The Dark Side of Dating Apps
Introduction
Dating apps seem to be the most popular way to meet your potential partner and there are no signs of slowing down.
There are more than 300 million people worldwide who use dating apps.
However, with every new rising technology feature, there is always need for safety.
Hey, I’m Nate, a current computer science undergrad student with a strong passion in reverse engineering and machine learning. In this article, we will explore how hackers use dating apps to take advantage of users and make millions in a self created market. I will also talk about how the rise of artificial intelligence makes this game of offense vs defense exponentially more difficult.
This article will be from the perspective of a security researcher and will include technical details about the security measures these apps are taking to prevent malicious actors.
The Rise Of Dating Apps
Tinder was the most downloaded app in 2023, followed by Bumble.
No, this statistic is not made up, it is real. Out of every app that has ever been posted to the Apple App Store, Tinder was the most downloaded in the year of 2023. This speaks volumes! Tinder is owned by the parent company named Match Group.
This parent company also owns other dating apps such named Hinge, Match, Meetic, OkCupid, Pairs, Plenty Of Fish, Azar, & Hakuna.
Not only are the yearly downloads of all dating apps are increasing, app revenue seem to follow the same trend.
Now, you might ask, “How do these companies even make money?”
Well, they do this in multiple ways:
- Subscriptions
- Advertisements
- One-time in-app purchases
Subscriptions account for the majority of a dating app’s revenue. Dating apps usually entice users to pay for subscriptions by limiting essential features of the app such as swipes. For Tinder, after 25 swipes you’re limited until the next calendar day. For Hinge, you’re limited after 8 likes in a single calendar day.
These subscriptions vary from $25 per week to $180 per every 6 months. There also is a “lifetime” subscription from the app Bumble for $249.
Of course, these subscriptions are not just only for unlimited swipes, but include “benefits” such as:
- Priority likes (your likes see you first before other likes)
- Skip the line (get seen before other non paying users)
- Free boosts/Super Likes/No Ads
The Psychology Behind User Engagement
Each time you see a potential partner on the feed of your dating app, you get a little dose of dopamine released in your brain. This feeling is even intensified when you get the push notification that the person you liked earlier has liked you back resulting in a match.
The Dopamine Effect
Dopamine is a neurotransmitter — a chemical messenger in the brain, one of many such chemicals essential for our survival. One of dopamine’s crucial roles is to influence when and how we experience pleasure and reward.
However, just like with social media apps, this can cause many issues within a society.
Male Loneliness
Did you know that men make up upwards to 70% of the users on dating apps?
Male loneliness is on a steady rise. Numerous articles are being written every day on this “epidemic”.
From The Western Howl: A study published by Equimundo in 2023 found that a majority of men, ranging from older Millennials to Generation Z, agree with the statement, “No one really knows me well.”
Generation Z had the highest percentage of agreement among all respondents.
From DesertNews: Several studies over the last few years have shown that men are experiencing what’s become known as a “friendship recession.” It’s essentially an epidemic of loneliness.
Surveys show that men in general have fewer close friends than women, and men today have fewer close friends than men 30 years ago. Since the early 1990s, the percentage of men who say they don’t have any close friends has multiplied several times over.
Men are less likely than women to reach out to friends to talk about their personal feelings, too. Not coincidentally, men are also nearly four times as likely as women to die by suicide, according to data from the Centers for Disease Control and Prevention.
These trends started before Covid-19, but a global pandemic sure didn’t help.
Exploitation by Unethical Actors
So after reading up to here, you probably realize two things.
- There is a huge loneliness problem particularly in the younger generation and even more particularly with males.
- There is a supposed way to “fix” loneliness through the use of dating apps.
This growing sense of isolation creates a perfect storm where individuals, yearning for connection, may overlook red flags. Unethical actors capitalize on this vulnerability, using sophisticated techniques to exploit users on dating apps.
The Lucrative World of Dating App Funnels
Have you ever gone through your dating app feed and see that you got a like from a very attractive partner. However, upon messaging them you are left with no response or even a suspicious one (more on this later in the AI section).
You decide to do more digging into their profile and you see that they have just an Instagram handle in their bio. You decide to look up their Instagram and see a realistic looking page with a link to an Onlyfans site.
Bots
This is a prime interaction of a user’s experience when dealing with a fake profile. Another variation of this bot is instead of having their instagram in the bio, it will be a handle to a snapchat account that will then leverage AI to form a “conversation” with you to eventually lure you to the model’s Onlyfans page.
These bots are setup by hackers for one reason; to make them money and do they make a lot.
Black Market of Funneling Dating App Users to OnlyFans
You probably heard of the company OnlyFans by now. It’s a “space for creators to express themselves freely, monetize content, and develop authentic connections with their fans”.
However, the reality is that the majority of the platform’s content producers are women and the majority of the platform’s content consumers are men.
