A daughter described her father being walked through a signals scam in public, step by step. Reading the sequence in order shows something the individual red flags miss: at each step, a check was available that required a document rather than an argument.

The case, as it was posted

In April a woman posted on r/CryptoScams that her father was being walked into an investment scheme and that nothing she said was landing. Her account is unusually complete, because she wrote it while the scheme was still running rather than after the money was gone.

The group was on WhatsApp. It was run by a figure called the Professor and a second account called the Assistant. The pitch was "100% successful AI trading signals" and a doubling of the deposit inside sixty days. The operation had a free Weebly site, no registered broker behind it, no securities registration and no address. Her father had been allowed to take a small amount out early, and that withdrawal was the reason he believed the rest. By the time she posted, he was asking her to open an account in her name and link her Coinbase.

The sequence in her post is not unique to her family. It matches, point for point, a scheme that regulators in at least eight jurisdictions have published warnings about. Read in order, it shows something that a list of warning signs does not: at every step there was a check available, and each one needed a document rather than an argument.

Step 1: an invitation into a group you did not ask to join

The recruitment happens in a messaging app, in a group that looks busy. New Zealand's Financial Markets Authority describes the format directly in its standing warning on this network of chats. Groups run on WhatsApp, Viber, Telegram and BonChat, "led by a 'mentor', 'coach', 'professor', 'assistant' or 'crypto adviser'", promising "100% returns" on trading signals shared through the day. Members are paid for bringing in friends and family. The regulator adds a detail that is hard to see from inside: the groups "appear popular, but are mostly filled with bots".

The joint investor alert from the SEC, CFTC, FINRA and NASAA describes the same entry point in general terms. Fraudsters "might run advertisements or add targets to a group chat that the target didn't seek to join", then move the conversation somewhere less monitored.

The check available here costs nothing: the roles are the tell. The subreddit's own automatic reply to new posts states it flatly.

"No legit company/trader/investor has 'professors', 'assistants', or 'teachers'. Those are just scammers. No legit company forces you to pay a 'fee' or 'taxes' to withdraw money." - the standing automated reply on r/CryptoScams

Step 2: the claim that closes the case by itself

"100% successful" is the strongest thing in the pitch and the weakest link in it. A hit rate of one hundred percent is not an impressive number in trading, it is a statement that no losing trade has ever occurred, which describes no strategy that has ever been measured. The advertised return does the same work: doubling inside sixty days, repeated, produces a figure larger than the firm selling it could possibly need, which is the whole compounding test applied in one line.

This check needs no access to anything. No screenshots, no track record, no argument about whether the Professor is real. The claim disposes of itself.

Step 3: a registration that either exists or does not

The father's position was reasonable on its face: "Anyone can write anything on the internet." He was right, and the answer to that is not to write more things at him. It is to point at the register.

The Utah Division of Securities published an alert on this exact operation in March 2026. It states there is no record of the firm being registered to sell securities in Utah. It also deals with the counter-claim in advance: the operation "falsely claim[s] to be licensed by the Securities and Exchange Commission". A partial Form ADV filed for exempt-reporting status and a Form D claiming a registration exemption are neither of them registration. The alert says so, adding that Form D filings "are not validated and should not be taken as confirmation that a business is legitimate".

The regulators' own cross-border search tool exists for this. IOSCO runs a public database of alerts published by member regulators, and the FMA's warning tells readers to use it: search the name before the money moves. The value of that search is that it does not depend on anybody's judgement about anybody's character. Either an entry comes back or it does not.

Step 4: the small withdrawal that changed his mind

The one piece of evidence he had was real. He asked for money, and the money arrived. That is the point in the sequence where persuasion usually ends, and it is the reason the payout exists.

"The small withdrawal is the most important thing to address because that's what's keeping him in - it's a standard pig butchering technique, they let victims withdraw a small amount early specifically to build trust before asking for the big deposit. It's not proof the system works, it's the setup for the final ask." - u/Infinite_Airline7705, in the thread

Both regulators describe the same mechanic in their own language. The FMA notes that users "may even be able to withdraw their profits so they believe the platform is authentic and encouraged to invest more funds". Utah's alert records that "a limited number of investors have been able to withdraw small amounts from the platform", and calls it "a common tactic used in cryptocurrency scams to build trust". A payout is an event, and the only thing it establishes is that this particular payout was permitted.

Step 5: the move to an app that erases both sides

Then the group was moved to BonChat, an app most of the members had never heard of. Inside it, administrators can delete messages on both ends of the conversation and block a member instantly. The daughter noticed what that meant: her father would have no record of what he had been promised, by whom, on what date.

This is the step that deserves more attention than it usually gets, because it is the one that converts a persuasion problem into an evidence problem. Every earlier claim, every screenshot, every "guaranteed" number becomes unquotable the moment the operator decides it should be. A track record you cannot re-read is not a weak track record. It is an absence of one, which is the same reason a signal edited after publication tells you nothing about the trade it describes.

The check here is procedural and takes a minute: before a group moves, export or screenshot what has already been said. After it moves, treat the history as gone.

Step 6: the ask that appears when you try to leave

The most useful suggestion in the thread was not an argument. It was a test that the operator has to answer.

"Tell him he's right. Anybody can write anything on the internet. Even claim to be a professor. Tell him to pressure test it. Tell the 'professor' he's changed his mind and wants to withdraw the investment. They'll ask him for a fee... That's the con. There is always another 'fee' or 'tax'. It never ends" - u/ConjunctEon, in the thread

The regulators document the outcome of that test with numbers. The FMA's warning states that when a user asks to withdraw everything, "they are told they must pay a significant fee to release the money", and that these fees run "between 40% and 90% of your total investment". Utah's alert answers the same question in its FAQ: legitimate platforms deduct fees from your balance or issue tax documents, and demanding an upfront payment to release funds is not how any of it works.

What makes this test better than the others is that it does not require the believer to concede anything in advance. He runs it himself, on his own money, and the operator supplies the evidence.

Step 7: the family becomes the product

By the end of the post the father was recruiting: his daughter's identity documents, his wife, an account in someone else's name. This is designed in. The FMA notes that members are "encouraged to invite new recruits (often friends or family)" and are paid for each one.

It also explains why the arguments were failing. He was no longer only a customer, he was a participant with a position to defend, and every request to reconsider now cost him something socially as well as financially. The revenue model behind that structure is not the subscription fee, and it never was.

Why the argument loses and the record does not

One reply in the thread is worth carrying out of it.

"Monitoring this subreddit shows that some people cannot be convinced by the best arguments and evidence until they have lost every[thing]" - u/Blockchainauditor, in the thread

That is the honest ceiling on what a conversation can do. A person who has taken a withdrawal, told his family about it, and defended the decision once already is not weighing evidence in a neutral state. Another commenter noted that this same script is now more than five years old, and mentioned a friend whose mother lost more than a million dollars to it.

What survives the argument is the external record. A register that lists the firm or does not. An alert published by a regulator with a date on it. A chat log exported before the group moved. A set of published calls that can be replayed against prices nobody in the arrangement controls. None of those depend on being believed at the time. They can be checked later, by someone else, and they say the same thing then as now.

That is the practical division. Arguing about whether the Professor is real is a debate. Searching his firm's name in a regulator's alert database is a lookup. Only one of them survives contact with a person who has already decided.

Sources