# Scam, fraud, and impersonation of a friend

**URL:** <https://onehack.st/t/scam-fraud-and-impersonation-of-a-friend/316519>\
**Category:** Discussion & Solutions\
**Tags:** solved\
**Created:** [January 8, 2026, 12:24pm UTC](https://onehack.st/t/scam-fraud-and-impersonation-of-a-friend/316519 "2026-01-08T12:24:14Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![IHaveBeenPawned](https://onehack.st/letter_avatar_proxy/v4/letter/i/b782af/32.png) [@IHaveBeenPawned](https://onehack.st/u/IHaveBeenPawned)\
**Post date:** [January 8, 2026, 12:24pm UTC](https://onehack.st/t/scam-fraud-and-impersonation-of-a-friend/316519/1 "2026-01-08T12:24:15Z")

</div>

# 🎭 Friend Got Cloned on WhatsApp — 900 USDT Gone in Minutes

**🗺 Situation-Summary:** Social engineering scam using cloned identity stole crypto — now hunting the ghost behind the number.

* * *

## 💀 Why This Matters

Some guy spent _weeks_ studying victims — their contacts, their friends, their trust patterns — then texted them pretending to be someone they love. One fake “hey bro I need help” later, 900 USDT vanished into a wallet that doesn’t exist anymore. This isn’t rare. This is happening _right now_ to people you know.

* * *

## 🧠 The Scam (How It Went Down)

Scammer texts on WhatsApp:

- ✅ Real friend’s name
- ✅ Real friend’s profile picture
- ❌ Different phone number (Palestinian prefix 970/972, Jawwal carrier)

Asked for 900 USDT. My friend sent it.

Then he messaged his _actual_ friend on Facebook.

> “Did you ask me for USDT?”  
> “Bro… I didn’t even know you had any.”

That moment when your stomach drops through the floor.

* * *

## 🔍 What We Already Tried

> **Everything that failed (click to expand)**
>
> - **Local SIM provider** — number has no registered data
> - **Meta coordinates** — GPS in our region is garbage
> - **GitHub OSINT tools** — limited functionality, some Linux-only
> - **Cybercrime division complaint** — filed, nothing happened
> - **Binance support** — useless
> - **Other victims** — found them, none succeeded in tracking either
> 
> Still on the table:
> 
> - Reverse phone lookup sites
> - PhoneInfoga (needs strong APIs)

* * *

## 🎯 What We Actually Need

Someone who can:

1. **Track the number** — real-time location if possible
2. **Access via WhatsApp or Facebook** — device access to find personal files, accounts, wallets
3. **Recover the USDT** — or at least identify who this person actually is

This isn’t just about one friend. Same number scammed _multiple people_. Same method every time.

* * *

## 📍 The Details

- **Location:** Palestine 🇵🇸
- **Scammer’s number prefix:** 970 or 972 (Jawwal carrier pattern)
- **Amount stolen:** 900 USDT
- **Method:** WhatsApp impersonation + social engineering
- **Pattern:** Creates fake FB accounts, rotates WhatsApp names/pics on same number

* * *

> He studied victims for weeks. Knew their contacts. Knew their tone. Knew exactly who to pretend to be.

If you’ve got skills or connections that can help — or you’ve dealt with something similar — drop it below. 👇

---

<div class="post-metadata">

**Author:** ![RoohNooh](https://onehack.st/user_avatar/onehack.st/roohnooh/32/166257_2.png) [@RoohNooh](https://onehack.st/u/RoohNooh)\
**Post date:** [January 8, 2026, 12:50pm UTC](https://onehack.st/t/scam-fraud-and-impersonation-of-a-friend/316519/2 "2026-01-08T12:50:15Z")

</div>

# 🔍 Hunt the Scammer: Your Step-by-Step Guide

**Your situation:** Someone cloned your friend on WhatsApp, tricked you, and stole 900 USDT. Now we hunt them down.

**What this guide does:** Gives you every free tool and exact steps to track the scammer and maximize your chances of getting money back.

* * *

> **⚠️ READ THIS FIRST — The One Thing That Changes Everything**
>
> **If you’re Palestinian, there’s a complication with Binance.**
> 
> In late 2023, Binance started freezing Palestinian users’ funds when Israeli authorities requested it. This means:
> 
> - Even if you trace your stolen USDT to a Binance wallet
> - Standard “report to Binance” advice may not work for you
> - You’ll need alternative paths (we cover those below)
> 
> This isn’t to scare you — it’s so you don’t waste time on dead ends.
> 
> **Source:** [Cointelegraph reported this in August 2024](https://cointelegraph.com) — search “Binance Palestinian funds seized”

* * *

## 🎯 DO THESE THINGS RIGHT NOW

Before the scammer changes anything:

