It begins with a message that wasn't meant for you. A friendly woman asks for an appointment, gives a strange name, and apologizes when you correct her, explaining that she dialed the wrong number. The apology leads to a conversation, and the conversation to an invitation to a group where stock market trends are discussed.<\/p>\n\n\n\n
What follows is almost always the same. The group appears active, participants report gains, and an expert provides assessments. Ultimately, there's a platform available only to members of this group and a balance that cannot be withdrawn.<\/p>\n\n\n\n
Crypto Investigation is now seeing this variant more frequently than the classic fake broker. This article describes the process, identifies the warning signs, and shows which traces can still be followed after a payment. It complements our article on... Crypto fraud via Telegram<\/a>, which describes the same mechanics in a different context.<\/p>\n\n\n\n The first message seems harmless and personal. It contains a stranger's name, sometimes a photo, often a trivial question. The sole purpose is to start a conversation. Anyone who replies, even just to correct something, has already cleared the crucial hurdle. Variations involve supposed recruiters, alleged acquaintances from abroad, or ads on social networks that lead directly to a chat.<\/p>\n\n\n\n After a few days, you'll receive an invitation to a group, often with a respectable-sounding name and several hundred members. There's an expert who explains market conditions, assistants who answer questions, and participants who share screenshots of their profits. Often, there are even rules and warnings that reinforce the impression of legitimacy.<\/p>\n\n\n\n The crucial point is invisible: the vast majority of these members are part of the structure. The questions asked are prepared, as are the answers. New members experience a group where everyone benefits and are the only genuine participants.<\/p>\n\n\n\n Eventually, a trading platform is introduced, often with its own app or as a web application. It displays price trends, positions, and account balances. All of this is a representation without any connection to a real market. If your account balance increases, the number is increased; if it decreases, it is decreased. Both actions serve to trigger further deposits.<\/p>\n\n\n\n Initially, a small payout works. This is the most effective way to demonstrate trust and costs the perpetrators little. Beyond a certain amount, their behavior changes: a payout is refused because a tax, fee, verification amount, or security deposit is due. Each fulfilled demand generates the next.<\/p>\n\n\n\n Individual characteristics say little, the combination is unambiguous.<\/p>\n\n\n\n Suspicious is an unsolicited initial message that was allegedly sent to the wrong person. Suspicious is a group where only positive experiences are shared and critical questions are either ignored or immediately moved to private chats. Suspicious is a trading platform that is only accessible via a link from the group, has no verifiable legal notice, and whose domain was only recently registered.<\/p>\n\n\n\n Equally suspicious are the request to keep the matter confidential, the pressure exerted through supposedly limited time windows, the refusal to allow withdrawals without an additional fee, and the request to send only cryptocurrency deposits to constantly changing addresses. A regulated provider does not operate this way.<\/p>\n\n\n\n A practical check: Search for the platform's name along with terms like "experience" or "payout." Also, check whether the alleged provider is listed in the public registers of the relevant regulatory authorities. The absence of an entry is a clear warning sign. You can find a detailed overview of warning signs in our [link to relevant article\/document]. Prevention guide<\/a>.<\/p>\n\n\n\n The effect isn't created by the offer itself, but by the environment. Someone who reads along in a group for weeks, where others appear to be successful, assesses the risk differently than someone who sees a single advertisement. Added to this is the personal relationship with the person who initiated the contact. They listened, asked questions, and perhaps even shared their own concerns.<\/p>\n\n\n\n This combination of social validation and personal connection is the core of the scam. It works regardless of education and professional experience because it doesn't target knowledge, but rather trust. We describe how these mechanisms work in detail in the article about why even intelligent people fall victim to crypto fraud.<\/p>\n\n\n\n Stop all further payments immediately, even if a high balance is displayed. This figure belongs to a surface controlled by the other party. Payments for alleged taxes or clearances will only increase the damage.<\/p>\n\n\n\n Afterward, secure the evidence before any content is deleted. This includes the complete chat history with the contact person, the group with names and visible members, the platform's address spelled out exactly, screenshots of the account and withdrawal requests, and all transaction IDs of your payments with date, time, and amount. Also, note which exchange you used to purchase the funds.<\/p>\n\n\n\n Do not leave the group before you have backed up everything, as the content will no longer be accessible to you after leaving. Then file a police report with this information and inform the exchange where you made your purchase. In the case of payments in stablecoins, a timely, well-documented report can, in certain cases, lead to your holdings being frozen.<\/p>\n\n\n\n Expect to be contacted shortly afterward by individuals claiming to be helping, promising to repatriate you. This second wave is no coincidence. We explain how to recognize such offers in the article about... Repatriation agencies and recovery scams<\/a>.<\/p>\n\n\n\n You invested in a supposed deal through a group and don't know if anything can still be done? We track your payments, check if the recipient addresses are known from other cases, and tell you frankly whether there is a tangible connection.<\/p>\n\n\n\nThe most important information at a glance<\/h2>\n\n\n\n
\n
WhatsApp crypto fraud: How the scam works<\/h2>\n\n\n\n
Entry via the wrong number<\/h3>\n\n\n\n
The change to the group<\/h3>\n\n\n\n
The platform<\/h3>\n\n\n\n
The first payout and the turning point<\/h3>\n\n\n\n
How to recognize a fraudulent WhatsApp group<\/h2>\n\n\n\n
Why the group is so convincing<\/h2>\n\n\n\n
What you should do after a payment<\/h2>\n\n\n\n
Track payments from a WhatsApp group<\/h2>\n\n\n\n