What this tutorial says in five lines
- A paid ad is bought reach, not a recommendation. Anyone can buy one.
- Deepfaked endorsements of real people are now routine and cost almost nothing to produce.
- A giveaway that asks you to send crypto to receive more is the entire fraud in one line.
- Any investment group where you cannot verify the admin’s identity is a set, not a community.
- Look up the exact name in quotes on a source you found yourself — the tells are usually public.
- Reach out to the person whose face is used. They did not endorse it.
Why this matters
Social platforms are the most efficient fraud distribution channel ever built, for one structural reason: they sell attention, and attention is the only thing a fraud needs before its first pitch. This tutorial covers the four channels through which these scams arrive — paid ads, direct messages, group chats and giveaways — and the specific verification that defeats each one.
Why paid ads changed the economics of fraud
Before social advertising, a fraud operation had to build an audience. Now it can rent one, targeted by interest, age and location, for a few dollars per thousand impressions. A video that looks like a news interview with a well-known business figure can be produced cheaply and shown to exactly the audience most likely to act on it.
This is why "I saw it advertised" carries less weight than it used to. An advertisement is a purchase, and the platform’s review is a quality gate rather than a legitimacy check.
A sponsored post is bought reach. The person whose image appears in it has almost certainly never seen it.
The four channels and the check that defeats each
These are the routes by which almost all social-media crypto fraud arrives. Each has a specific verification that works, and each check is independent of anything the sender controls.
The giveaway row is the only one that needs no investigation at all — the request itself is conclusive.
| Channel | How it presents | The tell | The check that works |
|---|---|---|---|
| Paid advertisement | A video or article styled as a news item or a celebrity endorsement | Urgency, a link to an unfamiliar domain, no named journalist | Search the exact headline in quotes. Real news exists on real news sites. |
| Direct message | A friendly stranger, often attractive, patient, and never in a hurry | Contact you did not seek, and a gradual move toward investment talk | Ask for an unscripted video call at short notice. Note the excuses. |
| Group chat | A large group with testimonials, screenshots and an encouraging admin | Almost everyone agrees, and the enthusiasm is uniform | Try to verify the admin’s identity outside the group. You will not be able to. |
| Giveaway | Send crypto to a named address to receive double back | The request itself. There is no legitimate version of this | None needed — close it. |
| Fake support account | A reply to your public post offering to help | They contacted you; real support does not | Look up the official handle yourself and contact them directly. |
Why the group chat is the most effective channel
A group chat manufactures the two things people rely on most: social proof and consensus. Testimonials appear from accounts with history, screenshots show wins, and the general mood is warm. The member count implies that many people have verified something.
What victims rarely consider is how cheap this is to produce. A group of four hundred members can be operated by a handful of people, with one person answering as several, and the testimonials are written by the same team that will later handle the withdrawal refusal.
The chart below shows how these channels perform, which explains why the group format persists despite being the easiest to fake.
Which channels convert most effectively, per attempt
Relative reported success rate per approach, by channel
Reading: The group format ranks highest because it supplies evidence no single account can: other people, appearing to agree. That apparent agreement is the product being sold.
The giveaway mechanic, stated plainly
There is no version of this that works, and understanding why removes the small doubt that keeps people engaged.
To send you double, the operator would need to know which address sent the funds and then return more than was sent, at a loss, on purpose. No business does this. The appearance of one is created by a fabricated screenshot of a previous payout.
The real mechanic is simpler: funds sent to the address are collected, and nothing is returned.
No legitimate person, platform, exchange, brand or celebrity will ever ask you to send crypto in order to receive crypto. There is no exception to this, and it is the most reliable single rule in this entire library.
Hardening your own accounts
These scams do not only arrive at your inbox. A compromised social account becomes a delivery channel pointed at everyone who trusts you, which is why the accounts of people who post about crypto are targeted for takeover.
The measures below take under half an hour and close the routes most commonly used.
- 01Turn on two-factor authentication with an authenticator app, not SMS, on every account connected to your identity or your money.
- 02Review third-party app connections and remove anything you do not recognise — an old authorisation can post as you.
- 03Check active sessions and sign out everywhere if you see a device you do not know.
- 04Set your account so that direct messages are restricted to people you follow, where the platform allows it.
- 05Never post wallet balances, transaction screenshots with visible addresses, or the amount you hold — it marks you as worth approaching.
If a friend’s account messages you about an investment opportunity, verify on a channel they do not control. A video call on a number you already had is the fastest test.
What to do when you spot one
Reporting a fraud post costs a minute and removes the channel for the next person, which is the only mechanism that reliably reduces reach.
- 01Report the advertisement or post inside the platform, using the fraud category rather than the spam category.
- 02Tell the person whose face or name was used. Their team can pursue impersonation takedowns, and they usually act quickly.
- 03Paste the domain and the receiving address into a search engine before doing anything else — operations are reused and the warnings are often already public.
- 04If you sent funds, record the transaction hash and the receiving address before the post is taken down — the evidence disappears with the content.
- 05Report the approach at IC3.gov and ReportFraud.ftc.gov, including the platform and the handle.
- 06Warn the group you found it in, factually and without detail about your own position.
The visual summary
Everything above, reduced to the four stages that matter for this topic. If you only look at one thing on this page, look at this.
Where this fits in the pattern
Before contact
Nothing has happened yet. This is when every tutorial here is most useful and costs you nothing but reading.
During the approach
The script is running. The verification tests in this tutorial are designed to be run here, neutrally, without confrontation.
At the money request
The decisive moment. Any request for funds, fees, taxes or unlock deposits is the end of the script, not a stage of it.
After a loss
Prevention is over; evidence work begins. Preserve, report, and never pay a second fee to recover the first.
Common questions
Check an address that came from a social post
Before you send anything, run the receiving address through the tracer to see its real on-chain history — which is often the whole warning you needed.
Primary sources and further reading
- FTC — Social Media Scams consumer.ftc.gov
- FTC — Consumer Sentinel Data Book www.ftc.gov
External links open in a new tab so you can verify the underlying material yourself. TrueMoneyTalk is not affiliated with these organisations.
Prevention only works if it reaches people before the contact does.
Disclaimer: this tutorial is general information, not legal, financial or recovery advice, and is not a substitute for advice from a licensed professional in your jurisdiction. Individual outcomes vary and are never guaranteed.