top of page

The scam of's long-running impersonation

A visual used in the impersonation scam

Find all the details about the impersonation scam in this article. In the realm of internet scams, it is common to come across similar modus operandi. Innovations are rare. Yes, each scam appears different at first glance. The logo is never the same. The name changes. The colors change. The type of product changes. In short, the form is renewed. The appearance always changes. However, the essence remains the same. There is a pretext with visual support. An efficient sales team to approach potential victims. And in the end, the victims deposit money, either in a bank account or a fraudulent wallet. Moreover, these schemes have a limited lifespan, lasting no more than a few months to half a year at most. But today, you will discover an operation that lasted nearly 4 years.

The impersonation scam uses local intermediaries

So, what are the innovations in this case? Firstly, it starts with a rather common situation: identity theft, with a fake clone site that disappeared relatively quickly. Behind this site were collection bank accounts. So far, nothing out of the ordinary. But this is where it gets interesting. The operators of this site, using the pseudonyms Antoine Sicot and Mickael Jordan Agranier, managed to find local intermediaries.

These individuals worked as business brokers, actively engaging and convincing numerous victims face to face. They presented simulations on boards, had business cards, and sometimes handed out printed documents in person. Obviously, these individuals will be implicated, particularly regarding legal obligations related to investment advisory activities and potentially other criminal offenses. Watch our video alert on the impersonation scam.

A long-term scam where time wreaks havoc

The strength of this scheme goes beyond promising excessive and miraculous returns. It relies on keeping funds unavailable for years. Simultaneously, expected returns are distributed without major issues, on paper. And when the maturity date arrives? The victims reinvest. They do not wish to touch their accumulated fortune. Naturally, good advice encourages them to do so. And even when withdrawal requests are made, the payments are honored. It follows the classic style of a pyramid scheme.

So, let's summarize the situation: very high returns, long-term funds lockup, honored maturity dates, and the capital released correctly in the end for the few who requested it. What could be better to make the scheme believable? However, it was clear that one day the entire structure would collapse. That day arrived in early 2023, to the investors' great misfortune.

Behind the façade, a well-oiled machinery

In this case, a well-functioning, rapid, simple, and efficient machinery was required. The fake website quickly went offline. But no worries, email addresses using Gmail were sufficient. The documents remained identical. Standardized and mass-produced, the monthly reports were disseminated on fixed dates. They appeared modest, based on falsified real documents from, successfully deceiving people. The contracts were drafted in a conventional manner, using existing templates.

Above all, the victims actively contributed to their own misfortune. They had to provide not only their personal data but also their identification documents. Consequently, a significant number of bank accounts were created. These accounts were managed to facilitate the collection of funds. Undoubtedly, this was a full-time job where any mistake could jeopardize and collapse the entire scheme.

Fortunately, we discovered some errors in their operations.

This modus operandi included a few cryptocurrency transactions. Using our Crypto&Check service technology, we were able to trace these operations, and here is the essence of it.

The illusion of opening a real account with

The graph below corresponds to real data from the case. It is intentionally blurred for confidentiality reasons. We observe a consolidation towards a collection account, which is relatively common. Victims' accounts feed into a central consolidation account, which then moves to a higher-level account.

What is less common is that in this case, there were commission payments made to business brokers. Some of these commissions were even paid in cryptocurrencies, which makes it more interesting.

Diagram of Crypto transactions in the impersonation case

Discover the Crypto transactions in the impersonation case

Look at this diagram. Two elements are worth noting. The purple bubbles indicate the exit points of financial flows, i.e., the accounts where cryptocurrencies are converted into fiat currencies. The most significant account is located in the middle, represented by the central purple bubble with the largest arrow. And here comes the big surprise. The accounts receiving commission payments originate from a single account hosted by!

A scam where justice is already in motion

The notable aspect of this extraordinary case is that an investigation has been opened. The police services responsible for the case have already taken initial actions. Two of our referring lawyers are representing victims and are in contact with the Public Prosecutor's Office. It is crucial for each victim to be part of the legal proceedings to protect their rights and potentially provide new evidence that could be lacking. If you are a victim of this scheme, we strongly encourage you to contact us to join the others. If you have conducted cryptocurrency transactions, you can authorize us to analyze your operations. We are here to help and support you through the process.


bottom of page