In brief: a technology company was offered an investment of over a million euros through a London intermediary. The investor sent a passport, a bank statement and a phone bill, and asked the company to open a cryptocurrency wallet first. NCRB verified the person, the documents, the company, the intermediary and the transaction structure, and delivered a clear conclusion within five working days: fabricated documents, a weeks-old website, an intermediary flagged by financial regulators. Do not proceed. The client did not, and lost nothing.
At a glance
| Client | North American technology company |
|---|---|
| Trigger | Investment offer of over EUR 1 million via a UK intermediary |
| Condition | Client had to open a cryptocurrency wallet (USDC) first |
| Question | Is this investor who he says he is? |
| Turnaround | 5 working days |
| Outcome | Fabricated documents, fake website, intermediary flagged by financial regulators. Recommendation: do not proceed. |
An offer that looked too good
It started the way many good deals start: with an introduction. A financial advisory firm in London connected the CEO of a North American technology company with a European businessman. He wanted to invest well over a million euros. He sent his KYC documents straight away: a passport copy, a bank statement and a phone bill. Neat, complete, professional.
There was one condition. The company first had to open a cryptocurrency wallet, “under its own control”, into which the amount would be deposited in USDC.
The CEO had no concrete reason to doubt the offer. But he had a feeling. And with that feeling, he came to NCRB.
Four questions, seven answers
The client wanted to know four things:
- Is the person I am corresponding with the same person behind the company he names?
- Are there public photographs of him to compare with the passport?
- Does his company actually exist?
- What is his corporate history, and which other companies are linked to him?
We advised adding three elements, because a counterparty never stands alone from the chain that delivered him:
- Verification of the supplied documents themselves
- Investigation into the intermediary and the two individuals who made the introduction
- Assessment of the proposed transaction structure
Fixed fee agreed in advance, delivery within five working days.
What the investigation uncovered
The bank statement was made in a word processor
The three documents came in a single PDF. The file’s metadata told the first story: created in a word processor, on a date earlier than the bank statement and the invoice it contained. Banks and telecom providers generate their documents with their own systems, not with Word.
Then it became concrete. One counterparty account number on the statement had an invalid check digit, a combination no real bank can produce. Another counterparty account was identical to the account itself. And under a black box meant to hide a name, the name was still perfectly readable.
The statement itself told an implausible story: close to two hundred thousand euros out in three weeks, interspersed with cash deposits, without a single grocery run, fuel stop or subscription. Not a real account, but an account designed to suggest proof of funds.
The phone bill departed from the provider’s format, wording and billing logic. Compared with a genuine bill from the same period, it did not hold up.
The passport was real. That did not make it better.
The personal details on the passport matched the registered director of the company: a one-person construction company, incorporated with one euro of share capital, that had never filed annual accounts and had no credit score. Nothing in the public record supported the seven-figure profile presented to the client.
No public photographs of the director existed, despite extensive searches. A comparison with the passport photo was therefore impossible. That is a finding in itself: a businessman prepared to invest EUR 1.2 million without leaving any digital trace.
Whether this businessman is a victim of identity misuse or a participant could not be established from public sources. Both scenarios remain open, and the report says so.
The email domain was a few weeks old
The domain the “investor” used had been registered a few weeks before the first contact, with a budget hosting provider and a hidden registrant. The website behind it presented a fictitious international real-estate investment firm and had copied the real construction company’s registration details from a commercial credit-report page. During the investigation, the intermediary’s website went offline as well.
The intermediary had a history
The London advisory firm turned out to be a renamed company. Under its old name, a European financial regulator had warned against it in 2023 for conducting banking business without a licence, a warning relayed by several other regulators. No authorisation, an overdue annual confirmation statement, an active strike-off proposal. One of the two representatives was not a registered officer anywhere and could not be traced independently.
The structure was the pattern
A legitimate investor wires funds to the bank account of the company he invests in. Asking the receiving party to open a cryptocurrency wallet first is the opening move of a known scam. After the “deposit” comes a request for fees, taxes, an activation payment or a “compliance charge” to release the funds. Or a request to hand over control of the wallet.
The outcome
Within five working days the client received a report with a conclusion on each question, source references and evidence appendices. The advice was unambiguous: do not proceed, do not create a wallet, do not pay any fee. The client followed it. Nothing was opened, nothing was paid and nothing further was shared.
The report was written to be directly usable by the client’s lawyer and bank, and as the basis for a report to law enforcement or a regulator.
How to spot a fake investor
Five signals from this case that you can check yourself:
- Reverse due diligence. Normally the investor investigates the company. If the investor volunteers a complete set of documents, he is buying trust he intends to cash in later.
- A young domain. Check how old the counterparty’s email domain is. A company that has existed for years does not email from a domain registered last month.
- Crypto as the payment vehicle for an investment. Especially when you, as the recipient, are asked to open, set up or pay for something first.
- An unlicensed intermediary. Check the introducing party with the financial regulator and in the company register. Watch for name changes.
- Documents that are too good. A bank statement with only large amounts and no daily expenses is not a bank statement. It is a story.
A genuine passport, incidentally, proves nothing about the sender. It only proves that a person with those details exists. Leaked passport scans are misused on a large scale.
Doubts about an investor, buyer or business partner?
NCRB is a licensed Dutch private investigation agency (Wpbr, POB 1737) working internationally for companies, law firms and insurers. We verify the identity and background of business counterparties (background checks and due diligence), check supplied documents for authenticity and consistency (digital evidence and document verification), and map corporate structures and introduction chains (fraud investigation). A standard counterparty investigation is delivered within three to five working days at a fixed fee you know in advance.
Contact us at info@ncrb.nl or through the contact form. An initial assessment of your situation is free of charge. Urgent matters can be prioritised.
Frequently asked questions about investment fraud and due diligence
How do I recognise investment fraud involving a fake investor?
Typical features are an unsolicited offer, an intermediary who arranges the introduction, an investor who sends documents to build trust, and a request for you to open or pay for something before the funds become available. Cryptocurrency is often proposed as the payment vehicle.
Can I check a passport copy myself?
Partly. The check digits in the machine-readable zone can be recalculated and document numbers follow a fixed format. But a genuine passport does not prove that the sender is its owner. That requires investigation into the sender, the email domain and the official registers.
What is a USDC wallet scam?
A fraud in which an “investor” asks the target company to open a cryptocurrency wallet into which the investment would be deposited in USDC. After a fake deposit or a mirrored transaction, a request follows to pay fees, taxes or an activation charge, or to hand over control of the wallet. The money never arrives.
What does an investigation into an investor or counterparty cost?
A standard verification of one individual and one company in the Netherlands or the United Kingdom is carried out by NCRB at a fixed fee agreed in advance, with a turnaround of three to five working days. For several parties or jurisdictions we provide a tailored quote beforehand.
What is the difference between a KYC check and due diligence?
A KYC check verifies the identity of a person or company against documents and registers. Due diligence goes further and also assesses background, corporate history, reputation, related parties and the plausibility of the proposed transaction.
Does NCRB work for companies outside the Netherlands?
Yes. NCRB works for clients in and outside Europe. We know the Dutch registers and sources, how to query them and how to interpret the results. Reports are delivered in English or Dutch.
This case study has been fully anonymised. Names, sector, country, amounts and dates have been changed or omitted. The investigation was carried out in accordance with the Dutch Private Security Organisations and Investigation Agencies Act (Wpbr), the Privacy Code of Conduct for private investigation agencies and the GDPR.
