A self-proclaimed "successful individual" engaged in automobile trading, who speaks with considerable tact; a crypto assets application that appears to display real-time cryptocurrency prices, account balances, and investment returns; and on-screen figures showing continuously rising returns ultimately exceeding 800%—if one looks only at the numbers on the screen, this might appear to be a story in which both romance and wealth arrive simultaneously.
It was not until the user requested a withdrawal that the platform began to delay, citing reasons such as account anomalies and failed verification. The purported romantic partner and the individual responsible for cash settlement subsequently became unreachable. Only then did she realize that what she had been viewing might not have been a crypto assets account involving genuine transactions, but merely a back-end interface that the fraud syndicate could modify at will.
The Hong Kong Police Force’s “Cyber Defender” unit recently reported that, between July 24 and July 30, the police received 25 reports of investment fraud cases involving online romance scams, with total losses approaching HK$70 million. Among these, an insurance practitioner in her fifties handed over approximately HK$4 million in cash and transferred nearly HK$22 million to multiple mule bank accounts over a period of about six months, resulting in cumulative losses exceeding HK$26 million. After the fraudulent investment app displayed returns exceeding 800%, her withdrawal request was rejected, and the relevant individuals subsequently became unreachable.
What truly warrants the attention of Web3 users in this case is not merely the admonition to “not trust investment recommendations from online romantic partners.” The more significant issue is:An app can be designed to closely resemble a cryptocurrency exchange, displayingUSDTbalances, candlestick charts, and profit records, yet the figures on the page do not necessarily correspond to real-world assets existing on-chain.
What fraudulent platforms fabricate is not merely returns, but the very “sense of asset existence.”
Many fraudulent investment platforms do not limit themselves to producing simple screenshots of returns. Instead, they replicate the comprehensive interfaces of legitimate exchanges: users can log into their accounts, view candlestick charts, select cryptocurrencies, submit orders, contact customer service, and even observe daily fluctuations in principal and earnings.
These features create a highly tangible impression for users that their funds have entered an investment account and that the platform has indeed used those funds to purchase USDT, Bitcoin, or other digital assets.
However, what appears on the page depends entirely on what the platform’s back-end chooses to display. Account balances, yield rates, and position records may simply be entries in a database, without corresponding to any genuine wallet addresses or on-chain transactions. In its risk alert regarding online investment fraud, the Hong Kong Police Force’s “Cyber Defender” unit explicitly stated that fraudulent websites are often difficult to locate through standard search engines, fraudulent apps may not be listed on official app stores, and the product prices and user asset portfolios displayed on such pages may be fabricated.
Therefore, when assessing the authenticity of a platform, it is insufficient to ask only whether the app resembles an exchange. One must further inquire: Does the so-called account balance represent merely internal bookkeeping by the platform, or does it correspond to on-chain assets that can be independently verified?
Viewing assets, querying assets, and controlling assets constitute three distinct levels.
The display of “holding 1 million USDT” in the app merely indicates that the platform presented this figure to the user; it does not prove the actual existence of 1 million USDT on-chain.
If the platform can provide wallet addresses and transaction hashes, and the user can verify the transactions or balances via an independent blockchain explorer, this confirms the existence of the relevant on-chain records. However, even if assets exist on-chain, it remains necessary to confirm whether such assets belong to the user and whether the user possesses actual control over them.
For instance, a platform may display the same public wallet address to multiple users, or show portions of assets held in a unified custodial address, without implying that each user has the independent right to dispose of the corresponding balances. The decisive factor is whether the user can withdraw assets normally in accordance with publicly disclosed rules, or whether the user holds the relevant private keys, signing authority, and other means of actual control.
In other words, the presence of a balance on the interface does not equate to the existence of assets on-chain; nor does the existence of assets on-chain equate to the user’s possession of control rights.
Based on publicly available information in this case, the victims’ primary payment methods were cash delivery and bank transfers. There is no public material proving that these funds were genuinely converted into virtual assets, nor is there evidence indicating that the victim ever possessed the corresponding wallet addresses or transaction hashes. Therefore, although this case was packaged as “cryptocurrency investment,” the so-called crypto assets may have existed solely within the backend interface of the fraudulent app.
Five key aspects should be verified to assess the authenticity of a platform
To determine the credibility of a crypto platform, one should not rely solely on interface design, customer service responsiveness, or permission for initial withdrawals. Instead, a comprehensive review should cover the platform entity, regulatory status, download channels, funding paths, and asset control.
First, verify the operating entity. The platform should clearly identify the company providing the services, and there should be consistency among the registered address, service agreement, customer service email, and the actual payment recipient. If the platform fails to disclose the operating company, or if the company name in the service agreement is entirely unrelated to the payment account or website domain, heightened caution is warranted.
Second, verify the regulatory status. The Securities and Futures Commission of Hong Kong continuously publishes lists of licensed virtual asset trading platforms and alerts regarding suspicious platforms. Users can verify through official channels whether the licenses claimed by the platform are genuine and whether the scope of permission covers the services actually provided. It should be noted that a platform’s absence from the alert list does not imply that it has obtained a license, nor does it guarantee the platform’s safety.
