Fake investment platforms

What it is

A fake investment platform is a very good piece of software that does exactly one real thing: accept deposits.

Everything else on it is a rendering. The price chart moves. The order book updates. Positions open and close, profit and loss accrue, the portfolio value climbs. There is a support chat that answers, a verification process that asks for your passport, an app you install. None of it connects to a market, because there is no market — there is a database, and your row in it says whatever the operators want it to say.

Your deposit, by contrast, is entirely real. It leaves your bank, usually converts to cryptocurrency at a genuine exchange in your own name, and then leaves to addresses the operation controls. Within hours it is gone, while the number on your dashboard continues to rise.

This is the largest reported loss category in the United States. The FBI recorded $8.65 billion across 72,984 complaints in 2025, of which $7.2 billion was cryptocurrency investment fraud specifically. UK investment fraud rose 40% to £221.5 million. Australia’s combined figure was A$837.7 million — the highest-loss category for every age group from 25 upwards.

How it actually works

1. An introduction, not an advertisement

   A trading group on Telegram. A mentor. A friend of a friend. Someone met on a dating app or LinkedIn. Or an advert carrying a public figure’s face, generated without their knowledge. Almost nobody arrives at these platforms by searching for one.

2. A venue built to be examined

   Live charts, an order book, leverage settings, a fee schedule, an app, and a KYC upload that asks for your identity documents. That last step is counter-intuitive and deliberate: being asked for documents feels like a regulatory burden rather than a data harvest.

3. A modest deposit, which gains

   The money is real and takes a real route — often bought as crypto at a mainstream exchange in the victim’s own name, then withdrawn to the platform’s address. The gain that appears afterwards is a database entry.

4. A withdrawal that works

   Small, prompt, and the single most effective thing the operation does. It converts “I think this is real” into “I have tested this myself”.

   Where it could have stopped

   An early withdrawal that succeeds is the strongest evidence you are inside the scheme, not outside it. It costs the operation almost nothing and reliably produces a much larger second deposit. If a platform someone introduced you to has just paid you out, stop before the next deposit and check the regulator’s register.

5. Scale, and help finding more

   Larger positions. Leverage. In-platform “loans” that manufacture a debt you now feel obliged to trade out of. Suggestions about remortgaging, borrowing from family, or accessing a pension.

6. The withdrawal is blocked

   A withdrawal tax. A compliance fee. An anti-money-laundering deposit. An account upgrade. Each is payable only from new outside money — never from the balance on screen, which should be impossible if the balance existed.

7. The platform goes

   The site closes, or the account freezes, or support stops replying. Weeks later, a recovery approach arrives.

Why it works

It is not sold to strangers. Almost every victim was introduced by someone — a friend, a mentor, a group, a partner. The platform never has to overcome scepticism on its own; that work was done by the relationship, which is why pig butchering and this page describe two halves of one operation.

Investing is supposed to be opaque. Nobody understands exactly how their broker executes an order. A dashboard that shows plausible numbers is indistinguishable from a real one to almost everyone, and “I do not fully understand this” is a normal feeling about finance rather than a warning.

The verification step inverts a defence. Being asked to upload a passport reads as regulation. It is data collection, and it makes the operation look more legitimate precisely because it is annoying.

The withdrawal test is the wrong test, and it is the one everybody runs. People know to be suspicious of a platform that will not pay out. Very few know to be suspicious of one that will.

Losses feel recoverable. Markets go down. A dashboard showing a temporary drawdown does not read as fraud; it reads as investing. That framing keeps victims paying through the phase where they might otherwise have stopped.

And the final fee arrives when leaving is unthinkable. By then the on-screen balance is large, sometimes life-changing, and a tax of a few percent to release it is straightforwardly worth paying. That is the moment the scheme is built for.

Where it comes from

The enforcement record here is unusually specific, and it points at the same places as pig butchering, because they are the same operations.

