On October 20, 2026, the US Romance Scam Prevention Act was signed into law. When a dating platform bans someone for fraud, it has to warn everyone that account messaged, and it has to do it quickly. Platforms have a year before the obligations take effect.
The reasoning behind it is one most of us in Trust & Safety will recognize. Scammers rarely stay on the app where they found someone. By the time a platform bans the account, the conversation has often moved to text or another messaging app, and the person on the other end has no idea the profile they met was removed for fraud (sponsor's one-pager).
This article will tell you what the law covers and how you can prepare.
Note: If there’s one thing that Musubi knows well, it’s dating apps. Our CEO and co-founder Tom Quisel was CTO at OkCupid and Grindr, and I ran Trust & Safety at both platforms, so between us we’ve seen a lot. However, I'm not a lawyer, and nothing here is legal advice.
Who's covered
This is a US federal law, and it applies to any website or app that “offers members access to dating or romantic relationships with other members by arranging or facilitating the social introduction of members.” There's no size threshold, so a small niche app is covered just as much as the biggest names.
This is broader than the state laws that came before it. Vermont and Utah, for example, limited their rules to companies whose main business is dating. The federal definition drops that qualifier, so what matters is what your service offers, not what your company mostly does.
Dedicated dating apps are clearly in scope. Dating features inside larger platforms, such as a dating tab in a social app, very likely are too. Then there's a real gray area: social discovery apps, friend-finding apps, and community or event platforms. Many of these facilitate introductions, and some host singles groups or events, but the definition still turns on offering access to dating or romantic relationships. If your product sits near that line, the scope may be wider than you'd assume, and it's worth a conversation with counsel now rather than next fall.
What the law asks for
In brief, the requirements are:
- When it applies: you ban or suspend an account because you judge it's at significant risk of trying to get money from other members through fraud.
- Who you notify: every member who received a message from that account.
- What the notice says: the banned account's username, the last time the member exchanged messages with them, a statement that the account may have used a false identity or tried to defraud members, a warning not to send money or financial information, fraud-prevention tips, and how to reach your support team.
- How it's delivered: by email or text message. Other channels are allowed only if the member has consented to them. An in-app message isn't enough by default. The people who most need this warning are often the ones who have already moved the conversation somewhere else and stopped opening your app.
- How fast: within 24 hours of the ban, or up to three days if circumstances require it. If law enforcement asks you to hold the notice for an investigation, you wait, then send it within three days after the hold ends.
- Who enforces it: the FTC and state attorneys general.
The law focuses on what happens after a ban. Detection is up to the platform. Every person a scammer messages before the ban is one more notice sent.
What to do
Only fraud bans or suspensions trigger this required notice. Here's how the bill defines a fraud ban:
“The term ‘fraud ban’ means the termination or suspension of the account or profile of a member of an online dating service because, in the judgment of the online dating service provider, there is a significant risk the member will attempt to obtain cash or another form of currency from another member through fraudulent means.”
The gray areas
That definition leaves a lot of room for judgment. Here are some cases where the line isn't obvious. It's worth deciding before the law takes effect rather than case by case after.
Is it “another form of currency”?
- Asking for gift cards, items off a wish list, or online game currency “traded” to a specific username.
- Crypto, which the law doesn't mention by name.
Is it “fraudulent means”?
- Sextortion, where money is taken by threat rather than deception, even if it started with a fake identity.
- Fundraising asks, like a profile link or QR code to an “emergency vet bills” page, or a request to donate to someone's “research fund.”
- Commercial pitches, like “financial freedom” investment groups, multi-level marketing, high-priced coaching seminars, or pushes to paid content elsewhere.
- Findom and sugar-dating arrangements, where money changing hands is part of the deal, but fraud often hides behind them. An upfront “deposit for travel expenses” or a first “allowance” can be either, and the line is very fine.
Is it “from another member”?
- Pig-butchering, where the scammer never asks for money directly and instead steers the victim into depositing on a fake investment site.
- Money mule recruitment, like “can you receive a payment for me?”
Whose account is it?
- A three-year-old account with no violations suddenly sends fifty new matches the same message about a private investment group. It could be a takeover, or a real user who's pivoted to aggressive marketing.
