On February 12, 2026 at 8:15 p.m., the topic of cybercrime will be brought to the attention of the general public in the Kabel-eins show “Achtung Abzocke”. The show will shed light on a recent case of professionally organized online fraud – including the technical and organizational mechanisms behind it. Our SECUINFRA Falcon team was involved in the analysis and provided in-depth insights.
It is clear from the outset that this is not an isolated case, but a scalable scam that is operated in clearly structured campaigns. The recurring use of job ads as bait, which are targeted via social media platforms, is striking. The aim is to build trust and gradually steer potential victims into a supposedly lucrative crypto trading environment. The ads, communication channels and even the trading portals themselves are highly interchangeable and are regularly replaced to make investigations more difficult.
A key feature of this scam is the strict separation between money extraction and money laundering. Different roles, different players – an approach that makes traceability much more difficult. In such schemes, it is entirely conceivable that individual components, such as money laundering, are provided by third parties as a “criminal service”. Establishing a reliable connection is correspondingly complex.
The analyzed trading platform also follows this pattern. The domain was only recently registered and the owner data is concealed by a WHOIS privacy service. In addition, a protection service is installed upstream of the actual web server, which not only protects against technical attacks but also prevents the underlying infrastructure from being identified. Other subdomains indicate test or administration environments, but remain largely opaque without deeper access.
Technically, the platform is deliberately minimalist: a modern web interface implemented with common JavaScript frameworks, external integration of graphics from international cloud infrastructures and an interface that only gives the appearance of real CFD crypto trading. Our analysis suggests that no real trading takes place. Instead, price data is merely displayed, while user deposits effectively end in a controlled total loss – often with the aim of provoking further additional payments.
Several warning signs are obvious: a misspelled domain, alleged salary payments to trading accounts, a lack of transparency regarding providers and regulations and ultimately the impossibility of payouts. At this point at the latest, those affected should refrain from making any further payments.
The aspect of KYC verification is also particularly critical. If ID documents or selfies have been uploaded as part of the process, there is a considerable risk of identity fraud. In such cases, it is strongly recommended not only to report the financial loss, but also to explicitly point out possible identity fraud.
The TV report on 12.02.2026 impressively shows how professionally and collaboratively modern fraud networks operate – and how important technical analysis, education and prevention are.
At this point, we would also like to emphasize that our commitment is not limited exclusively to protecting companies and our customers. As cyber defense specialists, we also see it as our responsibility to make an active contribution to raising awareness and protecting society as a whole. Digital scams no longer only affect organizations, but also private individuals. With our expertise, we therefore not only want to offer services, but also share knowledge, make risks visible and sensitize ordinary citizens to real dangers in the digital space. Prevention starts with transparency – and that’s exactly what we want to do our bit for.
It’s worth switching on.
