A WhatsApp group offers free stock ideas from a confident “professor” and a helpful assistant. Early recommendations may perform well, members post screenshots of gains, and an exclusive app promises access to pre-market trades.
The account balance grows until the investor asks to move the money back out.
Overview
The group builds trust before promoting its own platform
A recent victim warning described a Citiuni or Citi Group stock-trading group on WhatsApp. The reporter said a “Professor Antoine” and “Assistant Zoe” shared stock recommendations, then directed members to a separate app for pre-market trading.
The public account is brief and does not identify the app package, deposit destination, amount lost, or operator. MalwareTips therefore treats the names and withdrawal problem as allegations from one user, supported by a well-documented broader scam pattern.
FINRA and the SEC have repeatedly warned that investment-group fraud begins in social media ads, moves to WhatsApp or Telegram, and uses a professor, assistant, testimonials, and a private platform to control what victims see.
The displayed profits may never represent real trading
The reporter said the app eventually would not allow withdrawals. A platform can display trades, balances, bonuses, and profits without sending orders to a real market or holding assets in the investor’s name.
The SEC’s group-chat investor alert explains that fake apps may show profits and then demand a fee, tax, or additional deposit when a victim tries to withdraw.
An app-store listing does not settle this question. A polished application can be approved under a generic finance description, distributed outside an official store, or removed before victims search for it.
Citiuni should not be confused with Citigroup
The Reddit warning used “Citiuni or Citi Group,” while the reported app and group name appear to be Citiuni. Similar wording may encourage an association with Citi or Citigroup without making a direct claim.
MalwareTips found no basis to treat Citiuni as an authorized Citigroup service. A familiar fragment in a name, a blue interface, or a finance logo is not evidence of affiliation.
Before joining any stock group, verify:
- Is the professor a registered investment professional?
- Does the firm appear in FINRA BrokerCheck or the SEC adviser database?
- Does the professional’s official profile list the WhatsApp group?
- Who legally operates the app?
- Where are customer assets held?
- Can a small withdrawal reach your bank without another payment?
- Are deposits sent to personal accounts, unrelated companies, or crypto wallets?
- Do group members post identical praise at scripted times?
- Are only selected winning calls preserved?
- Does the app claim pre-market access that your normal broker cannot verify?
If the group controls the advice, the platform, the account balance, and the withdrawal rules, there is no independent source left to confirm the investment.
The Withdrawal Test Reveals Who Controls the Balance
A fake platform can show any number its operator chooses. Depositing more money can instantly increase a dashboard balance, and fabricated trades can create a smooth record of gains. None of that proves ownership of securities or cash.
A withdrawal is different because it requires real value to leave the operator’s control. That is why the first withdrawal request often triggers a new condition.
The investor may be told to pay tax, insurance, anti-money-laundering verification, liquidity collateral, a security deposit, a VIP upgrade, or a penalty for breaking a trading plan. Each label explains why money must move in before anything can move out.
A legitimate US broker does not ask a customer to send a separate payment to release their own balance. Taxes are not normally collected through a professor’s assistant or an unrelated bank account.
Some fraudulent platforms permit a small early withdrawal. That can build confidence and encourage a much larger deposit. The successful test proves only that the operator chose to pay a small amount, not that later balances represent real assets.
Never pay to solve a withdrawal problem. Contact the bank, exchange, card issuer, or transfer service used for the original deposit and report suspected investment fraud immediately.
How the Citiuni WhatsApp Investment Scam Works
Step 1: An ad or invitation promises expert stock ideas
The target sees an advertisement, receives an unexpected message, or is added to a group. The offer may promise education, AI signals, institutional research, or access normally reserved for wealthy investors.
Entry is free because the group itself is the trust-building stage.
Step 2: A professor and assistant divide the roles
The professor delivers market commentary and authority. The assistant answers questions, guides account setup, reminds members about deadlines, and privately encourages larger deposits.
This structure feels like a real advisory firm while keeping the main figure distant from payment problems.
Step 3: Group members manufacture social proof
Accounts celebrate gains, thank the professor, post screenshots, and describe successful withdrawals. Some may be bots, controlled profiles, or other victims repeating numbers shown in the app.
Real people can also praise early stock calls without knowing that the private platform is fraudulent.
Step 4: Familiar stock tips create a winning record
The group may begin with liquid, widely followed stocks that move for reasons unrelated to the recommendation. Winning calls are highlighted while losing calls disappear or are reinterpreted.
Once members believe the professor has an edge, the assistant introduces something their normal broker supposedly cannot offer.
Step 5: The Citiuni app becomes the exclusive route
The app may advertise pre-market placements, institutional accounts, new listings, block trades, AI allocation, or a special token. Deposits can be sent to changing bank accounts, payment processors, or crypto addresses.
