AI-Simulated Crypto Trading Dashboards: Inside the INGFX, Velement and Vortax Scam Kits

The fake-broker scam has been re-engineered around generative AI. Group-IB and other threat-intelligence firms have documented pre-packaged scam kits — INGFX and Velement are two of the better-known templates — sold openly on Russian- and Chinese-language dark-web markets for a few hundred dollars. A non-technical operator buys the kit, points it at a freshly registered domain and within minutes has a fully animated trading terminal live on the public internet: candlestick charts pulled from real Binance and Coinbase APIs, simulated order books, a portfolio view, a withdrawal page, and a chat widget backed by a large language model trained to handle objections in the operator's chosen language. Crucially, the back end is entirely synthetic. The scammer logs into a control panel and types instructions in plain language — "set victim balance to fifty thousand dollars," "trigger a fake margin call," "display a tax notice on withdrawal" — and the victim's screen updates accordingly.

Two complementary techniques harden the illusion. Lookalike exchange clones register domains one or two characters off the real platform — coinbase-support-portal.net, kraken-fixed-income.com, binance-premium-vault.io — and pull live market data through the genuine exchange's public API, so the price ticker on the fake page is mathematically identical to the real one. The Vortax malware campaign documented by security researchers takes the deception further: victims are lured into downloading what they believe is a legitimate AI trading assistant, but the package installs a browser extension that rewrites what they see in their real exchange account, hiding outbound transfers and replacing balance figures in the DOM before they reach the rendered page. To the victim, their genuine Coinbase or Kraken dashboard appears to confirm everything the scammer is claiming.

Three anatomical features give every simulated dashboard away. The first is the guaranteed-return tracker: real markets oscillate, but a fake account displays a near-perfectly smooth upward curve, a daily profit figure that never goes negative, and a 'win rate' above ninety percent. The second is the locked-withdrawal trigger: the first withdrawal attempt produces a modal demanding fresh crypto for 'AML clearance,' 'capital-gains tax,' 'liquidity provisioning' or 'account verification,' none of which any regulated exchange has ever required. The third is the onboarding pipeline: legitimate exchanges run automated KYC through their own secure portals, while every simulated dashboard is introduced to the victim by a 'mentor,' 'analyst,' romantic partner or WhatsApp/Telegram group that walks them through which buttons to press — frequently on a live video call where the supposed fund manager's face and voice are now generated in real time by commodity deepfake software.

The defensive principle is unchanged but more urgent than ever: never trust a platform on the basis of its user interface, its chat support or a video call alone, no matter how convincing. Confirm that the operating entity is authorised by a recognised financial regulator — ASIC in Australia, the SEC and FINRA in the United States, the FCA in the United Kingdom, BaFin in Germany, MAS in Singapore — and that the licence number resolves to the same legal entity on the regulator's own website. Scam AI automates that check across global registries, regulator warning lists, sanctions data, WHOIS records and unsafe-website feeds, returning a legitimacy verdict and the underlying evidence in seconds. Before depositing a cent into any crypto trading platform introduced to you over WhatsApp, Telegram, Instagram or a video call, scan the URL free of charge at scamai.org.