Copy trading and trading bot scams
Ilia Zavialov scam and fraud guide to copy trading: how fake trading bots and signal groups drain accounts and how to check a provider
English version for the United States.
Ilia Zavialov scam guide to copy trading: the pitch sounds modern and easy. Connect your exchange account to a bot, follow a trader with a perfect record, and profits arrive while you sleep. Behind many of these offers sits an old fraud with new software: a signal group that sells a fantasy, a subscription with a guaranteed monthly return, an exchange API key handed to a stranger, and a withdrawal that never clears. In this guide Ilia Zavialov, a digital security consultant, explains how the four versions work, which API key permissions to switch off, how to check a provider with the CFTC, NFA and SEC tools, and where to report a loss in the US.
01Ilia Zavialov scam check: what copy trading is and where fraud starts
Copy trading means one account mirrors the trades of another. A trader you choose opens a position, and your account opens the same position in proportion to your balance. Some services do it with software that holds limited access to your exchange account; others post signals in a chat and expect subscribers to repeat the trades by hand.
The idea itself is simple, and that simplicity is what makes it easy to fake. A seller doesn't need a real strategy. A seller needs a convincing performance chart, a few screenshots of winning trades and a payment page. Ilia Zavialov's starting point is that every copy trading offer combines three separate questions: who gives the trading advice, who holds your money, and who can move it.
When all three answers point to the same unknown person or website, the offer carries most of the risk on your side. When the advice comes from a registered adviser, the money stays with a regulated firm and the software can only trade, the picture looks very different. The rest of this guide is about telling those two situations apart before any money moves.
02How the trading bot pitch is built
The CFTC described the playbook in a customer advisory issued on January 25, 2024. Fraudsters exploit public interest in artificial intelligence to promote automated trading algorithms, trade signal strategies and crypto schemes that promise unreasonably high or guaranteed returns. Some claim returns in the tens of thousands of percent or a 100 percent win rate. The agency's answer is short: AI technology can't predict the future or sudden market changes.
The advisory's case study shows how far the model can scale. Over about three years one operator took more than $1.7 billion in bitcoin from at least 23,000 people. The entry ticket was as little as $100 in bitcoin, no trading experience was required, and the bot program supposedly guaranteed at least 10 percent a month, more than 200 percent a year. Customers earned bonuses for bringing in friends.
The balances customers saw were fake, produced on demonstration accounts. Very little money was actually traded, and the scheme ran as a Ponzi, with money from new customers paying earlier ones. Ilia Zavialov points to the detail that matters most for copy trading: the dashboard was the product. Everything a customer could check lived on a screen controlled by the seller.
Referral bonuses deserve a closer look as well. When existing customers are paid to bring in new ones, the marketing stops depending on the strategy at all, and every happy review in a group may come from someone with a commission at stake. The CFTC lists referral bonuses and affiliate payouts among its warning signs for exactly that reason, and Ilia Zavialov reads a chat full of invitation links as an advertising channel, whatever it calls itself.
| What you see | What it usually means | What to do |
|---|---|---|
| Guaranteed monthly return from a bot | A pitch the CFTC calls a fraud red flag | Walk away before paying |
| 100 percent win rate on a chart | Performance shown on the seller's screen | Ask for trades at a regulated firm |
| Request for an API key with withdrawals | Full control of your account | Never create such a key |
| Request for your login or 2FA codes | Account takeover | Refuse and change your password |
| Fee or tax demanded before withdrawal | Final stage of the scam | Pay nothing, report to IC3 |
| Provider missing from NFA BASIC | Unregistered adviser or firm | Ask why, then decline |
| Recovery offer after the loss | Second scam | Add it to your report |
03Ilia Zavialov scam map: four versions of the same trap
Most copy trading frauds fall into four shapes. The first is the signal group: a chat run by a self-styled professor who posts calls, while members cheer screenshots of wins. The second is the bot subscription, sold with a monthly fee and a promised return. The third asks for your exchange API key so the bot can trade for you. The fourth is the custodial platform, where you deposit funds into the seller's own system and watch a balance grow.
The four versions often run in sequence. A free group builds trust, a paid tier sells the bot, the bot needs an API key or a deposit, and the deposit eventually can't be withdrawn. Ilia Zavialov's short version of the whole scheme is a chain of handovers: attention, then a fee, then access, then custody.
