From a Telegram “Signal Group” to a Bank Recall: £44,000 Returned

It started with a free Telegram “signal group” and a broker that quoted a real, regulated firm’s registration number. By the time our client realised the broker only borrowed that licence, he had wired tens of thousands. Acting on the bank rail is what saved most of it.

Forensic Notes · Recovery story · 6 min read

The clone-firm trap

The broker presented itself as an established, regulated firm and quoted a genuine registration number lifted from the public register — a tactic called a clone firm. When he looked the number up, the real entity appeared, and he relaxed. The bank details, phone numbers, and domain all differed from the genuine firm — the one thing a clone cannot copy.

Two rails, two routes

Because the loss began as bank transfers he was deceived into authorising, it qualified as authorised push payment (APP) fraud — which opened a reimbursement route alongside the on-chain trace. We documented where the broker’s details diverged from the register, then supported his bank’s recall while we froze the converted crypto leg at the receiving exchange.

The outcome

£44,000 of roughly £48,000 returned — most via the bank’s APP-fraud reimbursement, the remainder from the frozen Bitcoin. Clone-firm cases reward speed and documentation.

Before you transfer

Always call a firm using the number on the regulator’s register — not the one the firm gives you — and be suspicious of any “signal group” that funnels you to a single broker.