Scam patterns

The “trader” who messaged you on Telegram or WhatsApp

It starts as a wrong number, a comment under your post, a job offer, or a woman who seems genuinely interested in you. Weeks later there is a trading platform, a balance that only goes up, and a reason why you cannot withdraw. The script is the same whether it arrives in Telegram, WhatsApp, Instagram or a dating app — and knowing the script is the fastest way to recognise it, whether you are still deciding or already paid.

Updated 16 October 2026 · about 9 minutes to read

How the conversation starts

Nobody opens with an investment pitch. The first message is designed to be answered without thinking:

• The wrong number. “Hi, is this Anna? Sorry — wrong contact. You seem nice though, what do you do?” Repeated to thousands of numbers; the ones who reply politely get the full treatment.
• The comment and the DM. You asked a question in a crypto group, under a YouTube video or on an exchange’s post. Within minutes several accounts write privately. Public questions about crypto are harvested continuously.
• The job. Remote work, “crypto arbitrage assistant”, “testing a trading platform”, paid in USDT. The work exists only until you have to top up a balance yourself.
• The romance. Weeks of ordinary conversation, photos, voice notes, a story about family. Investment appears only once you have grown attached. That longer version is pig butchering, and it is run by organised operations, not by a lonely stranger.
• The “official”. A support agent from an exchange you really use, writing first about a problem with your account. Real exchange support does not initiate private chats in messengers.

The script, stage by stage

The stages run in order, and each one has a job:

• 1. Rapport. Days or weeks of normal talk. Your work, your family, your plans. They remember details and ask about them later. This is the part that makes victims later say “it was not like a scam at all”.
• 2. The accidental reveal. They never sell you anything. They mention a profit, an uncle at a fund, a “signal group”, an arbitrage window between exchanges. You are the one who asks how it works — which is exactly the point.
• 3. The small win. You put in a small amount on a platform they send you to. The balance grows. You withdraw successfully, and that withdrawal is the real product being sold: it buys your trust, and it costs them a fraction of what you will send next.
• 4. The scale-up. A limited window, a bonus for larger deposits, a “VIP tier”. Often there is now a second person — a “manager”, an “analyst”, a “customer care” agent — to add weight.
• 5. The wall. You try to withdraw a real amount. Now there is a tax, a conversion fee, an anti-money-laundering deposit, a “gas fee”, an account upgrade. Each payment unlocks the next demand. This is the stage described in detail in a fake exchange will not let you withdraw.
• 6. The squeeze. Pressure, deadlines, a frozen balance, sometimes a threat about taxes or the police. Some victims are pushed to borrow. Then contact ends — or the “recovery” offer arrives.

Nine things that give it away

You can check all nine in a few minutes, before any money moves:

• They wrote first and the subject turned to money.
• The platform is not findable outside their link: no history, no independent coverage, a domain registered months ago, an app installed by a link or a “TestFlight” invitation rather than from a normal app store listing with a long review history.
• Profit is promised as a rate, a daily percentage or a guarantee. Markets do not work that way, and nobody licensed is allowed to talk that way.
• Deposits go to an address, not to a company account. A regulated venue takes your money to an account in its own legal name.
• The balance is just a number on their website. You cannot verify it in any blockchain explorer, and your deposit left for an address you cannot identify.
• Urgency. Windows that close, bonuses that expire, “the price moves in an hour”.
• They coach you about your bank. If you are told what to answer when the bank asks what the payment is for, the conversation is already criminal.
• Video is avoided or is suspiciously short and low quality, while photos are abundant. Reverse-searching their photos sometimes finds the real owner.
• Everyone is nice. Support answers instantly, the manager is patient, the “analyst” is modest. Real brokers are bureaucratic and slow; a frictionless financial service is a warning sign in itself.

Why the balance on the screen is not money

Understanding this one mechanism saves people from the second and third payment. The platform you are looking at is a website, and the number on it is text. Your deposit did not go into a trading account; it went to a blockchain address controlled by the operation, usually in USDT on Tron or BNB Chain, and from there to an exchange within hours. The “profit” you watch growing was typed into a database. That is also why the first small withdrawal works: paying you back ten per cent of a small deposit from the pool of other victims’ money is the cheapest advertising they can buy.

So when you are told that a payment is needed to “release” your balance, there is nothing to release. The only money that exists is the money you are about to send.

If you have already sent money

Move fast, in this order. The detailed version is in what to do in the first 48 hours.

• Stop paying. Whatever has been promised for the next payment, it will not arrive.
• Save everything before it disappears. Export the full chat (Telegram and WhatsApp both allow it), screenshot the profile, the username, the phone number, the platform pages with your balance, and every payment confirmation. Scammers delete accounts and wipe chats; an exported chat is evidence, a deleted one is a memory.
• Write down the money trail. Every transaction hash, every address you sent to, amounts, assets, network, date and time with time zone. If you paid by card or bank transfer, the recipient details too.
• Tell the receiving platform. If your funds landed on a real exchange, its compliance team can sometimes hold them. Our free freeze request template is written for exactly that letter.
• Report it. Local police, plus IC3 if you are in the United States or Action Fraud in the United Kingdom. A report number is what makes exchanges and banks able to act. The police report template covers the structure investigators expect.
• Protect your accounts. If you installed anything they sent, or connected a wallet to their site, assume your devices and approvals are compromised: new wallet, new seed phrase, revoke approvals, change passwords and two-factor settings.
• Tell your bank the same day if any payment went through a card or a bank. Recalls and chargebacks have short windows.

The second wave: “we can get it back”

Within days or weeks of a loss, new people appear: a “blockchain investigator”, a “recovery department”, a lawyer with a convincing letterhead, sometimes someone claiming to be the police or a regulator holding your frozen funds. They know real details of your case, because lists of victims are sold between groups. The pattern is always the same — a fee, a tax, a deposit, something paid before anything reaches you.

Before you answer any of them, run our free seven-question check or read how to spot a recovery scam. The single rule that protects you: never pay anyone for the return of your money before that money is actually in your account.