Investment Scam Victims: What to Do After Discovering the Fraud

Discovering that an investment may be fraudulent can happen suddenly.

A withdrawal is refused. The trading platform stops responding. An adviser demands another payment for tax or account verification. A bank raises concerns about the beneficiary. The website disappears. Or an independent search reveals that the company, investment licence or person you trusted is not what they claimed to be.

What happens next matters.

Investment fraud frequently involves money moving rapidly through bank accounts, companies, payment services or cryptocurrency wallets. Websites and communication accounts can disappear, and victims who have already lost money are often targeted again by criminals claiming they can recover it.

The immediate priorities are to stop further losses, preserve the evidence, secure your financial and digital accounts, identify the transaction pathway and report the fraud through the appropriate channels.

Stop Sending Money

Do not send further money to the investment platform, adviser or anyone associated with the suspected scheme.

Fraudulent investment platforms commonly tell victims that existing funds cannot be withdrawn until an additional payment is made.

The payment may be described as:

• tax;
• withdrawal fees;
• account verification;
• insurance;
• liquidity requirements;
• anti-money-laundering clearance;
• security deposits; or
• regulatory charges.

Do not assume that paying the requested amount will release your investment.

Scamwatch advises victims to stop sending money and contact their bank or card provider immediately if they believe they have been scammed.

If cryptocurrency was involved, the same principle applies. The FBI specifically advises cryptocurrency investment-fraud victims to stop sending money to the suspected criminals.

Contact Your Bank or Financial Institution Immediately

Contact the bank, card provider or payment service used for the transaction as soon as the fraud is identified.

Explain clearly that you believe the payment was made as a result of investment fraud.

Provide:

• transaction dates;
• amounts;
• beneficiary names;
• account numbers;
• payment references;
• relevant communications; and
• any information showing how the payment was induced.

Ask the financial institution what immediate action is available in relation to the transaction.

Depending on the circumstances, this can include attempts to stop, recall or trace a payment, contacting the receiving institution or placing appropriate alerts on your account.

Do not delay contacting the bank while waiting for a private investigation to begin.

The opportunity for a financial institution to intervene can change rapidly once funds have moved from the original recipient account.

If Cryptocurrency Was Used, Contact the Exchange

If you purchased cryptocurrency through an exchange before transferring it to the suspected fraudster, preserve the complete exchange transaction history.

Record:

• the exchange used;
• cryptocurrency purchased;
• date and time;
• amount;
• originating wallet;
• destination wallet;
• transaction hash or transaction ID; and
• any subsequent wallet addresses supplied by the fraudster.

Contact the cryptocurrency exchange through its official support channel and advise that the transaction relates to suspected fraud.

Do not rely on telephone numbers or links supplied by the person who introduced you to the investment.

The FBI identifies cryptocurrency addresses, transaction hashes, dates, amounts and exchange information as particularly important evidence in cryptocurrency investment-fraud investigations.

Preserve the Evidence Before Accounts or Websites Disappear

Do not begin deleting conversations, applications or accounts simply because you no longer wish to communicate with the fraudsters.

Preserve the evidence first.

Investment fraud investigations frequently rely on information contained across several different sources.

Retain:

• bank statements;
• transfer receipts;
• beneficiary account details;
• cryptocurrency wallet addresses;
• transaction hashes;
• cryptocurrency exchange records;
• emails;
• WhatsApp, Telegram, Signal or other messages;
• SMS messages;
• telephone numbers;
• usernames;
• social-media profiles;
• website addresses;
• trading-platform URLs;
• screenshots of account balances;
• withdrawal requests;
• investment contracts;
• invoices;
• supposed licences or certificates;
• identity documents supplied by the fraudsters;
• photographs;
• voice messages;
• advertisements; and
• correspondence regarding additional fees or taxes.

Where possible, retain the original electronic material rather than screenshots alone.

An email, for example, can contain technical information that is not visible in a screenshot. A blockchain transaction hash provides more useful investigative information than an image showing only the amount transferred.

Create a Chronology of What Happened

Write down the events while they are still fresh.

Start with the first contact and work forward.

Record:

• how you first encountered the investment;
• the date of first contact;
• names used by the people involved;
• telephone numbers and email addresses;
• how the investment was explained;
• when each transfer was made;
• where each payment was sent;
• what you were shown on the trading platform;
• any withdrawals that were permitted;
• when you first experienced difficulty withdrawing money;
• additional payments requested; and
• when you concluded that the investment was fraudulent.