- An account suspended pending ID verification because of fraud risk, which then passes and is reinstated.
Who “received a message”?
- Messages your filters blocked before they were delivered.
- Posts in group chats or event spaces.
Whatever you decide, write it down. Your answers to these questions become your working definition of “significant risk,” and they're what you'll point to if a regulator ever asks why a notice did or didn't go out.
Base fraud judgments on more than message text
The notice follows the fraud judgment of the platform, not the content of any particular message. In our experience, many scammers (probably most) try to move people off-platform before money ever comes up, so if your fraud judgments rest only on what's said in messages, the people most at risk won't get a warning.
Other signals can support a fraud judgment even when the messages look clean:
- A victim reporting that someone asked them for money.
- Links to accounts already banned for fraud through shared devices, IPs, photos, or payment details.
- Messages, photos, and bios that match known romance or investment scam scripts or patterns.
- Stolen-identity signals or mass-messaging paired with pushes to move the chat elsewhere.
Scam operations rarely run a single account. If you can identify the whole ring and act on it at once, you send one coordinated wave of notices instead of chasing accounts one by one, and the people they contacted hear about it sooner.
Scam tactics change constantly and your moderators often spot a new pattern early on. We’ve built ways to turn their fraud decisions into examples that automated reviews apply across accounts. A pattern one moderator catches can lead to shutting down an entire fraud ring.
Get your ban taxonomy precise
The reason your team or system attaches to a ban will now determine whether you owe a notice to every person that account contacted.
If your taxonomy lumps fraud in with fake profiles, spam, or sextortion, you'll need to separate them. This can be easier said than done. Moderators often get confused about the difference between scams and spam, and the line is genuinely blurry at times. As mentioned above, you’ll also want to make this distinction on more than just content, which requires whole-account and behavioral review.
You'll also need clear rules for mixed-reason bans.
Some state laws counted bans for using a false identity, while the federal definition is limited to suspected fraud involving money. You can still choose to notify people about bans the law doesn't cover, like fake profiles or suspected scammers who haven't asked for money yet, but that's not a legal requirement.
What to focus on next:
- Clear taxonomy that differentiates fraud, spam, scams, sextortion, and account takeover.
- Decide exactly what “significant risk” of fraud means for your platform. Where do you draw the line between a significant/ likely risk, and a potential risk?
- Optimize policies and retraining for both human moderators and automated systems.
- Create workflows that trigger whole-account review from suspicious content, or content from a suspicious account (see our case study with Stocktwits for info on how this can be done).
Keep false positives low, because notices name names
A wrongful fraud ban is no longer a contained mistake. The mandatory notice must include the banned account's username and goes to everyone that person messaged, which means the cost of a false positive is really high. Account takeovers, where a scammer is using a real person's compromised account, raise the stakes too. If you fraud-ban a compromised account, the notice goes out with the real owner's username attached to a fraud warning, so the fallout from an account takeover is now higher than it was before.
Some best practices:
- Route borderline or low-confidence fraud calls to a secondary review before the 24-hour clock becomes a problem.
- Decide ahead of time how you'll handle a ban that gets overturned after notices have gone out.
- Prepare for an uptick in customer questions and complaints, both from victims and accused fraudsters.
- Take account takeovers seriously, and try to intervene before any messages from that account are sent out.
Build the notification pipeline
State laws generally required notices only for people who received a message and replied, and only for residents of that state. The federal law covers everyone who received a message, with no geographic filter, so the volume per ban will be much higher. Law enforcement holds are also new.
In practice, that means:
- Monitoring the 24-hour window from the moment a ban starts, including bans triggered by automated systems or vendors.
- A process for law enforcement hold requests, covering verification, holding notices for specific bans, tracking extensions, and releasing notices within three days when a hold ends.
- Logging that would answer an FTC or attorney general inquiry: the ban reason, what made the decision, when notices went out, and to whom.
The year ahead
Platforms have until October 2027. The notice itself is relatively simple. The more difficult work is classifying bans accurately and building fraud judgments on more than message text. That’s exactly what we specialize in at Musubi, so please reach out if you need help in those areas.
Wondering if Musubi could help?
We love to talk about the basics, the gnarly edge cases, and everything in between.