17/07/2026
If you use LinkedIn for professional networking: please read this.
A managing director we worked with lost Β£95,000 to a forex scammer he met on LinkedIn. Here's what happened.
'James Whitfield' had 4,000+ LinkedIn connections, a professional headshot, 14 years of FX experience in his bio, and two mutual connections with his target. His profile looked completely legitimate.
His profile had been created 74 days before he sent the connection request. The headshot was a stock image. The FCA registration number on his recommended platform belonged to a completely different, legitimate firm.
HOW THE SCAM WORKED IN 4 STAGES:
1. THE CONNECTION β James sent a professional, low-pressure request. 'I noticed we share connections with [X] and [Y]. I work in FX strategy and occasionally share market insights.' For six weeks: no investment talk. Just market commentary and professional messages. Building credibility.
2. THE INTRODUCTION β 'My team has strong Q1 results. We're opening positions for trusted contacts on PrimeForex Capital.' Marcus checked the FCA register. The registration number appeared. He invested Β£5,000.
3. THE DEPOSIT LADDER β Dashboard showed 4.2% returns in week one. 9 transfers over 6 weeks. Total: Β£95,000. Every time Marcus tried to withdraw, James said: 'Reinvestment compounds the position.' This phrase is in the script. It prevents the test withdrawal that would expose the fraud.
4. THE BLOCK β Marcus requested a full withdrawal of his Β£127,400 balance. Response: 'HMRC compliance review. Capital Gains Verification Deposit required: Β£19,100. Transfer within 48 hours.' This does not exist. HMRC does not collect tax through trading platforms. This was the final theft.
WHAT ICAR FOUND:
Marcus's son contacted ICAR - Cyber Recovery 7 days after the withdrawal demand. Our investigators traced all 9 transfers on the blockchain. 71% of funds (Β£67,450) were traced to a Binance deposit cluster. We served a legal letter to Binance compliance.
Result: Β£54,200 frozen. 57% of Marcus's total loss recovered and pending court order. The remaining 29% had already moved to a self-hosted wallet and could not be recovered through exchange cooperation.
HOW TO PROTECT YOURSELF ON LINKEDIN:
β’ When checking an FCA registration, verify the company NAME, registration NUMBER, and contact details all match simultaneously, a number belonging to a different firm is clone firm impersonation
β’ Check fca.org.uk/scamsmart for known clone firm warnings before depositing anywhere
β’ Reverse image search any profile photo of someone recommending an investment
β’ Attempt a small test withdrawal before making any significant deposit
β’ Any 'HMRC compliance deposit' or 'capital gains verification fee' is fraud, not procedure
β’ Any adviser who consistently discourages withdrawals is a warning sign, not a professional
The full case study; including the OSINT investigation of James Whitfield's profile, the blockchain trace, the Binance cooperation, and a 7-question FAQ is on the ICAR website.
π° Full case study:
https://www.icar-global.org/blog
π± Free case assessment:
https://wa.me/447426426707
If you know a professional who uses LinkedIn for networking, please share this post. It may be the most useful thing they read this week. π