Profits may be displayed on the screen of the investment platform, a personal manager may promote of a profitable trade, and the balance can grow in your personal account. The problem becomes obvious when trying to withdraw funds: the withdrawal request is cancelled, the account is supposedly under review, and the client is required to pay a tax, commission, insurance premium or deposit to “unblock” the account.
This is how fake investment platforms and fraudulent brokers often work. They can simulate trading in stocks, cryptocurrency, gold, currency pairs or other assets, although the balance shown in the account does not always correspond to real funds. The victim’s money may be sent directly to bank accounts, cards, cryptocurrency addresses or exchange services controlled by the organizers of the scheme.
Refunds are sometimes possible, but they depend on the payment method, speed of action, route of assets, jurisdiction and the ability to identify the services through which the money passed. If the platform does not allow you to withdraw funds, the worst solution is to continue transfers in the hope of “closing the last commission.” First, you need to pause payments, preserve evidence and professionally trace the route of the funds.
Important: the real balance that can be withdrawn and the numbers in the personal account of the fraudulent site are not the same thing. Before paying any "tax" or "security deposit", it is necessary to check whether the assets claimed exist and where the advance payments actually went.
How fake investment platforms work and why they don’t withdraw money
Investment fraud rarely begins with a direct request to transfer a large sum. Usually, a person is gradually convinced of the platform’s reliability: they are shown a professional website, fictitious licenses, reviews, charts and successful transactions. Communication is carried out by an analyst, broker or personal manager who constantly stays in touch and explains every action.
How a person is attracted to fake investments
The first contact can take place through advertising on social networks, a Telegram channel, an investment group, a dating site, a phone call or a message from a financial advisor. A prospective client is offered a free consultation, a test account or an initial investment of a small amount.
To overcome scepticism, a manager can:
- use professional financial and cryptocurrency terminology;
- display credentials, certificates or licenses, the authenticity of which is difficult to verify without separate analysis;
- send links to positive reviews and publications created by the organisers themselves;
- show profitable trades in your personal account;
- allow you to withdraw a small amount to convince a person to deposit much more;
- create a sense of urgency: “the market is growing”, “a place in the group is closing”, “the opportunity is available today only".
After the first deposit, the amount on the screen often grows quickly. The manager explains this as successful trading and offers to increase the investment, apply for leverage, activate the VIP level or take part in a exclusive deal. At the same time, the client usually does not receive real evidence of acquiring assets or performing exchange transactions.
False profits and a balance that doesn't exist
The numbers in the account may be ordinary entries in the database of a fraudulent site. Organizers control the interface and can arbitrarily change the balance, profitability, transaction history and withdrawal request status. A beautiful chart in itself does not confirm that positions were opened or assets were purchased on the client’s behalf.
In cryptocurrency schemes, this is verified by matching information from the platform with blockchain data. If a person is told that they have purchased USDT, BTC or other assets, they need to establish wallet addresses, transaction hashes and the actual movement of funds. The absence of such data or constant refusal to provide it is a serious warning sign. See alsohow to check a transaction by TxID.
Why may you be allowed to withdraw a small amount first?
A successful test withdrawal does not prove the reliability of the platform. A small amount can be returned from the funds of other victims or from the same client deposit. The purpose of such a payment is to build trust and create the impression that the system supposedly works.
After this, the person is asked to deposit a large amount. When the person tries to withdraw the main deposit or the shown profit, new conditions appear: complete the check, achieve the required turnover, repay the loan, pay a fee or make a matching deposit.
"Tax", "insurance" and "commission" before withdrawal
One of the most common signs of fraud is a requirement to first transfer additional money in order to receive an existing balance. The payment may be called:
- tax on income or cryptocurrency;
- withdrawal fee or international transfer;
- insurance or guarantee fee;
- deposit to confirm liquidity;
- paid AML, KYC or financial verification;
- payment for conversion, gas or wallet activation;
- penalty for early closure of an investment account.
It is especially dangerous if money is asked to be transferred to an individual’s card, a new cryptocurrency address, or the account of a company not specified in the agreement. The legitimate fee must be provided for by the rules of the service and, of course, calculated. Tax obligations depend on the legislation of the relevant country, but the requirement to send “tax” to a manager or an unrelated cryptocurrency wallet does not confirm a legal procedure.
