The Scams Behind the Screens
What happened to Naveen follows a pattern that has been repeated thousands of times across India, in different cities, with different platform names, and with victims from every economic and educational background. The names change. CoinTrustPro, BitLuxe, CryptoVault India, TokenPrime. The mechanics stay the same. A professional-looking app. Fake charts connected to no real market. Small early withdrawals to build credibility. Larger deposits encouraged through rising fake balances. And then, when the victim tries to take out a meaningful amount, the exit door locks.
Naveen fell for a fake exchange scam, which is probably the most common variant operating in India right now. These platforms look like legitimate crypto trading apps. They have candlestick charts, order books, price tickers that update in real time. But none of it is connected to any actual blockchain or exchange. When Naveen “bought” Bitcoin, no Bitcoin was purchased anywhere. His Rs 3,00,000 went straight into the bank accounts controlled by the operators, and the dashboard just showed him whatever numbers would keep him depositing more. The app was in the Play Store, which gave it credibility. Google’s review process catches many fraudulent apps, but not all, and some operate for months before removal. CoinTrustPro had been live for about five months when Naveen joined. By the time he tried to withdraw, it had been running for seven months and had likely accumulated deposits from hundreds of users across the country.
Fake exchanges typically follow a lifecycle. Launch with a clean website and a mobile app. Spend money on Instagram and Facebook ads targeting young professionals in tier-2 and tier-3 cities. Allow small withdrawals for the first few months to generate testimonials and referrals. Once the deposit pool reaches a target amount, freeze withdrawals under various pretexts, drain the accounts, shut down the platform, and relaunch with a new name and a new website. The entire cycle can complete in six to eight months. Some operators run multiple platforms simultaneously under different names.
But fake exchanges are only one category. The broader pattern of crypto fraud in India has several distinct forms, and they often overlap.
Ponzi schemes using crypto vocabulary have produced some of the largest financial frauds India has seen. The GainBitcoin scam, orchestrated by Amit Bhardwaj starting around 2016, promised investors a 10 percent monthly return from what he described as a large-scale Bitcoin mining operation. Investors deposited Bitcoin with the expectation that it would be mined and multiplied. The operation pulled in an estimated Rs 8,000 crore from thousands of investors across India and the Gulf. Bhardwaj was arrested in 2018 in Bangkok. Years later, the vast majority of investors have not recovered anything. The money was not being mined. It was being redistributed. New deposits paid the returns of earlier investors. When new deposits slowed, the whole structure fell apart.
Morris Coin, which originated in Kerala, was a similar operation but with a different wrapping. It marketed a proprietary cryptocurrency, claimed extraordinary return potential, hosted lavish promotional events at luxury hotels in Kochi and Trivandrum, and built a referral programme that rewarded investors for recruiting others. The total amount defrauded is estimated at over Rs 1,200 crore. Many of the victims were working-class families who invested their savings based on recommendations from relatives and friends who were already in the scheme. The social pressure in tight-knit communities is intense: if your brother-in-law and your neighbour and your colleague have all invested and are showing gains, saying no feels like saying you do not trust your own people.
The referral model is what gives these schemes their velocity. When Deepak told Naveen about CoinTrustPro, he was not getting a commission. But many crypto Ponzi schemes pay explicit referral bonuses. Bring in one person, earn 5 percent of their deposit. Bring in five people, earn a higher tier. The structure mirrors multi-level marketing, and the incentive means that every victim becomes a recruiter. The scheme spreads through family WhatsApp groups, office lunch conversations, and neighbourhood chai stall discussions. By the time anyone suspects something is wrong, an entire social circle is invested, and nobody wants to be the first to say it might be fake because that would mean admitting they got fooled and caused their friends and family to lose money.
Pump-and-dump operations run through Telegram channels and WhatsApp groups disguised as “crypto signal” or “crypto trading tip” communities. The structure is simple enough. The channel admin identifies a low-value token with low trading volume. They quietly buy a large quantity of it. Then they post in the channel: “Buy XYZ token now, breakout coming, target 5x in 24 hours.” Hundreds of group members buy the token. The price spikes because of the sudden demand. The admin sells their holdings at the peak. The price crashes immediately after, and the members who bought on the signal are stuck holding a token that has dropped 80 percent. The admin posts about the next signal. Some members stay because they believe the next pick will recover their losses. It never does.
These groups are particularly active in cities like Surat, Lucknow, Jaipur, and Kolkata. Some charge membership fees for “premium signals,” Rs 5,000 or Rs 10,000 per month, which is a second layer of profit from the same victims. Police in Gujarat filed over 40 cases related to Telegram-based pump-and-dump groups in 2024 alone.
