Crypto & Investment Scams

The relationship is the payload. A dating-app match, a "wrong number" text that turns friendly, a commenter who becomes a daily chat — weeks or months of attention with little or no ask. That delay is not kindness. It is inventory: you stop treating them like a stranger. Only then does investing appear, often as their hobby, a screenshot of a green chart, an invitation to a "platform their firm uses." You are not evaluating an exchange. You are following a person you already like. That is why family warnings bounce. The scam is not the chart. The scam is the trust that makes the chart feel like a favor. Name it as a defender, not as an operator: TRUST THEN MONEY. If the financial ask cannot stand without the relationship — if you would never deposit on that URL from a cold email — the relationship is the exploit. Secrecy ("don't tell your sister, she doesn't understand crypto") is part of the same lock. Isolation keeps the dashboard unchallenged. A real regulated venue does not need your new partner to onboard you in a private chat, and it does not punish you for talking to family.

Fake trading apps and sites complete the picture. A download from a link in chat, a page that is not the exchange you would type yourself, reviews that all arrived the same week — the interface can look expensive. Buttons labeled Deposit work (that is the only real rail: you sending coins to an address they control). Buttons labeled Withdraw are theater until they are not, and then they demand another payment. A dashboard balance is not money in a wallet you control. It is a number in their database. Guaranteed returns — "1% a day, risk-free," "double in 30 days," "institutional arb, no downside" — contradict how markets work. Nobody can guarantee that without lying. If the upside is certain, the platform is the product, and you are the deposit.

The withdrawal-tax beat is how the funnel keeps eating after the first deposit. Fictionally: you request $2,000 out of a "$8,400" balance. A modal says pay 15% tax in USDT to a new address, or complete KYC by depositing more, or upgrade to a tier that requires a larger balance. Each story has the same cashflow: more of YOUR crypto to THEM, still no payout to an address you control. Paying the tax does not create a legal withdrawal. It confirms you will pay again. Stop. Do not "one more transaction to get the rest." The rest was never sitting in your wallet. Recovery scams are the second shift. After you know you were burned — or after you posted in a forum — a new contact offers to "trace the chain," "file with the exchange," or "unlock frozen profits" for an upfront fee in crypto or gift cards. Sometimes they claim to be police, a lawyer, or the first platform's "compliance team." They are usually the same crime with a new costume, or a copycat who hunts victims. Never send crypto to recover funds. Real investigators and licensed professionals do not require you to prepay in Bitcoin to a personal wallet. Report through official channels you type yourself (next module). Do not hire a stranger from a DM.

What you can do instead is boring and effective. Use only venues you typed — well-known names, from your own keyboard, with MFA you already understand from Topic 4. If a person you met online needs you on a different site, that is the flag, not a tip. You do not need to "try $50 to see if withdraw works." A small deposit is still a send to them. You do not need to reverse-engineer their contract or follow tokens into mixers. You need to stop feeding the address. Screenshots of profit are not evidence of a wallet. Withdrawals to an address you control, with no surprise tax, are. If that never happens, walk away and keep the coins you still hold.

The card is for a story in this lesson or a pitch already in YOUR chats. You are not creating an account on their site. You are not sending dust to their address to "see the tx." You are writing why you refuse. If a friend is in this funnel, share the TRUST THEN MONEY sentence and the tax-is-another-send sentence — do not take over their wallet, and do not contact the scammer for them.

mkdir -p "$HOME/cyberlium-lab"

{
  echo "date: $(date -Iseconds 2>/dev/null || date)"
  echo "=== trust-then-money ==="
  echo "relationship_existed_before_invest_ask: yes/no"
  echo "secrecy_pressure_dont_tell_family: yes/no"
  echo "=== platform ==="
  echo "url_i_would_type_myself_or_only_their_link: "
  echo "guaranteed_return_claim: yes/no"
  echo "=== dashboard vs wallet ==="
  echo "profit_is_only_a_number_on_their_screen: yes"
  echo "withdrawal_demands_another_send_tax_kyc_tier: yes/no"
  echo "=== recovery ==="
  echo "stranger_offers_to_recover_for_a_fee: yes/no"
  echo "=== refuse ==="
  echo "safe_action: do_not_deposit / do_not_pay_tax / do_not_pay_recovery / break_contact"
  echo "rule: never send crypto to recover funds"
  echo "ethics: did not deposit, did not run a fake desk, did not harass anyone"
} > "$HOME/cyberlium-lab/crypto-scam-refuse.txt"
chmod 600 "$HOME/cyberlium-lab/crypto-scam-refuse.txt"

You now treat pig-butchering as trust then money, fake dashboards as untrusted UI, guaranteed returns as a lie, and withdrawal taxes plus recovery DMs as more sends — never as unlocks. Next — QR Code Phishing — the camera becomes the click: sticker overlays, parking and Wi-Fi codes, and how you preview a URL on YOUR phone before anything opens.