1. **Save the scammer’s WhatsApp profile photo** (right-click, save image on WhatsApp Web)
2. **Screenshot EVERYTHING** — all chat messages, the phone number, timestamps
3. **Write down the exact USDT wallet address** they gave you
4. **Get your transaction ID** from your wallet app (looks like a long string of letters/numbers)

* * *

> **📱 STEP 1: Find Out Who Owns That Phone Number**
>
> The scammer used a phone number. That number might be linked to their real name, social media, or other accounts. Here’s how to check:
> 
> ### The Easy Tools (Free, No Tech Skills Needed)
> 
> | Tool | What It Does | Link |
> | --- | --- | --- |
> | **Truecaller** | Shows how others saved this number in their contacts | [truecaller.com](https://www.truecaller.com) |
> | **GetContact** | Same idea, sometimes finds different names | [getcontact.com](https://getcontact.com) |
> | **[Sync.me](http://Sync.me)** | Another caller ID database | [sync.me](https://sync.me) |
> | **Eyecon** | Pulls Facebook photos linked to phone numbers | [eyecon-app.com](https://www.eyecon-app.com) |
> 
> **How to use Truecaller (easiest):**
> 
> 1. Go to [truecaller.com](https://www.truecaller.com)
> 2. Sign in with Gmail (use a throwaway if you want)
> 3. Type in the scammer’s phone number
> 4. See what name pops up
> 
> **What you’re looking for:** A real name, a business name, or clues like “نصاب” (scammer in Arabic) if others already flagged them.

> **📲 STEP 2: Check if They Have Telegram (BIG Lead)**
>
> Scammers who use WhatsApp often have Telegram too. Same phone number = same person.
> 
> ### Quick Check (No Coding)
> 
> 1. Open Telegram on your phone
> 2. Add the scammer’s number as a contact
> 3. See if a Telegram account shows up
> 4. If yes — screenshot their username, profile photo, bio
> 
> ### Deeper Check (Telegram Bots)
> 
> Use these bots inside Telegram. Send them the phone number:
> 
> | Bot | What It Finds | Link |
> | --- | --- | --- |
> | **@BotoDetective** | Phone, email, social accounts | Open Telegram, search @BotoDetective |
> | **@SocialMediaLeaksBOT** | Leaked database info | Search @SocialMediaLeaksBOT |
> | **@GetContact\_bot** | Caller ID lookup | Search @GetContact\_bot |
> | **@creationdatebot** | When their account was created (new = sus) | Search @creationdatebot |
> 
> **Pro tip:** Use a burner Telegram account. Some of these bots are sketchy.

> **🔗 STEP 3: Track Where Your Money Went (Blockchain Tracing)**
>
> Your USDT didn’t disappear — it’s sitting in a wallet on the blockchain. Everything is recorded. Let’s follow it.
> 
> ### First: Figure Out Which Network
> 
> Your 900 USDT was probably sent on **TRON (TRC20)** — it’s the cheapest, most common for scams.
> 
> **You need:**
> 
> - The wallet address you sent money to (starts with T for TRON)
> - Your transaction ID/hash (from your wallet app)
> 
> ### Tool 1: Tronscan (The Basic Tracker)
> 
> **Link:** [tronscan.org](https://tronscan.org)
> 
> **Steps:**
> 
> 1. Go to Tronscan
> 2. Paste the scammer’s wallet address in the search box
> 3. Hit enter
> 4. Click “Transfers” tab
> 5. Filter by “USDT”
> 
> **What you’re looking at:**
> 
> - Did the money move? Where to?
> - Is it sitting there? (Good — might be freezable)
> - Did it go to a known exchange like Binance? (Good — they have ID records)
> 
> ### Tool 2: MistTrack (The Smart Tracker) ⭐ RECOMMENDED
> 
> **Link:** [misttrack.io](https://misttrack.io)
> 
> This is the secret weapon. It’s FREE and does the hard work for you.
> 
> **What it does:**
> 
> - Tells you if the wallet is “risky” (linked to scams)
> - Shows you a visual map of where money went
> - Checks against 1000+ known exchange addresses
> 
> **Steps:**
> 
> 1. Go to [misttrack.io](https://misttrack.io)
> 2. Click “Use MistTrack Light for free”
> 3. Paste the wallet address
> 4. Get your risk report
> 
> **Real results:** In Q2 2025, MistTrack helped recover almost $12 million for scam victims.
> 
> ### Tool 3: Bitquery (The Visual Map)
> 
> **Link:** [explorer.bitquery.io](https://explorer.bitquery.io)
> 
> If you want to SEE the money flow as a graph:
> 
> 1. Go to Bitquery
> 2. Enter the wallet address
> 3. Click on the graph view
> 4. Follow the dots
> 
> ### What Different Results Mean
> 
> | What You See | What It Means | Your Odds |
> | --- | --- | --- |
> | Money went to Binance/OKX/Coinbase | Exchange has their ID on file | ⭐⭐⭐⭐ Better |
> | Money is still sitting there | Hasn’t cashed out yet | ⭐⭐⭐ Good if you act fast |
> | Money hopped through 10+ wallets | They’re hiding tracks | ⭐⭐ Harder |
> | Money went to “mixer” or “Tornado Cash” | Intentionally anonymized | ⭐ Very hard |

