It all started with an ad. At the time, a Korean office worker living in the United States came across an ad for a P2P currency exchange service while browsing Instagram. Its exchange rate was 2–3% better than elsewhere. He needed to send money to Korea, so he clicked the ad and, liking the terms, started the exchange.

Before proceeding with the exchange, the site said that a simple AML (Anti-Money Laundering) check was required to verify that the funds were clean. He connected his account and approved the transaction requested by the site. About $25,000 disappeared.

He turned the case over to a private cyber investigation team. What they uncovered highlighted several common misconceptions people have about scams like this.

Misconception 1: A Good Exchange Rate Is Just a Lucky Find

The exchange rate was the bait. It wasn’t outrageously good; it was just favorable enough to look like a smart deal rather than an obvious trap. Scammers know that an offer that is slightly better than the competition gets more clicks than one that is absurdly good.

If a service you’ve never heard of is offering better terms than every established competitor, you should ask yourself: how is that possible?

Misconception 2: If a Service Performs an AML Check, It Must Be Legitimate

Real financial services perform compliance checks. That’s what made this one look more convincing. But this check wasn’t a separate security procedure. It was part of the same site, and its sole purpose was to get the victim to personally approve a transaction that moved money out of their own account.

A genuine AML check verifies the source of funds; it does not require you to authorize a transfer.

Misconception 3: It’s the Work of a Lone Scammer

The investigation revealed that the case was connected to an organized Drainer-as-a-Service operation. One group builds fake exchange sites, tools for intercepting payments, and management dashboards. Affiliates rent this package, run ads, attract victims, and receive a percentage from each successful scam. In some publicly documented cases, affiliates have reportedly taken as much as 80%.

The ad itself may not provide much of a clue. This particular ad could easily have been paid for with a stolen card, meaning that tracing the advertiser’s account could have led to a dead end. Affiliates coordinated their activities in private, invite-only communities, and following the transactions uncovered P2P traders suspected of converting the stolen funds into cash.

Misconception 4: Instagram Ads Are Visible to Everyone

The investigation team needed the ad itself. It was the starting point of the scam, and without the ad, they had no specific evidence to report to Instagram.

But ads are targeted based on country, age, interests, device, and other factors. For a team accessing Instagram from outside the US, a campaign targeting US residents might not appear at all. Meta’s public Ad Library can help, but scam ads change quickly, and many use cloaking — showing the real landing page only to users who match the intended targeting criteria.

To see what the victim saw, the investigators had to look like the victim. They created an Instagram account from scratch using a new email address, a consistent browser profile, and a US IP address.

Instagram also required a phone number, and it had to be a US number. Using a foreign number would have been inconsistent with the rest of the account information. Getting a physical US SIM card from abroad could have taken weeks. VoIP numbers are often rejected, while free public SMS sites were useless because anyone can see the verification codes and the numbers have already been used countless times.

The investigation team used a temporary US mobile number from the SMS verification service Tell A Bot. The verification code arrived and the account was activated. Because temporary numbers may later be reassigned to someone else, switching to an authenticator app for two-factor authentication immediately after signup is a common precaution.

The team then used the account like an ordinary user, following financial and investment pages similar to those the victim had followed. Eventually, P2P currency exchange ads began appearing in the feed.

Misconception 5: Reporting a Scam Ad Is Just a Matter of Clicking a Button

Clicking the "Report" button is easy. Making that report actually useful is not. Scam ads can disappear within days, so while the ad was still live, the investigation team preserved everything: screenshots, the ad ID and advertiser ID, the landing page URL, timestamps, and even file hashes proving that nothing had been altered afterward.

They were also careful about what the evidence did not prove. Sharing a payment account does not necessarily mean that two people are the same person, and someone who handled stolen money cannot automatically be considered a participant in the crime.

Misconception 6: The Hard Part Is the Tools

Proxies providing residential IPs, a clean browser, and a reliable temporary phone number were actually the easy parts. You just have to spend money on the right tools. The difficult part was keeping the account active naturally, without doing anything likely to trigger a ban, until the ad appeared. There are no guarantees, and even if the investigation itself is legitimate, an investigative account may still violate the platform’s rules.

Even after finding the ad, the money doesn’t come back. The investigation team cannot freeze accounts or issue subpoenas. What they can do is provide evidence that allows Instagram to remove the ad and account, and hand over records that a lawyer can take to payment services, courts, and law enforcement agencies.

For everyone else, the lesson can be summed up in one sentence: if an ad offers a better exchange rate than anywhere else and then asks you to prove that your money is clean, just walk away.

Next Chapter: Upgrade Your Property with Traditional Timber Sash Windows