The investor sees an account balance but may not receive broker confirmations, clearing records, or custody statements from a regulated third party.
Step 6: The dashboard rewards larger deposits
Trades appear profitable, bonuses unlock, and the assistant says the investor qualifies for a better tier. A countdown or oversubscribed allocation creates pressure to add funds before verification.
The group may discourage withdrawals by saying the strategy must finish first.
Step 7: Withdrawal becomes another payment demand
When the investor requests money, the app freezes the account or displays a compliance condition. The assistant insists the new payment is temporary and that all funds will be released together.
Paying usually produces another obstacle. Refusing may lead to threats, account closure, or offers from fake recovery agents.
Why Good Stock Calls Do Not Authenticate the App
An operator does not need to predict every market move. They can repeat analysis from public sources, issue many calls across several groups, or promote liquid stocks likely to move with the broader market.
They can also wait for a move and present an earlier message as the winning signal, delete losing posts, or use different timestamps and accounts. Private chat history is easier to curate than a regulated performance record.
The FBI warns that some investment clubs use a “ramp-and-dump” scheme. Organizers accumulate a low-priced stock, direct group members to buy it, and sell into the artificially increased demand.
Other groups never execute the displayed trades at all. The app is a ledger controlled by the fraudster, while deposits are diverted elsewhere.
Ask for audited performance, registration, custody, clearing, and statements from an independent broker. Screenshots posted by group members are not substitutes.
Registered professionals also have communication and supervision obligations. FINRA notes that many brokerage firms prohibit representatives from conducting business through channels such as WhatsApp.
Red Flags in the Citiuni Pattern
- An investment professor contacts strangers through social media.
- An assistant manages deposits and account problems.
- The group name resembles a familiar financial brand.
- Members post constant praise with few critical questions.
- The app offers exclusive pre-market or institutional access.
- The operator cannot be found in regulatory databases.
- Deposits go to unrelated recipients or crypto wallets.
- The account shows smooth gains that are not independently confirmed.
- Small withdrawals are used to encourage larger deposits.
- The group pressures members to borrow or increase allocation.
- A fee or tax is demanded before withdrawal.
- Support exists only inside WhatsApp.
- The app disappears from official stores.
- Recovery agents appear after the loss.
FINRA’s investment-group warning describes the same movement from social media into encrypted groups, including cases with millions in reported losses.
MalwareTips has examined another named investment-group fraud in the Richard Wealth Guide scam.
What Real Broker Evidence Looks Like
A regulated broker identifies its exact legal name and registration on public records. The name in the app, customer agreement, bank transfer, statement, and regulator database should align.
BrokerCheck and the SEC adviser database also list addresses, representatives, disclosures, and employment history. Verify the person through the telephone number in the record, not the number in WhatsApp.
Customers receive an agreement explaining custody, execution, fees, conflicts, withdrawals, and complaints. It does not promise that a professor can override those rules through a private group.
Deposits go to a clearly identified regulated entity or custodian. The beneficiary should not rotate among individuals, marketing companies, import businesses, or accounts in unrelated jurisdictions.
Trades produce confirmations with the security, quantity, price, time, venue, and fees. A scrolling list inside an app controlled by the promoter is not the same record.
Account statements arrive on a regular schedule and identify the custodian. The customer can contact that custodian without passing through an assistant.
Withdrawals follow written procedures. Compliance questions may delay a transfer, but the broker does not ask for a separate payment to make an existing balance real.
Tax documents report completed activity after the relevant period. A demand to prepay “tax” to a chat assistant before withdrawing is a classic advance-fee signal.
Marketing materials describe risks and do not guarantee profits or losses covered by the professor. Claims of certain gains or secret institutional access should trigger immediate verification.
Complaints can be filed outside the app. The firm provides supervised support, a postal address, and regulatory routes that do not disappear when one group administrator blocks a member.
A real broker may offer extended-hours trading, but it can explain order types, liquidity, spreads, and execution limits. “Pre-market access” is not a reason to use an unknown platform.
If the Citiuni contact cannot produce this evidence, the safest assumption is that the dashboard cannot be trusted. Do not send a test deposit in search of proof.
Why Group Screenshots Are So Persuasive
People naturally treat a crowded conversation as independent consensus. In a controlled group, one operator can manage many accounts, schedule praise, and answer objections before a victim asks them.
Profit screenshots are especially weak because they can be edited or generated by the same app. Ask whether the member can produce a statement from an independent regulated custodian.
Silence also matters. Members who question withdrawals may be removed, contacted privately, or hidden from new participants. The visible group becomes a filtered display of confidence.
Do not message enthusiastic members privately with personal loss details. They may be operator accounts collecting information for the next pressure script.
