Investment, romance, job, and recovery scams

The control pattern

Beneath the varying stories is a consistent sequence. An unsolicited contact establishes rapport over days or weeks. The conversation moves to a private channel where nobody else can comment. A platform is introduced—often a well-built website or app that exists solely for this purpose. A small deposit shows a profit. A small withdrawal is permitted and arrives, which converts scepticism into confidence more effectively than any argument.

Then the amounts increase, and at some point withdrawal stops working. What follows is a series of invented obstacles: a tax that must be paid before release, a verification deposit, a liquidity requirement, an account-upgrade fee. Each is framed as the last one.

The early withdrawal is not a mistake on the attacker's part. It is the mechanism. Recognising that a successful small withdrawal is a standard feature of the pattern, rather than proof of legitimacy, is the single most useful thing in this lesson.

The story can be anything

Romance, a remote job with unusual tasks, a message that appears to be a wrong number, a friendly mentor in a trading group, law enforcement claiming your accounts are compromised, technical support, a celebrity giveaway, a mining package, or an AI trading system—these are interchangeable front ends on the same payment path.

Because the stories vary endlessly, memorising them does not help. Recognising the structure does: unsolicited contact, a move to private messaging, an investment or payment you would not have sought out, a platform only they can vouch for, and eventually a request to send more in order to get something out.

Two claims deserve particular suspicion. Guaranteed returns describe something that does not exist in any market. And a request for secrecy—do not tell your family, they will not understand—exists to remove the outside perspective that would end the scheme.

Why the balance is not evidence

The numbers displayed on such a platform are simply text on a page that its operators control. A rising balance, a portfolio chart, and a transaction history can all be generated with no assets behind them, and they are.

The only meaningful test is whether value can be withdrawn to somewhere the operator does not control, without paying anything further. If withdrawal requires an additional payment to a person or address you cannot independently verify, the answer is already known.

Recovery is a second market for victims

People who have lost money are visibly identifiable—they post in forums, comment on articles, and file public reports. That makes them a targeted audience for a second offer: a service promising to trace, hack back, or unfreeze funds for an upfront fee.

Legitimate investigation exists, but it does not arrive unsolicited, does not guarantee recovery, and does not ask for a payment in crypto to begin. Treat any unsolicited recovery offer as a continuation of the original scheme.

The useful response is unglamorous: stop paying, preserve evidence—messages, addresses, transaction hashes, screenshots, the platform's domain—and report through authorities and services you locate independently. Recovery is often impossible. Preventing the second loss is entirely within reach.

• Unsolicited contact plus an investment opportunity equals stop.
• Treat a successful small withdrawal as part of the pattern.
• Never pay a fee to release your own funds.
• Break secrecy—describe the situation to someone uninvolved.
• Preserve evidence before closing accounts or deleting chats.