Signs that an investment platform may be fraudulent
- Guaranteed or disproportionately high profits. Any investment involves risk, so the promise of a stable income without possible losses should be treated with scepticism.
- Pressure to deposit funds immediately. The client is not given time to check the company, read the contract or get independent advice.
- It is impossible to verify the legal entity. The site does not have the full company name, registration number, address and valid license or this data belongs to another organization.
- The domain does not correspond to the stated history. The company talks about many years of experience, although its website was created recently or has changed its address several times.
- For deposits, new details are constantly provided. Payments go to different individuals, exchangers or cryptocurrency addresses without a clear connection with the company.
- The manager requires installing a remote access program. With help he can see bank data and gain access to the device or manage the transfer.
- Withdrawal depends on a new payment. After each payment there is another commission, check or requirement.
- No verifiable transactions. The platform claims to trade cryptocurrency, but does not provide addresses, TxID and other blockchain-compatible data.
A separate sign is a discrepancy between the name of the platform, the recipient of the payment and the website address. Fraudsters can copy the design of a well-known company, changing one letter in the domain, or illegally use the details of a genuinely registered legal entity. Therefore, it is necessary to check not a single document, but the entire set of identifying details.
Get a consultation
A quick case assessment — no obligation
Is it possible to get money back after investment fraud?
There is no definite answer without analyzing the specific situation. The refund does not depend on the amount reflected in the account, but on the actual payments made and the further movement of funds. First you need to establish exactly how much was transferred, in what way, to whom and through what services.
To do this, they create a chronology of events: from the first contact with the manager to the last transaction. Bank statements, receipts, cryptocurrency addresses, TxID, correspondence, call records, domains, application names and recipient details are added to it. It is this data that allows us to determine possible response options.
If the money was paid by bank card
You should contact your bank as soon as possible to report the fraud, review recent transactions, and request available procedures for disputing the payment. The possibility of a refund will depend on the type of transaction, the method of confirmation, the rules of the payment system, the timing of the application and evidence.
Chargeback is not a blanket guarantee. If the cardholder himself confirmed the payment, the bank may not consider the transaction unauthorized. However, this does not mean that it is pointless to apply: it is important to correctly describe the circumstances, preserve the advertising claims and prove that the service was fictitious or significantly different from the declared one.
If the money was transferred to a bank account
In the case of a bank transfer, you must notify your bank and law enforcement immediately. The sender's bank may attempt to contact the recipient's bank, but the ability to stop or return depends on whether funds remain in the account and what legal grounds exist for restricting transactions.
Full payment details, payment reference, account number, recipient's name and documents on the basis of which the transfer was made will be useful. If there were several payments, then they need to be described in a single chronology, and not as isolated transactions.
If investments were transferred to cryptocurrency
Once a blockchain transaction has been confirmed, it usually cannot be simply reversed. At the same time, cryptocurrency movements can leave a public digital footprint. Using transaction addresses and hashes, you can determine the route of assets, consolidation with other funds, exchange of tokens, cross-chain movement and possible entry into a centralized exchange or other service.
Professional on-chain analysis may include:
- verification of each initial transaction of the victim;
- construction of a graph of the movement of digital assets;
- determination of intermediate and consolidation addresses;
- analysis of token exchange through DEX, swap services and cross-chain bridges;
- identification of centralized exchanges, exchangers, payment providers and other VASP;
- AML assessment of addresses and related risks;
- research of sources and further use of funds - Source of Funds and Use of Funds;
- formation of analytical materials for subsequent legal and procedural actions.
If assets end up on a service that identifies users, there may be a practical point of intervention. However, an analyst or lawyer cannot independently seize or debit funds from someone else's account. Restriction of assets is carried out by the service itself in accordance with its rules or on the basis of a proper request from the competent authority. Therefore, speed of analysis and properly prepared materials are essential. Useful materials:AML-check USDT,Source of Funds,a blocked exchange account.
What determines the real possibility of a return?
- Response time. The longer funds travel between addresses and services, the more difficult it is to apply available measures in a timely manner.
- Payment method. Bank card, account transfer, P2P transaction and cryptocurrency transaction require different procedures.
- Current location of the assets. The presence of funds on a centralized service may create a different situation than their further movement across non-custodial addresses.
- Quality of evidence. TxID, statements and complete correspondence have much greater evidentiary value than a separate screenshot of the balance.