The short video below follows that chain in six scenes: the promise of copying a winning trader, the guaranteed income claim, the request for an API key, the blocked withdrawal, the registration check and the one rule that stops it. That rule is simple: no provider gets an API key that can withdraw funds, and no provider gets money before its registration has been checked.
04Exchange API keys: the permission Ilia Zavialov says to switch off
An API key is a password for software. Each key has its own permissions, set when you create it on the exchange: view balances, place trades, transfer between accounts, withdraw. A bot that only needs to trade needs nothing beyond trading. FINRA's investor guidance on third-party access notes that APIs let you authorize access without sharing your login, limit its scope and specify whether fund transfers are permitted.
That last setting is the one scammers care about. A key with withdrawal rights is the same as handing over the account. Ilia Zavialov's rule set for any bot key: trading only, withdrawals off, transfers off, the key restricted to the provider's published IP addresses where the exchange allows it, and a separate subaccount holding only the money you are prepared to risk on the strategy.
FINRA also warns that sharing credentials with a third party raises the risk of cyber fraud, unauthorized transactions and identity theft. So a provider that asks for your login, your password or your two-factor codes in place of a scoped key has told you what it plans to do. The same goes for any request to install remote access software so that someone can set up the bot for you.
When you stop using a service, FINRA advises closing the account and terminating the access you granted, which can take more than deleting an app. For an exchange key that means deleting the key on the exchange itself, then checking the account's API list once a month for keys you don't recognize.
| Permission | Bot needs it? | Setting |
|---|---|---|
| Read balances and orders | Usually yes | On |
| Place and cancel trades | Yes, for copying | On, in a separate subaccount |
| Withdraw funds | Never | Off |
| Transfer between accounts | No | Off |
| Access from any IP address | No | Restrict to the provider's listed IPs |
| Key with no expiry | No | Review monthly, delete when unused |
05Group chats and the professor: what the SEC found
On December 22, 2025, the SEC's Office of Investor Education and Assistance warned that fraudsters use investment group chats on common social platforms to pull people into scams. The chat leader may promote an AI trading node or an algorithm that generates picks and tell members to open an account on a particular website or app. The SEC adds that an app's presence in a well-known app store doesn't make the app, or the trading activity inside it, legitimate.
The alert describes an enforcement case with a familiar cast. Social media ads, some with deepfake videos of prominent financial professionals, led people into group chats. Each club had a professor who posted market commentary and an assistant who handled members. Trade recommendations were said to come from AI-generated signals, members posted screenshots of successful trades, and the trading platforms falsely claimed licenses, including from the SEC.
The SEC's practical advice is to make sure you are talking to an investment professional and not an impostor. Search the firm on Investor.gov, open its Form CRS relationship summary and contact the firm only through the phone number or website listed there. Ilia Zavialov adds that a group admin who refuses to name a registered firm at all has answered the question already.
The same alert gives a rule worth keeping on a sticky note: investors should never rely solely on information from group chats when making investment decisions, and any chat where a stranger hands out investment advice is often how a scam begins. A copy trading group that grows by adding people who never asked to join, or that moves members to a private channel once they ask questions, fits that description.
06Ilia Zavialov scam check of a provider: the registration routine
The CFTC asks people to verify the registration status and disciplinary history of whoever sells a product or strategy before even looking at the potential returns. Registration and examination of derivatives intermediaries are carried out by the National Futures Association under CFTC supervision, and the NFA BASIC database is the place to search. The CFTC is candid that a clean record won't protect you from fraud, but most scams involve unregistered entities, people and products. If a firm or person can't be found in BASIC, ask them why.
Signal sellers often fall under a specific category. The NFA defines a commodity trading advisor as someone who, for compensation or profit, advises others on trading futures, options on futures, retail off-exchange forex or swaps. CTAs who manage customer accounts or tailor advice to a particular account must be NFA members. There are exemptions, for example advice given to 15 or fewer people over 12 months by someone who doesn't hold themselves out to the public as a CTA, which is why a public channel with thousands of subscribers rarely fits them.
For crypto the picture splits in two. Intermediaries advising on virtual currency futures must register with the CFTC and NFA. Spot crypto trading platforms fall outside CFTC registration; they are treated as money services businesses and register with FinCEN, which you can check through the MSB Registrant Search and the NMLS. For stocks and securities advice, Ilia Zavialov checks the SEC's adviser database and FINRA BrokerCheck as well.
