Natali Raievska — Romance Scam Documentation

How This Romance Scam Works

The full modus operandi, documented from six months of first-hand experience. If any of this sounds familiar, the same script is being used on you.

The Hook — Weeks 1–2

The Platform

The primary hunting ground is UkraineDate.com, part of the Cupid Media network. The site is available in over 20 languages — giving the scammer access to men across every continent.

Her profile on UkraineDate uses the name "Hatasha" (misspelling of Natasha), age 36, located in Bila Tserkva, Kiev. She lists herself as seeking men aged 29–67 — the widest possible net. Almost every detail field is left as "No Answer" to avoid contradictions across different targets.

She targets men aged 45–65, typically in the UK, US, Canada, Western Europe, and the Gulf states.

First Contact

She initiates with a warm, slightly vulnerable message. She references specific details from your profile. Within the first few exchanges, she establishes that she is alone, educated, cultured, and has suffered — the war, a difficult past, financial hardship. Nothing too dramatic yet — just enough to trigger protective instincts.

She has no children — but she wants them. This is held in reserve for later deployment.

The Migration

Within days, she moves you to Telegram — away from the dating platform where her behaviour might be reported. She frames this as intimacy: "I want to talk to you properly, not through this site."

Love Bombing — Weeks 2–6

Messages arrive morning and evening. Good morning texts. Goodnight messages. Voice notes (never video at this stage — that comes on her terms). She shares daily life in vivid detail — what she cooked, what music she listened to, how her day went.

She introduces emotional anchors: "I've never felt this way before." "You understand me like nobody else." "I'm scared of how fast this is moving."

The Origin Story

She shares a deeply personal document — in this operation, a 30-chapter PDF called "Schubert's Suicide Note". She presents it as her own biographical story with reversed genders. It is a fabricated manipulation script shared with multiple targets simultaneously.

If someone you met online has shared a long, emotional, semi-autobiographical document with you early in the relationship, treat it as a major red flag. See the "The Script" tab for a full analysis.

Controlled Video Calls

Unlike many scams, this operation does use video calls early on — but only on her terms. She insists on specific times. Calls happen when she is prepared: hair done, makeup on, lighting controlled. Spontaneous calls are always deflected.

The early calls build proof she's real. This is what makes the operation dangerous — the target has "seen" her and can tell friends "we video call, she's real." Later, as the money phase ramps up, calls quietly disappear.

Pre-Recorded "Personal" Videos

She sends short video clips — a woman in a domestic setting, cooking, speaking to camera. They feel intimate. She never uses your name. The term of address is always generic: "Honey," "my love," "darling." A video that says "Honey" can be sent to every target simultaneously. Record once, distribute to all.

Building the Trap — Weeks 4–8

The Fictional Cast

She populates her world with characters: a father figure ("Oleg," supposedly military — actually a Telegram account she operates herself), a best friend who validates the relationship.

"I've chosen to have children with you"

When the prospect of meeting in person is raised, she drops the line: "I've chosen to have children with you." The timing is precise. The target is now invested not just in a girlfriend but in a future family. Walking away means losing the wife and children he's been promised.

The First Request

The first financial ask comes only after significant emotional investment — typically 4–8 weeks in. It is always small and reasonable: a cracked phone screen, medication, groceries. This is a test. If you send the first amount, the requests escalate.

Extraction — Ongoing

Every Documented Request

"I can't pay my phone bill"

The earliest and smallest requests. Repeated periodically. Small amounts designed to normalise the habit of sending money.

"I need money for food"

Impossible to refuse without feeling cruel. Who lets someone they care about go hungry? That is the calculation.

"My father needs a loan" / "My father's been in an accident"

The fictional father becomes a source of escalating need. The accident variant adds urgency: he'll go to prison if you don't pay his fine immediately. There is no time to verify.

"My grandmother died"

She went to visit her grandmother. Woke up and found her dead. Funeral costs needed covering urgently. Money had to be transferred directly to her — "you don't know how it works here." Funeral directors supposedly can't accept direct third-party payments. There was never a photograph of the grandmother. The grandmother was also "too shy to be seen on camera." A woman so camera-shy she could never appear, and who then died leaving nothing but a bill.

Later, the Anna Kachurovska bank account was explained as "my grandmother opened this for me" — the same dead grandmother whose funeral had already been paid for. A dead woman with active bank accounts.