Third, verify the download channel. Fraudulent platforms often do not offer downloads through official app stores or verifiable websites. Instead, they distribute private links, QR codes, beta applications, or installation packages via romantic partners met online, so-called investment mentors, or group chat customer service representatives. The more the download process relies on specific contacts, the more difficult it becomes for users to independently verify the platform’s true identity.
Fourth, verify the funding path. Legitimate platforms typically maintain relatively stable deposit channels that are disclosed in their platform rules. If a platform repeatedly requires users to transfer funds to different personal accounts, shell company accounts, or unfamiliar wallets, or even arranges for offline personnel to collect cash, such funding paths often lack a genuine correspondence with the so-called “platform investment accounts.”
Finally, verify asset control. Key indicators of a platform’s genuine operation include whether users can obtain authentic order records, wallet addresses, and transaction hashes; whether they can independently query transactions; and whether they can withdraw assets normally in accordance with publicly disclosed rules.
A successful initial small withdrawal does not prove the platform's legitimacy.
Some fraudulent investment platforms allow users to obtain small profits in the early stages, or even complete a small withdrawal. The Hong Kong Police Force’s risk advisory on online romance investment scams also notes that fraudsters may first allow victims to earn small profits to build trust, thereby inducing them to invest more funds.
However, a single small withdrawal only proves that the counterparty is willing to pay a certain amount to the user; it does not prove that all assets displayed in the platform account genuinely exist, nor does it prove that the so-called profits stem from genuine market transactions.
For fraud syndicates, using a small payment to induce users to subsequently inject dozens of times more capital is itself part of the cost of the scam. Once users interpret “successful small withdrawal” as the platform having completed comprehensive credit verification, they tend to overlook the fact that the operating entity, fund flows, and on-chain assets remain unverifiable.
Therefore, the legitimacy of a platform cannot be determined based on a single customer service response, a single receipt of funds, or a so-called regulatory certificate. Instead, users should continuously observe whether various pieces of information corroborate one another.
If these anomalies occur, cease further investments immediately.
A single anomaly may not be sufficient to directly prove that a platform is fraudulent. However, when multiple anomalies occur simultaneously, users should no longer continue investing under the pretext that “the review process may just be slow” or “the platform’s business model is unique.”
Examples include: the platform can only be downloaded via private links, and the operating company cannot be identified; the so-called licensing information cannot be verified on the regulator’s official website; the deposit accounts are inconsistent with the platform name and change frequently; users cannot see any genuine wallet addresses or transaction hashes; account returns show long-term unilateral growth, largely unaffected by market volatility; and after requesting a withdrawal, users are required to pay taxes, security deposits, credit verification fees, or unfreezing fees to new accounts.
In particular, when the platform refuses to deduct relevant fees directly from the so-called account balance but instead requires users to make additional payments of new funds, this usually indicates that the balance shown on the page may not possess genuine asset attributes.
Users may also verify suspicious URLs, telephone numbers, beneficiary accounts, social media accounts, email addresses, and other information through the Hong Kong Police Force’s “Anti-Deception Coordinator.” However, the relevant tools provide only risk assessments, and the query results cannot substitute for a comprehensive verification of the platform entity, regulatory status, and asset authenticity.
Upon identifying a suspicious platform, the first step is to preserve original information.
When users suspect that a platform may have issues, they should not immediately delete the app, reset their mobile device, or retain only a few cropped screenshots of profits. The platform’s installation package, download links, domain names, login accounts, customer service records, receiving accounts, and page changes may collectively reflect how the platform was built and operated.
Users shall preserve complete chat records, documenting who recommended the platform, from where the download link was obtained, at whose instruction funds were paid, and how the platform explained returns and withdrawals. Bank transfers, cash settlements, and actual virtual asset transfers shall be recorded separately; users must not broadly characterize all funds as “purchased crypto assets” merely because the App displays USDT.
If on-chain transfers have actually occurred, users shall also preserve wallet addresses, transaction hashes, token types, and networks; if payments were made only to bank accounts, users shall clearly distinguish bank funds from the virtual balances displayed solely within the App’s backend.
Such distinction not only helps reconstruct the facts, but also prevents continued misdirection by the interfaces of fraudulent platforms: the assets actually delivered by the user may be entirely different from the assets the App claims the user holds.
Lawyer’s Observations
The most deceptive aspect of fraudulent crypto platforms is not that they bear no resemblance to exchanges, but that they increasingly resemble legitimate exchanges.
They may display candlestick charts, account balances, order histories, and customer service systems; arrange small-scale withdrawals; and even produce seemingly authentic licenses and corporate documentation. However, none of these appearances can substitute for verification of the operating entity, funding pathways, on-chain records, and control over assets.
The most critical factor in determining whether a crypto investment is genuine is not the amount of USDT displayed on the interface, but confirming whether the relevant assets truly exist, can be independently queried, and are under the user’s actual control.
When a platform is accessible only through specific contacts, funds continuously flow into personal accounts unrelated to the platform, on-screen returns keep rising, and no verifiable on-chain records can be provided, the issue is likely no longer “whether investment risk is high,” but whether the so-called investment ever existed in reality.
/ END.
*This article is an original work of Mankun Law Firm. It reflects only the personal views of the author and does not constitute legal consultation or legal advice on any specific matter. For reprint permissions and legal consultations, please contact customer service at: mankunlawyer.
