing transferred funds before they're withdrawn.
The Government, Platform and Legal Angle
India already has legal tools for this, though enforcement lags the pace of the fraud. Cheating by personation online is punishable under Section 66D of the IT Act, 2000 (up to three years' imprisonment plus fine), often paired with Section 66C on identity theft; the Bharatiya Nyaya Sanhita's cheating provisions (replacing IPC Sections 420/419) apply where money is dishonestly induced. Under the IT (Intermediary Guidelines) Rules, 2021, platforms like Instagram, Facebook and Telegram must appoint a grievance officer, acknowledge complaints within 24 hours, and take down unlawful content within 36 hours of a court or government notification obligation. Hyderabad's cybercrime wing can invoke to force the removal of these ad networks. Larger "significant social media intermediaries" carry added duties around traceability and proactive monitoring.
The gap is upstream: platforms currently do little to verify who is running a commercial-sounding page before it reaches thousands of users, and AI-generated "profile" images are not systematically flagged. A stronger response would combine faster platform-side KYC for pages soliciting payment, proactive detection of AI-generated advertising imagery, and continued expansion of the 1930 golden-hour fund-freezing mechanism paired with public advisories like Hyderabad's, which remain one of the fastest ways to blunt a scam before it scales.
Conclusion
Loneliness is not something anyone should be ashamed of, but it is exactly what these networks are built to exploit. No genuine companionship service needs an advance QR payment before you've even met the person.
Sources
- Deccan Herald — Hyderabad Police Commissioner cautions young women over 'rent boyfriend' offers
- Republic World — 'Rent Boyfriend' Offers On Social Media?
- Newsdrum — What is 'Rent Boyfriend' trap?
- IndiaSpend — How India's Cyber Crime Incidence Is Rising
- FBI IC3 2025 Annual Report Brochure
Related Blogs
Executive Summary
Amid rising tensions in West Asia and concerns over the safety of Indian seafarers, a video showing a vessel engulfed in flames and thick black smoke is being widely circulated on social media. The clip is being shared with the claim that it depicts a US attack on a ship carrying Indian nationals in Omani waters. CyberPeace Research Wing research found the claim to be misleading. The viral video predates the incident it is being linked to and is not related to any recent attack.
Claim:
A Facebook user shared the video alleging that the United States attacked a ship carrying Indian citizens in the maritime region near Oman. The post has been widely circulated as part of the ongoing West Asia tensions. Facebook link: https://www.facebook.com/reel/3031094270427837, https://www.facebook.com/reel/3031094270427837
Fact Check:
A reverse image search of keyframes from the viral video led to several media reports published on 2 March 2026, which carried the same visuals seen in the circulating clip. The reports indicated that the footage showed a vessel targeted amid escalating tensions in the Strait of Hormuz, following restrictions on maritime movement in the region. https://www.ndtv.com/world-news/iran-targets-6th-ship-in-hormuz-strait-video-shows-billowing-smoke-11159019
Further research also found the same visuals in a Moneycontrol report published on 2 March 2026. The report clearly established that the footage is from an earlier incident and not linked to any recent developments. https://www.moneycontrol.com/world/indian-crew-member-killed-after-drone-boat-strikes-oil-tanker-off-oman-coast-first-indian-casualty-in-us-iran-tensions-article-13848303.html
Conclusion:
The research confirms that the viral video is not related to any recent US attack on a vessel carrying Indian nationals. The footage has been online since at least March 2026 and shows an earlier incident involving the oil tanker Skylight during tensions in the Strait of Hormuz. Hence, the claim being circulated on social media is misleading.
Executive Summary
A picture of Mohan Bhagwat is going viral on social media, showing him allegedly laying the foundation stone of a so-called “52nd Shakti Peeth” named Bharatdurga. Users are claiming that the RSS chief insulted Sanatan Dharma by creating a new Shakti Peeth in Nagpur. Research by CyberPeace Research Wing found that the claim is false. The viral image is AI-generated, and Mohan Bhagwat did not inaugurate any “52nd Shakti Peeth.” In reality, he laid the foundation stone of the Bharatdurga Temple.
Claim
An X user named Sandeep Dev shared the viral image and alleged that after creating “fake Shankaracharyas,” the RSS had now introduced a new form of Goddess Durga called “Bharat Durga” and declared it the 52nd Shakti Peeth. The post further claimed that the RSS was redefining Hinduism and creating new religious sites.
Fact Check
To verify the claim, we searched relevant keywords and found reports published on April 24, 2026, by India TV and Navbharat Times. According to these reports, Mohan Bhagwat laid the foundation stone of the world’s first Bharatdurga Temple in Nagpur during a ceremony organized at the Jamtha campus of Dr. Abaji Thatte Seva and Research Institute. Several prominent saints and religious leaders attended the event. Importantly, none of the reports described the temple as the “52nd Shakti Peeth.”
