Case #3
Romantic Scam
AML Crypto was approached by another victim (identity withheld for privacy) of a fraudulent scheme involving romantic connections and fake investments. AML Crypto specialists assisted the victim in recounting their story, gathering as much information as possible about the scammer’s contacts and the platform used for "trading." As with most such cases, the perpetrators meticulously concealed their true identities, using fake profiles and anonymous communication platforms.
It all started with an ordinary acquaintance on a popular dating app
Initially, the victim was merely curious and asked questions about how the system worked. Soon, the scammer offered to demonstrate it firsthand. They sent a link to a platform where the victim could open a "personal account" and start trading. The website looked convincing: a colorful interface, asset growth data, charts, and forecasts that inspired confidence.
Succumbing to manipulation, the victim decided to invest a small amount to test the platform. To their surprise, the balance in their account started growing almost immediately, which reinforced their trust in both the "new partner" and the scheme itself. Encouraged by this, the victim invested more, expecting a significant profit. However, when it came time to withdraw funds, problems arose: withdrawals were "temporarily unavailable due to a technical error."
Soon, the victim received an email from the platform’s support team requesting a 15% tax payment before withdrawal. The email emphasized that this was a standard procedure necessary to complete the transaction. Trusting the information and failing to verify its legitimacy, the victim complied and sent the requested sum. However, after doing so, the platform stopped responding, and the "partner" disappeared, deleting their account.
Realizing they had been scammed, the victim turned to AML Crypto for assistance. Our specialists conducted a detailed interview and initiated an investigation, analyzing the provided data, including the platform’s web address, scammer contacts, and the victim’s transactions.
Our objectives were to trace the financial flow, identify where the stolen funds were transferred, assist in their recovery, and find ways to de-anonymize the fraudsters while warning others about similar scams.
All information presented in this material is for informational purposes only and does not encourage independent investigations. The data has been anonymized but is based on a real incident to highlight the importance of vigilance and awareness in fraud prevention.
As part of the OSINT (Open-Source Intelligence) analysis, we conducted an in-depth investigation to gather as much information as possible based on the victim’s data about the scammers. The victim provided details about the fraudulent website used for fictitious trading, as well as contact information linked to the scammers' Telegram accounts.
Since the focus of this phase was gathering evidence from open internet sources (Web 2.0), blockchain wallet analysis was handled separately. This approach enabled the collection of crucial digital traces that could later be used for tracking cryptocurrency transactions.
Social media analysis linked these accounts to crypto trading forums, suggesting a broader fraud network.
To analyze how the fraudsters laundered stolen funds, we examined a multi-step transaction scheme using AML Crypto’s Bholder tool:
