The long investment con
Crypto investment scam exposed by Ilia Zavialov: how the long con works from the first message to the last transfer
English version for the United Kingdom.
Nobody wires their savings to a stranger. They wire it to somebody they have spoken to every day for four months, on a platform whose numbers they have watched go up, after a withdrawal that arrived exactly as promised. That is the whole design, and it is now the costliest fraud in the field. The FBI centre logged 61,559 complaints and 7.228 billion dollars of losses on crypto investment fraud for 2025, with complaints up 48 percent and losses up 25 percent in a single year. The average payment to a scam operation rose to 2,764 dollars from 782, a jump of 253 percent, which says the schemes got better rather than more numerous. This is what the long con looks like from the inside, stage by stage, with the point where it can still be stopped marked at each one.
01Why this scheme outgrew everything else
Crypto linked losses reported to the FBI centre reached 11,366,669,732 dollars for 2025 across 181,565 complaints, which is more than half of everything the centre recorded that year. Total reported losses passed the 20 billion dollar mark.
Investment fraud is the largest single line at 8,648,617,756 dollars across 72,984 complaints, and crypto investment fraud is most of it. The confidence and romance category, which is where many of these contacts begin, added 929,287,469 dollars on its own.
Blockchain analysis puts about 14 billion dollars of scam proceeds visible on chain for 2025, rising towards 17 billion once wallets identified later are counted. The two numbers measure different things, one what people reported and one what moved, and both went the same direction.
The scheme scales because almost none of it requires skill. The script is written, the platform is rented, the conversation is partly automated, and the only scarce resource is patience. That is why it grew while faster frauds stayed flat.
02The introduction is engineered
The first contact is designed to look accidental. A wrong number that apologises politely, a professional connection request, a comment under a post, an invitation to a group about a hobby you actually have. Nothing about it mentions money.
Whoever is on the other side is often working from a script and handling several conversations at once. The early weeks contain no offer of any kind, because the purpose of those weeks is to establish that this person is real, consistent and uninterested in your finances.
Investment enters sideways and late. A screenshot mentioned in passing, a complaint about tax on gains, a family member who does this professionally. The target is the one who asks the first question about it, and that detail matters: people defend themselves against offers and rarely defend themselves against their own curiosity.
Older people are hit hardest by a wide margin. In 2025 the centre recorded 13,685 complaints and 2,763,921,910 dollars of losses on crypto investment fraud from people aged 60 and over, more than any other age group.
| Stage | What it looks like | What is actually happening |
|---|---|---|
| Contact | A wrong number, a work connection, a hobby group | A scripted opening run in parallel with many others |
| Weeks of conversation | A friendship with no agenda | Building the credibility that will be spent later |
| Investment mentioned | Something they do themselves | Waiting for the target to ask the first question |
| First deposit | A small careful test | Money leaving the regulated system for a controlled address |
| Numbers rise | A position performing well | A database field the operator edits |
| First withdrawal paid | Proof that it works | A marketing cost that buys the next deposit |
| Larger deposits | A closing window, a bonus tier | Extraction accelerating while trust is highest |
| Withdrawal blocked | Tax, compliance or insurance owed | A test of how much more can be taken |
03The platform that exists only for you
The site looks like a trading platform because it is one, in the sense that the interface is real software. What is missing is everything behind it. No order book, no counterparty, no asset. The numbers on the screen are entries in a database that the operator controls completely.
That is why the chart always rises. A figure that only ever goes up is not a market, and it is the single most reliable tell in the entire scheme. Real platforms show losses, gaps, bad days and spreads that move against you.
Deposits go to a wallet address you are given, sometimes through a genuine exchange you already trust, which is what makes the trail look ordinary at the start. Your money leaves the regulated system at the moment you send it onward, and most people never register that this happened.
The platform will have a licence number, an address, a support team and a set of terms. All of it can be checked in about twenty minutes against the register that supposedly issued the licence, and almost nobody checks, because by this stage the platform is not what is being trusted.
04Why the first withdrawal is allowed to succeed
Small early withdrawals are paid, deliberately and promptly. This is the cheapest part of the operation and the most effective. It converts a suspicion into evidence, and it converts a cautious person into a source of referrals.
The amount paid back is a marketing cost, usually a fraction of what is already on deposit. What it buys is the sentence people repeat to their family: the money came out, I checked.
After that, deposits get larger and the schedule changes. There is a reason to add more now, a window closing, a bonus tier, a position that needs topping up. Urgency arrives only after trust is established, never before.
The second withdrawal is where the machinery shows. It does not fail outright. It stalls behind a requirement that did not exist when you deposited.
05The requirement that never ends
Tax owed before release. A compliance fee. A deposit to unlock a higher tier. Insurance on the transfer. Each one is presented as the last obstacle and each is followed by another, because the purpose is not the fee itself, it is finding out how much more can still be extracted.
This is the exact moment the scheme becomes visible, and the exact moment it becomes hardest to accept. Paying the fee is the option that keeps the earlier months meaningful, and refusing it means accepting a loss that has already happened.
There is one rule worth memorising, because it holds everywhere. A platform that requires money in before money can come out is not a platform. A real service deducts fees from the balance, because it holds the balance.