Romance scams repackaged as crypto opportunities represent the cruelest variant. International law enforcement calls them “pig butchering” scams. A scammer builds a relationship with the victim over weeks or months, usually through a dating app, Instagram, or even LinkedIn. The conversations are warm, personal, patient. The scammer shares details about their life (all invented), asks about the victim’s life (all studied), and gradually introduces the subject of finances. “I have been doing well with crypto lately. Do you want me to show you the platform I use?” The victim trusts this person. They have been talking for weeks. They might even believe they are in a relationship. The platform the scammer recommends is, of course, fake. The scammer walks the victim through making a deposit, helps them see early gains, and encourages bigger investments. When the victim deposits a large sum, the platform freezes, and the scammer either disappears or starts asking for “fees” to unlock the withdrawal. The victim has lost money and has been emotionally manipulated. Some victims I have read about in police reports sent Rs 10 to Rs 15 lakh before realising what had happened.
Celebrity endorsement scams using deepfake technology have become a growing problem. Deepfake videos of Mukesh Ambani, Ratan Tata (before his passing), various Bollywood actors, and even Indian cricket players have been circulated on Facebook and Instagram as advertisements for fake crypto platforms. The videos are sophisticated enough to pass casual inspection. They show the celebrity apparently endorsing the platform, describing their personal profits, and urging viewers to invest. These ads run for a few days before the social media platform takes them down, but a few days is enough to capture thousands of clicks and hundreds of deposits. YouTube livestream scams work similarly: a looping video of a tech conference is streamed live with a banner advertising “Send 0.1 BTC, get 0.2 BTC back.” The scam is obviously a scam if you think about it for five seconds. But the production quality and the association with trusted names short-circuit the thinking.
Every one of these scam types exploits the same regulatory vacuum. Cryptocurrency in India is not illegal. The government taxes it at 30 percent on gains and applies a 1 percent TDS on transactions above a threshold. This taxation gives crypto a veneer of official acceptance. If the government is taxing it, people assume it must be regulated. It is not. There is no investor protection body for crypto. No licensing authority that certifies whether an exchange is genuine. No deposit insurance. The RBI would prefer a ban and has said so repeatedly, but the Supreme Court struck down the RBI’s earlier banking restrictions on crypto in 2020, and the promised Cryptocurrency Regulation Bill has been delayed year after year. SEBI does not oversee crypto because it is not classified as a security. The Enforcement Directorate (ED) has taken action against specific cases of crypto fraud, including freezing assets worth hundreds of crores in connection with scams like E-Nuggets and HP Token, but the ED acts after the fraud has happened, not before. Prevention is nobody’s job.
In 2024, the government required all crypto exchanges operating in India to register with the Financial Intelligence Unit (FIU-IND). WazirX, CoinDCX, CoinSwitch, and ZebPay complied. Several foreign exchanges that had been operating without registration were blocked. That was a step in the right direction, but FIU registration is an anti-money-laundering requirement, not a consumer protection measure. It tells you that the exchange reports suspicious transactions to the government. It does not tell you that the exchange actually holds the crypto it claims to hold, that its reserves are audited, or that your money is safe.
Some scam platforms have started using tax compliance as a credibility tool. They issue fake TDS certificates. They offer to “help you file your crypto taxes” through their platform. They point to these features as proof of legitimacy. None of it means anything. Anyone can generate a document that looks like a TDS certificate. What would actually prove legitimacy is a third-party audit of the platform’s holdings, published proof of reserves, and registration with a recognised regulatory body. CoinTrustPro had none of these. Naveen did not know to check for them. Most people would not.
After the Money Was Gone
When Naveen tapped “Withdraw” on CoinTrustPro and submitted his request for Rs 1,12,000, the platform did not decline it outright. That would have been too obvious. Instead, a message appeared in the support chat: “Your withdrawal is being processed. To complete the withdrawal, a processing fee of Rs 25,000 is required. Please deposit this amount to proceed.”
Naveen hesitated. Rs 25,000 is not a small amount. But the alternative was walking away from Rs 3,00,000 of his own money plus the Rs 1,12,000 in profit that the dashboard was showing him. The sunk cost was overwhelming. He had already put in three lakhs. Spending twenty-five thousand more to get four lakhs back seemed rational. He paid the fee.
A day later, another message. “Tax verification deposit of Rs 15,000 required before funds can be released. This is a regulatory requirement under Indian tax law.” The message included a reference to the 30 percent crypto tax and a TDS provision, which made it sound official. Naveen paid that too. His total outlay was now Rs 3,40,000.
