What this tutorial says in five lines
- Every crypto investment fraud runs the same seven stages in the same order.
- Stages one to three contain no request for money — that is what makes them work.
- The first request for funds is the end of the script, not a step within it.
- Trust is manufactured through time, small wins and social proof before it is ever tested.
- Once you can name the stage you are in, the next move stops being a surprise.
Why this matters
Investment fraud is not improvisation. It is a scripted process refined over thousands of victims, and the reason it feels personal is that the script is designed to. Each stage has a purpose, a duration and a specific cue that marks the transition to the next. Learning the seven stages does something no amount of scepticism achieves on its own: it lets you locate yourself in the process, which is what makes the following move predictable.
Why a script beats a lie
A single lie has to survive scrutiny immediately. A scripted process survives it by never presenting the lie until a point where scrutiny has already been spent on smaller, true-seeming details.
This is why victims of well-run operations describe months of legitimate-seeming contact before anything untoward occurred. Nothing was being hidden; the fraud had simply not started yet.
The absence of a money request in the first weeks is not evidence of good faith. It is stage management, and it is the part of the process that makes everything after it possible.
The seven stages
These occur in this order, and the durations are typical rather than fixed. The two columns that matter most are the cue that the stage has begun and the correct action at that point.
Read the correct action column as what you do while still neutral — no confrontation, no accusation, just verification. Confrontation ends the observation and removes your advantage.
| Stage | What happens | The cue it has begun | Correct action |
|---|---|---|---|
| 1. Introduction | Contact through a dating app, a group, a job post or a mistaken message | Someone you did not seek out is unusually easy to talk to | Do not invest. Verify their identity independently. |
| 2. Rapport | Weeks or months of genuine-feeling conversation; no money mentioned | Photo, voice notes, consistent story, time invested in you | Ask for a live video call. Note the excuses if refused. |
| 3. The soft reveal | They mention their own success: a platform, a mentor, a group, a strategy | Investment talk appears, but as *their* story, not a pitch | Treat the platform as unverified from this moment. |
| 4. The small win | You are invited in at a small amount; the balance climbs; a withdrawal works | You withdraw something successfully | Recognise this as a trust device. Do not scale up. |
| 5. The expansion | Bonuses, "limited allocation", a mentor who is impressed by you | Your deposit stops being enough | Run the nine platform checks. Do not add funds. |
| 6. The wall | Withdrawal fails; the reason is a fee, a tax or a verification deposit | Your withdrawal does not arrive | Stop all payments. Preserve everything. |
| 7. The second fraud | A "recovery agent" or a "fellow victim" appears | Inbound contact within days of the loss | Report it. Do not respond. Never pay. |
Where the money actually goes, by stage
The financial shape of the playbook is worth seeing, because the escalation is not arbitrary — deposits cluster around a small number of predictable moments, and stage six is where the total finalises.
This chart shows the relative share of total victim loss contributed at each stage, based on patterns in published victim disclosures.
How victim loss accumulates across the seven stages
Relative share of total loss contributed at each stage
Reading: Stage five carries the largest share because it is the stage designed to feel like a reward. Stage seven — the recovery fraud — is the only stage that takes money from someone who already knows they were defrauded, which is why it is worth naming separately.
The three tests you can run from any stage
You do not need to know the stage to protect yourself. These three tests work at any point in the process, and they work because each one requires something the script cannot provide without breaking itself.
Run all three before any money moves. All three are free, and two of them take minutes.
- 01The video call test: ask for a live, unscripted video call at short notice. Scripted operations depend on prepared contact; a real person does this without resistance.
- 02The platform test: take the platform name and search it on sites you did not reach from their link. A fabricated platform has no independent existence.
- 03The withdrawal test: deposit the minimum allowed and withdraw it immediately. This is the only test with a definitive result, so run it with an amount you would not mind losing.
Run these neutrally, without accusing anyone of anything. Each one keeps the relationship intact if you want to keep observing, and each one protects you if you do not.
The sentence that ends every stage-six conversation
Once a withdrawal has failed, the script has only one remaining objective: to obtain one more payment. Every framing serves that single purpose.
There is one response that closes all of them, and it does not require you to determine which framing is being used.
"I will not pay anything further in order to access my own money." That covers a tax, an unlock fee, a verification deposit, a gas top-up and a court fee. There is no legitimate platform in the world for which this sentence is a problem.
If you are in stage five right now
The good news is that this is the single best moment to stop, because you are pre-loss and the information you need is already available to you.
The bad news is that it is also the stage designed to feel most rewarding, which is why the decision is genuinely difficult rather than obvious.
- 01Do not add funds. Not a bonus, not an upgrade, not to "unlock" a tier.
- 02Attempt the withdrawal test with a meaningful but affordable amount before depositing anything further.
- 03Search the platform independently, from a device where you have not clicked their links.
- 04Write down everything you have already deposited, with hashes and addresses, while you still have platform access.
- 05If the withdrawal works cleanly and instantly, you have one data point — not proof. If it fails, you have your answer and you have lost nothing further.
The visual summary
Everything above, reduced to the four stages that matter for this topic. If you only look at one thing on this page, look at this.
Where this fits in the pattern
Before contact
Nothing has happened yet. This is when every tutorial here is most useful and costs you nothing but reading.
During the approach
The script is running. The verification tests in this tutorial are designed to be run here, neutrally, without confrontation.
At the money request
The decisive moment. Any request for funds, fees, taxes or unlock deposits is the end of the script, not a stage of it.
After a loss
Prevention is over; evidence work begins. Preserve, report, and never pay a second fee to recover the first.
Common questions
Locate yourself in the process
If funds have already moved, the tracer builds the movement record and the Report Builder turns it into the filings your next step actually requires.
Primary sources and further reading
- FBI IC3 — Internet Crime Report www.ic3.gov
- FTC — Investment Scams consumer.ftc.gov
External links open in a new tab so you can verify the underlying material yourself. TrueMoneyTalk is not affiliated with these organisations.
Prevention only works if it reaches people before the contact does.
Disclaimer: this tutorial is general information, not legal, financial or recovery advice, and is not a substitute for advice from a licensed professional in your jurisdiction. Individual outcomes vary and are never guaranteed.