Export the group before confronting anyone. Administrators can delete messages, change the group name, remove members, or move the conversation to a new channel after withdrawals fail.
Record the invitation source as well as the chat. The original advertisement, social profile, or accidental message can connect the group to other campaigns and payment recipients.
Compare several members’ writing style and timing. Repeated phrasing, identical punctuation, and synchronized praise can indicate scripted accounts, although these signs are not proof by themselves.
Search profile photos carefully, but do not contact the real people whose images may have been copied. Their identities can be unrelated to the operation.
A genuine community tolerates questions about registration, custody, and withdrawals. A group that treats verification as disloyalty is controlling the conversation, not educating investors.
Most importantly, never let other members vote on whether your withdrawal problem is normal. Only the regulated custodian and payment providers can establish where the money went.
Ask your bank for the exact transaction reference and beneficiary details. Screenshots from the app may change, while payment records create a durable trail for recalls and reports.
If crypto was used, preserve the transaction hash and wallet address. Do not send a tiny second transfer to “verify” ownership or activate an investigator. Legitimate investigators do not need a fresh payment to trace an old one.
Company, Address, and Fulfillment Checks
Verify the professional and firm registration
Search the professor, assistant, app operator, and firm in FINRA BrokerCheck and the SEC’s Investment Adviser Public Disclosure database. Then call the registered firm using the number in the official record.
Do not use contact details posted in the WhatsApp group.
Identify the legal operator and address
The Citiuni name alone does not identify a licensed broker, custodian, or legal company. Demand the entity name, jurisdiction, regulatory number, physical address, and complaint process.
A generic app developer name or virtual office does not establish custody of assets.
Trace the deposit destination
Compare the recipient on every wire, card transaction, ACH transfer, or crypto address with the regulated firm. A payment to an unrelated business or individual breaks the claimed chain.
Save beneficiary names and bank details before they change.
Verify trade and withdrawal fulfillment
Real securities transactions produce broker confirmations and custody records. A screen controlled by the same group that gave the advice is not independent fulfillment.
Never send a new deposit to unlock an old balance.
What to Do if You Have Fallen Victim to This Scam
- Stop all new deposits. Do not pay a tax, verification, security, or withdrawal fee.
- Try no further trades. Additional activity can complicate the record and give the operator more time.
- Preserve evidence. Export WhatsApp chats, save group member numbers, app screens, receipts, beneficiary names, wallet addresses, and withdrawal errors.
- Contact the payment provider. Report suspected investment fraud to the bank, card issuer, exchange, or transfer service immediately.
- Ask the receiving bank to preserve funds. Your bank’s fraud team may be able to send a recall or fraud notice.
- Report to regulators. Submit details to the SEC and FINRA when US investments or professionals are claimed.
- Report to law enforcement. File with IC3.gov and local authorities.
- Secure identity and accounts. Change reused passwords, enable multifactor authentication, and freeze credit if documents were shared.
- Remove the app safely. Save evidence first, revoke permissions, uninstall it, and remove unknown device-management profiles.
- Run Malwarebytes. Scan the device if the app was sideloaded or any remote-access tool was installed.
- Use AdGuard as a supporting layer. It may block known malicious domains, but it cannot verify a broker or recover a deposit.
- Warn the group carefully. Preserve evidence before leaving and avoid sending private details to other members who may be controlled accounts.
- Reject recovery agents. No private hacker, lawyer, or regulator can guarantee recovery for another upfront payment.
Frequently Asked Questions
Is Citiuni part of Citigroup or Citi?
MalwareTips found no evidence of an authorized connection. Similar wording, colors, or finance imagery should not be treated as affiliation.
Can a fake investment app appear in an official store?
Yes. Store review reduces some risks but does not guarantee that displayed trading, custody, licensing, or withdrawal claims are genuine.
Why did the professor’s early stock tips work?
The calls may use public analysis, liquid stocks, selective reporting, edited history, or different recommendations across groups. A good call does not authenticate the private app.
Should I pay a verification deposit to withdraw?
No. Stop and contact the payment provider and regulators. A new payment usually creates another demand rather than releasing the balance.
Is the balance shown in the app real?
Not unless an independent regulated broker or custodian confirms the assets in your name. The app operator can generate any displayed number.
Can a recovery company get the money back?
Only work through your bank, payment provider, regulators, law enforcement, and a lawyer you independently verify. Guaranteed recovery for an upfront fee is another common scam.
The Bottom Line
The Citiuni WhatsApp stock group story follows a mature investment-fraud design: authority from a professor, personal help from an assistant, social proof from the group, and apparent profits inside a platform controlled by the same operation.
The withdrawal failure is not a technical inconvenience to solve with more money. It is the point where the displayed balance meets reality. Stop paying, preserve the entire chain, and contact financial providers and regulators before the recipients and apps disappear.