Then silence. The support chat stopped responding. Naveen sent messages every few hours. “When will my withdrawal be processed?” “Please update me on the status.” “Is anyone there?” No replies. The app still worked. He could log in, see his dashboard, view the fake balance of Rs 4,12,000 still sitting there. But every button related to moving money out of the platform was greyed out. The “Withdraw” button displayed a message: “Account under compliance review. Please wait for further instructions.”
He tried to call the support phone number listed on the CoinTrustPro website. It rang endlessly. No voicemail. No answer. He sent an email. No reply. He checked the Play Store listing. The app was still there, still showing a 4.1-star rating, still available for download. Whoever was running CoinTrustPro had not shut it down yet. They were probably still collecting deposits from new users while stonewalling anyone who tried to withdraw.
Naveen called Deepak. Deepak was going through the same thing. He had tried to withdraw Rs 50,000 two days earlier and hit the same wall. Processing fee. Tax deposit. Then silence. They compared notes and realized that Deepak’s successful Rs 20,000 withdrawal months ago was the only real money either of them had ever taken out of the platform. Everything else was numbers on a screen. The charts, the rising balances, the profit figures, none of it corresponded to any actual cryptocurrency holdings anywhere. Naveen’s three lakhs and Deepak’s seventy thousand were gone.
Naveen went to the Surat cyber crime cell the next day. He brought printouts of everything: the CoinTrustPro dashboard, his UPI transaction receipts showing deposits to the platform’s account, screenshots of the support chat conversations, and the referral link Deepak had sent him. The officer who took his complaint was not dismissive, which Naveen had been afraid of. The officer told him they had received multiple complaints about CoinTrustPro from across Gujarat. At least fifteen other people in Surat alone. Similar amounts. Similar stories. The officer filed an FIR and told Naveen that the investigation would take time, and that he should not expect a quick recovery. The money had almost certainly been moved through a chain of bank accounts and crypto wallets by now, dispersed to make tracing difficult.
Naveen also filed a complaint on cybercrime.gov.in and called the 1930 helpline. The 1930 operator took down the details and said the report would be forwarded to the relevant state cyber crime unit. The process felt slow and bureaucratic, which it was, but Naveen filed everything he could because the officer at the Surat cell told him that the more victims who file, the more seriously the case gets treated. A single complaint is a nuisance. Fifty complaints from across the state get assigned a dedicated investigation team.
Deepak’s situation was different in a way that made it worse. He had lost Rs 70,000 of his own money, but that was not the real damage. He had recommended CoinTrustPro to four other people besides Naveen. A cousin in Ahmedabad. Two colleagues at his Bangalore office. A friend from his apartment building. All of them had invested. All of them lost money. His cousin lost Rs 2,00,000 and stopped speaking to him. One of the colleagues filed a complaint naming Deepak as the person who introduced him to the platform. Deepak was not a scammer. He had no financial relationship with CoinTrustPro beyond his own deposits. He had recommended it because he believed it was real, based on his own small withdrawal that went through. But the people who lost money because of his recommendation do not see a distinction between the person who scammed them and the person who brought them to the scammer. Deepak told me he has not slept properly in weeks.
If you are thinking about putting money into crypto, there are ways to do it that reduce your exposure to fraud. Use exchanges that are registered with the Financial Intelligence Unit (FIU-IND) and have been operating for years: WazirX, CoinDCX, CoinSwitch, ZebPay. These are not guaranteed safe. WazirX itself suffered a major hack in 2024 that resulted in losses of over $200 million. But they are real companies, with identifiable Indian management, published office addresses, and regulatory oversight, which is the minimum standard you should accept. Enable two-factor authentication using an authenticator app like Google Authenticator, not SMS, because SIM-swapping attacks can intercept text-message codes. If you hold more than a speculative amount, move it to a hardware wallet like Ledger or Trezor. A hardware wallet stores your crypto offline, out of reach of hackers, exchange failures, or platform shutdowns. Never share your seed phrase with anyone, under any circumstances. And never invest more than you can afford to lose entirely, because even on legitimate platforms, the value of crypto can drop sharply and without warning.
Last I heard, Naveen had stopped checking the CoinTrustPro app. It was still showing his balance, still showing the fake profits that were never real. He told me he keeps meaning to delete it but has not gotten around to it. “If I delete it, that means I am accepting the money is gone,” he said. “I am not ready for that yet.” He probably will not get the money back. Most people do not. But at least he stopped sending more.
Comments (0)