This chronology becomes particularly valuable where the fraud occurred over several months and involved hundreds or thousands of messages.

It can also help establish the relationship between representations made by the fraudsters and each financial transfer.

Secure Your Email, Banking and Online Accounts

If you provided passwords, identity documents, banking information or remote access to your computer or telephone, the fraud may extend beyond the money already transferred.

Change passwords for relevant accounts.

Start with:

• email;
• online banking;
• cryptocurrency exchanges;
• cloud storage;
• social media; and
• financial applications.

Use unique passwords and enable multi-factor authentication where available.

If the fraudsters instructed you to install remote-access software, review the affected device and remove unauthorised access.

Scamwatch specifically recommends changing passwords and security details where they may have been compromised.

Where identity documents have been exposed, additional identity-protection measures may also be required.

Do Not Destroy Access to the Fraudulent Platform Too Early

There is a difference between stopping contact and destroying evidence.

Do not send more money or continue relying on the fraudster’s advice.

However, before deleting an application or closing an account, preserve any information still available through the platform.

Record:

• displayed account balances;
• claimed trading history;
• account numbers;
• transaction records;
• deposit instructions;
• withdrawal messages;
• names of supposed advisers;
• company details;
• wallet addresses; and
• support communications.

The figures displayed on the platform may be fabricated, but the information surrounding them can still provide investigative leads.

Report the Fraud

Victims should consider reporting the matter to the relevant authorities in their jurisdiction.

For Australian victims, Scamwatch accepts scam reports through the National Anti-Scam Centre. Scamwatch reports assist authorities with identifying patterns and emerging scams, but a Scamwatch submission itself is not an official police report. Cybercrime involving financial loss can also be reported through the Australian police cybercrime reporting process.

United States victims can report internet and cryptocurrency investment fraud through the FBI’s Internet Crime Complaint Center, IC3. The FBI asks victims to provide as much transaction information as possible, including bank details, cryptocurrency addresses and transaction hashes.

Other countries operate their own police, cybercrime, financial-regulatory and fraud-reporting systems.

Keep copies of any reference numbers generated by those reports.

Establish Where the Money Actually Went

Once the immediate protective steps have been taken, the next issue is understanding the financial trail.

The name of the fraudulent investment platform is not necessarily the name of the organisation that received the money.

Funds may have been transferred through:

• bank accounts in unrelated company names;
• payment processors;
• money-mule accounts;
• cryptocurrency exchanges;
• digital wallets;
• intermediary companies; or
• accounts in multiple jurisdictions.

The recipient of the first payment may also be different from the people controlling the fraudulent platform.

This distinction matters.

A professional fraud investigation should separate the fraudulent representations, financial transactions, corporate entities, digital infrastructure and individuals involved, then examine how they connect.

Bank Transfers Can Provide Investigative Leads

A bank transfer can contain more information than the victim initially realises.

Relevant information can include:

• beneficiary account name;
• beneficiary bank;
• account number;
• SWIFT or BIC information;
• payment references;
• intermediary banking information;
• currency;
• dates; and
• transaction identifiers.

Where multiple transfers were made, analysing them together can reveal changing recipient accounts, repeated entities or particular jurisdictions used by the scheme.

Where funds have moved through multiple accounts, companies or financial services, an asset tracing investigation may assist in establishing the wider financial pathway.

The fact that funds were transferred overseas does not automatically mean they cannot be investigated.

It does, however, make the matter more dependent on the laws, disclosure mechanisms and financial institutions within the relevant jurisdictions.

Cryptocurrency Transactions Can Often Be Traced

Cryptocurrency fraud creates different investigative challenges.

A blockchain transaction can remain publicly visible even after the fraudulent website or person who arranged the transaction disappears.

Investigators can potentially reconstruct movements between wallets and identify interaction with exchanges or other cryptocurrency services.

Relevant evidence includes:

• wallet addresses;
• transaction hashes;
• blockchain used;
• cryptocurrency type;
• transaction value;
• transaction date and time; and
• exchanges involved.

Tracing cryptocurrency does not mean the cryptocurrency has been recovered.

The purpose of tracing is to identify where the digital assets moved and whether the transaction pathway creates further investigative or legal options.

