The trading app that is not an exchange

The app that behaved perfectly until the exit

Between 22 December 2021 and 7 May 2022, according to a Private Industry Notification published by the FBI on 18 July 2022, criminals posing as a US financial institution took roughly $3.7 million from at least 28 people. The mechanism was an app: it carried the name and logo of a real institution, and victims deposited crypto into wallets tied to their accounts inside it. What happened next is one flat sentence: "When 13 of the 28 victims attempted to withdraw funds from the app, they received an email stating they had to pay taxes on their investments before making withdrawals. After paying the supposed tax, the victims remained unable to withdraw funds."

Across the wider activity in that document, the FBI counted 244 victims and about $42.7 million.

Nothing in that story is about trading. The balance went up because a database said it went up. The chart moved because a chart is a picture. The exit failed not because a withdrawal broke, but because there was never a venue behind the screen - and everything painful that followed was decided by that one unchecked fact.

If you have seen how a signals operation runs end to end, the sequence, step by step usually terminates at a "platform" you were sent to. This piece is only about that platform: how to tell it apart from a real venue before you fund it.

What are you actually testing?

A trading venue is a set of obligations, not an interface. It matches orders against other people's orders. It holds an asset it must be able to give back. It publishes rules - fees, margin, liquidation - and answers to somebody when it breaks them. An app is a screen.

The gap is not theoretical. In a case announced in December 2025, the SEC alleged that investors were moved out of group chats onto purported crypto asset trading platforms "which falsely claimed to have government licenses, as alleged," and put the outcome directly: "In reality, no trading took place on the trading platforms, which were fake, and the Security Token Offerings and their purported issuing companies did not exist, according to the complaint" (SEC press release 2025-144).

The scale is not marginal. The FBI's 2025 Internet Crime Report states that "Cryptocurrency investment fraud was the highest source of financial losses to Americans in 2025 with $7.2 billion reported in losses," and describes the same machinery: victims "are enticed to send cryptocurrency to fake investment scam platforms or apps and are shown fake profits and offered loans to encourage larger investments."

So the question is not whether the app looks professional, but whether the venue exists outside its own screen.

In what order should you check?

Cheapest first. Four of the five checks cost minutes and no money, and all belong before a deposit. The one that costs money goes last, because it proves the least.

1. Where did the app come from?

Provenance is the fastest signal available. A public app store listing carries three things a link cannot: a named publisher, a version history with dates, and a distribution channel that is not a person in your chat. That is not authorisation, but it gives you a name and a timeline to check the story against. Compare the alternatives:

• A beta invite. Apple describes TestFlight in its own words: it "makes it easy for testers to give feedback on your apps, games, and App Clips across Apple platforms before you publish" (Apple, TestFlight). A venue with real customers distributing itself as an unpublished beta is telling you where it sits.
• A file or a device profile. An installer sent over chat, or a configuration profile, means no listing, no publisher record and no history - plus access to your phone that a web page never has.
• A web app and nothing else. Fine, but then the domain carries the weight.

The same notification tells investors to "Verify an app is legitimate before downloading it by confirming the company offering the app actually exists, identifying whether the company or app has a website, and ensuring any financial disclosures or documents are tailored to the app's purpose and the proposed financial activity."

Then check the age of the domain: a public registration-data lookup such as ICANN Lookup returns the creation date of a domain name. A venue presenting itself as established, with years of clients, on a domain created eleven days ago has made a claim you can settle alone. Registration data can sit behind a privacy service, and a young domain proves nothing alone - but a young domain under an old story is a contradiction.

2. Who authorises it, and in which country?

Most people do half of this check and stop.

Registers are per-jurisdiction. The UK's Financial Conduct Authority states that "Almost all financial services firms in the UK must be authorised or registered by us," and points consumers at its Firm Checker with an instruction worth reading twice: "Check that the firm reference number (FRN) and contact details you've been given match the details on the Firm Checker," and "Always use the website address above to visit the Firm Checker" (FCA, protect yourself from scams). The second line matters because an impostor will hand you a genuine reference number belonging to somebody else, plus a link to a lookup page it controls.

In the US, the CFTC says "Before working with any person or firm to trade in commodity futures, commodity pools, options, forex, or other derivatives, verify that the entity is properly registered with the CFTC," while noting that "Some firms or individuals may be exempt from registration or may not be regulated by the CFTC" (CFTC, check registration). Read what that register answers for: it covers derivatives activity, not every venue that will take a crypto deposit, so a blank result there is not a verdict on a spot platform.

