Bewary Get Bewary
Scam patternPublished Aug 6, 2026

Someone I met online wants me to invest in crypto. Is it a scam?

Bewary fraud research, published by Andrey Khayrullaev, founder. How we research scam patterns.

Example DM

Hey babe ❤️ I just checked my portfolio and I made another $8,400 this week! My uncle taught me his strategy and it really works. I know you said you don't know much about crypto but I'll teach you everything, it's so easy. You don't need a lot, even $300 to start. I set up an invite for you: coinvaultpro.net/join/ref-sarah88 Just create an account and I'll walk you through your first trade tonight 😘

SCAM

Yes. This is pig butchering. The FBI uses that name because the scammer fattens your confidence with fake returns before taking everything. The structural tell: no crypto exchange on earth blocks a withdrawal behind an additional deposit. Coinbase does not. Kraken does not. Binance does not. The moment someone says pay a 'tax' or 'insurance fee' to unlock your own money, you are looking at a website built to display invented numbers. The FBI's IC3 ranks investment fraud, driven heavily by pig butchering, as the costliest category of cybercrime reported to it.

How to spot this scam

  • They moved you to WhatsApp or Telegram within days of matching. Dating apps can detect and ban scam accounts, so the scammer needs you on a channel the app cannot see or shut down. Notice the sequence: they push to switch platforms before a single video call has happened.
  • They steer every conversation back to crypto investing. You mentioned your dog. They replied with a story about their uncle's trading strategy. The relationship is packaging. The platform URL is the product.
  • The platform shows steady, enormous gains. Those numbers are rows in a database someone edits by hand. Compare any price on the platform to the same asset on CoinMarketCap or CoinGecko in real time. They will not match, because no live market data feed connects to the site.
  • The domain is weeks old. Run the platform URL through a WHOIS lookup. Coinbase.com was registered in 2012. Kraken.com in 2008. If the domain hosting your supposed $50,000 portfolio was registered three weeks before you got the link, the answer is obvious.
  • A small early withdrawal worked perfectly. You pulled out $300 and it hit your real wallet within hours. That payout costs the operation a few hundred dollars to convince you to deposit tens of thousands. Once the large sum lands, withdrawals stop.
  • They require a 'tax,' 'fee,' or 'insurance deposit' before releasing your balance. This is a second extraction. You already lost the principal. No government, exchange, or financial institution anywhere operates by requiring a new deposit to process a withdrawal.
  • You were told to buy crypto on Coinbase or another real exchange, then transfer it to their platform. This two-step path exists for one reason: your bank can reverse a credit card charge, but nobody can reverse a blockchain transaction. Once crypto leaves your wallet for theirs, your bank is out of the picture.
  • They cancel every video call. Camera broken. Bad connection. Too shy. The photos on their profile may be stolen from someone else's social media or generated by AI. If weeks have passed and you have never seen this person's face move and speak live, the person behind the account may not match the photos at all.

What to do now

  1. Stop all deposits, including any 'withdrawal fee' or 'tax' they quoted you. That fee is not a processing step. It is a second theft. Paying it will not release your balance, because the balance was never real.
  2. Save everything before the site vanishes. These platforms go offline without warning once the operators move on. Screenshot the dashboard, export your chat history from WhatsApp or Telegram, copy every wallet address you sent crypto to, and save transaction confirmations from the exchange where you bought it.
  3. File at ic3.gov with the FBI's Internet Crime Complaint Center. Include every wallet address and transaction hash. The FBI's Virtual Assets Unit uses blockchain analysis to trace funds across exchanges and can freeze assets when they reach an off-ramp that converts crypto back to cash.
  4. Report at ReportFraud.ftc.gov. The FTC cross-references complaints to map networks of related fake platforms, and your report adds a data point that helps identify the operation running yours.
  5. Contact the exchange you used to buy the crypto through the same app or website where you made the purchase. Open a support case and flag the outbound transactions as fraud-related. If the receiving wallet has not yet moved the funds, the exchange can coordinate with law enforcement to freeze them.
  6. Tell someone you trust what happened. Pig butchering works by isolating you. The shame keeps victims depositing long past the point they suspect something is wrong. One conversation with a friend or family member breaks that loop.

What it looks like on your phone

Recreated example of the scam dm: Hey babe ❤️ I just checked my portfolio and I made another $8,400 this week! My uncle taught me his strategy a
A representative example based on common reports. Exact wording varies.

Got a message like this? Check yours free

Paste any text, link, or number you are unsure about. Bewary gives you a straight answer in seconds, and the exact reason why.

Private. Never sold, never tied to you.

Sources and reporting

Use official channels to confirm a suspicious request and report fraud.