A slightly better exchange rate. An Instagram ad. A routine-looking AML check.
And then $25,000 was gone.
A Korean man living in the US found a P2P currency exchange service on Instagram. Its rate was 2–3% better than competitors, which seemed like a good deal rather than an obvious scam.
He clicked the ad, connected his account, followed the site’s AML instructions, and approved a transaction.
The money disappeared.
A private cyber investigation later uncovered a much more complicated operation than a simple fake website. Here are six things the case shows about modern online scams.
1. Scammers don’t always make ridiculous offers
A scam doesn’t have to promise an impossible exchange rate.
Being slightly better than everyone else can be more convincing.
If an unknown service consistently offers better terms than established competitors, don’t just ask whether the offer is attractive. Ask why it is possible.
2. Fake security procedures can make a scam look more legitimate
The site requested an AML check.
That sounds reassuring because real financial companies use AML procedures.
But the check was simply part of the scam. Its purpose was to convince the victim to authorize the transaction himself.
A real AML procedure checks the source of funds. It doesn’t require you to send your money away to prove that it is legitimate.
3. There may be an entire business behind the scam
The investigation connected the case to a Drainer-as-a-Service operation.
Instead of one person doing everything, different groups can provide different parts of the operation.
One group builds the infrastructure. Affiliates advertise it and find victims. Other participants may help move or convert the stolen funds.
In some publicly known cases, affiliates have reportedly received up to 80% of the proceeds.
That makes these scams much harder to trace than a simple fake website run by one person.
4. Seeing the same advertisement can require becoming the same kind of user
The investigators needed to see the ad themselves.
But targeted advertising doesn’t work the same way for everyone. Country, age, interests, device, and other factors can affect what appears in a feed.
So they created a new account, used a consistent browser environment and a US IP address, and obtained a US phone number from Tell A Bot SMS verification service.
A temporary US mobile number was enough to complete the Instagram signup.
They then followed financial and investment accounts similar to the victim’s interests.
Eventually, the same P2P exchange advertisement appeared.
5. Reporting isn’t the same as preserving evidence
A scam ad can disappear quickly.
The investigators therefore saved screenshots, identifiers, URLs, timestamps, and file hashes while the ad was still online.
They also avoided jumping to conclusions. A shared payment account doesn’t automatically prove two people are the same person. Someone who handled stolen funds isn’t automatically part of the original scam.
Evidence is useful only when you can explain exactly what it proves.
6. The hardest part isn’t buying the tools
Residential IPs, a clean browser, and a temporary phone number were relatively easy to obtain.
The hard part was keeping the investigative account alive and behaving naturally long enough for the right advertisement to appear.
And even successful research doesn’t recover the stolen money.
Private investigators can’t issue subpoenas or freeze accounts. They can preserve evidence and provide it to platforms, lawyers, payment companies, courts, or law enforcement.
The simplest lesson is also the most useful:
If an unknown service offers a better exchange rate than everyone else and then asks you to prove that your money is clean by authorizing a transaction, walk away.