> **🧊 STEP 4: Try to FREEZE the Stolen USDT**
>
> Here’s something most people don’t know: **Tether (the company behind USDT) can freeze any USDT wallet.**
> 
> They’ve frozen over **$3.3 billion** across 7,000+ addresses.
> 
> ### How Freezing Works (Simple Version)
> 
> 1. Tether adds the wallet address to a blacklist
> 2. The USDT is still there, but can’t be moved
> 3. With law enforcement, Tether can “burn” the frozen USDT and send new USDT to the rightful owner
> 
> ### How to Request a Freeze
> 
> **Email:** compliance@tether.to
> 
> **What to send them:**
> 
> - Police report number (you need to file one first — see Step 6)
> - Transaction ID showing you sent money
> - The wallet address that received it
> - Screenshots of the scam conversation
> - Explain: “I was defrauded via WhatsApp impersonation scam”
> 
> **Reality check:** Tether usually needs law enforcement to make a formal request. Your email alone probably won’t freeze it. BUT — it creates a record that helps if your case gets bigger.

> **👥 STEP 5: Team Up With Other Victims (This 10x Your Chances)**
>
> You mentioned there are multiple victims. **This is your biggest advantage.**
> 
> ### Why Multiple Reports Matter
> 
> From the FBI’s own data:
> 
> > “50 initial reports grew into an investigation covering 14,000 victims and $4 million in losses”
> 
> One person reporting = easy to ignore  
> Five people reporting the same wallet = pattern = investigation
> 
> ### What To Do
> 
> 1. **Find the other victims** (you’re already in contact)
> 
> 2. **Create a shared document** with everyone’s:
> 
> 3. **File reports together** (see Step 6 below)
> 
> 4. **Reference each other** — “I’m one of X victims, others are filing too”

> **📝 STEP 6: File Reports EVERYWHERE (Checklist)**
>
> The more places you report, the more likely someone takes action. Do ALL of these:
> 
> ### Priority 1: These Actually Get Looked At
> 
> | Where | Link | What to Include |
> | --- | --- | --- |
> | **IC3 (FBI)** | [ic3.gov](https://www.ic3.gov) | Everything — this goes to federal database |
> | **Chainabuse** | [chainabuse.com](https://www.chainabuse.com) | Wallet address — exchanges check this |
> | **Scam Alert** | [scam-alert.io](https://scam-alert.io) | Wallet address — law enforcement uses this |
> | **Bitcoin Abuse** | [bitcoinabuse.com](https://www.bitcoinabuse.com) | Wallet address — public scam database |
> 
> ### Priority 2: Regional/Platform
> 
> | Where | How | Why |
> | --- | --- | --- |
> | **Palestinian Police (Cybercrime Unit)** | Go in person to your local station | They have an Electronic Crimes Unit (وحدة الجرائم الإلكترونية) |
> | **WhatsApp/Meta** | Report the number inside the app | Gets the scammer’s account banned |
> | **Your crypto exchange** | Contact support | If scammer used the same exchange |
> 
> ### What to Include in Every Report
> 
> Copy-paste this checklist:
> 
> ```auto
> □ Transaction ID (TxID/Hash)
> □ Wallet address that received money
> □ Amount stolen (900 USDT = ~$900 USD)
> □ Date and time of transfer
> □ Phone number used by scammer
> □ Screenshots of WhatsApp conversation
> □ Scammer's profile photo (saved)
> □ How they first contacted you
> □ Any names they used
> □ "Multiple victims — same scammer" (if applicable)
> 
> ```

> **🖼️ STEP 7: Reverse Image Search the Profile Photo**
>
> The scammer used your friend’s photo. But maybe they’ve used other photos too on other scams.
> 
> ### Tools That Find Faces
> 
> | Tool | Best For | Link |
> | --- | --- | --- |
> | **Yandex Images** | Best FREE face search | [yandex.com/images](https://yandex.com/images) |
> | **FaceCheck.ID** | Flags known scam photos | [facecheck.id](https://facecheck.id) |
> | **TinEye** | Finds where image was used before | [tineye.com](https://tineye.com) |
> | **Google Images** | General reverse search | [images.google.com](https://images.google.com) |
> 
> ### How to Use Yandex (Best Results)
> 
> 1. Go to [yandex.com/images](https://yandex.com/images)
> 2. Click the camera icon
> 3. Upload the scammer’s profile photo
> 4. Look for:
> - Other social media profiles using same photo
> - Scam warning posts about that photo
> - Original source of the photo

