{"id":407631,"date":"2026-08-31T07:01:22","date_gmt":"2026-08-31T07:01:22","guid":{"rendered":"https:\/\/malwaretips.com\/blogs\/?p=407631"},"modified":"2026-08-31T07:01:22","modified_gmt":"2026-08-31T07:01:22","slug":"bonchat-kkr-investment-scam-axa1565-com","status":"publish","type":"post","link":"https:\/\/malwaretips.com\/blogs\/bonchat-kkr-investment-scam-axa1565-com\/","title":{"rendered":"Bonchat KKR Investment Scam Pushes axa1565.com"},"content":{"rendered":"<p>A relative is invited into a private investment group by someone the family already trusts. A deposit is placed on the relative\u2019s behalf, and the only immediate obligation is to repay that helpful friend in cash.<\/p><div id=\"mwtad4068258197\" class=\"mwtadhigh-1 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"7453445881\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p>The arrangement sounds generous. The website behind it tells a very different story.<\/p>\n<figure><img fetchpriority=\"high\" decoding=\"async\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" width=\"1200\" height=\"675\" loading=\"eager\" alt=\"Authentic mobile screenshot of the axa1565.com login page presented as AXA Exchange\" title=\"\" class=\"lazyload\" data-src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/bonchat-axa1565-login.webp\"><\/figure>\n<div id=\"mwtad4241628816\" class=\"mwtadheader-1 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"2917133959\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>Overview<\/h2>\n<h3>A family referral led to Bonchat and an unknown exchange<\/h3>\n<p>A recent <a href=\"https:\/\/www.reddit.com\/r\/Scams\/comments\/1w28zee\/bonchat_axa1565com_scam_it\/\" target=\"_blank\" rel=\"noopener\">consumer report<\/a> describes parents being invited to a Bonchat group called \u201cKKR Investment Group\u201d by a family friend. The friend reportedly funded an initial deposit on their behalf.<\/p><div id=\"mwtad1240880823\" class=\"mwtadp1 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"1471373341\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p>The parents were expected to repay the friend in cash. At the time of the report, they had not tested a withdrawal and did not know whether the balance shown on the website could be recovered.<\/p>\n<p>That combination matters. A trusted referral can move money into a system before the new participant ever verifies the platform, the investment professional, or the withdrawal rules.<\/p>\n<h3>axa1565.com is a new site presenting itself as AXA Exchange<\/h3>\n<p>The linked site was live during our review. Its page title was \u201cAXA Exchange,\u201d and the mobile interface offered registration, login, fiat accounts, contract accounts, cryptocurrency prices, and trading controls.<\/p><div id=\"mwtad1947993739\" class=\"mwtadp2 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"6935453015\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p>Official Verisign RDAP records show that axa1565.com was registered on May 8, 2026 through Name.com. The registration is recent and the domain does not match the official websites of KKR or AXA.<\/p>\n<p>A legitimate-looking interface is not evidence that deposits are held, trades occur, or withdrawals will be honored. A browser dashboard can display any balance its operator chooses.<\/p>\n<h3>The brands and regulatory image fail basic verification<\/h3>\n<p>KKR\u2019s official fraud notice says it does not conduct business through chat platforms, does not send unsolicited investment messages, and warns about impostors creating websites and social accounts that promise unusual returns.<\/p><div id=\"mwtad1203856714\" class=\"mwtadp3 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"5315249587\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p>The axa1565.com home screen also displayed an image containing an SEC CIK, an Aurora, Colorado address, and official-looking registration language. The SEC\u2019s own public data associates that CIK with \u201cUnity Growth Series Fund LLC &#8211; Fund 033\u201d at an address in Reston, Virginia, not with AXA Exchange, KKR, or the Aurora address shown.<\/p>\n<p>The warning signs together include:<\/p>\n<ul>\n<li>An investment pitch moves through Bonchat rather than an official firm channel.<\/li>\n<li>The group borrows the KKR name.<\/li>\n<li>The website uses AXA branding on an unrelated domain.<\/li>\n<li>The domain was registered recently.<\/li>\n<li>A friend funds the first deposit and asks for cash repayment.<\/li>\n<li>No successful withdrawal has been independently verified.<\/li>\n<li>The dashboard can show balances without proving custody.<\/li>\n<li>The displayed CIK does not identify the platform shown.<\/li>\n<\/ul>\n<figure><img decoding=\"async\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" width=\"1200\" height=\"675\" loading=\"lazy\" alt=\"Authentic screenshot of the axa1565.com dashboard showing account balances, cryptocurrency prices, and an official-looking document\" title=\"\" class=\"lazyload\" data-src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/bonchat-axa1565-dashboard.webp\"><\/figure>\n<div id=\"mwtad144778426\" class=\"mwtadheader-2 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"9284335404\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>What We Verified on axa1565.com<\/h2>\n<div id=\"mwtad2355720524\" class=\"mwtadp4 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"8735619847\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><p>The domain responded with a live JavaScript application during our review. The login page used a bright green AXA-style logo and the awkward line \u201cWelcome to AXA Exchange Exchange.