Brand-impersonation crypto investment scam: a ChargePoint case study

A fake investment platform doesn’t need to be sophisticated to work. It needs a name people trust, the promise of easy money, and victims willing to bring in their friends.

CYJAX has been tracking a multi-level marketing (MLM) investment scam campaign that impersonates more than 30 global brands to get victims to deposit cryptocurrency. The brands include ChargePoint, Binance, BMW, Lidl and Walmart. The sites are built from an almost identical template and spread through referral links on Facebook and Instagram. A network of Telegram channels and “support” accounts posing as official brand channels backs them up.

In this report, we use ChargePoint as a case study. We explain how the scheme pulls victims in, through fake VIP tiers, a three-level referral commission structure and a fake endorsement from the US Securities and Exchange Commission. We also map the Telegram infrastructure behind it. Several of the linked accounts point to Chinese-speaking operators. An older strand of activity suggests French-speaking actors in Central Africa.

ChargePoint Overview

The campaign uses a standardised web-app format across different brands and domains, showing slight differences based on the company branding and attached images; however, the core functionality and stylistic choices remain consistent throughout. It is distributed using affiliate referral codes spread on social media, and logon is possible using email and phone number. These do not need to be verified as valid or used by the user.

The site displays multiple notices upon login, including a likely AI-generated notice describing how ChargePoint links to the investment scam, providing false context as to why users should invest in the scheme. Another notice then appears, detailing instructions on how users can deposit cryptocurrency to the site, explicitly admitting that users may lose their funds, and enforces a coercive recruitment rule that freezes accounts unless new depositing users are continuously brought in.

On the site, users receive daily tasks every 24 hours, these can be completed to gain small amounts of USDT. In one instance, a user was rewarded $1.30 for a daily task.  

Throughout the site, the operators maintain the appearance that users can withdraw funds at any time. Initially, users can earn small sums through their tasks and are advised by the site to deposit cryptocurrency to increase the users VIP rank.

VIP ranks dictate a daily credit amount distributed to a user’s account, the lowest level, VIP1, costs $9 and rewards users with $5 daily. The highest level is VIP9, costing $18,888 and promising a daily reward of $16,666. Each rank promises a daily reward of an amount that would cover the cost of the deposit within 2 days, luring victims into investing under the guise of seemingly free money.

The site operates an affiliate marketing scam in which users are promised task rewards for reaching referral milestones. In one example, a user was offered 21.00 USDT and VIP2 status if 38 people registered through their referral code. Referred members also join the user’s “team”, allowing the original user to earn a percentage of their income. This commission structure extends across three levels, enabling referral chains to generate income for the original user.

Users are actively reminded and advised to share referral codes and links on different social media platforms to further spread the campaign for operators and increase the alleged profits for the users themselves.

Furthermore, the site impersonates regulatory bodies such as the US Securities and Exchange Commission, likely to illicit trust from the platform by linking it to a major US governmental organisation.

Please see the Telegram section for details related to the Telegram channel and account associated with this site.

Non-ChargePoint branded sites

Several other companies were observed being impersonated in the same manner via similar investment scam pages thought to originate from this campaign. The first appearance of these sites dates back to 7 January 2024. The site structure and methodology were almost identical. Each brand impersonated had several sites hosting the same page, and a Telegram support channel. As the structure of all the sites were so similar this could suggest a kit or template being used to generate the pages.

The campaign likely impersonated specific brands to hijack trust, which would entice more users to sign up to the investment schemes. The campaign saw impersonation of over 30 different companies, including:  

• BMW

• Mercedes-Benz

• Family mart

• Lidl

• Ikea

• Walmart

• Coinbase

• Binance

Throughout the campaign there has been no specific geographical targeting, with organisations worldwide being impersonated. During this campaign, a variety of sectors were mimicked, varying from high-trust retailers to smaller, unregistered corporations. Notably, multiple AI, technology, and cryptocurrency companies were impersonated during this campaign. This may be because it is more probable that a user would confuse the investment page with the legitimate service. Cryptocurrency sites are also more likely to be effective as the sites make all transactions, including withdrawals and investments, in cryptocurrency.

Excluding Walmart, all the notable companies listed have a global footprint. Trust hijacking large, prolific, globally-recognised companies helps the sites maximise ROI and gain a wider pool of victims. These impersonation targets are likely chosen to maximise the amount of people that sign up for the investment schemes, reduce scepticism, and increase the apparent legitimacy of the scheme.  

Some additional sites were observed being hosted on domains with typo-squatted branding or legitimatte brand names in a different language, such as Koka-Kola. This could be a further attempt to manipulate users into thinking the investment schemes are legitimate.

