Don't Fall for the Telegram Investment Scam — Inside One Syndicate's Playbook

It started on an ordinary day. My phone would not stop buzzing — Telegram notifications, one after another, from a group I was certain I had never joined.

When I finally opened it, it was some kind of investment group. And scrolling through the member list, I recognised names — a whole cluster of my own contacts were already in there. A little further up the chat, I could see how: one of my contacts had added their entire phonebook into the group at once. Every single person they knew, dumped in without asking.

That person did not do it on purpose. Their account had been hijacked, and the scammers used it to pull everyone they trusted into the trap. That is the part most people miss: you do not join these groups. A hacked friend drags you in.

So I stayed, and I watched. Here is exactly what I saw — and how you can recognise it in seconds.

If a Telegram group promises you RM25,000 back from a RM500 “investment” in three hours, patuh Syariah, 100% trusted — stop. That is not an investment. That is a script, and we can show you the exact people running it.

Over the past few months we tracked a string of Telegram “investment” groups — among them Capital Market Amanah Saham Nasional Berhad, FUTU Trade Market and AlixCO Malaysia, with more surfacing all the time. They use different names, different logos and different admins. But when we followed the money, the same mule bank accounts kept showing up across them. They are not separate scams. They are one syndicate wearing many masks.

How the scam actually works

1. You see a group or an ad promising huge fixed returns — e.g. “Pakej Basic: RM500 GET RM25,000”, “RM10,000 GET RM450,000”, “proses 3–6 jam, patuh Syariah”.
2. You are told to PM the admin and fill in a “joining form” before you can invest.
3. The admin gives you a bank account number and tells you to transfer your ‘modal’ (capital). The account belongs to a random person's name — not to any licensed company.
4. You are shown a fake trading dashboard displaying made-up USDT / crypto ‘profits’ climbing in real time.
5. The group is flooded with ‘members’ posting withdrawal receipts, luxury cars, gold and cash — all fake, all designed to build trust and FOMO.
6. When you try to withdraw, you are told to deposit more (‘tax’, ‘processing fee’, ‘upgrade pakej’). Eventually the admin goes quiet and you are blocked.

The red flags, in plain terms

• Guaranteed or fixed profit — real investments never guarantee returns.
• You must pay first to ‘unlock’, ‘activate’ or ‘withdraw’ your money.
• The receiving account is a personal name, and a different name each time.
• The company name sounds official (uses 'Amanah Saham', 'Nasional Berhad', 'Capital Market') but has no licence you can verify.
• Pressure and urgency: 'limited slot', 'hari ni je', 'first 100 orang'.
• The group is full of testimonials, luxury photos and 'profit masuk' receipts — manufactured social proof.

How to spot it in five seconds — the tells

Once you've seen one of these groups, you've seen them all. They recycle the same tricks, and the tells are surprisingly consistent:

• The group name uses a weird stylised font — 𝗹𝗶𝗸𝗲 𝘁𝗵𝗶𝘀 or 𝙩𝙝𝙞𝙨 — instead of normal letters. It looks 'fancy', but the real reason is to slip past Telegram's spam filters, which scan plain text. Legitimate companies do not name themselves in cursive Unicode.
• The name leans on a big, trusted brand — 'ASNB', 'Amanah Saham Nasional Berhad', 'Capital Market', 'Malaysia' — with a flag emoji stapled on for good measure. The bigger and more official it sounds, the more suspicious it should be.
• The Malay is mostly passable, but Indonesian slips through. The shills try hard to sound Malaysian, yet every so often a word gives it away — 'silahkan' instead of 'sila', 'bisa' instead of 'boleh', 'artinya', 'keuntungan', 'tuk', and banking words like 'saldo' or 'rekening' that Malaysians would say as 'baki' or 'akaun'. It reads like a foreign operation cosplaying as local.
• The exact same dashboard screenshot appears everywhere — the identical fake trading panel with USDT 'profits', reused across totally different groups. Real platforms don't share one screenshot between rival companies.
• The admin's name is a costume: 'Cikgu', 'Encik', 'Tuan Admin', 'Dato' — titles chosen to sound authoritative and trustworthy. The username gives it away too: handles like @admin_… or @cs_… that no ordinary person uses for a personal account. And the biggest tell of all — the display name is a full formal name, the kind no real Malaysian would ever set on their own personal Telegram.
• The 'members' are actors. There's always a fake victim asking 'ni betul ke? legit ke?' then 'trying it' and posting profit; a stream of fake testimonials; and a tidy set of fake Q&As — all scripted to reassure the naive and reel in the hesitant.

Why we know it's one syndicate

We collected the bank accounts victims were told to pay across every group we mapped. Two things gave the syndicate away. First, the same mule person appeared in more than one group under slightly different accounts. Second — and this is the clincher — the exact same account numbers were reused across different groups, and some receipts carried the recipient reference ‘AlixCO’ even inside groups with other names. Different brand names, same wallet.

The fake platform is more convincing than you'd think

The dashboard they show victims is not a crude mock-up. The price chart on it is a real, live TradingView widget — genuine Bitcoin candles from Coinbase, updating in real time. So if you check 'is this the real BTC price?', the answer is yes, and that honesty is exactly what earns your trust. The lie is everything bolted around it: the 'Buy 180% / Sell 180%' buttons, the 'Live' balance showing your money growing, and the profit figures. The chart is real so you'll believe the fake numbers next to it.

What to do before you transfer anything

1. Check the account and phone number on PenipuMY. Go to penipu.my and search the bank account number or the admin's phone / Telegram before paying. If it's a known mule, we'll tell you.
2. Verify the company with the regulator. Real investment schemes are licensed. Check Bank Negara Malaysia's Financial Consumer Alert list and the SC's Investor Alert list. If it's not there, walk away.
3. Never pay a personal account for an 'investment'. Licensed funds collect through the company, not a stranger's savings account.
4. Ignore the receipts and luxury photos. They are the cheapest part of the scam to fake.
5. Never upload your IC or a selfie to 'verify' an account on a platform from a Telegram group. A real live chart does not make the platform real — and their KYC step exists to steal your identity, not protect it.
6. If you've already paid, call the National Scam Response Centre (NSRC) at 997 immediately — the first hour matters most for freezing funds — and lodge a police report. If you already uploaded your IC, report it too and watch for accounts or loans opened in your name.

These groups rebrand and respawn constantly — a new name, a fresh Telegram link, the same accounts underneath. The name on the door will keep changing. The rule won't: if it guarantees profit and asks you to pay a stranger first, it's a scam. Share this with the people in your life who are most likely to be targeted.