This scam starts in your TikTok DMs. A brand-new account drops a melodramatic message—terminal illness, last goodbye, “I left you some assets.” At the bottom: a ready-made username and password for a crypto site you’ve never used. It’s designed to feel urgent and personal so you tap before you think. The whole funnel is built for phones: big tap targets, short copy, sticky chat bubbles—perfect for someone arriving straight from TikTok.

Thanks to our community for spotting this one. This exact scam was shared on our Malwarebytes subreddit by user Ok-Internal-2110, who posted a warning for TikTok users after encountering it firsthand.

I walked through the flow so you don’t have to.

What the site shows vs. what actually exists

The illusion:
The moment you log in with the credentials from that TikTok DM, a glossy, mobile-friendly dashboard flashes a huge balance. There’s motion (numbers “update”), a believable “history,” and a big Withdraw button right where your thumb expects it. On a small screen, it looks like a real account with real money.

The trap:
When you try to send that balance to your own wallet, the site asks for a withdrawal key belonging to the original account holder—the one from the DM. You don’t have that key, and support won’t give it to you. External withdrawals are a dead end by design.

The detour they push you to take:
Support suggests using Internal Transfer instead. Conveniently, they also offer to help you create a new user “in seconds,” and this new account will have its own key (because you created it). That makes it feel like you’re finally doing something legitimate: “I’ll just transfer the funds to my new account and then withdraw.”

The paywall you only meet once you’re invested:
Internal transfers only work on “VIP” accounts. To upgrade to VIP, you must pay for a membership. Many victims pay here, assuming it’s a one-time hurdle before they can finally withdraw.

Why nothing real ever leaves the site:
After you upgrade and attempt the internal transfer, the site can:

• demand another fee (a “limit lift,” “tax,” or “security key”),
• fail silently and push you to support, or
• “complete” the transfer inside the fake ledger while still blocking any external withdrawal.

Victims end up paying for the privilege of moving fake numbers between fake accounts—then paying again to “unlock” a withdrawal that never happens.

The scam in a nutshell

This scam is built for volume. DMs and comments via a huge platform like TikTok seed the same gift-inheritance story to thousands of people at once.

Two things do the heavy lifting:

• Shock value: That huge, unexpected number on the dashboard delivers a little jolt of surprise mixed with excitement, which lowers skepticism and pushes you into fast, emotional decision-making.
• Foot-in-the-door: Small steps (log in > try withdraw > hit a roadblock > “just upgrade to VIP”) nudge you toward paying a fee that now feels reasonable.

With borrowed authenticity from a big on-screen balance, the scammers sell you VIP access to move that fake balance around internally while keeping you forever one step away from a real, on-chain withdrawal.

Why do people keep paying up?

• The balance looks real, so every new hurdle feels like bureaucracy, not fraud.
• Paying once creates sunk cost: “I’ve already invested—one more step and I’m done.”
• Internal movements inside their dashboard mimic progress, even though no on-chain transfer ever occurs.
• A mobile flow encourages momentum—it’s always “one more tap” to finish.

Any system that makes you pay to receive money that allegedly already belongs to you is likely to be a scam.

The part most people miss is that you’re also handing over personal data. Even if you never send crypto, the site and the chat funnel collect a surprising amount of information, including your name, email, and phone number.

That data is valuable on its own and makes follow-up scams easier. Phishing that references the earlier “account,” extortion threats, fake “refund” offers that ask for remote access, SIM-swap attempts tied to your number, or simple resale of your details to other crews—and sadly, getting hooked once increases the odds you’ll be targeted again.

How to recognize this family of scams

• You’re asked to log into a site with credentials someone else gave you.
• A big balance appears instantly, but external withdrawals require a mystery key or never complete.
• You’re told internal transfers are possible only after buying VIP or a membership.
• The support bubble is quick to reply about upgrades and silent about on-chain withdrawals.
• Any “proof” of funds exists only inside their dashboard—no public ledger, no small test withdrawal.

How to stay safe

There are safer ways to test claims (without losing money):

1. Never pay to “unlock” money. If funds are yours, you don’t buy permission to move them.
2. Ask for on-chain proof. Real balances live on a public ledger. If they can’t show it, it doesn’t exist.
3. Attempt a tiny withdrawal first to a wallet you control—on legitimate platforms, that’s routine after verifying your identity (know you customer, or KYC) and enabling two-factor authentication (2FA).
4. Search the flow, not just the brand. Scam kits change names and domains, but the “VIP to withdraw” mechanic stays the same.

What to do if you already engaged:

• Stop sending funds. The next fee is not the last fee.
• Lock down accounts: change passwords, enable 2FA, reset app passwords, and review recovery phone/email.
• Reduce future targeting: consider a new email/number for financial accounts and remove your number from public profiles.
• Document everything (screenshots, timestamps, any wallet addresses or TXIDs if you paid).
• Report the TikTok account and the website, and file with your local cybercrime or consumer-protection channel.
• Tell someone close to you. Shame keeps people quiet; silence helps the scammers.

If a platform says there’s a pile of crypto waiting for you but you must buy VIP to touch it, you’re not withdrawing funds; you’re buying a story. TikTok brings you in on your phone; the mobile UI keeps you tapping. Close the tab, report the DM, and remember: dashboards can be faked, public ledgers can’t.

We don’t just report on scams—we help detect them

Cybersecurity risks should never spread beyond a headline. If something looks dodgy to you, check if it’s a scam using Malwarebytes Scam Guard, a feature of our mobile protection products. Submit a screenshot, paste suspicious content, or share a text or phone number, and we’ll tell you if it’s a scam or legit. Download Malwarebytes Mobile Security for iOS or Android and try it today!