Most fraud we investigate falls into a limited number of repeating structures. Recognising the structure tells you what happens next — and where intervention still has value.
Relationship investment fraud ("pig butchering")
The largest category by value. An operator builds a personal or romantic relationship over weeks, then introduces a trading platform they claim to use themselves. Small early withdrawals are honoured to establish credibility. Once the victim commits substantial funds, withdrawals stop and fee demands begin.
Structure: social contact → trust building → small test deposit → successful test withdrawal → large deposit → withdrawal blocked → escalating fees.
Critical point: the successful small withdrawal. It is the proof-of-concept the operator needs, and it costs them very little.
Fake exchanges and cloned platforms
A polished website, live-looking price charts, an app that may even be listed in an app store. The interface is a display layer; there is no exchange behind it. Balances are database entries the operator controls.
Structure: advertisement or referral → account opening → deposit → dashboard shows growth → withdrawal request → verification loop → fees → silence.
Critical point: the first deposit. Funds usually leave the deposit address within hours.
Advance-fee and recovery fraud
The victim is told a sum is waiting — an inheritance, a settlement, a seized wallet, recovered funds — and only a fee stands between them and it. The fee is the entire product. Each payment produces a new obstacle requiring another payment.
This category includes recovery scams, which specifically target people who have already been defrauded. Because it is the most common way victims are harmed a second time, we cover it separately in Recovery scams: how not to be a victim twice.
Impersonation of officials and institutions
Contact appears to come from a police force, tax authority, financial regulator, bank fraud team, or a well-known exchange. Caller ID and sender addresses are trivially spoofed. The message manufactures alarm — your account is compromised, a warrant has been issued, funds must be moved to a "safe wallet".
The rule that defeats all of it: no legitimate authority or bank ever asks you to move funds to a wallet or account they nominate, and none accepts payment in cryptocurrency or gift cards. End the contact and call the institution back on a number you look up independently.
Fake giveaways, airdrops, and celebrity endorsement
"Send 1 ETH, receive 2." Livestreams using footage of well-known figures, deepfaked interviews, and sponsored posts attributing endorsements to public personalities who have given none. The transfer is one-directional by design.
A variant is the malicious airdrop: a token appears in your wallet, and claiming it requires a signature that grants spending approval over your other assets.
Wallet-drainer signatures
Increasingly, no transfer is requested at all. The victim connects a wallet to a site and approves a transaction they believe is a mint, claim, or verification. The signature is actually an unlimited token approval, and assets are removed later — sometimes weeks later, so the connection to the site is not obvious.
Defence: read what you are signing. Treat setApprovalForAll and unlimited allowances as high-risk. Review and revoke stale approvals periodically.
Pump-and-dump and rug pulls
A token is promoted heavily across social channels; insiders holding most of the supply sell into the demand they created. In a rug pull, liquidity is withdrawn outright, or the contract contains code preventing anyone but the deployer from selling.
Checkable before you buy: token distribution concentration, whether liquidity is locked and for how long, whether the contract is verified and audited, and whether the "team" exists outside the project's own website.
Fraudulent mining, staking, and cloud yield
Sold as passive income from infrastructure that does not exist. Returns paid to early participants come from later participants' deposits — a Ponzi structure with a technical costume. Collapse is arithmetic, not misfortune: it happens when inflows stop.
Recruitment and task-based fraud
A remote "job" involving simple tasks — reviewing products, boosting app ratings, completing order sets. Small commissions are paid initially. Then a task requires the worker to fund a "combination order" from their own money, and the balance becomes unwithdrawable.
What the patterns share
Across every category: irreversible payment rails, manufactured urgency, artificial trust signals, and a fee demanded before money can be released. If you can identify these four elements, you can identify most fraud without knowing which specific scheme you are looking at.
This guide is general information, not advice on your specific case
Every case turns on its own facts. If you have been defrauded, submit a report for a free assessment, and report the matter to your national fraud authority as well.
Been targeted by something like this?
Submit your case for a free assessment. If recovery is unlikely, we will say so.