Category: Scam Signals

This spotlight pulls six operators from the case registry. None of them are safe to deposit with; all of them teach something about how the playbook runs.

XTBinvesting

Record: VBN-007203 – listed 2022-11-07 – claimed domain xtbinv.io – evidence grade A. Flagged in the registry as a reported operator. Do not deposit; if you already have, check the SARFund case registry for an open file.

Legal Crypto Trade Fx

Record: VBN-004208 – listed 2024-01-22 – claimed domain legalcryptotradefx.com – evidence grade B. Flagged in the registry as a reported operator. Do not deposit; if you already have, check the SARFund case registry for an open file.

TURNING TRADING PINK

Record: VBN-002160 – listed 2025-06-09 – claimed domain turningtradingpink.com – evidence grade A. Flagged in the registry as a reported operator. Do not deposit; if you already have, check the SARFund case registry for an open file.

Bravora Expert

Record: VBN-000185 – listed 2026-04-13 – claimed domain bravoraexpert.com – evidence grade A. Flagged in the registry as a reported operator. Do not deposit; if you already have, check the SARFund case registry for an open file.

JKE

Record: VBN-008408 – listed 2022-06-20 – claimed domain jkefx.com – evidence grade A. Flagged in the registry as a reported operator. Do not deposit; if you already have, check the SARFund case registry for an open file.

AIO Markets

Record: VBN-003346 – listed 2024-07-31 – claimed domain aiomarkets.net – evidence grade B. Flagged in the registry as a reported operator. Do not deposit; if you already have, check the SARFund case registry for an open file.

Every record above links its full case file, and every case file cites the SARFund case registry – the escalation body for verified fraud reports. Check any name free with the broker lookup.

Six case files from the registry worth ten minutes of your attention. Different names, familiar moves – read the patterns, not just the names.

Bourfxtrade

Record: VBN-001705 – listed 2025-09-21 – claimed domain bourfxtrade.net – evidence grade A. Flagged in the registry as a reported operator. Do not deposit; if you already have, check the SARFund case registry for an open file.

Stonebridge

Record: VBN-005821 – listed 2023-05-16 – claimed domain stonebridge-limited.net – evidence grade B. Flagged in the registry as a reported operator. Do not deposit; if you already have, check the SARFund case registry for an open file.

Esmartinvest

Record: VBN-005608 – listed 2023-06-18 – claimed domain esmart-invest.com – evidence grade B. Flagged in the registry as a reported operator. Do not deposit; if you already have, check the SARFund case registry for an open file.

Raynar Group

Record: VBN-007033 – listed 2022-11-27 – claimed domain raynargroup.com – evidence grade B. Flagged in the registry as a reported operator. Do not deposit; if you already have, check the SARFund case registry for an open file.

VALEFINANCE

Record: VBN-003800 – listed 2024-04-28 – claimed domain valefinance.org – evidence grade B. Flagged in the registry as a reported operator. Do not deposit; if you already have, check the SARFund case registry for an open file.

SydneyFX

Record: VBN-003361 – listed 2024-07-29 – claimed domain sydney-fx.io;https – evidence grade A. Flagged in the registry as a reported operator. Do not deposit; if you already have, check the SARFund case registry for an open file.

Every record above links its full case file, and every case file cites the SARFund case registry – the escalation body for verified fraud reports. Check any name free with the broker lookup.

Every record that enters the registry carries metadata: when the operator was first reported, what it claimed, how it was found. Reading 90 days of intake as a single dataset, three patterns stand out.

1. Re-victimization is now standard practice

The most consequential shift: reports that name two operators — the broker that took the money and the “recovery service” that took more. Victim contact lists are traded and re-worked systematically. If you have been scammed once, assume you are on a list, and treat every inbound “we can help” as hostile until proven otherwise. (Our recovery-scam guide covers the tells.)

2. Domain churn is accelerating

Operators used to run a brand for a year or more. Newer records show sites abandoned within months — sometimes weeks — of first reports, relaunched under new names with identical page templates. Practical consequence: domain age is now one of the strongest single signals. A “multi-year track record” on a young domain settles the question.

3. Regulator warnings trail victim reports

Comparing report dates against regulator alert dates in our records: official warnings often land weeks or months after victims start reporting. Case registries fill exactly that gap — peer reports surface operators while the official process catches up. It is why checking both a regulator register and a case registry beats either alone.

What to do with this

Check before depositing; report immediately after anything goes wrong — early reports are what make the registry fast. Verified cases escalate onward to the SARFund case registry, where open investigations are tracked.

