Common pattern
A victim may first be offered a small paid task, rating/review work or an investment opportunity. Small initial returns can be used to build trust before larger deposits are demanded. Fake dashboards or group chats may then display profits that cannot actually be withdrawn without further payments.
For victims: preserve the complete funnel
Preserve the first contact, Telegram usernames and groups, phone numbers, websites/apps, bank beneficiary details, UTRs, crypto wallet addresses, payment instructions and every demand for additional money. Report financial cyber fraud promptly through 1930 and NCRP.
For account holders receiving disputed funds
A bank account may appear in the transaction chain even where the account holder says the payment related to a different transaction. Identify the exact credit, its consideration, the counterparty and supporting records. If the transaction involved P2P crypto, preserve the corresponding order and blockchain records.
Do not treat a Telegram identity as verified identity
Usernames, profile photographs, group titles and displayed company names can be changed or impersonated. Investigations may therefore rely on bank KYC, device/platform data, telecom records and other corroborating material.
Primary sources
- Delhi Police RTI Manual – IFSO / Cyber Crime mandate and 1930 helpline
- National Cyber Crime Reporting Portal (NCRP)
Frequently asked questions
What should I do immediately after a Telegram investment scam?
Stop further payments, call 1930, report through NCRP, notify the bank and preserve the complete communication and transaction trail.
Why do scammers pay a small amount first?
Small payments can be used to create confidence and persuade a victim to deposit larger amounts. The exact method varies by case.
Can an innocent recipient's account be restricted?
A downstream account can be affected when disputed funds are traced through it. The account holder should identify the exact transaction and available legal/procedural remedy.