> **🔎 STEP 8: Google Dorking (Search Like a Pro)**
>
> Use special Google searches to find info about the scammer’s phone number:
> 
> ### Copy-Paste These Searches
> 
> Replace `970XXXXXXXXX` with the actual scammer phone number:
> 
> ```auto
> "970XXXXXXXXX" site:facebook.com
> "970XXXXXXXXX" site:instagram.com
> "970XXXXXXXXX" scam
> "970XXXXXXXXX" احتيال
> "970XXXXXXXXX" نصاب
> "970XXXXXXXXX" whatsapp
> 
> ```
> 
> ### What Each Search Does
> 
> - `site:facebook.com` — Only searches Facebook
> - `احتيال` — Arabic for “fraud”
> - `نصاب` — Arabic for “scammer”
> - Quotes `" "` — Searches exact phrase

> **🚫 STEP 9: DON'T Fall for Recovery Scams**
>
> After you get scammed, **new scammers will try to scam you again**.
> 
> ### Red Flags — DO NOT Trust Anyone Who:
> 
> - ❌ “Guarantees” they can recover your money
> - ❌ Asks for upfront payment before doing anything
> - ❌ Claims they can “hack” the scammer’s wallet
> - ❌ Found you on social media and DMed you first
> - ❌ Says they have “insider access” at exchanges
> 
> ### Legit Help Looks Like This:
> 
> - ✅ Law enforcement referrals
> - ✅ Lawyers who work on contingency (no recovery = no payment)
> - ✅ Organizations like [Global Anti-Scam Organization (GASO)](https://www.globalantiscam.org)
> - ✅ Free tools like the ones in this guide
> 
> **Rule:** If someone contacts YOU offering to recover your crypto, it’s a scam. 100% of the time.

> **📊 STEP 10: Your Realistic Chances (Honest Talk)**
>
> Let’s be real about what you’re working with:
> 
> ### Your Case Breakdown
> 
> | Factor | Good or Bad? |
> | --- | --- |
> | Amount ($900) | Small — law enforcement won’t prioritize |
> | Multiple victims | **GREAT** — pattern detection triggers investigations |
> | Phone number from real carrier (Jawwal) | **GOOD** — traceable, not a burner VoIP |
> | USDT on TRON | OK — traceable on blockchain |
> | Scammer studied target for weeks | Bad — they’re experienced |
> 
> ### Probability Estimates
> 
> | Scenario | Recovery Chance |
> | --- | --- |
> | You alone, doing nothing | ~2% |
> | You follow this guide, solo | ~15-20% |
> | Multiple victims, coordinated reports | ~30-40% |
> | Funds traced to KYC exchange + multiple reports | ~40-50% |
> | Law enforcement takes interest | ~50%+ |
> 
> ### Bottom Line
> 
> Your best move is **coordinating with other victims** and **filing everywhere**. One report is noise. Five reports of the same wallet is a signal.

* * *

## 🛠 QUICK TOOL REFERENCE

> **All Links in One Place**
>
> ### Phone Number Lookup
> 
> - [Truecaller](https://www.truecaller.com) — Web, sign in with Gmail
> - [GetContact](https://getcontact.com) — App only
> - [Sync.me](https://sync.me) — Web + App
> - [Eyecon](https://www.eyecon-app.com) — App, pulls Facebook photos
> 
> ### Telegram Investigation
> 
> - [@BotoDetective](https://t.me/BotoDetective) — Phone lookup bot
> - [@SocialMediaLeaksBOT](https://t.me/SocialMediaLeaksBOT) — Leaked data
> - [@GetContact\_bot](https://t.me/GetContact_bot) — Caller ID bot
> - [Bellingcat Telegram Checker](https://github.com/bellingcat/telegram-phone-number-checker) — For techies
> 
> ### Blockchain Tracing
> 
> - [Tronscan](https://tronscan.org) — TRC20 explorer
> - [MistTrack](https://misttrack.io) — FREE risk assessment ⭐
> - [Bitquery Explorer](https://explorer.bitquery.io) — Visual flow
> - [MetaSleuth](https://metasleuth.io) — Cross-chain tracking
> - [Breadcrumbs](https://breadcrumbs.app) — Investigation tool
> 
> ### Scam Reporting
> 
> - [IC3 (FBI)](https://www.ic3.gov) — US federal database
> - [Chainabuse](https://www.chainabuse.com) — Exchange-monitored database
> - [Scam Alert](https://scam-alert.io) — Law enforcement database
> - [Bitcoin Abuse](https://www.bitcoinabuse.com) — Public scam database
> 
> ### Face/Image Search
> 
> - [Yandex Images](https://yandex.com/images) — Best free face search
> - [FaceCheck.ID](https://facecheck.id) — Scam photo database
> - [TinEye](https://tineye.com) — Reverse image search
> - [PimEyes](https://pimeyes.com) — Paid, powerful
> 
> ### Support Organizations
> 
> - [Global Anti-Scam Org (GASO)](https://www.globalantiscam.org) — Victim support