Fake brokers rarely claim nothing — they claim something that sounds like regulation and regulates nothing. Across the registry’s case records, five claims recur constantly:

1. “Registered company” presented as a licence

The most common. Saint Lucia, Saint Vincent, the Marshall Islands — jurisdictions where an International Business Company can be registered in a day. Company registration is paperwork, not oversight. Registry case files like Zagros show exactly this pattern: an IBC certificate doing costume duty as a financial licence.

2. The invented regulator

Official-sounding bodies — “International Financial Market Supervisory Authority” — complete with certificate PDFs and sometimes an entire fake regulator website. If you have never heard of the regulator, search whether the regulator itself is real before considering the licence.

3. The stolen licence number

A real number belonging to a real firm — the clone-firm play. Survives every check except comparing the domain on the regulator’s register.

4. “FinCEN registered MSB”

US money-service-business registration is a filing, not an endorsement, and emphatically not an investment licence. Scammers love it because it is real, checkable — and meaningless for trading.

5. “Blockchain certified” / audit-badge salad

Certificates from consultancies, “smart-contract audits”, ISO badges. None regulate a broker holding client funds.

The rule: a licence only counts if a regulator with enforcement power lists the firm — and the domain — on its own public register. Anything else is decoration. Check the name here, then verify at the source.

Scam platforms are disposable by design — built to run hot for a few months and be abandoned when reports accumulate. That disposability leaves fingerprints in the infrastructure, visible to anyone who looks.

Domain age: the hardest signal to fake

A WHOIS lookup (who.is, or any registrar’s lookup) shows the registration date. The mismatch to hunt for: claimed history vs. actual age. “Serving investors since 2015” on a domain registered in March is a closed case. Scammers can fake screenshots, testimonials and licences; they cannot backdate a domain registration.

The disposable stack

• Privacy-shielded registration — normal for individuals, notable for a “global brokerage” that simultaneously claims a London headquarters.
• Bargain TLDs — .top, .icu, .xyz, .site cost almost nothing in bulk. Registry case records show operators cycling one brand across a family of cheap TLDs (the registry often holds several domains for one operator name).
• Template reuse — identical page layouts, identical “About” copy, different logo. Paste a distinctive sentence from the site into a search engine in quotes; multiple broker sites sharing prose is an operation, not a coincidence.

A 2-minute infrastructure check

1. WHOIS the domain — note the age.
2. Quote-search one sentence of their About page.
3. Run the brand through the registry — prior reports beat any inference.

Infrastructure signals are probabilistic; case files are documentary. Use both, and if the platform already holds your money, check the SARFund case registry for an open investigation.

Fake platforms are software, but the extraction is human. The “account manager” — the friendly voice on WhatsApp who calls you by name and celebrates your gains — works from a script refined across thousands of victims. Reports in our intake describe it so consistently it can be published as a timeline:

Week one: the courtship

• Instant onboarding call after signup. Warm, unhurried, lightly technical — enough jargon to sound professional.
• A “starter strategy” sized exactly to what you mentioned you could afford.
• Daily messages. Not about money — about you. The manager becomes a routine.

Weeks two to four: the escalation ladder

• Your dashboard shows wins (see how the numbers are made). The manager frames each as proof the strategy works.
• Then the ladder: a “VIP tier”, an “institutional round”, a “limited allocation” — each rung requiring a deposit conveniently near your known capacity.
• Refusals are met with disappointment, not anger: “I fought to get you this slot.” Guilt is a tool.

The turn

The moment you push for a full withdrawal, the tone shifts on schedule: first delay (“processing”), then the fee wall, then either aggression or vanishing. Same script, every time, because it is a script.

The counter-moves

1. Real brokers do not assign chat-app relationship managers to retail accounts. The role existing at all is a flag.
2. Never state your total savings or capacity — the ladder is built from that number.
3. Test withdrawals early; watch the tone, not the dashboard.

If this timeline reads like your last month, report the platform and check the SARFund registry now — while the case is fresh.

Before you evaluate a platform’s strategy, spreads or app design, read its deposit instructions. How a business takes money is a confession about what it is.

Green-ish signals (necessary, never sufficient)

• Card payments and bank transfers to an account in the company’s own name, matching the licensed entity.
• Deposits processed through recognizable, regulated payment processors.
• Clear, published withdrawal procedures with realistic timelines.