The US Treasury’s September 2025 designations named Shwe Kokko in Karen State, Burma, and Sihanoukville, Bavet and Pursat Province in Cambodia, alongside the estimate that Americans lost at least $10 billion to Southeast Asia-based scam operations in 2024 — a 66% increase in a year. In October 2025 the Justice Department charged the chairman of Cambodia’s Prince Group over forced-labour compounds running cryptocurrency investment fraud, with a forfeiture action covering roughly 127,271 bitcoin.

The FBI’s own 2025 report states the attribution plainly: cryptocurrency investment scams are “largely perpetrated by organized criminal enterprises based in Southeast Asia using victims of human trafficking as forced labor to run the scam operations.”

Two qualifications, as everywhere on this site. This describes criminal enterprises and the territories where they have found protection, not nationalities — and the workforce is substantially trafficked, which means many of the people running the chat windows are victims of a separate crime. And the geography moves: the UN’s 2026 report records the industry spreading to Pacific Island countries, South Asia, the Gulf States, West Africa and the Americas.

A separate and older strand runs from boiler rooms in Europe and the Gulf, selling forex, bonds and commodities by telephone to lists of previous investors. Same structure, different accent, and it is the version most UK and European regulators’ warning lists were built for.

Real cases

Red flags

• You were introduced to it. By a person, a group chat, a mentor or an advert with a famous face. Real venues are found by you, on a regulator’s register.
• It is not on your national regulator’s register, or the register entry’s contact details differ from the ones you were given — a clone firm.
• Returns are consistent. Real markets are not. Steady weekly gains are the signature of a database, not a portfolio.
• An early withdrawal worked. Treat this as the strongest indicator, not as reassurance.
• Deposits go to a wallet address or a personal account rather than a named regulated institution — and the destination changes between deposits.
• A tax, fee or deposit is required before withdrawal, payable only from outside money.
• You are offered a loan, leverage or credit inside the platform.
• You are encouraged to borrow — remortgage, credit line, family, pension.
• A “mentor” or “account manager” who is available constantly and manages your positions with you.
• Pressure to act before a window closes, or a limited allocation.
• Instructions to keep it private, or to tell your bank the transfer is something else.

If it’s happening to you

If you have deposited but not yet been blocked. Try to withdraw everything, immediately, and stop depositing regardless of what happens. Then check the regulator’s register yourself, from a search you started. If the platform appears with different contact details, it is a clone.

If a withdrawal has been blocked.

1. Send nothing more. No tax, no fee, no deposit. The balance shown does not exist, and no payment will release it. This is where most of the total loss happens.
2. Call your bank today. A recent transfer may be recallable, and the bank can block further payments.
3. If you bought crypto at a mainstream exchange and sent it on, tell that exchange immediately with the transaction hashes. They can sometimes act, and their records matter for any later forfeiture.
4. Report it to your national agency and your financial regulator. See where to report. Regulator reports are what populate the warning lists that protect the next person.
5. Preserve everything: the platform URL, screenshots of the balance, the app installer, wallet addresses, transaction hashes, the chat history and the introducer’s profile.
6. Tell someone. Secrecy is a load-bearing part of this scheme and it does not end when the money does.
7. Expect a recovery approach and refuse it. Civil forfeiture does occasionally return funds — as in the Tether case below — but it happens through prosecutors, never through someone who emails you.

Where the money goes

The route is short and very fast. A deposit typically leaves the victim’s bank, buys cryptocurrency at a genuine retail exchange in the victim’s own name, and is withdrawn to an address the operation controls — often within the same day.

From there it splits across wallets, hops between chains and tokens, and reaches over-the-counter brokers who exchange it for local currency outside any venue that would ask questions. The UN’s 2026 report describes the standard chain: mule bank accounts, conversion to virtual currency, movement through wallets, laundering by OTC brokers, then reintroduction into formal banking.

The detail that the Prince Group forfeiture makes concrete is how much of it simply stays in crypto. Roughly 127,271 bitcoin sat in unhosted wallets — never handed to a custodian who could be subpoenaed, and never converted into something harder to seize. That is why the forfeiture was possible at all, and it is the closest thing to good news in this category.

By the numbers

No agency publishes a line item for most of the schemes on this site, so these charts show the official categories that contain this scheme. Each series is labelled with the agency's own category name. See how the mapping works.