Where digital assets form a significant part of the matter, a dedicated cryptocurrency fraud investigation may be appropriate.

Investigate the Companies and People Behind the Scheme

Fraudulent investment schemes can use legitimate companies, newly established companies, shell entities, cloned businesses or entirely fabricated corporate identities.

Corporate enquiries may identify:

• directors;
• shareholders;
• beneficial owners where available;
• registered addresses;
• incorporation dates;
• associated companies;
• previous company names;
• common officers; and
• relevant jurisdictions.

These findings need to be treated carefully.

The appearance of a person’s name as a company director does not by itself prove participation in fraud.

Similarly, a legitimate company’s identity may have been cloned without the knowledge of its genuine owners.

A proper investigation distinguishes confirmed evidence from assumptions.

Examine the Digital Infrastructure

The fraudulent website is another source of evidence.

Relevant investigation can include:

• domain-registration history;
• website creation dates;
• archived versions of the site;
• associated domains;
• email infrastructure;
• hosting information;
• telephone numbers;
• online advertisements;
• social-media profiles;
• usernames; and
• connections with other fraudulent platforms.

Organised fraud networks frequently replace websites while continuing to use related infrastructure, companies, contact information or financial pathways.

Looking at the broader digital footprint can therefore reveal connections not apparent from the investment platform alone.

Be Extremely Cautious About Recovery Services

One of the greatest risks after discovering an investment scam is being defrauded again.

Scamwatch warns that people who have lost money are frequently targeted by follow-up scams, particularly people offering to help recover the original funds. Scamwatch states that around one in three scam victims is scammed more than once.

Recovery scammers can claim to be:

• lawyers;
• investigators;
• government agencies;
• cryptocurrency specialists;
• regulators;
• financial institutions; or
• representatives of supposed compensation programs.

They may already know details of your original loss.

That knowledge does not prove they are legitimate.

The US Federal Trade Commission warns that victim information can be circulated between criminals, allowing recovery scammers to approach victims with convincing details about the previous fraud.

Particular caution should be exercised where someone contacts you unexpectedly and claims:

• your money has already been recovered;
• cryptocurrency has been found in a wallet in your name;
• a government agency is holding your funds;
• tax must be paid before money can be released;
• cryptocurrency must be sent to activate recovery;
• an upfront payment guarantees recovery; or
• they require remote access to your computer or telephone.

No legitimate investigation can guarantee that funds will be recovered.

Can Money Lost to an Investment Scam Be Recovered?

There is no single answer.

The prospects depend on the facts of the individual matter.

Relevant factors can include:

• how the funds were transferred;
• how quickly the fraud was identified;
• where the money went;
• whether recipient accounts can be identified;
• whether cryptocurrency was used;
• whether assets remain identifiable;
• the jurisdictions involved;
• the availability of legal processes;
• cooperation from financial institutions or exchanges; and
• the quality of the available evidence.

Some investigations identify accounts, companies, individuals or assets that create practical options for further action.

Other investigations establish the financial trail but identify substantial jurisdictional, evidential or legal barriers.

That is why investigation should come before promises of recovery.

What Should an Investment Scam Victim Do First?

The immediate priorities can be summarised simply:

1. Stop making further payments.
2. Contact your bank, card provider or cryptocurrency exchange.
3. Preserve all financial and digital evidence.
4. Secure affected accounts and devices.
5. Create a chronology of the fraud and payments.
6. Report the matter through the appropriate official channels.
7. Establish where the funds were transferred.
8. Be cautious of unsolicited recovery offers.
9. Consider professional investigation where the financial loss and available evidence justify it.

Speed matters, but decisions should still be evidence-based.

Victims should avoid being pressured into immediately paying another party simply because that person claims to know how to recover the money.

Investment Fraud Investigation

Global Anti-Scam Centre conducts investment fraud investigations, cryptocurrency fraud investigations and other forms of cyber-enabled financial crime.

Our investigations can include financial transaction tracing, cryptocurrency and blockchain analysis, corporate intelligence, digital investigation and cross-border enquiries to identify relevant individuals, entities, accounts and transaction pathways.

Each matter is assessed according to the available evidence, financial loss, transaction history and jurisdictions involved.

If you believe you have transferred funds to a fraudulent investment or trading platform, preserve your transaction records and communications and request a confidential assessment of the matter.