Fake investment platforms
A website or app shows a growing balance that exists only in the operator's database. Deposits leave for operator-controlled wallets within minutes, and withdrawal is eventually blocked behind a fee, tax or compliance charge.
- Usual asset: USDT, most often on Tron, because fees are negligible and settlement is instant.
- Money movement: deposit address, rapid automated forwarding, consolidation with other victims' funds, then layering.
- Preserve: platform URL and app download link, dashboard screenshots, deposit confirmations, all correspondence.
Relationship-led investment fraud
Contact begins socially and runs for weeks before money is mentioned. A small early withdrawal is permitted to build confidence, then deposits escalate. The pattern is covered in detail in our dedicated guide.
- Money movement: identical to fake platforms, but spread across more payments over a longer period.
- Preserve: full chat exports, profile photographs, any voice or video call records, and the sequence of payments with dates.
Wallet drainers and malicious approvals
Rather than asking for a transfer, the attacker obtains a signature. A token approval granted on a fake mint, airdrop or support page allows an address to move assets out of your wallet later, without any further action from you.
- Money movement: direct sweep from your wallet to the drainer's address, often instantly and repeatedly.
- Immediate step: revoke outstanding approvals and move remaining assets to a newly created wallet.
- Preserve: the transaction hash of the approval, the site URL, and the wallet address involved.
Impersonation of exchanges, banks and support desks
A caller or message claims your account is compromised and instructs you to move funds to a 'safe' wallet. The wallet belongs to the caller. Numbers and sender IDs are frequently spoofed to match the real business.
- Money movement: a single large transfer, usually followed within minutes by onward layering.
- Preserve: the number or account that contacted you, call times, and the exact instructions given.
- Rule of thumb: no legitimate exchange, bank or police force will ever ask you to move funds to a wallet they supply.
Giveaway, airdrop and cloned-brand schemes
- A well-known name promises to return a multiple of anything sent. Nothing is ever returned.
- Cloned websites and sponsored search results imitate real exchanges down to the domain spelling.
- Preserve: the URL exactly as typed or clicked, the advert or post that led you there, and the payment record.
What to do in the first 24 hours
- Stop all further payments, including any described as a release, tax or compliance fee.
- Export wallet history, exchange statements and correspondence before access is removed.
- Report it: Action Fraud in England, Wales and Northern Ireland; Police Scotland on 101 in Scotland. Keep the reference.
- Notify the exchange or bank you funded from, and revoke wallet approvals if a site ever connected to your wallet.
- Do not tell the other party you are investigating — it usually triggers immediate cash-out and account deletion.
If you are looking at your own case rather than reading generally, our cryptocurrency investigation service explains how a case is scoped and worked, the asset tracing hub covers the network-specific work, and our overview of cryptocurrency scam recovery in the UK sets out what is realistic. Asset pages: USDT tracing, Bitcoin tracing and Ethereum tracing. You can also contact the investigations team directly.
Common questions
- Which cryptocurrency scam is reported most often in the UK?
- Fake investment platforms, including relationship-led variants, account for the majority of losses reported to us. They share a structure: a dashboard balance that is not real, and deposits that leave for operator wallets within minutes.
- Why was I asked to pay a fee before withdrawing?
- Because the balance shown is a database entry rather than money held for you. Fees exist to extract further payments, and each one paid tends to produce another demand.
- My wallet was emptied without me sending anything. How?
- Most likely through a token approval you signed on a fraudulent site, which lets another address move assets out later. Revoke outstanding approvals and move any remaining assets to a newly created wallet.
- Can these losses be traced?
- The transfers are permanently recorded and can be followed to a terminal point such as an exchange deposit address, a bridge or a dormant wallet. Tracing establishes the route funds took; it does not reverse transfers or identify individuals from ledger data alone.
Have a case you want reviewed?
We scope at intake and tell you honestly whether the onchain data supports a traceable case.