Financial fraud investigations are often associated with what happens after victims have lost their money.
However, the FBI’s Operation Level Up demonstrates a unique approach.
Rather than waiting for victims to report significant losses, the FBI’s initiative focused on identifying individuals
who were actively being targeted by cryptocurrency investment fraud and intervening before additional funds
were transferred. Using investigative techniques and intelligence developed through ongoing investigations, the
FBI contacted potential victims directly, warning them that the investment opportunity was fraudulent before
further financial harm could potentially occur.
The results themselves perfectly illustrate the value of proactive financial investigations. As of December 2025,
Operation Level Up had identified more than 8,100 victims, with approximately 77% having been unaware that
they were being scammed. The FBI estimates that the initiative has prevented more than $511 million in
additional financial losses.
8,100+
Victims identified
77%
Unaware they were being
scammed
$511M+
In potential losses prevented
C Y B E R F R A U D I N VESTIGATION S Independent. Impartial. Evidence-based.
Investigation spotlight: Operation Level Up | cybercfi.com Page 1
Proactive investigation can stop fraud before it causes lasting damage.
Figure: Operation Level Up case study | cybercfi.com
C Y B E R F R A U D I N VESTIGATION S Independent. Impartial. Evidence-based.
Investigation spotlight: Operation Level Up | cybercfi.com Page 2
The Fraud Methodology
The fraud schemes follow a pattern that has become increasingly familiar. Victims are approached through
unsolicited messages, social media, professional networking platforms or dating applications. Over time, the
fraudsters establish trust before introducing what appears to be a legitimate cryptocurrency investment
opportunity.
Victims are directed to sophisticated websites or mobile applications that display account balances, trading
activity and steadily increasing profits, creating the impression that their investments are performing
exceptionally well. This methodology has become a recurring feature of cryptocurrency investment fraud and
continues to affect victims worldwide. The effectiveness of these schemes rarely depends on sophisticated
technology alone. Instead, they rely upon gradually building trust before introducing increasingly larger
investment opportunities. The early profits displayed by the platform reinforce confidence which encourages
victims to invest additional funds as they have been led to believe they are making informed financial decisions.
In some cases, victims may even be permitted to withdraw a relatively small amount of money during the early
stages of the fraud. This initial withdrawal can create the impression that the platform is legitimate and that larger
balances displayed on the platform are genuine. Once that confidence has been established, victims are often
encouraged to make substantially larger deposits before eventually being prevented from accessing their funds.
When larger withdrawals are requested, new obstacles frequently emerge. Victims may be informed that taxes,
Anti-Money Laundering (AML) charges, compliance fees, liquidity requirements or other administrative payments
must first be made before their assets can supposedly be released. Each additional payment is presented as the
final requirement, only for another condition to arise after the previous payment has been made.
The Investigative Challenge
One of the greatest investigative challenges presented by schemes such as these is distinguishing information
generated by the fraudulent platform from evidence that can be independently verified.
Fraudulent investment platforms are often designed to closely replicate the appearance of legitimate financial
services. In some cases, they imitate well-known cryptocurrency exchanges or investment platforms by using
similar branding, colour schemes, layouts or domain names that differ only slightly from the genuine website.
These subtle differences can be difficult to identify, particularly when victims are directed to the platform through
links provided by the fraudsters rather than locating the legitimate website independently. Trading dashboards,
account statements, portfolio valuations, transaction histories and profit calculations may all appear authentic to
the victim. Professional financial investigations therefore seek to establish whether the information displayed can
be corroborated through independent sources of evidence. Bank records, blockchain transactions, exchange
records, payment confirmations, communications, account documentation and chronology each contribute a
different perspective on the financial activity under investigation. Individually, they may reveal very little.
However, when examined together, they allow investigators to distinguish genuine financial transactions from
information generated solely by the fraudulent platform.
This distinction is particularly important because screenshots of account balances or trading profits are often
among the first documents victims preserve. While these records may assist investigators in understanding how
C Y B E R F R A U D I N VESTIGATION S Independent. Impartial. Evidence-based.
Investigation spotlight: Operation Level Up | cybercfi.com Page 3
the fraud was presented, they do not, on their own, establish that the assets displayed ever existed. Their
investigative value emerges when they are considered alongside independently verifiable financial evidence.
Why Operation Level Up Worked
Operation Level Up demonstrates how financial investigations are not solely concerned with asset recovery after
a substantial loss has occurred.
This initiative succeeded because the financial investigators were able to connect intelligence gathered from
multiple independent sources. Individual complaints, wallet addresses, financial transactions, websites,
communications and other investigative information were assessed collectively rather than in isolation. Patterns
that may have remained invisible within a single victim’s report became identifiable when viewed across
thousands of investigations. This broader intelligence picture enabled investigators to identify individuals who
were actively being targeted before additional payments were made. Rather than waiting for victims to realise
they had been defrauded, the investigation itself created the opportunity to interrupt the fraud while it was still
unfolding.