Distribution of the campaign

The scheme operates under typical MLM scheme, with users profiting from recruiting new individuals to the platform through a percentage of the new user’s income. This is chained to three levels of recruitment.  

Users are asked to spread the referral code and link it throughout social media. CYJAX has identified a multitude of Facebook and Instagram posts advertising referral links to the operation. A large portion of observed posts under the ChargePoint campaign were written in Arabic, advertising daily profits from using the site with a small deposit, though the posts generally had low levels of engagement.

Telegram channels

CYJAX has identified the Telegram channel and account associated with the investment scheme site.

ChargePoint  

Platform: Telegram Channel

username: @chargepoin_ujn

Channel display name:ChargePoint

URL: https://t.me/+9rOjlan_z8NlMjBh#

Analyst comment: A Telegram channel registered under the username @chargepoin_ujn was identified. The display name is listed as "ChargePoint", the profile picture displays an image of the ChargePoint logo, and the bio description shares a link to another Telegram account. The channel was created on 24 May 2026 and currently has 10,375 subscribers. The channel advertises a potential cryptocurrency investment scheme using the ChargePoint brand. An image of an alleged license was posted in the channel which may act as proof of legitimacy of the scheme. Posts uploaded to the channel contain links to the suspected investment scheme site along with a Telegram support team detailed below.

Chargeo_SPOT  

Platform: Telegram

Username: @Chargeo_SPOT

Display name: Chargeo_SPOT

URL: https://t.me/Chargeo_SPOT

Analyst comment: A Telegram user registered under the username @Chargeo_SPOT was found. The display name is listed as “Chargeo_SPOT” and the user’s activity status is shown as "last seen recently". The account has no bio and the profile picture displays an image of the ChargePoint logo.

Partial search results for “

Additional Telegram channels, groups, and accounts potentially related to the campaign or linked to the history of the investment schemes using the ChargePoint brand were identified.

ChargePoint official channel  

Platform: Telegram

Group username: @ChargePoint2

Group display name: ChargePoint official channel

URL: https://t.me/ChargePoint2

Analyst comment: A Telegram group registered under the username @ChargePoint2 was found. The display name is listed as "ChargePoint official channel" and the profile picture displays an image of the ChargePoint logo. The bio description reads “Take advantage of the rapidly growing EV market and grow your business by offering industry leading EV charging solutions from ChargePoint.”. The group was created on 13 August 2025 and currently has 58 members. The group is owned by the user @HHMMDD99 and posts are uploaded by the user @mdd838383. The accounts both appear to be owned by Chinese-speaking users. Posts by @mdd838383 advertise a potential cryptocurrency investment scheme using the ChargePoint brand. These posts contain an invitation code, a registration link, a link to a suspected investment scheme site, a link to a Telegram channel, and a Telegram support team. The invitation code contains the repeated digit 8 which in Chinese culture is considered lucky and linked to prosperity and wealth. This may further indicate potential for this particular investment scheme to be linked to Chinese-speaking threat actors. As of 1 May 2026, @mdd838383 appears to advertise another cryptocurrency investment scheme that does not use the ChargePoint brand and instead uses the Binance and ORXY brands. At the time of writing, the Telegram support team with the username @ChargePoint3 cannot be found. This may be due to deletion of the account or takedown by the platform for violating its Terms of Service. Please see details on the additional Telegram channel below.

ChargePoint official channel  

Platform: Telegram

Channel username: @ChargePoint0

Channel display name: ChargePoint official channel

URL: https://t.me/ChargePoint0

‍Analyst comment: A Telegram channel registered under the username @ChargePoint0 was found. The display name is listed as "ChargePoint official channel" and the profile picture displays an image of the ChargePoint logo. The bio description reads “ChargePoint is committed to leading global partners to create wealth together, build a world-leading electric vehicle charging economy, save more fuel costs, reduce combustible gas pollution, and improve the quality of life.”. The channel was created on 14 August 2025 and currently has 1,185 subscribers. The channel posts the content seen in the ChargePoint official channel group. A post advertising the current investment scheme, which impersonates the Binance brand, implies distribution is spread through various social media platforms. Referral links are suggested to be shared through platforms such as Facebook, X (formerly Twitter), YouTube, Instagram, TikTok, KaKao, Whatsapp, and Telegram. The mention of KaKao, a Korean messaging application, indicates potential distribution within East Asia.

红牡丹集团-阿九

Platform: Telegram

Username: @HHMMDD99

Display name: 红牡丹集团-阿九

URL: https://t.me/HHMMDD99

Analyst comment: A Telegram user registered under the username @HHMMDD99 was found. The display name is listed as “红牡丹集团-阿九” which roughly translates to “Red Peony Group-ANine” from simplified Chinese. The user’s activity status is shown as "last seen a long time ago". The account bio, roughly translated from simplified Chinese, reads “Japan, Korea, Asia, the Middle East, Europe, the Americas, Africa, Oceania, overseas first-hand business negotiation and docking, the only docking number, never proactively contact users, special offer for handicap”. As of 6 August 2026, @HHMMDD99 became the new owner of the group named "ChargePoint official channel" due to inactivity from the user @mdd838383. Please see details of the @mdd838383 account below.

