Boiler room checklist: recognise the pattern before you invest

How do you recognise a boiler room before you invest?

You recognise a boiler room by the combination of unsolicited contact, an offer with artificial urgency and a counterparty that cannot be found in any supervisory register. None of those three is conclusive on its own, but together they form a pattern that returns in almost every file.

A boiler room is a sales operation that offers investments which do not exist or are worthless, using intensive contact by telephone or chat. It differs from other forms of investment fraud in its emphasis on personal contact and on pace.

The boiler room checklist below is deliberately kept tickable. Walk through it before you transfer anything, and simply count the ticks.

Which signals go on the boiler room checklist at first contact?

At first contact you look at who started the conversation and how much haste is being made. These six points are the most common signals in that phase:

• You did not start it yourself: contact came through a call, an advertisement or a message you were not expecting.
• The caller knows your name and sometimes your earlier investments, but you cannot check where that data came from.
• You are contacted several times within a few days by the same person, each time friendlier and more personal.
• There is a second person who presents himself as senior, specialist or manager and who confirms the offer.
• You are asked not to discuss the conversation with family or with your adviser, because the offer is said to be exclusive.
• Contact shifts from the telephone to a chat channel, so that no fixed line and no company mail address remain.

Which signals go on the checklist for the offer, the platform and the payout?

In the offer itself you look at everything that is presented as certain, because certainty about return does not exist. These eight points belong on the boiler room checklist:

• A return is named that is fixed, guaranteed or risk free.
• The offer is only valid today, only this week or only for a limited number of participants.
• You may start with a small amount and are then encouraged to top up more and more.
• The platform shows a rising balance, but you cannot find the underlying transactions on a public blockchain.
• The first small withdrawal does work, the second and larger one does not.
• Before a payout a tax, a fine, a verification amount or a commission has to be transferred first.
• You are asked to install a program that lets someone operate your screen or your wallet remotely.
• Someone asks for your recovery phrase or private key, in any form whatsoever.

That last point is absolute: a reliable party never asks for your recovery phrase or private key. What a fake crypto platform shows you is a screen and not a balance.

Which boiler room checklist signals apply to the party behind the offer?

For the party itself you check whether it can be found and addressed in official registers, because a name on a website is not a licence. Four points are enough:

• The company is not in the register of the Dutch Authority for the Financial Markets, or is in fact on a warning list.
• The company cannot be found in the European overview of admitted providers that ESMA maintains.
• The address is a virtual office, the telephone number changes and the domain name is a few weeks old.
• There are only positive reviews, all of them placed in the same period.

Note the division of roles: providers of crypto services fall under MiCA and under the licence requirement that comes with it. That is exactly why a provider who cannot be found anywhere has a problem, and not you.

How many ticks are too many and what do you do on a match?

Four or more ticks on this boiler room checklist is enough not to deposit, and a tick at the recovery phrase or at the payment up front to release a payout is sufficient on its own. On a match you do the following, in this order:

1. Transfer nothing further, not even the amount the counterparty says is needed to release your money.
2. Break off contact and remove any software that allowed someone to watch remotely.
3. Record what you have: screenshots with dates, the addresses used, the transaction hashes and the full conversation history.
4. Check your own wallet and move holdings only if you are certain that you are the only one with access.
5. File a police report and take the recorded data with you, so that the report rests on facts.
6. Report the offer to the AFM, so that the warning list can be supplemented for others.
7. Have the payments investigated so that it is established where the money ended up and which next step makes sense.

What is often underestimated is step three. We regularly see that a chat conversation has already been deleted before someone looks for help, and it is exactly those conversations that complete the timeline. The full sequence is in what you do immediately after a crypto scam.

How does an investigation work once you have already deposited?

After a deposit the investigation starts at your own payment and follows the route to the point where the holdings arrive at a service provider. Paucitas records per step what happened, with date, amount and transaction hash, so that a third party can recalculate the reconstruction.

Paucitas uses no automated analysis software, in any role whatsoever. The investigation is done manually on the basis of publicly accessible block explorers. Every transaction and every transaction hash is verified one by one before it is included in a report.

In boiler room files it often stands out that several affected people end up at the same collection point. That simultaneity is a factual finding and makes a police report more concrete than a story about a vanished platform. How that approach works is set out on the situation page about investigating boiler room fraud.

What can an investigation into a boiler room not establish?

An investigation establishes where your payment ended up and not who was behind the offer. That boundary is hard and belongs explicitly in the report, because a file that suggests more than it can substantiate loses its value at the first critical question.

• Paucitas does not independently establish who is behind a crypto address. What is recorded is which service provider or party holdings went to, so that this information can be followed up through the channels intended for it.
• Paucitas makes no commitment about the outcome of an investigation.
• A report by Paucitas is limited to factual observations and the investigation of those observations.
• Paucitas holds no funds itself and carries out no transactions on behalf of clients.
• Transactions outside the blockchain, such as cash payments or internal bookings within an exchange, are not visible in blockchain data. They are only included if underlying documents are available.
• Paucitas gives no tax or legal advice.

Paucitas also writes no statement on your behalf and conducts no correspondence with a platform or a compliance department. The report is yours.

What can you do yourself and when is that not enough?

You can walk through the boiler room checklist yourself, check the registers and secure your data, and in most cases that is precisely what makes the difference. As long as you have not deposited, that is enough.

It is no longer enough as soon as money has been transferred, as soon as the counterparty insists on an extra payment to release your balance, or as soon as someone has had access to your wallet or your screen. From that point on it is about recording and following, and that is work which has to be verifiable.

Paucitas never asks of its own accord for your recovery phrase or private key. If you need help reading out or restoring your wallet, we guide you through that completely, without us having to see that data ourselves.

What is in the report and how long does an investigation take?

A report by Paucitas follows a fixed structure: reason and description of the assignment, the questions, the scope, the starting points, the data supplied, the sources consulted, the method in outline, verification and quality assurance, reservations and limitations, findings per part, a chronological overview, analysis and coherence, conclusion, statement of independence and appendices. Not every report contains all parts, and the structure is matched to the purpose.

An investigation by Paucitas takes, depending on the size of the file and the urgency, between one working day and two weeks. An urgent report can be delivered within one working day and in exceptional cases on the same day. A regular investigation is usually ready within three working days. In files with many transactions, several wallets or missing history the lead time rises to around two weeks. A surcharge applies to urgent assignments.

Paucitas works with a fixed rate based on your situation. Sometimes we apply an hourly rate by agreement, but the hours are always fixed in advance, so that you never face surprises. No investigation is started before the costs have been discussed and agreed.

Data is supplied digitally or at the office. Per case a delivery list is provided which states what data is needed. Where necessary Paucitas guides the collection and delivery of that data.

Where does the work of the AFM and the police begin and where does that of Paucitas?

The AFM supervises providers and warns about parties without a licence, and the police take down your report and can demand data through criminal procedure. Paucitas does neither and instead establishes the facts that substantiate your notification and your police report.

If you have doubts about an offer or have just deposited, you can have your situation gone through calmly in a free intake. We look at what you have and are honest about what can still be established. More about this service is on blockchain investigation and transaction tracing.

Date of last revision: 26 August 2026.