Hackers know this, and with their level of expertise regarding reverse engineering, they create sophisticated scripts to bypass the complicated security measures these dating apps have in place to mass produce fake profiles to lure men into the actual women’s Onlyfans page.
Once the user has signed up, usually through a monthly subscription, the hacker and the content producer split the earnings and end in a win win scenario, for those two at least.
You might be wondering, “How much do they even make to go through all this trouble?”
A conversation I had with someone anonymous who used to do this exact type of work said the following: “OFM is dependent on the Onlyfans model and funnels but if they are all good and setup well, you can be making hundreds of thousands/month per model like I was.”
Yes, you read that right: hundreds of thousands per month, per model.
Now, don’t fall under the assumption that this type of work from the hacker’s side is anything close to easy, because it definitely is not.
Technical Mechanisms and Security Measures
This is where we get into the technical part of the article.
Of course, these apps are not letting just anyone navigate through their app’s essential functions without any sense of defense.
Anti-Bot and Verification Systems
One of the primary defenses against fake profiles and bots is the implementation of anti-bot and verification systems. For instance, Tinder utilizes the FaceTec SDK, which employs advanced 3D face authentication technology to verify user identities.
This system requires users to take a series of selfies from different angles, creating a 3D face map that’s difficult for bots or fraudulent profiles to replicate.
Similarly, Snapchat has developed its own in-house anti-bot solutions. They employ custom bot detection algorithms that analyze user behavior patterns to detect anomalies indicative of bot activity. Additionally, they collaborate with companies like Arkose Labs to strengthen their defense mechanisms.
Other common methods of combating fake profiles are as follows:
- AI Detection Algorithms
- Encryption & Secure Communication Protocols
- 2FA & Verification Badges
- Regular Security Audits & Updates
However, all of this is worth the trouble for someone who has the time and the perseverance to reverse engineer these solutions.
How Hackers Bypass Security Measures
Onto the technical side …
Despite robust security measures, determined hackers often find ways to circumvent these defenses. Understanding these methods is crucial for both users and developers to enhance security and protect against potential threats.
Reverse Engineering and API Exploitation
Attackers use advanced reverse engineering techniques to dissect application binaries and understand the underlying logic, security features, and http traffic.
Using tools like decompilers and dynamic analyzers, they can unravel obfuscated code and gain insights into the application’s inner workings.
One common method is bypassing certificate pinning, a security measure that ensures an app communicates only with a trusted server. Attackers might use techniques such as:
- Dynamic Instrumentation: Utilizing frameworks like Frida to intercept and modify method calls at runtime.
- Binary Patching: Modifying the app’s binary to alter its behavior, such as bypassing security checks.
By undermining certificate pinning, attackers can perform Man-in-the-Middle (MitM) attacks to intercept and manipulate network traffic between the app and the server. This allows them to analyze API calls, extract sensitive data, or inject malicious payloads.
If an application’s API endpoints lack robust authentication and authorization mechanisms, attackers may exploit these weaknesses to bypass verification processes or gain unauthorized access. For instance:
- Parameter Tampering: Modifying parameters in API requests to escalate privileges or access restricted resources.
- Replay Attacks: Capturing and reusing valid authentication tokens or sessions to impersonate legitimate users.
This shows the critical importance of implementing strong server-side validation, using secure authentication protocols like OAuth 2.0, and adhering to the principle of least privilege in access controls.
Bypassing Facial Recognition Systems
Biometric authentication systems, such as facial recognition provided by technologies like FaceTec, are designed to enhance security by verifying users based on unique biological characteristics. However, attackers have developed methods to deceive these systems through:
- Presentation Attacks (Spoofing): Utilizing high-resolution images, masks, or video replays to simulate the biometric features of legitimate users. Advanced attacks may employ 3D masks or textured artifacts that mimic facial depth and contours.
- Adversarial Machine Learning: Crafting inputs that intentionally deceive facial recognition algorithms. By introducing subtle perturbations to images (imperceptible to humans), attackers can cause misclassification or bypass authentication.
To counter these threats, developers are incorporating liveness detection mechanisms that analyze involuntary biological signals (e.g., blink rate, micro-expressions) and deploying multi-factor authentication to combine biometric verification with other authentication factors.
Automated Bots with Human-like Behavior
Hackers create sophisticated bots that mimic human behavior to evade detection. These bots may:
- Randomize their activity patterns to resemble human usage.
- Use natural language processing to generate realistic conversations like GPT.
- Incorporate delays and varied response times.
By simulating human-like interactions, these bots can slip past behavior-based detection algorithms.
Leveraging AI and Deepfakes
More about this in the AI section in this article.
Serious Consequences Beyond Scams
While financial scams and unauthorized charges are concerning, the misuse of dating apps can lead to far more severe consequences that impact individuals and society at large.