* * *

## ✅ YOUR ACTION CHECKLIST

Print this. Do it in order:

```auto
TODAY:
□ Save scammer's WhatsApp profile photo
□ Screenshot all conversations
□ Get your transaction ID from wallet app
□ Run phone through Truecaller & GetContact
□ Check if number has Telegram account

THIS WEEK:
□ Look up wallet on Tronscan
□ Run wallet through MistTrack (free)
□ Contact other victims, make shared evidence doc
□ File IC3 report (all victims)
□ Report wallet on Chainabuse + Scam Alert
□ Do reverse image search on profile photos

NEXT:
□ File with Palestinian Cybercrime Unit (in person)
□ Email Tether compliance with evidence
□ Monitor wallet for movement (check Tronscan weekly)

```

* * *

**Remember:** You’re not just trying to get your money back. Every report you file helps protect the next person. The scammer did this before you, and they’ll do it after — unless they get caught.

Good luck. The 1Hack community has your back. 🔥

* * *

_Scammers love crypto because it’s “untraceable.” Tronscan disagrees._

_The blockchain never forgets — make sure it remembers you fighting back._

---

<div class="post-metadata">

**Author:** ![IHaveBeenPawned](https://onehack.st/letter_avatar_proxy/v4/letter/i/b782af/32.png) [@IHaveBeenPawned](https://onehack.st/u/IHaveBeenPawned)\
**Post date:** [January 9, 2026, 3:27pm UTC](https://onehack.st/t/scam-fraud-and-impersonation-of-a-friend/316519/3 "2026-01-09T15:27:15Z")

</div>

Thank you for sharing your knowledge, But tbh I already tried some of the steps before.  
like reverse phone number lookup services from step 1.  
And for step 2 i tried to search about the number with country code 970 and 972 but nothing found and for the bots they offer a lot of services but not free.  
Step 3 is good and shows me money movement and transfers and he was using multi exchanges maybe 3 of them, The most one was ByBit , He used two networks with different address, One was from TRX (TRC20) and the other(which is the wallet address used to transfer all money on ByBit using other address with network TRX(TRC10) i think.  
From step 4 through step 6 (the better ones) But to be honest it needs time and patience and the replyment of related law enforcement compliance (I think they won’t give a shit about my friend) Becuase the victims we reached out to them is 4 people and the 5th one is my friend and for our cybercriminal division they said we can’t help, same goes to crypto exchange support (Binance), I already provided scam reports for Chainbase and Scam Alert and waiting for their replyment.

From step 7 until step 10, I already tried them before and they are useless to me.  
Please if you know any better solutions, Provide it to me to solve this problem and put an end to the scammer, Or we want quick and direct intervention from the One Hack team.

---

<div class="post-metadata">

**Author:** ![RoohNooh](https://onehack.st/user_avatar/onehack.st/roohnooh/32/166257_2.png) [@RoohNooh](https://onehack.st/u/RoohNooh)\
**Post date:** [January 9, 2026, 4:39pm UTC](https://onehack.st/t/scam-fraud-and-impersonation-of-a-friend/316519/4 "2026-01-09T16:39:16Z")

</div>

# 🎯When Basic Steps Already Failed

**You did all this…none worked:**

- ✅ Phone lookup (Steps 1-2) — tried, nothing found
- ✅ Blockchain tracing (Step 3) — WORKS, found ByBit + 3 exchanges, TRC20 + TRC10
- ⏳ Steps 4-6 (reports) — filed Chainabuse/Scam Alert, waiting
- ❌ Palestinian Cybercrime Unit — said “can’t help”
- ❌ Binance support — said “can’t help” (but main exchange is ByBit anyway)
- 5 victims total

**The breakthrough:** ByBit is Dubai-based. This opens paths your local police can’t block.

* * *

> **🔥 THE BYBIT ESCALATION PATH (Your Real Shot)**
>
> Your scammer is using **ByBit** as their main cash-out point. This is actually good news because:
> 
> 1. ByBit has a **dedicated stolen funds reporting system**
> 2. ByBit is based in **Dubai, UAE** — strong crypto regulations
> 3. ByBit was recently hacked for $1.5B themselves — they’re extra motivated to show they fight fraud
> 
> ### ByBit’s Official Stolen Funds Process
> 
> **Link:** [bybit.com/en/help-center/article/How-to-Report-Stolen-Assets](https://www.bybit.com/en/help-center/article/How-to-Report-Stolen-Assets)
> 
> **The Problem:** ByBit’s system works like this:
> 
> - **VIP users:** Can submit directly, get reviewed in 2-4 hours
> - **Non-VIP users:** Need police report + official freezing order first
> 
> **Your workaround:**
> 
> Since your local cybercrime unit refused, you need to file with **Dubai Police** instead. ByBit operates under Dubai jurisdiction — a Dubai police report is valid for their system.
> 
> ### Step-by-Step ByBit Report
> 
> 1. **Gather evidence package:**
> 
> 2. **Submit to ByBit anyway** (even without police report):
> 
> 3. **ByBit’s Lazarus Security Lab** reviews reports 24/7. Even if they can’t freeze immediately, your report creates an internal flag on the scammer’s account.
> 
> **Key contact for escalation:**
> 
> - ByBit Security Team: [security@bybit.com](mailto:security@bybit.com)
> - ByBit’s Lazarus Security Lab handles fraud investigations

