Anatomy of the fake crypto investment scam

Anyone who has never fallen for it assumes the crypto investment scam comes down to a single question: how does someone believe a promise of 8% a month? It's the wrong question, and that's precisely why prevention built on it fails.

Nobody accepts the promise at first contact. The victim accepts a sequence of small propositions, each reasonable in light of the last, and only sees the whole picture once the money is gone. The scam isn't an argument. It's a funnel.

The six stages

1. Recruitment. An ad on social media, a messaging group, a profile they've been following for months, or — the most effective variant — a referral from someone they know who is also a victim and doesn't know it yet. Referral-based recruitment is the hardest to counter, because the critical filter has already been switched off by someone we trust.

2. Social proof. Screenshots of returns, testimonials, a channel with hundreds of members where nearly everyone is an extra. The point isn't to prove that it works; it's to establish that other ordinary people have already decided it works.

3. A small initial deposit. A modest amount, almost always below what the victim could lose painlessly. At this stage the scam isn't yet a scam: it's a test the victim sets for herself, and one she is going to pass.

4. The withdrawal that works. The decisive stage, and the one that almost never appears in prevention guides. The victim withdraws — and gets paid. The money lands in her account. From that moment on, she is no longer assessing a promise: she is assessing her own experience. Returning a fraction of the initial deposit is the cheapest investment the operator makes, and the one that unlocks everything that follows.

5. Escalation. With doubt resolved by personal evidence, the deposits grow. In come the savings, the car that was sold, the payroll loan, other people's money. The dashboard shows a balance rising every day. That balance is a number in a database the operator controls — it never existed as an asset.

6. The lock-in. The victim tries to withdraw the large amount and runs into a new requirement: a release fee, withheld tax, a compliance check, an "anti-money-laundering audit." Always a small amount next to the balance on display, which makes paying it feel obvious. This is the final extraction, and it can repeat for as long as credit remains available.

There is a seventh stage that targets those who have already realized they were robbed: the recovery scam. Someone offers to retrieve the funds in exchange for an upfront payment. It's usually the same group, or someone who bought the victim list — which by that point is an asset with a market price.

Why the victim doesn't see it

It isn't naivety, and treating it as naivety is why so many prevention campaigns fail. The funnel exploits mechanisms that operate in anyone:

• Commitment and consistency. Once you've defended the decision to your family, admitting the mistake costs more than carrying on.
• Sunk cost. The more money already committed, the more irrational stopping feels — precisely when stopping is the only rational move.
• Personal proof. The withdrawal in stage 4 isn't someone else's argument; it's your own memory. It outweighs any warning.
• Isolation. The operator pre-empts the family's objection by framing it as short-sightedness. By the time the warning arrives, it has already been predicted — and predicted by the fraudster, which only reinforces his authority.
• Urgency. A window that's closing, a spot that's running out, an allocation about to close. Haste doesn't persuade; it prevents the check that would dismantle everything.

Someone with a finance background isn't protected. They're exposed to a more sophisticated variant.

Signs that show up before the loss

• Returns presented as constant — real markets fluctuate; a fabricated spreadsheet doesn't
• Withdrawals only possible through an informal channel, or with a minimum threshold that keeps rising
• Deposits into an individual's account or a company account unrelated to the brand
• A brand imitating a well-known institution with a slightly different domain
• Pressure to increase the deposit right after the first successful withdrawal
• Any charge in order to receive — a fee, tax or penalty that precedes the credit is, with no known exception, extraction

What to preserve once it has happened

Time is the adversary here. Crypto settles fast, and the recoverable amount drops by the hour. Before anything else, preserve:

• Transaction hashes and destination addresses — this is what makes tracing possible
• PIX, TED and boleto receipts, with dates and beneficiary accounts
• Complete conversations, exported, not cropped screenshots
• URLs, dashboard captures and any promotional material, before they go offline
• A record of who made the referral, and when

A cropped screenshot has low evidentiary value. A full export, with metadata, has high value. The difference between the two is usually settled in the first few hours, by someone who doesn't yet know they'll need it.

Where the money goes

The destination follows a pattern. Victim deposits are consolidated into a handful of addresses, fragmented, and moved through services designed to break traceability — until they reach a fiat off-ramp, almost always an exchange subject to some jurisdiction.

That exit point matters more than it seems. The blockchain is a public and permanent record: the trail doesn't expire, and time works against whoever needs to convert it into usable money. That's why cases written off as lost start moving again months later — not because the money reappeared, but because the record never went away.

---

CyberX works in digital intelligence applied to investigation — OSINT, on-chain tracing and fraud prevention. This content is informational and does not constitute legal advice.