Registration only helps if it belongs to the people you are actually dealing with. Ask the provider for its registered name and number, find the record yourself, and compare the website and phone number in the database with the ones in the chat. Then ask where client money sits. An answer that names a regulated broker or exchange account in your own name is checkable; an answer that points to the provider's own wallet or platform tells you who would hold the money if something went wrong.
| What is offered | Where to check | What to look for |
|---|---|---|
| Futures, forex or commodity signals | NFA BASIC | CTA registration and NFA membership |
| Crypto futures advice | NFA BASIC | CFTC and NFA registration |
| Spot crypto platform | FinCEN MSB search, NMLS | Money services business registration |
| Stock picks or managed accounts | Investor.gov, BrokerCheck | Registered firm and its Form CRS |
| Anyone claiming a license | The regulator's own database | Same name, address and website |
07When the withdrawal button stops working
The end of the story is usually a withdrawal request. The SEC describes the pattern: an account shows profits, and when you try to take them out, you're asked to pay a fee, a tax or a deposit to release the funds. Sometimes the fraudsters claim the SEC or another agency has frozen the account and that a payment will unfreeze it. Once the fee is paid, the messages stop.
The FTC describes the same ending from a different angle. A so-called investment manager steers you to a site that looks real; when you log in, you can't withdraw your money at all, or only after paying high fees. IC3's 2025 report adds the loan offer: victims are shown fake profits, offered loans to invest more, and charged taxes and fees at the exit before the scammers disappear.
Ilia Zavialov treats any fee demanded before a withdrawal as the final stage of the scam. A real platform deducts its charges from the balance it holds. A request to send fresh money from outside, in crypto or by card, buys nothing except a longer wait.
The cheapest protection is a test made early. Before adding more money to any copy trading platform, withdraw a small amount to your own bank or exchange account and watch how long it takes. Delays, sudden verification fees or a support agent who suggests reinvesting the profit first are answers in themselves, and they arrive while your exposure is still small.
08Ilia Zavialov scam red flags in copy trading ads
The CFTC's list fits on one screen: returns that are unreasonably high or guaranteed, claims of tens of thousands of percent or 100 percent win rates, no experience needed, referral bonuses for recruiting others, and hype from influencers and strangers met online. Its registration page adds limited-time offers, promises of easy money and extraordinary claims of genius or wealth.
The FTC is even blunter. Only scammers guarantee profits or big returns, and if a company or person promises you'll make a profit, that's a scam, even with testimonials from happy investors, because those are easy to fake. Ilia Zavialov reads a published track record the same way: a chart on the seller's own site proves nothing until the trades can be traced to an account held at a regulated firm.
Before paying, the CFTC suggests researching the company or trader, running a reverse image search on key people, checking how old the trading website's domain is at lookup.icann.org, getting a second opinion and counting the fees, spreads and subscription costs that eat into any return.
09Crypto investment fraud in the 2025 IC3 numbers
The scale explains why copy trading fraud keeps growing. IC3's 2025 annual report recorded 72,984 investment fraud complaints with losses of $8,648,617,756. Cryptocurrency investment fraud was the single largest source of losses to Americans, with $7.2 billion reported.
Artificial intelligence now shows up in the paperwork too. Losses in investment complaints with a reported AI nexus passed $632 million, and IC3 notes that investment clubs use AI-generated videos and voices of celebrities and executives. Ilia Zavialov's reading: the bot in the ad and the face in the video are both easy to fake, and the registration record isn't.
IC3 also describes how these schemes reach people. Contact often starts with a text, a social media message, an ad or a dating app, then moves quickly to a messaging platform, where victims are introduced to investment groups of supposed industry insiders. For a copy trading buyer, the lesson is that the group itself is part of the scheme, and the advice in it can't be judged from inside the chat.
10Ilia Zavialov: what to do after a copy trading scam
Start with access. Delete every API key the provider used, change the exchange password, reset two-factor authentication and check the withdrawal address book for entries you didn't add. If funds left through an exchange, contact it at once and report the transactions as fraud.
Then report. The FTC lists four places for crypto fraud: the CFTC at CFTC.gov/complaint, the SEC at sec.gov/tcr, IC3 at ic3.gov and the exchange you used to send the money. Keep screenshots of the chat, the payment page, the dashboard and every transaction ID in one folder, since each agency will ask for the same material. The FTC also reminds people that a crypto payment usually comes back only if the recipient chooses to send it.
