d_43da87a9
INTERVENE2026-08-09 12:00:14 UTC · partner demo · threshold profile balanced · source live
Reasoning
The core real-time coaching pattern is fully present: repeated long idle gaps, tab switching, and a pasted destination address, meaning someone is very likely walking the user through this step by step. It sits on top of a textbook small-win bait escalation (200 to 1000 to 4800) into a brand-new one-off wallet that empties within minutes, which matches an investment-scam shape.
Signal vector, as received
| Signal | Value | Contributed |
|---|---|---|
| account_age_days | 3 | — |
| is_first_purchase | true | — |
| amount_eur | 4800 | — |
| amount_vs_median | null | — |
| funding_method | card | — |
| minutes_to_outbound | 6 | yes |
| destination_first_seen_days | 2 | — |
| destination_type | fresh_eoa | — |
| declined_attempts | 0 | — |
| address_entry_method | pasted | — |
| idle_gaps_over_60s | 4 | yes |
| tab_switches | 3 | yes |
| deposit_escalation | [200, 1000, 4800] | yes |
| kyc_retries | 0 | — |
| merchant_verified | null | — |
Probe transcript
Can you tell me what's going on with this transfer?
“I met someone on a dating app about two months ago. We talked every day, and he told me about this investment platform his uncle runs — it's how he gets early access to good entry prices.”
When it came to where the money actually goes, how did you get that wallet address - did he send it to you, or did you get it from the platform itself?
“The address was sent to me directly in our chat, I just copied and pasted it in.”
Since you started talking about this, has anything happened that's made it feel more real or more pressing - like a smaller deposit showing a return, or a window he said you needed to get in by?
“Yes, actually — I withdrew 200 euros last week and it landed in my account, so I know it's real.”
One last thing - has he asked you to keep this between the two of you, or told you what to say if your bank or someone in your family asked what the money was for?
“He did mention I shouldn't really talk about it with my family, since they don't understand crypto and would just worry. And if anyone at the exchange asks, he said to just say I'm buying it for myself.”
Pattern shown to the user
Put side by side, these three things form a shape we see fairly often: an investment introduced through a close personal relationship, a first small amount that pays out smoothly, and then guidance about who not to discuss it with and what to say if asked. The small successful withdrawal is usually the part that does the work, because after it lands, larger amounts feel safe. What stands out here is not the platform or the amount, but that the same person who introduced the opportunity also supplied the address and the wording to use with your family and with us. Genuine investments do not usually need to coach you on what to tell people.