Escalation to Human Trafficking and Safety Risks
One of the most alarming risks is the potential for fake profiles to be used as tools for human trafficking. Predators may pose as potential romantic partners to build trust with unsuspecting victims. Once a relationship is established, they might manipulate or coerce individuals into exploitative situations.
According to the Polaris Project, traffickers often use social media and dating apps to recruit and exploit victims. The anonymity and vast reach of these platforms make them fertile ground for such nefarious activities.
Identity Theft and Data Breaches
Hackers may use dating apps to collect personal information, which can be used for:
- Identity Theft: Opening bank accounts, credit lines, or making purchases in the victim’s name.
- Doxing: Publishing private information publicly to harass or intimidate the victim.
- Financial Fraud: Unauthorized transactions and financial losses.
Notably, data breaches of dating apps can expose sensitive user data on a massive scale, as seen in past incidents where millions of user accounts were compromised.
Emotional and Psychological Impact on Victims
Victims of these schemes often experience:
- Betrayal and Trust Issues: Discovering that a connection was based on deception can lead to long-term difficulties in trusting others.
- Mental Health Challenges: Feelings of embarrassment, anxiety, depression, and even post-traumatic stress disorder (PTSD) can result from such experiences.
- Isolation: Victims may withdraw from social interactions out of fear or shame.
Men fell victim to these funnels the most because of the growing rate of loneliness. The whole time they feel like they are talking to the real actual person on their profile but little do they know it’s either a person in a developing country who has been hired for pennies on the dollar, or even artificial intelligence.
The Role of Artificial Intelligence and Machine Learning
AI has introduced a lot of good but an equal amount of bad into society.
AI as a Tool
A more known example of how AI can be used in this process is in the “conversation” between the bot profile and the unknowing dating app user. This can be easily done through various ways but we are here to explore something even more cynical.
Deepfake: a video of a person in which their face or body has been digitally altered so that they appear to be someone else, typically used maliciously or to spread false information.
Deepfakes are particularly scary for obvious reasons.
From The Georgetown Journal:
In January 2024, artificially generated pornographic images (also known as “deepfakes”) of pop superstar Taylor Swift circulated the social media platform, X (formerly Twitter), at an alarmingly quick rate. Within hours, some images were seen more than 45 million times and accrued thousands of shares and likes before eventually being taken down.
The incident, which gained media attention in part due to Swift’s mega-star status and passionate fan base, brought up fascinating First Amendment questions about the role of social media platforms in regulating obscene speech and protecting victims, especially minors, from these types of attacks.
Want to know something even more scary? Anyone can do it.
Just take a look at this github repo. Anyone can download the required files and get this application running in no time. You can essentially deepfake as anyone you want just from a simple image of the person.
AI in Security and Prevention
However, AI is also used on the defensive side.
Machine learning algorithms, trained on massive datasets, can analyze patterns and identify characteristics typical of fake profiles, helping platforms to detect and remove them before they cause harm.
Through advanced pattern recognition and anomaly detection, AI can flag suspicious behavior — such as rapid messaging, repeated language, or unrealistic profile photos — making it harder for fake accounts to operate undetected.
The advancements in pattern recognition and anomaly detection help …
The Arms Race Between Offense and Defense
The battle between platforms and malicious actors is an endless arms race, with each side constantly evolving its tactics. As dating apps improve their AI-driven defenses, hackers develop more sophisticated methods to bypass them, leveraging reverse engineering and automation to stay a step ahead.
For every defensive measure, new exploits emerge, making the game of digital cat-and-mouse perpetual.
This game will never end.
The Need for Regulation and User Awareness
Does AI need regulation?
Well the CEO of the world’s biggest artificial intelligence chatbot company believes so, along with many others I might add.
Current Regulatory Environment
Governments worldwide are grappling with how to regulate the fast-evolving digital landscape. Key regulatory considerations include:
- Data Protection Laws: Regulations like the General Data Protection Regulation (GDPR) in the EU enforce strict guidelines on data privacy and give users control over their personal information.
- Anti-Fraud Legislation: Laws that criminalize online scams, identity theft, and unauthorized access.
- AI and Deepfake Regulations: Emerging laws aimed at controlling the malicious use of AI-generated content.
In the United States, there is growing bipartisan interest in regulating AI technologies to prevent misuse, as indicated by testimonies from industry leaders advocating for oversight.
Ending
The digital landscape of dating apps is a reflection of society’s shift towards online interactions. As dating apps integrate advanced AI, they risk becoming tools for exploitation rather than connection.
Malicious actors can use this technology to create convincing scams and manipulate users, making it harder to distinguish real interactions from deception.
Without stronger safeguards, we face a future where trust fades, leaving users vulnerable in a digital world that blurs the line between connection and harm.