Special Investigations — Part 2

18 domains registered in the last 90 days, all cloning a real MT5 skin. First withdrawal succeeds; the second is gated behind a fabricated 20% IRS clearance fee. Deposit wallets cluster on Tron TRC-20.

Paid signal channels selling 'guaranteed 30% weekly' that quietly pivot into a pooled trading platform. Deposits go to a rotating TRC-20 cluster we tag daily.

Search ads impersonate FCA-registered UK brokers. The FRN on the site is real; the domain, phone, and dashboard are the scam. Always cross-check the FRN on the FCA register.

Openers claim to be Emma / Chloe / Sophia in Singapore who 'met your friend at a gallery'. Moves to WhatsApp within 6h and cites a fake FINEXO-branded trading app. Deposit wallets cluster on Tron TRC-20.

Old script, new domains. The 'wealthy uncle' now sends a MetaTrader5 clone hosted on look-alike .top domains registered in the last 90 days. First withdrawal always succeeds; second is blocked behind a 20% 'IRS clearance' fee.

Within 48h of filing an investment or wrong-number report, victims are DM'd by 'blockchain forensics' impostors on Telegram asking for an up-front USDT retainer. GACS never charges to help.

Not all pig-butchering starts with a wrong number. Matches on Hinge or Bumble that push to WhatsApp/Telegram within a day, refuse video calls, and mention crypto by week 2 follow the identical script.