“Ghost withdrawal” scam uses fake betting sites to charge fees for supposed winnings

Criminals are running fake betting platforms that show users a balance, then block withdrawals and demand a R$ 20 to R$ 30 Pix fee to “release” the money. For PSPs and risk teams, the interesting part is not the costume — it is that the fraud is built into the site flow, not delivered through malware on the device.

1. ZenoX, an AI cybersecurity startup, identified pages promising returns of up to R$ 3 mil from deposits of R$ 20 to R$ 30. The sites are promoted mainly through social media profiles on TikTok, Instagram and Telegram, according to the research.
2. The investigation, dubbed Saque Fantasma, found a network of fake bets operating under different addresses but using the same mechanism. After the first deposit, the user sees an interface that mimics a betting house, with games, balance and records of supposed withdrawals.
3. When the user tries to cash out, the platform says an additional R$ 20 to R$ 30 must be paid via Pix to unlock the amount. Before showing the charge, the site simulates the processing of the withdrawal request. If payment issuance through the payment service fails, the site generates a Pix QR Code in the browser.
4. The payment-check mechanism, however, cannot confirm the fee as paid. The withdrawal remains marked as “pagamento da taxa pendente” and the user can generate a new QR Code, which resets the loop. In one of the bases analyzed by ZenoX, 68% of 231 transactions were still pending.
5. On another platform linked to the operation, data from more than 3.600 accounts were exposed. The report says this exposure increases the risk of follow-on fraud, including scams that use the victim’s own information to offer a supposed recovery of the money. One of the domains belonged to NEWWBET7K; the researchers also identified maxxbet7k.online, maxbtt7k.online and newwbet7k.online as related to the operation.

Gabriel Paiva, CEO of ZenoX, said the point is not a novel technology but the combination of simple elements that create a convincing experience. In practical terms, that means the fraud can sit entirely inside the site’s logic: no malicious app, no device compromise, just a withdrawal flow designed to keep the user paying for another try.