"I'm ill — bacterial infection — ovarian cysts — I need an operation"

A staged medical escalation. Began with vague symptoms and a "weak immune system." A routine check-up found a vaginal bacterial infection (intimate enough to discourage questions). When that money was sent, the condition worsened: ovarian cysts and a urological prolapse requiring surgery. Cost: approximately $600. And — following the identical pattern as the funeral — the clinic "cannot accept direct payment." Personal transfer only.

The Payment Methods

The scammer steers targets towards untraceable methods:

• SWIFT bank transfers — international, slow to reverse
• Visa/Mastercard direct transfers — card numbers provided via message
• Revolut — when traditional transfers are flagged
• Xoom (PayPal) — specifically suggested to bypass fraud detection
• MoneyGram — presented as "more convenient" with the lie that "Ukraine only works on cash." Ukraine has Monobank, PrivatBank, Apple Pay, contactless everywhere. The cash-only claim pushes targets towards untraceable cash pickups.

The Bank Account Shell Game

Eight accounts across four names. When one is blocked, a new one appears with a creative explanation.

Control & Retention

The scam makes leaving feel impossible through sunk cost, emotional manipulation (self-harm threats, invoking the future family), perpetual delay of the meeting, guilt, and isolation from friends and family who might offer perspective.

Platform Control

Telegram is the primary channel — it offers message deletion and limited traceability. If a target goes quiet, she deploys WhatsApp as a secondary channel to re-engage. If she suddenly contacts you on a platform you don't normally use, it means you've stopped responding and she's chasing.

The Cycle

"Schubert's Suicide Note" — The Romance Scam Script Used by Natali Raievska

One of the most distinctive tools in this operation is a 30-chapter psychological conditioning document known as "Schubert's Suicide Note" (Записки Шуберта). Natali Raievska shares this document with targets early in the relationship, presenting it as her own autobiographical story. It is a fabricated manipulation script — almost certainly shared with multiple targets simultaneously. If someone you met online has sent you this document, you are almost certainly being scammed by the same operation.

Key Names and Terms

If any of these names are familiar, the person who sent it to you is using a known romance scam script:

Characters

References

What the Document Does

Evidence Gallery

Photographs, screenshots, and video clips from the scam operation. All images are unedited originals with metadata intact. Video clips are also available on the dedicated video evidence page.

Dating Profile — UkraineDate.com

Active profile as "Hatasha, 36" from Bila Tserkva. Last active within hours of these screenshots. Seeking men aged 29–67.

Active profile. Seeking men aged 29–67 — the widest possible net. Almost every detail field set to "No Answer" to avoid contradictions across different targets.

Instagram — @natali_raevskaya

Active Instagram account. Posted within 24 hours. Living comfortably in Kyiv cafés while telling marks she can't afford food.

Tagged by @arinabelanova — a known associate. Note the hand tattoos and face-covering habit even on personal social media.

Telegram Photos — Sent to Target

Photos sent via Telegram over the course of the relationship. Note consistent identifying features: septum ring, gold chain necklace, finger tattoos.

Salon visits, backstage makeup rooms, wine evenings, designer robes — not the lifestyle of someone who can't afford groceries or a phone bill.

Protect Yourself

A checklist for recognising this scam, and where to report it. You are not alone.

Warning Signs

If three or more of the following apply to your online relationship, you are almost certainly being scammed:

• Video calls happened early but have gradually stopped while financial requests have increased
• She moved you off the dating platform quickly to Telegram or WhatsApp
• She has asked for money for any reason, no matter how small or reasonable
• Money has been requested to a name different from hers
• You have been given multiple bank accounts across different banks or names
• She has shared a long, emotional document about her past early in the relationship
• Every attempt to meet in person has been delayed by a new obstacle requiring money
• She discourages you from discussing the financial details with friends or family
• She has suggested specific transfer methods like Xoom, MoneyGram, or cryptocurrency
• She gets angry, threatens self-harm, or disappears when you question the requests
• Her "personal" videos never use your actual name — only "Honey" or similar
• She claims service providers (hospitals, funeral directors) cannot accept direct payment

Report It

Every report from a different angle increases the pressure. The bank freezes the account. Telegram restricts the profile. The cyber police open a file. Each one matters.