Caught Up in a Bad Romance: From Heartbreak to Enterprise Security Risk

“I want your love and I want your revenge
You and me could write a bad romance” – Lady Gaga

We’ve all been there. Breaking up is hard to do. And we’ve all heard the stories about love gone wrong, vindictive exes and online romantic scams.

While failed romances may break hearts, they can also expose enterprises to serious — and often overlooked — security risks.

The threat that breakups and romance- or love-related scams pose to the enterprise is “a widely underestimated” security threat. “Romance scams, bad breakups, and revenge scenarios sit at a dangerous intersection of personal life and corporate risk,” says Alina Bizga, security analyst at Bitdefender. “As work and private lives increasingly overlap, threat actors no longer need to ‘hack’ systems in the traditional sense.”

Indeed, breakups and divorces “can create the perfect storm for modern social engineering: heightened stress, disrupted routines, and a flood of emotionally charged communication,” says Dayna Rothman, chief marketing officer at FusionAuth. “During these periods employees are more likely to reuse passwords, delay updating credentials they may have shared with a partner, approve requests quickly just to clear mental load, or overlook subtle red flags.”

Compounding the risk, former partners “may already have access to personal devices, shared email accounts, or password managers; creating unintentional insider risk,” she says. Take the experience of a man who recently broke up with a girlfriend only to discover that she was accessing his email, texts and social media accounts and interfering in conversations with colleagues. He didn’t learn the depths of her deception until later but picked up a valuable lesson about safeguarding access to his accounts.

Love and romance make for “powerful social-engineering tools,” Bizga explains, with attackers often deliberately working “to build long-term trust through emotionally intimate relationships.”

That may sound like a Hollywood scenario but the implications to business are clear. “Once trust is established, an attacker may learn sensitive details about internal systems and workflows, gain physical access to offices or restricted areas, observe security practices, or obtain credentials or devices without raising suspicion,” says Bizga.

That kind of access bypasses technology-driven security, making it “especially dangerous.”

These cases might be “less common than typical romance scams,” but “the potential impact is far greater, particularly for organizations handling sensitive data, intellectual property, or critical infrastructure,” Bizga says.

Relationships that “begin legitimately can become a security issue when they end badly. Former partners may know passwords, recovery answers, work contacts, schedules, or internal tools, or still have access to shared devices and accounts. In emotionally charged situations, that knowledge can be misused for revenge, disruption, or reputational harm,” she adds.

That can lead to social media account takeovers, data leaks, and public-facing sabotage. In controlling or abusive relationships, risk may escalate further with the use of spyware and stalkerware, which can be used to “silently monitor communications, capture credentials, and track activity across devices,” says Bizga. “If a work device is affected, corporate data can be exposed without any obvious signs of intrusion, making it easier for attackers or malicious partners to move from personal access to professional exposure.”

She recounts one case “where an ex with passwords to the company’s social media accounts posted intimate photos of the employee on the corporate pages.” That not only created “a PR and HR nightmare for the company,” it also “turned into a criminal issue for the person who posted.”

Rothman points out that bad actors also leverage breakups to help execute nefarious acts. They “exploit dating applications or social platforms to build trust and then pivot to credential theft or emotionally driven ransomware or extortion--leveraging personal details about a breakup to create urgency, fear, or compliance,” she explains.

And AI only increases the likelihood a romance scam will succeed. “AI makes phishing harder to detect” so scammers can “quickly create polished emails, insert details from LinkedIn, and make them highly personal,” says Krishna Vishnubholta, vice president, product strategy, at Zimperium. “It’s no longer just copying and pasting. Since they can tell the AI what words or patterns to avoid, many of the usual phishing filters don’t even trigger.”

The prolific technology serves as a wingman for bad actors—helping them perpetuate romance scams at scale, using AI to “generate dozens of polished, industry-specific emails in seconds and run simple tests to see what works” and to make personalization easier since it “can scan your public social profiles, job boards, and more in seconds, building highly accurate profiles, projects, or writing quirks.”

Bad actors also have made significant strides in voice imitation “to create realistic, personalized phishing scams at scale and to use voice imitation to authenticate them, making the scams seem to come from someone you trust,” says Vishnubholta.

What’s an organization to do to protect its own assets from jilted lovers and online scammers? While their visibility into employees’ private lives is limited or non-existent (as it should be), there are concrete steps they can take to reduce risk to corporate assets. Security pros slipped into the role of Dear Abby to offer some advice for the lovelorn and their organizations.

Organizations and employees alike should assume emotional manipulation is part of a playbook. “If a new online relationship suddenly feels too perfect, too fast, or too intense, that’s a signal,” Quilici says.

Consumers need better tools, but they also need better habits. “Don’t respond to unknown texts. Don’t pick up calls from area codes you don’t recognize,” says Quilici. “A little friction can save you a lot of heartache.”

Password changes and access reviews should be de rigueur after major personal changes, Bizga advises. That may sound basic but those simple hygiene tips often go unheeded.

Promote device hygiene and separation of work and personal accounts, “providing confidential reporting channels, and framing guidance around support rather than suspicion,” says Bizga. “Clear, compassionate guidance can help employees recognize scams.”

Employees should “treat a breakup like a security rest moment,” says Rothman, changing passwords, reviewing MFA settings, and separating personal from work accounts, “especially if devices or credentials were ever shared.” They should also “slow down on any work request that creates urgency or emotional pressure, even if it appears to come from a colleague” and not “hesitate to ask for additional verification if something feels ‘off.’”

Reinforce security training and phishing-resistant authentication. Training continues to be critical, reinforcing best practices like not clicking on links or offering up personal information especially without confirming where a request, email or text originated.

Design systems so that no single compromised identity can escalate to a companywide breach. “The reality is uncomfortable but unavoidable: today's attackers don't break systems first, they wait for people to be vulnerable,” says Rothman.

Make guidance stigma free. “Employers can support this without being intrusive” and by “normalizing security reminders during major life events,” says Rothman.

Assured Identity using biometrics (with proximity and domain bound credentials) “is the path to rapid passwordless login and absolute assuredness that the user is the authorized user,” says Token Chair Kevin Surace. “Whether its Office or Salesforce or Zoom, with AI generating spoofing sites and phishing emails that work every hour, we need 100 percent solutions. This is one worth watching."

Create a reporting structure for suspected scams. Employees should be encouraged, not shamed or punished, for reporting scams that may have ensnared them.

Neither employees nor their organizations can afford to brush off scams. He warns that “Romance scams are no longer fringe. They’re mainstream, they’re growing, and they’re increasingly powered by the same AI advances that make legitimate communication easy,” says Quilici.

While employees are concerned about personal safety, privacy, and control over their digital lives, Rothman says, “Organizations can reduce risk by acknowledging that life events can affect security and by offering guidance that supports both employees and the business.”