> **🇦🇪 DUBAI POLICE — THE BACKDOOR YOUR LOCAL POLICE BLOCKED**
>
> Since ByBit is Dubai-based and your local cybercrime unit refused to help, go around them.
> 
> ### Dubai Police eCrime Portal
> 
> **Link:** [ecrime.ae](https://www.ecrime.ae)
> 
> **Why this works:**
> 
> - ByBit is registered and operates in Dubai
> - Dubai has **Federal Decree-Law No. 34 of 2021** covering crypto fraud
> - Dubai Police has jurisdiction over crimes involving Dubai-based companies
> - They can issue freezing orders that ByBit must comply with
> 
> ### How to File
> 
> 1. Go to [ecrime.ae](https://www.ecrime.ae)
> 2. Create account (works for non-UAE residents)
> 3. Select: **Financial Fraud** → **Cryptocurrency Fraud**
> 4. Include:
> - “The fraud involves ByBit, a Dubai-licensed exchange”
> - All wallet addresses
> - Transaction hashes
> - Evidence that funds reached ByBit
> - Number of victims (5)
> 
> **Alternative channels:**
> 
> - **MOI Cybercrime Hotline:** 800-CYBER (800-29237)
> - **Al Ameen Service:** [alameen.gov.ae](https://www.alameen.gov.ae) (anonymous reporting)
> 
> ### Why Dubai Police Might Care
> 
> - ByBit holds a **VARA license** (Virtual Assets Regulatory Authority)
> - Licensed exchanges must cooperate with law enforcement
> - UAE takes crypto fraud seriously — fines up to AED 3 million + imprisonment
> - Your report goes into their system even if they don’t immediately investigate
> 
> **Pro tip:** Reference that this involves a “VARA-licensed entity (ByBit)” in your complaint. This flags it for their regulatory compliance team.

> **📋 VARA COMPLAINT (Dubai Crypto Regulator)**
>
> VARA is Dubai’s crypto regulator. ByBit operates under their license.
> 
> ### Why File with VARA
> 
> - VARA can pressure ByBit to cooperate
> - Licensed exchanges must maintain compliance or risk losing license
> - Regulatory complaints create paper trail
> 
> ### How to Contact VARA
> 
> **Website:** [vara.ae](https://www.vara.ae)
> 
> **Email:** info@vara.ae
> 
> **What to include:**
> 
> ```auto
> Subject: Fraud complaint involving VARA-licensed entity (ByBit)
> 
> We are 5 victims of a WhatsApp impersonation scam where stolen USDT 
> (TRC20/TRC10) was transferred to wallet addresses associated with ByBit.
> 
> Scammer wallet addresses: [list them]
> Transaction hashes: [list them]
> Total loss across victims: [amount] USDT
> 
> We request VARA's assistance in:
> 1. Coordinating with ByBit to freeze/flag the receiving account
> 2. Obtaining account holder information for law enforcement
> 3. Guidance on formal legal process in UAE jurisdiction
> 
> Evidence package attached.
> 
> ```
> 
> **Attach:** All screenshots, transaction records, MistTrack report

> **👥 5 VICTIMS = 5X THE PRESSURE (Coordination Strategy)**
>
> You have **5 victims**. This is your biggest weapon. Here’s how to weaponize it:
> 
> ### Create a Shared Evidence Document
> 
> All 5 victims contribute to ONE master document:
> 
> ```auto
> VICTIM COORDINATION DOCUMENT
> ============================
> 
> Scammer Phone Number(s): [list all used]
> Scammer WhatsApp Profile: [screenshots]
> 
> VICTIM 1:
> - Date of scam: 
> - Amount lost: 
> - Transaction hash(es):
> - Receiving wallet address:
> - Screenshots: [attached]
> 
> VICTIM 2:
> [same format]
> 
> ... (all 5 victims)
> 
> COMMON WALLET ADDRESSES:
> [list addresses that appear across multiple victims]
> 
> FUND FLOW ANALYSIS:
> [MistTrack/Tronscan showing where money went]
> 
> ```
> 
> ### Filing Strategy
> 
> **All 5 victims file to ALL of these:**
> 
> | Platform | How to Reference Others |
> | --- | --- |
> | IC3 ([ic3.gov](http://ic3.gov)) | “This is a coordinated complaint. 4 other victims are filing simultaneously: [names/ref numbers if available]” |
> | Chainabuse | All report same wallet addresses — creates multiple flags |
> | Dubai eCrime | Reference “5 victims, same scammer, same receiving addresses” |
> | ByBit Support | “Multiple victims reporting same fraudulent account” |
> 
> ### Why This Matters
> 
> From FBI IC3 data:
> 
> > _“50 initial IC3 reports grew into an investigation covering 14,000 victims”_
> 
> One victim = noise  
> Five victims = pattern = investigation trigger
> 
> ### Timing
> 
> Coordinate timing. All 5 victims should file within the same 24-48 hour window. This creates a burst of activity that algorithms and analysts notice.