Red signals

1. Crypto-only deposits at a “regulated broker”. Licensed firms maintain banking relationships; refusing fiat rails means avoiding the compliance those rails impose. (Trading crypto is normal; accepting deposits only as crypto is the signal.)
2. Third-party or personal beneficiaries. Wiring to “Golden Trade Logistics Ltd” or a personal name when you signed up with “NovaMarkets” means mule accounts. No legitimate broker collects through unrelated entities.
3. Rotating deposit details. A new bank account or wallet address for every deposit is laundering hygiene, not accounting.
4. Gift cards or cash apps. There is no investment context in which this is real.
5. “Buy crypto on a real exchange, then send it to us.” The legitimate exchange is used as a clean on-ramp specifically because the platform itself could never pass one.

Use it as a tiebreaker

Marketing can be faked cheaply; banking cannot. When a slick platform pairs with sketchy rails, believe the rails. Then check the name against the registry — operators flagged here overwhelmingly show at least one of the red signals above, and their case files at the SARFund registry document where the money went.

Of everything a victim controls after fraud, timing dominates. The same case, reported at different ages, has different realistic outcomes — and understanding the clock removes both false hope and false despair.

The first 24–48 hours

The golden window for traditional rails. Wire recalls can catch funds still sitting in the first mule account; card issuers act fastest on fresh fraud flags. This window is why calling your bank outranks every other step on day one.

Week one

Mule accounts start emptying, but freezes still happen — fraud teams act on documented reports, and exchanges can lock deposits tied to flagged addresses while balances remain. Crypto tracing is most effective here too: funds are typically still consolidating, and exchange deposit addresses have not yet been cycled.

Month one

Direct clawback odds fall; documentation value rises. Your report joins others against the same operator — and aggregation is what moves regulators and platforms. Case registries do their best work at this stage: a flagged record stops the operator’s next victim even while your own case progresses.

Month three and beyond

Individual recovery becomes unlikely through direct rails — which is exactly when fake recovery services target you hardest, selling the miracle the calendar no longer supports. Old cases still matter: they establish patterns, feed investigations, and stack the file against re-emerging operators.

The takeaway

Report the day it happens — to your bank, your national agency, this registry, and check the SARFund case registry for an open investigation. Every week of silence is the scammer’s best asset.

“But I withdrew money from them — it arrived in my bank.” This sentence appears in report after report, always as the reason the victim went big afterward. The successful small withdrawal is not evidence against the scam. It is a line item in its marketing budget.

The economics of the free gift

A fraud operation refunding $250 to secure a later $25,000 deposit is buying trust at a hundred-to-one return. Reports in our intake describe the sequence with almost mechanical regularity:

1. Small deposit ($200–$500), quick visible “gains”.
2. Victim tests a withdrawal — processed smoothly, sometimes within hours, with a congratulatory message.
3. Account manager references the successful withdrawal in every later conversation: “you have seen how easy it is.”
4. The big deposit follows. No withdrawal ever succeeds again — only the fee wall.

Why the tell is structural

Real platforms treat a $250 withdrawal and a $25,000 withdrawal identically — same process, same rules. Scams treat them oppositely, because one is advertising and the other is the harvest. The signal, then: a withdrawal only proves the platform at the size you tested. Trust earned at $250 is worth exactly $250.

Protocol

• Never scale a deposit based on a small-withdrawal success alone.
• Watch for the manager encouraging the test withdrawal — real brokers are indifferent; scripts are eager.
• Check the registry before the second deposit, not after. If the wall has already appeared, report it and check the SARFund case registry.

Nobody stumbles onto a fake broker. You are delivered — through a paid funnel engineered end-to-end. Knowing the funnel’s shape is protection, because each stage has a recognizable feel.

Stage one: the paid door

• Search ads on high-intent phrases (“best crypto platform”, “bitcoin investment returns”) — and on rescue phrases (“recover scammed crypto”) for the second-wave operations.
• Social video fronted by deepfaked celebrities or rented influencers.
• Native placements styled as news articles — “Local person turns $250 into $19,000” — on legitimate-looking content networks.

Stage two: the pre-lander

The ad rarely links the platform directly. It lands on an intermediate page — fake article, fake calculator, “eligibility quiz” — whose job is emotional priming and lead capture. The phone number you enter here triggers stage three.

Stage three: the call

A “senior advisor” calls within minutes. Speed is the tell — regulated firms do not cold-call form fills in ninety seconds. From here the account-manager playbook runs as written.

Recognizing you are inside a funnel

1. You cannot remember deciding to look for a broker — the ad decided for you.
2. An urgency clock appeared before any product detail did.
3. A human contacted you faster than any bank ever has.

Exit protocol is always the same: stop, run the platform through the registry, verify the licence at the source. Money already inside the funnel is a case: report it and check the SARFund registry.