This principle reflects an important distinction explored throughout this series: Reporting
creates intelligence. Investigations determine what that intelligence demonstrates.
Prevention Through Investigation
Financial investigations are often viewed as reactive exercises undertaken after losses have already occurred.
Operation Level Up demonstrates that investigations can also prevent financial harm. By gathering, assessing
and connecting intelligence from multiple independent sources, investigators were able to identify emerging
criminal methodologies, recognise individuals who were actively being targeted and intervene before additional
funds were transferred.
Preventing a victim from transferring a further $100,000 may ultimately have as much
investigative value as recovering $100,000 that has already been lost.
This illustrates that the purpose of financial investigations extends beyond recovery. They also contribute to
disruption, prevention and the protection of future victims. The success of an investigation should therefore not
be measured solely by the assets it recovers, but also by the financial harm it prevents.
Evidence Beyond Blockchain
Cryptocurrency investigations are frequently associated with blockchain analysis, and while blockchain evidence
is an important component of many investigations, it rarely provides the complete picture.
C Y B E R F R A U D I N VESTIGATION S Independent. Impartial. Evidence-based.
Investigation spotlight: Operation Level Up | cybercfi.com Page 4
Operation Level Up demonstrated that successful financial investigations depend upon the integration of multiple
independent sources of evidence such as: complaints submitted by victims, communications, websites, financial
institution records, cryptocurrency exchange information, intelligence gathered during previous investigations
and other forms of financial intelligence each contribute to understanding how the fraud developed.
Blockchain analysis may establish where digital assets moved.
Communications may explain why they were transferred.
Financial records may identify the institutions involved.
Chronology may establish how the fraud evolved over time.
Individually, each of these sources answers a different investigative question. Examined together, they may
reveal relationships, patterns and connections that would not be apparent if each source were considered in
isolation.
Investigative Insight
Operation Level Up demonstrates that the value of financial investigations extends beyond recovering assets
after a fraud has occurred.
Intelligence gathered from one victim may identify another. While, information collected today may prevent
losses tomorrow. Independent pieces of evidence, when connected over time, can reveal organised criminal
activity that would remain invisible if each report were viewed in isolation. Perhaps the most important lesson is
that evidence gains value through context. Thousands of reports that have been examined collectively can
expose criminal methodologies, identify emerging patterns and create opportunities to prevent further
victimisation. Operation Level Up exists because investigators recognised those connections across thousands
of independent reports rather than viewing each complaint as an isolated event.
Financial investigations are not simply about following the money. They are about understanding how
independent sources of evidence connect, what those connections demonstrate and how that understanding
can be used not only to investigate financial crime, but also to prevent it. One of the most important investigative
lessons from Operation Level Up is that the information displayed on an investment platform should never be
confused with independent evidence that assets actually exist. According to the FBI, the platforms used in these
schemes often display fabricated account balances and fictional investment returns. In some cases, victims are
even permitted to withdraw a relatively small amount of money during the early stages of the fraud. This initial
withdrawal is intended to reinforce confidence in the platform and encourage substantially larger investments
later. When victims eventually attempt to withdraw larger amounts, they are frequently told that additional
payments are required before their funds can be released.
This is a significant distinction as it reveals that the objective is not to determine whether a website displays a
balance, but whether independent evidence supports the existence and movement of the assets it claims to
represent. Professional financial investigations therefore focus on corroborating information through bank
C Y B E R F R A U D I N VESTIGATION S Independent. Impartial. Evidence-based.
Investigation spotlight: Operation Level Up | cybercfi.com Page 5
records, blockchain transactions, exchange records, communications, payment instructions and other
independent sources of evidence rather than relying solely on information generated by the platform itself.
Operation Level Up also demonstrates the importance of reporting financial fraud. Many victims contacted by the
FBI had not realised they were being deceived and were preparing to invest substantially more money, including
liquidating retirement accounts, selling their homes or obtaining loans. By identifying these victims early,
investigators were able to interrupt the fraud before additional losses occurred.
Investigative Insight
Operation Level Up demonstrates that financial investigations are not solely concerned with recovering assets
after a fraud has occurred. They also play an important role in identifying criminal patterns, connecting
intelligence and preventing further victimisation.
Perhaps the most valuable lesson is that a displayed balance, investment return or successful withdrawal should
never be treated as proof that corresponding assets exist. The investigative value lies in corroborating those
claims through independent sources of evidence. It is often those independent records, not the numbers
displayed on a screen, that reveal what has actually happened.
