My broker wants to see tax or a deposit before I can withdraw, what happens to that money?

Why does a platform ask for extra money before you can withdraw?

A platform that asks for tax or a deposit upfront, or other costs, uses that condition to delay your withdrawal and at the same time receives a new payment from you. The label changes from case to case: tax on the profit, a deposit for liquidity, costs for an anti-money laundering check, a verification amount or a fee for releasing your account. The outcome is always the same: money goes from you to the platform before anything comes back to you.

Europol describes this pattern in investment fraud: as soon as someone asks questions about the returns, reasons are given why a withdrawal is not possible, such as fees or taxes, and more money is requested to release the funds (Europol, Online fraud schemes). The Dutch AFM warns along the same lines about providers that first ask for a deposit or tax before they buy or sell your investment (AFM on dubious investment proposals, in Dutch).

Whether your situation involves fraud is not something you need to establish at this moment. What is certain is that the payment now being requested from you becomes a factual record as soon as you make it. An overview of how an investigation into such situations works can be found on the page about crypto fraud investigation. If you are now being asked to pay, contact us first before you transfer anything, so that it is first established where your earlier payments went and whether that route supports a suspicion of fraud.

What happens to money you pay upfront as tax or a deposit?

The money you pay upfront ends up at an address or account controlled by or on behalf of the platform and follows its own route from there, separate from your earlier deposits. A tax authority or a deposit account in your name does not appear anywhere in that route.

On the blockchain this usually looks as follows. You send the requested amount to the address you are given. That address forwards the amount shortly afterwards, often together with payments from others, to a collection address. From the collection address it moves on to a service provider, another network or a series of intermediate addresses. Meanwhile the platform itself shows a balance that stays the same or even rises; that balance is a figure in an environment controlled by the platform, not a holding on the chain.

That distinction is what makes the situation understandable. What you see in the dashboard is what the platform shows you. What is on the chain is what happened to your payments. A fake crypto platform works with that split: a convincing screen at the front, a series of ordinary addresses behind it.

Paucitas sees in files that it rarely stops at one condition. After the requested tax or a deposit there is often a verification amount as well, and each step is presented as the last. Each of those payments is a new deposit with its own receiving address.

Can that extra payment still be traced?

Yes, an extra payment in crypto can be traced on the blockchain from the moment you send it, and because that payment is recent and often went to a new address, it regularly produces a clearer trail in an investigation than the first deposit. A recent payment has a short route behind it, and a new address has not yet been mixed with years of traffic.

That is why Paucitas does not treat the second payment as a warning sign you should have noticed afterwards, but as a separate object of investigation. The questions are concrete: to which address did the amount go, when was it forwarded, which other payments was it combined with and at which service provider did it end up. Anyone with a similar question about a broker that no longer responds will find more on the question page about investigation of a fraudulent crypto broker.

Case. A private individual had deposited several times over a few months with a platform that asked for tax at his first withdrawal. He paid, after which a deposit followed and finally a smaller amount for verification. His earlier deposits had gone through addresses that had been in use for a long time and were quickly absorbed into large flows.

The last and smallest payment went to an address that had only been put into use that week. From that address the route was short: within a few days the amount, together with other incoming payments, ended up at a service provider. That trail produced the most concrete finding in the report, namely the service provider where the funds arrived, with date, amount and transaction hash for each step.

The limit. Paucitas does not independently establish who is behind a crypto address. What is recorded is to which service provider or party funds have gone, so that this information can be followed up through the appropriate channels.

What should you record now before doing anything else?

Before doing anything else, record five details for each payment and make no new payment. That order prevents a further deposit from being added and ensures that the investigation can start with complete data.

1. Make no further payment, not even if it is announced as the final step.
2. Keep the message, email or chat in which the payment was requested, with date and sender.
3. Note for each payment the date, the amount, the receiving address and the transaction hash.
4. Export the transaction history of your own wallet or exchange account.
5. Take screenshots of the balance and the messages in the platform while it is still accessible.

At this stage it happens that someone comes forward offering help with releasing your balance and asks for access to your wallet in return. Paucitas never asks of its own accord for your recovery phrase or private key. If you need help reading out or restoring your wallet, we will guide you through it fully, without needing to see that information ourselves.

What a private individual can concretely expect from us is described on the page for private individuals.

What does Paucitas do with the payment you made upfront?

Paucitas investigates each payment separately, including the payment of tax or a deposit, and records for each payment to which address the money went and where the route ends. In the report the first deposit is therefore not lumped together with the later payments; each payment appears as its own line with date, amount, addresses and transaction hashes.

Data is supplied digitally or at the office. Per case a delivery list is provided which states what data is needed. Where necessary Paucitas guides the collection and delivery of that data.

A Paucitas investigation takes between one working day and two weeks, depending on the size of the file and the urgency. An urgent report can be delivered within one working day and in exceptional cases the same day. A regular investigation is usually ready within three working days. For files with many transactions, several wallets or missing history, the lead time rises to around two weeks. A surcharge applies to urgent assignments.

The order is fixed: first the investigation, after which you can use the report to file a police report. With the report in hand you have a documented route instead of loose screenshots.

If you want the payment you made upfront to be investigated, Paucitas starts with an assessment of your data; the approach is described under blockchain research. If you are still unsure whether the platform exists as it presents itself, also read the related blog is my crypto investment a scam, and then contact Paucitas.