Avoid Scams: Don’t Send Money | Protect Yourself

In recent months, a structured system of social groups has spread that promise selective access to OTC operations on US securities, with recurring returns and access reserved for a “fleet” of privileged investors. The entire path starts from Telegram groups presented as “academy”, and then converges in a closed panel connected to the pem-pros domain[.]com and in a WhatsApp group called “Investment Academy – Special Group”. We are not faced with training courses or advisory services, but with an operational scam that is still active, built to collect deposits and move them to non-recoverable destinations. Following the first reports received by the editorial team, we ask anyone who was involved to send wallet addresses, payment references or bank statements to this link, so as to complete an evidential reconstruction of the financial chain.

Telegram as a recruitment and pre-qualification phase

The model opens in Telegram groups that propose the same narrative scheme: graduated paths in “V1-V3”, limited availability, presumed technical approvals to operate on US securities and investments generated by proprietary analyses. The most recurring rooms are “Investment Academy-842” and mirrored versions with minimal denominations, constructed to suggest an institutional context. The user enters, observes screenshots of returns already achieved and is convinced that he is faced with a system that is both exclusive and already tested by previous investors. No license is shown, no contractual documentation is provided, there is no company attributable to the service. It is the psychological onboarding phase.

The operational transition to WhatsApp

Once qualified, the user is invited to the WhatsApp group called “Investment Academy – Special Group”. Here the language changes: training is no longer promised, but immediate access to operations “with a short time window”. You are asked for balance screenshots, deposit confirmations, and are also provided with one-time use codes or passwords. The deposit becomes a gesture of trust; failure to file is described as a loss of a unique opportunity. The pressure is direct and personal. This phase is the actual point of collection of funds and constitutes the most critical area in terms of economic impact on victims.

The closed panel connected to pem-pros[.]com

The alleged operational portal is not publicly accessible from browsers. The domain was registered on 21 October 2025, protected by Cloudflare, without a homepage, without corporate documentation, without any behavior attributable to any supervised operator. Access takes place only via the app, via authentication sessions and private links. When the panel is visible, it shows a portfolio made up of existing stocks, such as Johnson & Johnson or Check Point Software, with returns already accounted for and “open” positions that grow over time. There is no verifiable link to real market transactions, nor to institutional counterparties. It is a static profit simulation.

The instrumental use of Coinbase Wallet

The app used by users is not a fake app, but the authentic Coinbase Wallet app, previously called Base Wallet, regularly distributed by Coinbase, Inc. Its technical legitimacy is being exploited by its promoters. Coinbase Wallet is a non-custodial wallet: the user holds his own keys and no intermediary can recover or revoke transfers. In the fraudulent environment this factor becomes the central weapon. The app is presented to the user as a guarantee of security, leading them to believe that the funds are “protected by Coinbase”. In reality, the wallet is used as a means of transfer to addresses controlled by scammers. Once the requested amount has been sent, there is no form of refund, recovery, chargeback or dispute possible. The deposit is final.

The final block and the total loss of funds

When the user tries to withdraw the supposed profits, the platform introduces artificial constraints: tax audit, AML verification, residual margin balancing. The user is encouraged to pay further sums to “unlock” the amount visible on the panel. It is the final phase of the scam, in which the simulated balance is used as psychological leverage to extract further payments. When the user asks for transparency or reports anomalies, the groups are silenced, the admins stop responding and the conversation stops definitively.

Fraud in progress and importance of evidentiary material

This is not a closed case: the facility is active and continues to operate. The Telegram and WhatsApp groups mentioned above are still in operation and registrations are managed through direct contacts. Anyone who has deposited, even partially, and is in possession of on-chain hashes, bank receipts or screenshots with the wallet addresses used, is invited to send this material to Decripto at this link. The reconstruction of flows is crucial for correlating entry nodes, terminal wallets and exit platforms. Each documented transaction can help define the perimeter of the network and speed up its effective identification.