Bewary Get Bewary
Scam patternPublished Aug 3, 2026

Is the soldier I'm talking to online actually in the military?

Bewary fraud research, published by Andrey Khayrullaev, founder. How we research scam patterns.

Example DM

Hey beautiful. I know this is forward but I feel a connection I can't explain. I'm Sergeant First Class Daniel Reeves, currently stationed at FOB Shank in Afghanistan. My unit just got extended 4 months and I'm losing my mind out here. You're the only good thing in my day. I want to come home and meet you so bad. My CO said I can put in for emergency leave but there's a $3,800 processing fee the Army doesn't cover for personal requests. I hate asking but my pay is held in a restricted account I can't access while deployed. Can you send it through Zelle or a Google Play gift card? I'll pay you back double the day I land. I love you. Please don't tell anyone, they won't understand what we have.

SCAM

Fake. The tell is the fee. No branch of the U.S. military charges soldiers for leave, medical care, or communications. Army CID says it directly: 'Soldiers are not charged money so that they can go on leave.' DFAS deposits their pay on the 1st and 15th, deployed or not. TRICARE covers medical. MWR centers provide free video calls. Every service this person claims to need your money for, the military already funds.

How to spot the U.S. Army / U.S. Military scam

  • There is no leave fee. Military leave is requested on a DA Form 31 and approved by the soldier's commanding officer. No payment at any step. Army CID: 'Soldiers are not charged money so that they can go on leave.' The $3,800 'processing fee' is invented from nothing.
  • No military pay account is ever 'restricted' or 'locked.' DFAS (Defense Finance and Accounting Service) deposits pay on the 1st and 15th of every month, deployed or not, into the soldier's own bank account. There is no special deployment hold. The scammer needs this lie because without it, you would ask why a salaried federal employee needs your Zelle.
  • Months of daily messages, zero live video. Deployed soldiers access video calls through MWR (Morale, Welfare, and Recreation) centers on base, personal phones on base Wi-Fi, or local SIM cards they buy themselves. A real soldier who has talked to you for weeks can get on camera. A scammer running multiple targets simultaneously cannot.
  • The rank and unit sound right but do not check out. Scammers pull real unit designations from public news articles and pair them with photos stolen from DVIDS, the military's own public image database. You can verify a claimed unit's actual location through its official social media page or public affairs office. Scammers count on you not checking.
  • The username is one character off from a real soldier's profile. An 'l' swapped for a '1', an 'O' for a '0'. The clone sits next to the original without triggering a duplicate flag. Compare letter by letter against any tagged profile. The difference is built to be invisible at a glance.
  • They stretch 'OPSEC' into a reason you cannot verify anything. Real operational security means a soldier will not share classified mission details. It does not mean they cannot show their face on video, tell you their real name, or let you call their unit's public affairs office. Scammers warp OPSEC into a blanket gag order because one phone call to a PAO ends the con.
  • A photo of a Common Access Card proves nothing. Scammers fabricate military IDs using templates found online, filling in the stolen name and photo. A CAC is government property. No real soldier photographs theirs and texts it to someone they met on Instagram.
  • The payment method bypasses every military finance system. Google Play cards, Steam Wallet codes, Zelle, Bitcoin. No military finance office in any branch processes anything through gift cards or peer-to-peer apps. The scammer picks these methods because once you send, you cannot reverse the transaction.

What to do now

  1. Stop all payments now. Gift cards, Zelle, crypto, wire transfers: none can be clawed back. There is no remaining balance that unlocks the leave request. Every new ask is another cut from the same script.
  2. Reverse-image-search every photo through Google Images or TinEye. These scams almost always use photos lifted from DVIDS (the Department of Defense's public media archive) or a real soldier's social media. You will likely find the same face under a different name and rank.
  3. Ask to verify through the soldier's unit public affairs office. Every military unit has one. A real soldier can give you a DSN number or a .mil email you can confirm independently. A scammer will refuse, stall, or suddenly have a 'mission.'
  4. Report the impersonation to Army CID at army.cid.crime-tips@army.mil. Include screenshots of the profile, all messages, and payment receipts. CID tracks these networks and posts confirmed scam identities on its public warning page.
  5. File at ic3.gov, the FBI's Internet Crime Complaint Center. Include dollar amounts, payment methods, dates, and every username the person used. IC3 is the federal intake point when money crosses borders, which in these cases it almost always does.
  6. Report the profile on the platform where you met them. Use the impersonation-specific flow, not general harassment. Flag it as 'pretending to be someone else.' This pulls the stolen identity off the platform before the same photos hook someone else.

What it looks like on your phone

Recreated example of the U.S. Army / U.S. Military scam dm: Hey beautiful. I know this is forward but I feel a connection I can't explain. I'm Sergeant First Class Daniel
A representative example based on common reports. Exact wording varies.

Got a message like this? Check yours free

Paste any text, link, or number you are unsure about. Bewary gives you a straight answer in seconds, and the exact reason why.

Private. Never sold, never tied to you.

Sources and reporting

Use official channels to confirm a suspicious request and report fraud.