Investment scams persist because professional-looking websites, impersonated identities, social-media advertising and staged account balances can manufacture credibility quickly. The useful question is not why victims “fell for it,” but which trust signals were fabricated, how money moved and where independent verification would have exposed the scheme.
Preserve the original approach
Save the advertisement, profile, group-chat invitation, phone number, email, domain, app listing and every message in original form. Record the date, platform and account identifiers. Screenshots help, but exports, headers and transaction records preserve stronger evidence. Do not alert suspected operators before volatile material has been secured.
Identify the exact offer
Separate shares, bonds, funds, foreign exchange, contracts for difference, cryptoassets, staking and managed-account claims. Record promised returns, risk statements, withdrawal conditions and who supposedly holds the assets. A high-risk investment may be genuine and a modest-looking return may still be fraudulent.
Verify the firm and individual independently
Search the relevant regulator’s register using the legal name, registration number, domain and telephone number. Contact the firm through details obtained independently, because clone firms copy genuine credentials. The UK Financial Conduct Authority’s online-trading scam guidance highlights fake endorsements, professional-looking platforms, initial apparent returns and later withdrawal failure.
Test whether the asset and trading exist
Request offering documents, custody records, trade confirmations and independently verifiable account statements. For securities, inspect issuer filings and exchange data. For cryptoassets, verify contract addresses, wallet control and transactions on the relevant chain. A number displayed inside an operator-controlled dashboard does not prove that funds were invested.
Trace every payment
Build a ledger of deposits, beneficiaries, intermediary accounts, wallets, fees, refunds and withdrawal demands. Preserve bank references and exchange records. Unexpected “tax,” “insurance” or “unlock” fees after a withdrawal request can indicate advance-fee fraud. Apply the same financial-tracing discipline used in investigations of cryptocurrency laundering networks.
Examine the manufactured trust
Check whether testimonials, news articles, awards, regulator seals, celebrity endorsements and staff photographs are authentic. Reverse-search images, inspect domain history and compare contact details across sites. Social proof inside a private chat may be coordinated. In a 2025 case, the US Securities and Exchange Commission alleged that investment clubs used social media and group chats to steer investors to fake trading platforms; the allegations remain subject to court determination.
Separate warning signs from findings
Pressure, secrecy, guaranteed returns, unusual payment routes and failed withdrawals justify scrutiny, but each allegation needs supporting evidence. Compare the facts with relevant regulatory action using the outcome-based method in our regulatory-action assessment guide.
Malta News Online’s report on crypto impersonation warnings in Malta illustrates how genuine regulatory language and copied identities can be misused. Verify the underlying warning through the regulator before relying on any secondary account.
Create a defensible case file
List each representation, the person who made it, evidence that it was true or false, the money connected to it and the response received. Distinguish confirmed facts, regulator allegations and unresolved inferences. Victims should contact their bank or payment provider promptly and report through the appropriate financial regulator and law-enforcement channel.