Warning lists are the other half, and weaker evidence than people assume. The FCA publishes a Warning List of unauthorised firms. The CFTC publishes the RED List, which "contains names of foreign entities that appear to be acting in a capacity that requires registration with the CFTC, but they are NOT registered with the CFTC," and which carries its own caveat: "The inclusion of an entity's name on the RED List does not mean that the CFTC or a court has concluded that a violation of any provision of the Commodity Exchange Act or the Commission's Regulations has occurred." IOSCO's Investor Alerts Portal collects alerts published by member regulators - the fastest way to look across jurisdictions, though it holds only what members choose to publish.

Absence from a warning list is not an endorsement. An entry gets written after complaints arrive and a regulator acts, and a platform three weeks old has not had time to earn one. A listing there is a hard stop; the positive evidence you want is a register entry, under a name and reference number matching what you were given.

A company registration number proves incorporation, not authorisation. Anyone can form a company. A number from a companies registry means an entity exists and a filing was made; it says nothing about permission to hold client money, run a trading venue, or solicit anyone. An app whose only credential is a registration number and a certificate image has answered a question you did not ask. Check that the number resolves in the registry it claims, to the same name - then check the register that governs the activity.

3. Do the prices agree with the outside world?

Open the same pair on a public venue, on a different device, and compare at the same minute. Small differences are normal: venues run their own books, spreads and latency. What you want is cruder - a price that never moves against you, a chart with no wicks during a volatile hour, a quote that drifts by percent rather than ticks.

Then ask whether the pair exists at all. An instrument no public venue lists is not exotic, it is unpriceable - and an unpriceable instrument is a number the app sets to whatever it likes.

Finally, look for the documentation a venue cannot avoid publishing: fee schedules, margin tiers, funding mechanics, a liquidation policy, a status page, an API. These differ per venue and change over time, which is why a real one has to keep them current - and why an app with nothing but marketing copy has nothing to keep. Real venues carry real risks, and exchange risk explained covers them; the difference is that a real venue's risks are documented in advance and a fake one's are invented when you ask.

4. Where does the deposit actually go?

On a real venue, a deposit address belongs to your account and is issued inside it. When an address arrives from a person instead - an account manager, someone who messaged you first - the routing of your money depends on that person, not a system. Addresses handed out per user in chat are how money gets separated from the account it was supposedly credited to.

Before sending anything, paste the address into a block explorer for that chain. Two things are worth a minute: whether it has any history, and where funds go after they land. An address created hours ago that forwards everything onward within minutes is a collection point, not a treasury. A different address on a second request deserves the same suspicion, as does a request to send a token or chain other than the one on screen.

Identity requests run the same tell in reverse. A venue with real obligations asks who you are at defined moments and explains why; an app that asks nothing until you try to leave, then demands documents to release a withdrawal, has produced a hurdle, not a process.

5. The small withdrawal - last, and least

Send a small amount out early and see whether it clears quickly, with no conditions attached. Do it last: it costs money, takes time, and carries the weakest evidence of the five. What a successful withdrawal actually proves is exactly one thing, and it is smaller than it feels.

What carries information is the shape of the refusal, when one comes. A joint investor alert from the SEC and the CFTC describes it plainly: "Sometimes the fraudsters direct investors to pay additional costs (such as purported taxes) to withdraw fake 'profits' earned from the investment." The alert then names the pattern: "This is an example of an advance fee fraud scam, where investors are asked to pay a bogus fee in advance of receiving proceeds, money, stock, or warrants" (joint investor alert on fraudulent digital asset and crypto trading websites). The FBI's March 2023 public service announcement supplies the ending: "When victims attempt to withdraw their money, they are told they need to pay a fee or taxes. Victims are unable to get their money back, even if they pay the imposed fees or taxes."

The rule is not that withdrawals never carry fees - real venues charge network and withdrawal fees, deducted from what you take out. The rule is about direction. Money that has to go in before money can come out - a tax, an unlock fee, a verification deposit, a tier upgrade, a minimum balance you never agreed to - is the moment the account stops behaving like an account.

If money is already inside

Stop adding to it. The FBI's account of these cases is that victims who paid the demanded taxes or fees still could not withdraw: the exit charge is a second loss, not a rescue. Preserve what you can while you still have access - deposit addresses and transaction hashes, the app name and where it was installed from, the domain, screenshots of the balance and the fee demand, the handles of whoever sent you there. Report to the regulator in your jurisdiction, and in the US to the FBI's Internet Crime Complaint Center. Treat anyone arriving afterwards to recover the funds as the second half of the same event.

The fact nobody checked

Everything painful in these stories happens after a deposit, and everything decisive happens before one. App provenance, domain age, a register entry, a price checked against a public venue, a deposit address on an explorer - under an hour, across sources that cannot all be controlled by whoever sent you the link.

You have already decided to follow somebody else's trades. That decision is yours to make and yours to be wrong about. But where your money sits while you make it is a separate question with a checkable answer - and losing it there is not a trading outcome. It is an unasked question.