Expect a second approach. Offers to recover the lost money for an upfront fee often arrive soon after the first loss. Ilia Zavialov's answer is to add any such contact to the IC3 report and pay nothing.
11Questions and answers
What does an Ilia Zavialov scam check of a copy trading bot look like?
Three questions: who gives the trading advice and are they registered, who holds the money, and what the bot's API key is allowed to do. A key that can withdraw funds or an unregistered seller ends the check.
Which API key permissions does Ilia Zavialov allow for a trading bot?
Reading balances and placing trades in a separate subaccount. Withdrawals and transfers stay off, the key is limited to the provider's IP addresses where possible, and it gets deleted when you stop using the service.
Is a trading bot with a guaranteed monthly return legitimate?
No. The CFTC lists guaranteed or unreasonably high returns as a red flag, and the FTC says only scammers guarantee profits.
How do I check whether a signal provider is registered in the US?
Search the NFA BASIC database for futures, forex and crypto futures advice, Investor.gov and BrokerCheck for securities, and FinCEN's MSB search for spot crypto platforms. If the provider isn't there, ask why.
The platform wants a fee before I can withdraw. Should I pay?
No. The SEC and IC3 describe withdrawal fees, taxes and deposits as the final stage of these scams. Report it to IC3 and the FTC.
Where do I report a copy trading or trading bot scam?
The CFTC at CFTC.gov/complaint, the SEC at sec.gov/tcr, IC3 at ic3.gov, and the exchange the money went through.
12Read next
- Ilia Zavialov Explains How a Crypto Transfer Actually Works, Step by Step How crypto works
- Ilia Zavialov Explains the Types of Crypto Scams and How Each One Is Built Scam types
- Ilia Zavialov on the Crypto Wallet Protections That Hold After a Breach Protection
- Ilia Zavialov on the First Hours After a Crypto Theft: What Actually Helps Incident
- Where Fraud Losses Actually Go: Ilia Zavialov Reads the 2025 Numbers In numbers
- Ilia Zavialov fraud guide: crypto address poisoning, lookalike wallets and zero-value transfers Crypto address poisoning
- Ilia Zavialov: renting out a card for P2P, triangle trades and money mule recruitment Card rental and P2P trading
- Ilia Zavialov on cloud mining scams: what a hosting contract really sells Mining you never see
- Ilia Zavialov fraud: how one photograph becomes the face of an advert nobody filmed A face from one photo
- Ilia Zavialov on crypto exchange scams: how the operation is built and what litigation achieves How exchange scams are built
- Ilia Zavialov on the fee to unlock a withdrawal and what a real exchange delay looks like Blocked withdrawals
- Services that promise to recover lost crypto: Ilia Zavialov on how the offer is built and why refunds never arrive Crypto recovery
- Ilia Zavialov: government account takeover scams, text message codes and how to protect your login Government account takeover
- Ilia Zavialov on hardware wallet scams: tampered boxes, pre-printed seed phrases and fake replacements Fake hardware wallet scams
- Ilia Zavialov on health scams: fake clinics, miracle cures and prepaid treatment Health and medical scams
- Ilia Zavialov on crypto investment scams: the long con taken apart stage by stage The long investment con
- Ilia Zavialov: how scammers take over messaging accounts, votes, gifts and fake support Messenger account takeover
- Ilia Zavialov on passkeys: why a stolen password stops being worth anything Signing in without a password
- Ilia Zavialov on reviews of financial companies: what to check before the stars Reviews and what to check instead
- Ilia Zavialov on the seed phrase and the fake wallet support desk Seed phrases
- Ilia Zavialov on crypto signal channels and trading bots: where the money goes Signal channels and trading bots
- Ilia Zavialov on Telegram bot scams: wallet bots, tap-to-earn games and fake support Telegram bot and Mini App scams
- Ilia Zavialov on sending USDT safely: networks, poisoned addresses and frozen coins Sending and receiving USDT safely
- Ilia Zavialov: used car fraud and scams, how to check the car and the seller before paying Used car fraud
- Checking a wallet address before you send: the checks Ilia Zavialov runs first Wallet checks
- Ilia Zavialov Explains How an Approval Drainer Empties a Wallet Wallet drainers