Fraud Investigator · Level 1 · about 12 min
Authorized scams
What it looks like
The customer makes every payment themselves, from their own device, after being deceived. There's no takeover to find. What you see is payments that grow, money pulled from savings or new credit, and staff notes where the story doesn't hold.
Transactions · an investment scam that escalates
| Date | Transaction | Detail | |
|---|---|---|---|
| Aug 3 | Transfer out | $500 to a crypto exchange · first time | New payee |
| Aug 10 | Transfer out | $2,000 to the same exchange | Growing |
| Aug 22 | Savings → checking | $10,000 · savings held for years | Savings drained |
| Aug 24 | Transfer out | $8,000 to the exchange | Growing |
| Sep 6 | Loan deposit | $15,000 personal loan, then wired out | New credit |
| Sep 9 | Transfer out | $4,800 · "release fee" to withdraw | Fee to withdraw |
Small first payment, then larger ones funded by savings and a loan, and finally a fee to get money back: the shape of an investment scam (pig butchering).
Supporting notes · signs of coaching
| Date | Source | Note | |
|---|---|---|---|
| Sep 6 | Teller note | Wire of $15,000 to Silverline Trading Ltd. Says it's for a car. | Cover story |
| Sep 6 | Teller note | On the phone throughout; would not say who with. | On the phone |
| Sep 6 | Teller note | Asked us not to call her about it. | Secrecy |
A story that doesn't fit the payee, a caller on the line, and a request for secrecy suggest the customer is being coached.