How the pattern usually works
- An unsolicited message offers flexible online work.
- You are paid small amounts at first, often in USDT.
- Your account shows a 'negative balance' or a locked bonus that needs a deposit.
- Each deposit leads to a new, larger demand before any withdrawal.
Do not deposit to clear a balance
Genuine employers do not ask staff to pay in money to receive wages. Treat any request to top up, upgrade or pay a fee as part of the fraud.
Report and preserve the evidence
- Screenshots of the task dashboard, balances and any 'commission' pages.
- All chats with the recruiter and the 'mentor' or support agent.
- The website address and every wallet address you sent funds to.
- Report to your bank and to Action Fraud (Police Scotland in Scotland).
Can the payments be traced?
Deposits are often made in USDT on the Tron network, which is publicly recorded. A trace can show where the funds went and whether they reached a service able to act. It cannot guarantee an outcome.
If you are looking at your own case rather than reading generally, our cryptocurrency investigation service explains how a case is scoped and worked, the asset tracing hub covers the network-specific work, and our overview of cryptocurrency scam recovery in the UK sets out what is realistic. Asset pages: USDT tracing, Bitcoin tracing and Ethereum tracing. You can also contact the investigations team directly.
Common questions
- I was paid at the start. Does that mean it was real?
- No. Early small payments are used to build trust before larger deposits are requested.
- Will I get in trouble for the payments I received?
- If you are worried, explain everything when you report it. Being open with your bank and the police is the best approach.
Have a case you want reviewed?
We scope at intake and tell you honestly whether the onchain data supports a traceable case.