Further research led us to the full video of the foundation ceremony uploaded on the YouTube channel of Devendra Fadnavis. The stage backdrop and video thumbnail clearly mention “Bharatdurga Temple Foundation Ceremony.” However, the viral image frame was not visible anywhere in the authentic footage.
We also analyzed the viral image using AI detection tools, which indicated that the image was AI-generated.
Conclusion
Our research confirms that the claim about Mohan Bhagwat laying the foundation of a “52nd Shakti Peeth” is false. The viral image is AI-generated. In reality, he participated in the foundation ceremony of the Bharatdurga Temple in Nagpur.
.webp)
Executive Summary:
On July 4, 2024, a giant password dump, “RockYou2024” was posted on a cybercrime marketplace containing 9,948,575,739 plain-text credentials. This blog explains the technical aspects of this leakage and its consequences in the sphere of information security.
RockYou2024 is a list of passwords obtained from different data breaches ranging over the course of more than twenty years. It integrates older passwords with the lexical database with the additional passwords from the recent hacks, thereby, cumulating the database of genuine and existing passwords. The compilation is said to contain data from more than 4,000 databases putting the tool in the hands of potential attackers. RockYou owns the name to this type of attack since a data breach attacked a social media company named , “RockYou'' and released 3.2 million users’ passwords as a .txt file. Since then, the term gained a common meaning connected with mass password data breaches.
Technical Implications:
- Credential Stuffing Attacks: The RockYou2024 list comprises a great number of actual passwords that increases the likelihood of credential stuffing attacks. With this, the attackers help themselves with an opportunity to try to gain unlawful access into several online accounts that a user may have, particularly ones where an individual re-uses the same password.
- Brute-Force Attacks: The collection is extensive for brute force attack on systems that have no protection against such exercise. This is especially the case for devices and services that are exposed to the internet and which may use either weak or factory-set alphanumeric codes.
- Password Cracking: Web compilations that include such lists are often employed by security specialists and penetration testers who use John the Ripper or Hashcat to check the password’s strength or the system’s susceptibility to attacks.
- Machine Learning Models: The dataset could be used to create machine learning models for password prediction or analysis, which would only lead to further better methods to be used in the attacks.
Countermeasures / Mitigation:
Below are the technical risk/process operating proposed to reduce the risks associated with RockYou2024:
- Password Hashing: It is necessary to ensure that all the passwords required to be saved should be encrypted in one of the most secure algorithms like bcrypt, Argon2, or PBKDF2 along with a reasonable number of iterations.
- Salt and Pepper: The features for both salting and peppering should also be enabled to complicate the cracking of passwords even after the hashed password databases have been procured.
- Multi-Factor Authentication (MFA): Ensure the usage of complex passwords in addition to deploying MFA across all the technological systems and services within the company.
- Password Strength Policies: Adhere to password policies for features like the length, strength of the passwords and the change in password frequency.
- Rate Limiting and Account Lockouts: Inactivity methods must be used on consecutive attempts to log in and to the temporary lock out after so many attempts in a bid to discourage brute force attacks.
- Monitoring and Alerting: There should be measures in place to monitor for any violations such as login tappings or a form of credential stuffings and there should be alerts, where securities risks are likely to arise, in real time.
- API Security: The following proper API security measures that will result in the prevention of the following attacks; rate limiting, input validation, and token.
- Web Application Firewalls (WAF): To defend against threats from the internet for potential credential stuffing or brute-forcing the authentication process, utilize WAFs to operate at the application layer.
Analyzing the Impact:
To understand the potential impact of RockYou2024, organizations should assess the possible effects of RockYou2024, such as:
- Conduct Password Audits: LeakYou2024 scan current passwords database with RockYou2024 (in ethical and safe methods) and see which accounts have been compromised.
- Implement Continuous Monitoring: If this is a monthly or weekly event then there must be new information on data breaches and act on it concerning new security changes.
- Educate Users: Continued security consciousness training, regarding the effective protection of an individual’s password in combination with a password generator.
- Perform Penetration Testing: It is suggested to conduct penetration testing at least twice a year to find out if there are vulnerabilities in the systems and applications in the current use.
Conclusion:
The RockYou2024 leaked password database is a serious security risk; it contains almost 10 billion account credentials. This unprecedented leak further increases the exposure to credential stuffing, brute force and password cracking attacks. To deal with these threats, organizations need to have measures that include password hashing, multi-factor authentication, password strengthening and password audit. Patching, user awareness, bandit activities are imperative to prevent future invasions and strengthen the cyber security posture.
References :
- https://statanalytica.com/blog/rockyou-2024-txt-password/
- https://dig.watch/updates/rockyou2024-password-leak-exposes-nearly-10-billion-unique-passwords
- https://complexdiscovery.com/rockyou2024-leak-nearly-10-billion-passwords-exposed-heightening-cybersecurity-risks-for-businesses/