> **🔬 ADVANCED BLOCKCHAIN ANALYSIS (Beyond Tronscan)**
>
> You said Step 3 worked. Now go deeper.
> 
> ### MistTrack Deep Analysis
> 
> **Link:** [misttrack.io](https://misttrack.io)
> 
> You probably just did a basic lookup. Do this:
> 
> 1. **Run ALL wallet addresses** — both TRC20 and TRC10 addresses you found
> 2. **Check risk scores** — does MistTrack flag them as “high risk”?
> 3. **Get the full flow chart** — where did money go AFTER ByBit?
> 4. **Download/screenshot the report** — you’ll need this for police
> 
> ### Cross-Reference the Exchanges
> 
> You said scammer used 3 exchanges, ByBit being the main one. Identify the others:
> 
> - Are any of them regulated exchanges with KYC?
> - Each exchange = another reporting target
> - Each exchange = another potential freeze point
> 
> ### TRC10 vs TRC20 Note
> 
> TRC10 is the older TRON token standard. Scammers sometimes use both to split trails. Make sure you’re tracking BOTH:
> 
> - **TRC20 USDT contract:** `TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t`
> - **TRC10 tokens** have different tracking — check both in Tronscan

> **📞 ALTERNATIVE LAW ENFORCEMENT PATHS**
>
> Your local cybercrime unit said no. Here are other paths:
> 
> ### Option 1: Go Higher in Palestinian Authority
> 
> Don’t accept “can’t help” from frontline officers. Escalate:
> 
> - Ask for **supervisor/commander** of Electronic Crimes Unit
> - File **written formal complaint** (not just verbal report)
> - Reference the Palestinian Cybercrime Law (Decree No. 10 of 2018)
> - Bring printed blockchain evidence showing exact money flow
> 
> ### Option 2: Israeli Police (if applicable)
> 
> If any victims are in Israel or if scammer used Israeli phone prefix (972):
> 
> - Israeli Police Cyber Unit has more resources
> - They have cooperation with international exchanges
> - File at your nearest station, request transfer to cyber unit
> 
> ### Option 3: IC3 → FBI
> 
> Even though you’re not in the US:
> 
> - IC3 accepts international complaints
> - FBI has international cooperation
> - Large-scale crypto fraud (5+ victims) can trigger international coordination
> - **Link:** [ic3.gov](https://www.ic3.gov)
> 
> ### Option 4: Interpol (Long Shot)
> 
> For pattern crimes crossing borders:
> 
> - File via your national police who can forward to Interpol
> - Emphasize multiple victims, multiple countries (if applicable)
> - Crypto scam networks are on Interpol’s radar

> **⚡ TETHER FREEZE REQUEST (Updated Strategy)**
>
> Tether CAN freeze USDT. But here’s the reality:
> 
> ### What Tether Needs
> 
> 1. **Official law enforcement request** — this is why Dubai Police matters
> 2. **Evidence of crime** — transaction hashes, proof of fraud
> 3. **Identified wallet address** — where stolen funds sit
> 
> ### Your Current Blocker
> 
> Your local police said no → No official request → Tether won’t act on individual complaints alone
> 
> ### Workaround
> 
> 1. **File Dubai eCrime report** → Get case number
> 2. **Email Tether compliance:** compliance@tether.to
> 3. **Reference your Dubai case number** in the Tether email
> 4. **Request:** “Please place a watch on address pending law enforcement formal request from Dubai Police case #[Y]”
> 
> ### What Actually Happens
> 
> Tether may not freeze immediately, but they:
> 
> - Flag the address internally
> - Monitor for movement
> - Can act quickly once formal request comes
> 
> **Total frozen by Tether since 2023:** $3.3 billion across 7,268 addresses — they do act when evidence is solid.

