I paid a party that called me, where does that money go afterwards?

Which route does your deposit take after the payment?

Money after investment fraud takes a route in four phases, and those four phases usually follow each other within days rather than within weeks. Paucitas describes them in that order, because every phase produces a different kind of lead.

1. Intake: your payment arrives at an address often created only for you, so that on the receiving side it is clear who deposited what.
2. Bundling: your amount is joined with payments from others, which makes visible that you were not the only one and how large the flow is.
3. Spreading: the bundled amount is divided over several addresses and sometimes moved to another network, which makes the chain longer but does not interrupt it.
4. Exit: parts arrive at a service provider where they can be exchanged or booked on, and there the visibility stops.

The second phase is the phase that produces most in this type of file, and that is exactly the phase people do not expect. As soon as your payment comes together with other payments, a pattern arises with a size and a frequency, and that pattern can be described in a report.

On the organised side of investment fraud and the scale on which it is committed, Europol publishes.

How is it established where money after investment fraud leaves the chain?

That is established by determining per entry which part of the outgoing amount comes from your payment and by carrying that calculation through to the address that demonstrably belongs to a service provider. Paucitas does that manually, entry by entry, and states per step whether the share of your deposit can be established with certainty or with a margin.

Paucitas uses no automated analysis software, in any role whatsoever. The investigation is done manually on the basis of publicly accessible block explorers. Every transaction and every transaction hash is verified one by one before it is included in a report.

Whether the party that called you is registered anywhere as a provider you can check yourself; the Dutch Authority for the Financial Markets publishes registers and warnings about providers without a licence. That takes a quarter of an hour and it is useful for your file, even if the answer does not surprise you.

How an investigation into this type of payment proceeds is set out on the question page about investigating boiler room fraud with crypto payments.

Has your deposit already been exchanged into euros at that moment?

Usually not yet in full at the moment you first wonder whether something is wrong, and that is the reason the time of your report counts. Exchanging into euros happens at a service provider and that is an administrative act, not an entry on the blockchain, so from that point the position can only be known through that provider.

With money after investment fraud three situations can be distinguished and they lead to a different report. If the funds still stand at an address without a service provider in between, the whole route can be described. If they have arrived at a service provider, the report ends at that point with the amount, the time and the receiving address. If a mixer or a privacy oriented network has been used, it is stated explicitly up to which point the route can be established.

What an investigation means for you as a private individual, from intake to report, is set out on the page for private individuals.

How long does a chain reconstruction take?

An investigation by Paucitas takes, depending on the size of the file and the urgency, between one working day and two weeks. An urgent report can be delivered within one working day and in exceptional cases on the same day. A regular investigation is usually ready within three working days. In files with many transactions, several wallets or missing history the lead time rises to around two weeks. A surcharge applies to urgent assignments.

With money after investment fraud the time rarely lies in the following and almost always in the excluding. With a bundled flow there are several candidates per step, and every candidate that drops off has to drop off with a reason, otherwise the finding cannot be defended later.

Data is supplied digitally or at the office. Per case a delivery list is provided which states what data is needed. Where necessary Paucitas guides the collection and delivery of that data.

One more point that often comes up in this phase, because after a first loss people are called by a party saying it can solve the problem.

Paucitas never asks of its own accord for your recovery phrase or private key. If you need help reading out or restoring your wallet, we guide you through that completely, without us having to see that data ourselves.

What can and cannot be established, and what can you do yourself?

What can be established is the route of your payment, the bundle it ended up in and the service provider where the funds arrived; what cannot be established is who the person on the telephone was.

• Paucitas does not independently establish who is behind a crypto address. What is recorded is which service provider or party funds went to, so that this information can be followed up through the channels intended for it.
• Paucitas holds no funds itself and carries out no transactions on behalf of clients.
• Paucitas makes no commitment about the outcome of an investigation.
• Transactions outside the blockchain, such as cash payments or internal entries within an exchange, are not visible in blockchain data. They are only included if underlying documents are available.
• Where mixers or privacy oriented networks are used, the chain cannot always be followed in full. In that case it is stated explicitly up to which point the route can be established.

You can do three things yourself that make the investigation shorter: list all payments with date, time, amount and transaction hash, keep the call history and the telephone numbers, and take screenshots of the platform and your account page before they disappear.

That is where the limit of this work lies: Paucitas records the route and the end point, but does not retrieve funds and makes no commitment about what a service provider or an authority will do with that finding.

A report on money after investment fraud follows a fixed structure at Paucitas: occasion and description of the assignment, question, scope, starting points, data supplied, sources consulted, method in outline, verification and quality assurance, reservations and limitations, findings per element, chronological overview, analysis and coherence, conclusion, statement of independence and appendices. Not every report contains all elements.

Paucitas works with a fixed price based on your situation. Sometimes we apply an hourly rate in consultation, but the hours are always fixed in advance, so that you never face surprises. No investigation is started before the costs have been discussed and agreed.

Paucitas usually responds within a few minutes to an hour and in almost all cases the same working day.

Which investigation belongs here you can read under blockchain investigation. A worked example of a route across several networks is set out in the case study about USDC fraud across three networks.

The order stays the same here: first the investigation, then you can file a police report with the report, because the entries have then already been named and can be verified.

List your payments and send them to Paucitas. In a first assessment it is named how deep the chain currently runs and whether there is a cash out point that can be recorded in a report.

Date of last revision: 10 September 2026.