Ask someone how it started and the answer is almost never "I saw an advert". It was a comment under a video that seemed unusually sensible. A group a colleague was already in. A message from someone whose profile showed two mutual contacts and eleven years of ordinary holiday photographs. Nothing was being sold at that point, which is precisely why it worked.
The opening is designed to be unremarkable
Every part of the first fortnight is built to feel like normal online life. Someone mentions their own results without pushing. A sceptic in the group asks the question you were thinking and gets a patient, technical answer. Somebody complains about a withdrawal taking three days and is politely corrected by another member. The conversation performs its own credibility.
Clients often tell us they were "not the type to fall for anything", and they are usually right. That is why the approach never begins anywhere near a payment: someone alert to a sales pitch is not alert to a group chat.
Where these conversations now start
In the files that reach us, the entry points cluster into a short list:
- Comment sections under financial or news videos, where a helpful reply leads to a private message
- Group chats on WhatsApp or Telegram, joined through an invite rather than found
- Professional networks, where a profile with a plausible employment history opens with a question rather than an offer
- Short-video platforms, where a clip about someone's results ends with an invitation to a group
- Advertising that borrows a broadcaster's name, a public figure's face, or a familiar bank's typeface
What these share is that you arrive by invitation and feel like you found it yourself. That feeling is the product.
The small deposit is not about the money
When a first amount is finally mentioned, it is modest, and the platform around it behaves impeccably: registration works, identity verification is requested the way a real firm would request it, and a small withdrawal is sometimes honoured. People later describe that withdrawal as the moment they stopped worrying.
Its purpose is not the deposit. It converts an unknown website into something you have personally tested, and everything afterwards is measured against that memory rather than against the evidence in front of you.
What is checkable at the time
Very little of this requires expertise. Before any money leaves, a few things are visible and cost nothing to look at:
- The name of the legal entity behind the site, and whether it appears on the public register of the regulator it claims to answer to
- Whether that register entry matches the company actually receiving your transfer, rather than a similarly named firm in another country
- Where the money is being sent — a licensed payment provider, a private account, or a wallet address given over chat
- How the person on the other end reacts to being asked those questions
The last one carries the most weight. A regulated firm is indifferent to being checked. An operation that answers a question about registration with warmth, urgency, or a closing-soon argument has already told you what it is.
If this describes a conversation you are having now
Then the most useful thing you can do is nothing at all for one day: make no further transfer while you check the entity name against the register. Nothing legitimate expires overnight, whatever the person on the other end says about the window closing.
And if the transfers have already gone out, the same material that would have answered your questions then is what a case is built from now — the statements, the screens, the messages, and the order in which they happened. Keep them somewhere you can find them, and write to us with what you have.