Johnny  

Platform: Telegram

Username: @mdd838383

Display name: Johnny

URL: https://t.me/mdd838383

Analyst comment: A Telegram user registered under the username @mdd838383 was found. The display name is listed as “Johnny” and the user’s activity status is shown as "last seen within a week". The account bio, roughly translated from simplified Chinese, reads “Please call to confirm any transactions involving funds”.  

ChargePoint Official Telegram Group

Platform: Telegram

Channel username: @chpt6

Channel display name: ChargePoint Official Telegram Group

URL: https://t.me/chpt6

Analyst comment: A Telegram channel registered under the username @chpt6 was found. The display name is listed as "ChargePoint Official Telegram Group". The bio description reads “This channel will release important ChargePoint announcements and promotions! Please pay attention to it in time to avoid missing out on important information.”. The channel profile picture displays an image of the ChargePoint logo and the channel has 107 subscribers. The channel was created on 9 December 2024 and is used to advertise a potential cryptocurrency investment scheme using the ChargePoint brand. Posts contain instructions on how to navigate the site, a registration link, and details on job opportunities. Activity in the channel was last seen 18 December 2024 with a post detailing alleged investment into the operation from ChargePoint investors most likely to gain the trust of unsuspecting victims.

Canal d'information officiel  

Platform: Telegram

Group username: @ChargePoint_UT

Group display name: Canal d'information officiel

URL: https://t.me/ChargePoint_UT

Analyst comment: A Telegram group registered under the username @ChargePoint_UT was found. The display name is listed as "Canal d'information officiel" which roughly translates to “Official information channel” from French. The account profile picture displays an image of the ChargePoint logo, has no bio, and has 12,045 members. The channel administrators are bots @GHClone5Bot and @joinhide15_bot. The creation date of the group is not known. However, the first post was shared on 15 October 2026. The group is used to advertise a potential cryptocurrency investment scheme using the ChargePoint brand. Posts contain registration links, an invitation code, link to the potential investment scheme site, and a Telegram support account. Please see details on the account below.

ChargePoint  

Platform: Telegram

Username: @ChargePoint_VIP

Display name: ChargePoint

URL: https://t.me/ChargePoint_VIP

Analyst comment: A Telegram user registered under the username @ChargePoint_VIP was found. The display name is listed as “ChargePoint”, the account has no bio, and the user’s activity status is shown as "last seen recently".

Canal d'information officiel

Platform: Telegram

Group username: @ChargePoint_news

Group display name: Canal d'information officiel

URL: https://t.me/ChargePoint_news

Analyst comment: A Telegram channel registered under the username @ChargePoint_news was found. The display name is listed as "Canal d'information officiel", which roughly translates to “Official information channel” from French. The account description, roughly translated from French, reads “We are ChargePoint, the world leader in electric vehicle charging. ChargePoint has deployed electric vehicle charging facilities in 16 countries, including across Europe and North America, providing people with 24-hour vehicle charging services.”. The account profile picture displays an image of the ChargePoint logo, and the channel has 1,926 subscribers. The group was created on 10 May 2023. The group is used to advertise a potential cryptocurrency investment scheme using the ChargePoint brand. Posts contain screenshots of alleged transactions, instructions on inviting and referral, and QR codes. These posts are written in French and a post containing the country flags for Cameroon, Congo, and Gabon may indicate the threat actor involved in this particular investment scheme is from a French-speaking African country. Activity in the channel was last seen 17 June 2023.

Conclusion

This campaign shows how easily brand impersonation scales. Operators re-skin one template for dozens of companies and spread it through referral links, so they can reach victims worldwide with very little effort. The MLM structure then turns each victim into a recruiter. The early payouts are bait. Each VIP tier promises to earn back its cost in about two days, and the withdraw button makes users feel their money is still within reach. The rule that freezes accounts unless new depositors keep joining keeps victims recruiting long after they start to have doubts.

For the brands being copied, the damage goes beyond money lost to fraud. Fake “official” Telegram channels with more than 10,000 followers, a posted “licence” and a false SEC endorsement all wear away trust in the real company. To catch campaigns like this early and get them taken down, organisations need to watch for lookalike domains, fake social media accounts and impersonating Telegram channels.

CYJAX continues to monitor this campaign and the infrastructure behind it. To find out how CYJAX can help detect impersonation of your organisation, get in touch.