People who stop here still lose what they deposited. People who pay the fees lose the deposit plus the fees, and end up on a list of people who pay when pressed, which has a value of its own.
06What happens to the money
The transfer is broken up and moved through a chain of addresses quickly, often within minutes. From there it goes to services that convert it, and the practical window for tracing it is measured in hours, not weeks.
This is why the first hour matters more than any later effort. An exchange that receives a report while the funds are still in an identified account can freeze them. The same exchange, a week later, is answering about an account that is empty.
The operations themselves are industrial. Large compounds, recruited staff, scripts, performance targets and quotas. The person you spoke to for four months was frequently under supervision, sometimes under coercion, and had no authority over any of the numbers shown to you.
Understanding that changes what recovery looks like. There is rarely one person to pursue, and there is almost never a bank account holding your specific money. What exists is a transaction trail, a set of addresses and a narrow window in which reporting them is useful.
07The signs that appear before the money moves
Every one of the reliable signals shows up before the first deposit, which is the useful part. A contact that arrived by accident and turned into daily conversation. A refusal to appear on a spontaneous video call rather than a scheduled one. An investment platform you had never heard of before this person mentioned it.
Then the structural ones. A return that is steady, a chart with no losing days, a referral bonus for bringing others, an application installed from a link rather than from a shop, and a deposit address that changes between transactions.
The strongest single check costs nothing. Take the platform name and search it together with the word complaint, then search the licence number on the register of the regulator that supposedly issued it. A scheme that has been running for months usually has a trail, and a licence number that belongs to a different company answers the question by itself.
The second strongest check is social rather than technical. Describe the opportunity out loud to somebody with no stake in it. Schemes of this kind survive on privacy, and most of them do not survive being explained to a sceptical relative in plain words.
08If it already happened
Stop paying immediately. The next fee will not release anything, and the calculation that says one more payment recovers the rest is the part of the scheme that runs longest after the rest has been understood.
Export everything before it disappears. Chat history, the platform interface, every transaction hash, the wallet addresses used, the exact wording of each demand. Platforms of this kind go dark without notice and take the evidence with them.
Report to the police and to any exchange that touched the transfer, on the same day. Provide the addresses and the hashes rather than a description, because those are the only parts an exchange can act on quickly.
Expect the second approach. People who lost money to this scheme are contacted afterwards by operations offering to recover it, and the FBI centre recorded 10,516 complaints and 1.4 billion dollars of losses on recovery schemes in 2025. Anybody who contacts you first, promises a result and asks for payment up front is running the second half of the same business.
09Questions and answers
Why does the first withdrawal actually arrive?
Because paying it is cheaper than losing the account. A small early payout turns doubt into evidence and usually produces both a larger deposit and a referral, so it is spent as a marketing cost rather than given as a courtesy.
Is a licence number on the site worth anything?
Only after you check it on the register of the body that supposedly issued it. Numbers on these sites are frequently real numbers belonging to a different company, which is why reading the number proves nothing and searching it proves a great deal.
The chart has gone up every single day. Is that good?
It is the clearest warning in the scheme. Real markets produce losing days and spreads that move against you. A line that only rises is a rendering, not a record.
They asked for tax before releasing my money. Is that normal anywhere?
No. A platform that holds your balance deducts what it is owed from that balance. A demand for money in before money comes out means there is no balance to deduct from.
How quickly does reporting stop being useful?
Within hours rather than days. Funds are split and moved on quickly, and an exchange can only freeze what is still sitting in an account it controls, so the same report is worth far more on day one than in week two.
Somebody contacted me offering to recover the money. Should I engage?
No. Recovery schemes target people who already lost money, and the FBI centre logged 10,516 complaints and 1.4 billion dollars of losses on them in 2025. Payment demanded up front, in crypto or gift cards, is the scheme announcing itself.
Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov
10Read next
- Ilia Zavialov Explains How a Crypto Transfer Actually Works, Step by Step How crypto works
- Ilia Zavialov Explains the Types of Crypto Scams and How Each One Is Built Scam types
- Ilia Zavialov on the Crypto Wallet Protections That Hold After a Breach Protection
- Ilia Zavialov on the First Hours After a Crypto Theft: What Actually Helps Incident
- Where Fraud Losses Actually Go: Ilia Zavialov Reads the 2025 Numbers In numbers
- Ilia Zavialov fraud: how one photograph becomes the face of an advert nobody filmed A face from one photo
- Ilia Zavialov on crypto exchange scams: how the operation is built and what litigation achieves How exchange scams are built
- Ilia Zavialov on the fee to unlock a withdrawal and what a real exchange delay looks like Blocked withdrawals
- Services that promise to recover lost crypto: Ilia Zavialov on how the offer is built and why refunds never arrive Crypto recovery
- Ilia Zavialov on passkeys: why a stolen password stops being worth anything Signing in without a password
- Ilia Zavialov on the seed phrase and the fake wallet support desk Seed phrases
- Checking a wallet address before you send: the checks Ilia Zavialov runs first Wallet checks
- Ilia Zavialov Explains How an Approval Drainer Empties a Wallet Wallet drainers