A Korean man living in the US saw an Instagram advertisement for a P2P currency exchange service. The rate was 2–3% better than competitors.

He clicked the ad.

The website asked him to complete an AML check. He connected his account, approved the requested transaction, and lost approximately $25,000.

A private cyber investigation followed. It revealed six useful lessons.

1. A small advantage can be better bait than an unbelievable one

The exchange rate wasn’t absurd. It was simply better.

That’s often enough. A modest advantage looks like a good deal; an impossible one looks like a scam.

If an unknown service consistently offers better terms than established competitors, ask why.

2. Technical language can create false confidence

The website used an AML check to make the process look legitimate.

Real financial services perform AML checks, so the request didn’t seem unusual.

But the check was part of the scam. Its purpose was to convince the victim to authorize a transaction.

A legitimate AML procedure verifies the origin of funds. It doesn’t require you to send those funds away.

3. Scams can operate like businesses

The investigation linked the operation to a Drainer-as-a-Service model.

One group can provide the infrastructure while affiliates handle advertising and victims. Other participants can help move the stolen money.

Some publicly reported operations have given affiliates as much as 80% of the proceeds.

This makes attribution much harder than simply finding the person behind a fake website.

4. Targeted advertising makes investigations difficult

The investigators needed to see the same Instagram ad as the victim.

That’s not guaranteed. Instagram targets advertisements based on characteristics such as location, interests, age, device, and account behavior.

The team therefore created a new account, used a US mobile IP address, maintained a consistent browser profile, and obtained a US phone number for receiving SMS.

After following financial and investment pages similar to the victim’s interests, the investigators eventually saw the advertisement.

5. A report is useless without evidence

Scam advertisements can disappear quickly.

The investigators preserved screenshots, ad and advertiser IDs, URLs, timestamps, and file hashes.

They also avoided overstating the evidence. A shared payment account doesn’t prove that two people are the same person, and handling stolen money doesn’t automatically prove participation in the original crime.

6. The difficult part wasn’t the technology

The basic tools were relatively easy to obtain. It was also quite easy to receive verification SMS online.

The difficult part was maintaining a believable account long enough to receive the advertisement without triggering Instagram’s defenses.

Even then, finding the ad didn’t recover the stolen money.

Private investigators cannot freeze accounts or issue subpoenas. Their role is to preserve evidence and provide useful records to platforms, lawyers, payment providers, courts, or law enforcement.

And the takeaway is simple:

When an unknown service offers a better exchange rate than everyone else and then asks you to prove your money is clean by authorizing a transaction, don’t do it.