> **🚨 REALISTIC TIMELINE AND EXPECTATIONS**
>
> ### Immediate (This Week)
> 
> - ✅ All 5 victims file IC3 reports
> - ✅ File Dubai eCrime report
> - ✅ Email VARA complaint
> - ✅ Submit ByBit stolen funds report
> - ✅ Get MistTrack analysis for evidence package
> 
> ### Short Term (2-4 Weeks)
> 
> - Dubai eCrime may respond with case number
> - ByBit may flag the account (internal hold)
> - Chainabuse/Scam Alert reports become visible to exchanges
> 
> ### Medium Term (1-3 Months)
> 
> - If Dubai Police takes case → Can request formal freeze
> - If multiple exchanges flagged → Scammer’s cash-out paths limited
> - Pattern recognition may trigger higher-level investigation
> 
> ### What Recovery Actually Looks Like
> 
> **Honest truth:** Recovery is unlikely without:
> 
> - Funds still sitting in exchange (not cashed out)
> - Law enforcement formal involvement
> - Exchange cooperation with freeze
> 
> **But:** Even without full recovery, your reports:
> 
> - Flag the scammer’s accounts (harder for them to cash out)
> - Create evidence for future victims
> - May contribute to larger investigation
> 
> ### Your Real Odds
> 
> | Scenario | Probability |
> | --- | --- |
> | No recovery, but scammer flagged | 60% |
> | Partial recovery (some funds frozen) | 15-25% |
> | Full recovery | 5-10% |
> 
> The 5-victim coordination significantly improves these odds vs. acting alone.

* * *

## 📝 YOUR ACTION CHECKLIST (Priority Order)

```auto
RIGHT NOW:
□ Create shared evidence document with all 5 victims
□ Run ALL wallet addresses through MistTrack
□ Screenshot everything from blockchain trackers

THIS WEEK:
□ ALL 5 VICTIMS: File IC3 reports (reference each other)
□ File Dubai Police eCrime report (ecrime.ae)
□ Email VARA complaint (info@vara.ae)
□ Submit ByBit stolen funds report
□ Email security@bybit.com with evidence package

FOLLOW UP:
□ Check Chainabuse/Scam Alert for responses
□ Re-escalate with local police (written complaint, supervisor)
□ Email Tether compliance with Dubai case reference
□ Monitor wallets weekly for movement

```

* * *

## 🔗 All Links

| Resource | Link |
| --- | --- |
| ByBit Stolen Funds Report | [bybit.com/help-center/article/How-to-Report-Stolen-Assets](https://www.bybit.com/en/help-center/article/How-to-Report-Stolen-Assets) |
| Dubai Police eCrime | [ecrime.ae](https://www.ecrime.ae) |
| VARA (Dubai Crypto Regulator) | [vara.ae](https://www.vara.ae) |
| IC3 (FBI) | [ic3.gov](https://www.ic3.gov) |
| MistTrack | [misttrack.io](https://misttrack.io) |
| Tronscan | [tronscan.org](https://tronscan.org) |
| Chainabuse | [chainabuse.com](https://www.chainabuse.com) |
| Scam Alert | [scam-alert.io](https://scam-alert.io) |
| Tether Compliance | compliance@tether.to |
| ByBit Security | [security@bybit.com](mailto:security@bybit.com) |

* * *

_The scammer thought they were safe using multiple exchanges and networks. But every hop leaves a trace, and you’ve got 5 people hunting them._

---

<div class="post-metadata">

**Author:** ![IHaveBeenPawned](https://onehack.st/letter_avatar_proxy/v4/letter/i/b782af/32.png) [@IHaveBeenPawned](https://onehack.st/u/IHaveBeenPawned)\
**Post date:** [January 25, 2026, 1:38pm UTC](https://onehack.st/t/scam-fraud-and-impersonation-of-a-friend/316519/5 "2026-01-25T13:38:07Z")

</div>

Each one of us knows these sorts of methods won’t work for me because the scammer secure himself very well but i think he knows nothing about coding and cybersecurity, And other thing is about reporting and law enforcement sources won’t care about 900 USDT and palestinian people.  
We need something evil but for justice and help other people not for revenge or stealing.

---

<div class="post-metadata">

**Author:** ![agoramilio](https://onehack.st/user_avatar/onehack.st/agoramilio/32/106787_2.png) [@agoramilio](https://onehack.st/u/agoramilio)\
**Post date:** [January 28, 2026, 1:08am UTC](https://onehack.st/t/scam-fraud-and-impersonation-of-a-friend/316519/6 "2026-01-28T01:08:44Z")

</div>

you’re an idiot and deserve what you get if you fall for this idiotic garbage

---

<div class="post-metadata">

**Author:** ![IHaveBeenPawned](https://onehack.st/letter_avatar_proxy/v4/letter/i/b782af/32.png) [@IHaveBeenPawned](https://onehack.st/u/IHaveBeenPawned)\
**Post date:** [January 28, 2026, 11:12am UTC](https://onehack.st/t/scam-fraud-and-impersonation-of-a-friend/316519/7 "2026-01-28T11:12:20Z")

</div>

Choose your word gently, That’s not the way to treat people if someone is fool and idiot about these things it’s not his fault in the beginning, Keep in mind its not me being scammed, It’s my friend.