Before the money

Almost nobody answers the question "how did it start" with "there was an advert". It was a reply under a video that read as unusually level-headed. A group a colleague had already joined. A message from an account showing two contacts in common and a decade of unremarkable holiday photographs. At that point nothing was for sale — which is exactly why none of it registered.

Nothing about the opening stands out

The first two weeks are built to pass for ordinary internet. Someone mentions their own returns and leaves it there. A doubter asks the question already forming in your head and receives a patient, technical answer. A member grumbles that a withdrawal took three days and another member politely corrects him. The conversation is staging its own credibility, and doing it well.

Clients tell us they were "not the sort to fall for this", and they are generally correct. That is the point of starting nowhere near a payment: a person braced against a sales pitch has no guard up against a group chat.

The places these start

Across the files that reach us the entry points fall into a handful of places:

• Comment threads under finance or news videos, where an obliging reply turns into a private message
• WhatsApp and Telegram groups entered by invitation rather than discovered
• Professional networks, where a profile with a credible career history opens with a question instead of an offer
• Short-video feeds, where a clip about somebody's returns closes with an invitation to a group
• Advertising that helps itself to a broadcaster's name, a public face, or the lettering of a bank you use

The common thread: you are brought in by invitation and left feeling you found the thing yourself. That feeling is what is being manufactured.

The first small deposit buys something other than a position

The first figure named is a small one, and everything around it performs faultlessly: registration works, identity verification is asked for in the manner a real firm would ask, and a modest withdrawal sometimes goes through. People describe that withdrawal afterwards as the moment the worrying stopped.

The deposit is not the point of it. It turns an unknown website into something you have tried yourself, and from then on every new fact is weighed against that memory rather than against what is actually on the screen.

What can actually be verified in the moment

Hardly any of this needs expertise. Before a single transfer goes out, a few things are in plain sight and cost nothing to check:

• Which legal entity stands behind the site, and whether it appears on the public register of the regulator it claims to answer to
• Whether that entry is the company actually receiving your transfer, rather than a similarly named firm somewhere else
• Where the money is actually going — a licensed payment provider, a private account, or a wallet address handed over in chat
• How the person at the other end takes being asked any of that

That last one tells you most. A regulated firm does not mind being checked. An operation that meets a question about registration with warmth, or urgency, or an argument about a window closing has already answered you.

If you are in one of these conversations right now

Then the single most useful thing available to you is to do nothing for a day: send no further money while the entity name is checked against the register. Nothing legitimate lapses overnight, whatever you are being told about a closing window.

And where the transfers have already left, the very material that would have answered those questions is what a case gets built from now — the statements, the screens, the messages, and the order they came in. Put them somewhere you can find them again, and write to us with what there is.