- Jurisdiction. The company, bank, exchange, victim and organizers of the scheme may be located in different countries.
- Interaction between services and law enforcement authorities. Requests must be addressed to the correct recipients and contain technically accurate data.
That is why it is correct to talk not about a “guaranteed return”, but about assessing the prospects after documenting payments and tracking funds. Some cases reveal services that can be contacted for data retention or asset restrictions. In others, the analysis confirms that the profit shown on the site was fictitious, and the actual subject of the investigation is only the funds actually transferred.
What to do if the investment platform requires a new payment
If another payment is required before withdrawal, do not act under pressure from the manager. Phrases such as “this is the last fee”, “the funds will arrive automatically after payment” or “otherwise the account will be cancelled” are often used to extract more money from the victim.
1. Stop all subsequent transfers
Do not pay any new tax, insurance, fee, liquidity deposit or release fee until an independent audit confirms the claim is legitimate. Do not lend money to complete the procedure or accept a “temporary loan” from the platform: this may result in new payments.
2. Save evidence for the account becomes inaccessible
Download or preserve:
- full correspondence with managers and support service;
- phone numbers, email addresses, Telegram accounts and other identifiers;
- website address, login page and personal account;
- video recording of the screen with balance, transaction history and rejected withdrawal requests;
- contracts, questionnaires, certificates, licenses and payment instructions;
- bank statements, receipts and recipient details;
- blockchain name, sender and recipient addresses, token, amount and TxID of each cryptocurrency transaction;
- links to advertising, profiles and groups through which the first contact took place;
- application files that the platform offered to install without launching them again.
Don't limit yourself to screenshots with cropped edges. Materials must display dates, addresses, account names, and the context of messages. It is advisable to save the original files without editing.
3. Protect your bank and cryptocurrency accounts
If a platform representative accessed your computer or phone through AnyDesk, TeamViewer or another application, stop the remote connection and do not log into financial accounts from this device until the device has been checked. Change passwords from another trusted device, end active sessions, and check your two-factor authentication settings.
If the seed phrase, private key, or backup copy of a wallet is shared with third parties, the wallet should be considered compromised. Further actions with assets should be planned carefully so as not to inform attackers about the preparation and not to lose the remaining funds. The support team of a legitimate service should not ask for a seed phrase or private key. See alsowhat to do if funds are “locked” in Trust Wallet.
4. Establish the actual route of funds
You should separate information from your personal account and real payments. For banking transactions, statements and recipients are analyzed. For cryptocurrency – blockchain, addresses and TxID. If USDT was first purchased on an exchange and then sent to a “broker,” both steps are important: documentation of the origin of the assets and the subsequent route after the transfer.
On-chain analysis should be carried out before bulk submission of incomplete requests. Properly defined end services, networks, tokens and transactions help generate a specific request rather than a general notification of loss of funds.
5. Contact the bank, services and law enforcement agencies
If a card or bank account was used, please report immediately. If a cryptocurrency transfer has taken place, based on the results of the initial analysis, requests to identified exchanges, exchangers and other services can be prepared. At the same time, the circumstances of fraud should be recorded when contacting law enforcement agencies and structured data on all payments should be added.
The mere fact of filing an application does not replace a technical analysis, and a private report does not replace a procedural decision of the competent authority. The best results come from coordinated work: preservation of digital evidence, blockchain analytics, legal assessment and timely communication with institutions through which the funds passed.
6. Beware of repeat “refund” scams
After losing money, the victim may be contacted by “lawyers”, “regulators”, “detectives” or “exchange representatives” who have allegedly already found the assets. Next, they show a fake document or AML report and demand an advance payment for unlocking, tax, gas, or opening a special wallet.
A professional service provider should explain the work methodology, the limits of his powers and the result of each stage. Promises themselves cannot confirm that funds have been found. Check the legal entity, authority of specialists, contract, domain, corporate contacts and content of future work. Do not share your seed phrase or private keys with anyone.
Fake investment platforms
The platform will not release funds or requires a tax, commission or insurance payment?
Stop making further transfers and contact ProDefence. We will restore the chronology of payments, check the domain and details, conduct on-chain analysis and determine realistic response points without access to the seed phrase and without unreasonable guarantees of return.
Prepare website, correspondence, receipts, wallet addresses and TxID.