\u201d<\/p>\n<p>After opening the public home view, the site displayed a zero balance, a \u201cFiat Account,\u201d a \u201cSecond contract account,\u201d and prices for BTC, ETH, XRP, LTC, BCH, SOL, and other assets.<\/p>\n<p>The interface used the visual language of a mobile crypto exchange. That presentation is easy to confuse with evidence of a functioning trading venue, but the public screen did not prove who operates it or where customer assets go.<\/p>\n<div id=\"mwtad583142674\" class=\"mwtadp5 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"9971336976\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><p>The home page included an image that appears designed to confer regulatory credibility. Its visible text included CIK 0002079971 and a business address at 5820 South Vaughn Way, Aurora, Colorado 80014.<\/p>\n<p>The SEC submissions API identifies CIK 0002079971 as Unity Growth Series Fund LLC &#8211; Fund 033. The official record lists 12001 Sunrise Valley Drive, Reston, Virginia 20191. It does not identify \u201cAXA Exchange.\u201d<\/p>\n<p>An SEC filing identifier is not a license that any website may reuse. Even when a CIK is genuine, it identifies a filer. It does not verify a chat group, guarantee an investment, approve a crypto exchange, or insure deposits.<\/p>\n<p>The domain registration date is also relevant because the website presents itself with the confidence of an established financial platform. A site only months old cannot inherit the operating history of the large brands printed on its pages.<\/p>\n<p>We found no basis to connect the Bonchat group or axa1565.com with KKR\u2019s authorized operations. KKR\u2019s own guidance directly conflicts with the route used here: the company says it does not conduct business over chat platforms.<\/p>\n<p>AXA is also a real global financial and insurance brand. Its name and logo appearing on an unknown exchange domain should be treated as possible impersonation, not as proof of endorsement.<\/p>\n<div id=\"mwtad4061110563\" class=\"mwtadheader-3 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"5345090394\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>How the Bonchat KKR Investment Scam Works<\/h2>\n<h3>Step 1: A trusted person delivers the invitation<\/h3>\n<p>The approach may come from a relative, friend, community member, or colleague who already appears to be participating. That person may be a victim rather than an accomplice.<\/p>\n<p>Trust moves from the relationship to the group without the platform earning it.<\/p>\n<h3>Step 2: The group borrows an established investment name<\/h3>\n<p>A title such as \u201cKKR Investment Group\u201d makes the chat sound connected to a known financial firm. Profile images, analyst names, market commentary, and copied documents reinforce the impression.<\/p>\n<p>The real company is not verified through the name chosen by a chat administrator.<\/p>\n<h3>Step 3: Members are directed to a private trading website<\/h3>\n<p>The operator supplies a registration link for an app or domain that is not the firm\u2019s official website. The interface shows prices, charts, account types, and trading buttons.<\/p>\n<p>The platform may be a simulation controlled entirely by the same people running the group.<\/p>\n<h3>Step 4: A starter deposit removes the first objection<\/h3>\n<p>A recruiter may lend or place funds on the new member\u2019s behalf. This makes the platform appear generous and lets the dashboard show activity before the target has sent money online.<\/p>\n<p>Repaying the recruiter in cash still creates a real loss if the website balance is fictional.<\/p>\n<h3>Step 5: The dashboard manufactures progress<\/h3>\n<p>Trades may appear to win, bonuses may be credited, and group members may post screenshots of withdrawals. None of those displays independently proves that assets exist outside the site\u2019s database.<\/p>\n<p>The SEC warns that investment-group scams can show fake profits and then demand fees, taxes, or deposits when a member tries to withdraw.<\/p>\n<h3>Step 6: Successful small withdrawals build confidence<\/h3>\n<p>Some schemes allow an early withdrawal using money from later participants. A small payment can persuade the family to add much more and encourage friends to join.<\/p>\n<p>One withdrawal proves only that one amount was paid at one moment. It does not validate the business or future access to the balance.<\/p>\n<h3>Step 7: The exit becomes another payment demand<\/h3>\n<p>When the target requests a large withdrawal, the platform may claim there is a tax, compliance deposit, insurance charge, credit score issue, frozen account, or liquidity requirement.<\/p>\n<p>Paying the new charge does not release the balance. It extends the loss until the operator blocks contact or abandons the domain.<\/p>\n<div id=\"mwtad3735007008\" class=\"mwtadheader-4 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"5354318971\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>Why the Friend\u2019s Deposit Is Not Free Money<\/h2>\n<p>The most disarming detail in this report is the claim that the parents did not initially send money to the website. A family friend supposedly covered the first deposit.<\/p>\n<p>That does not remove financial exposure. If the parents hand cash to the friend, they have exchanged recoverable money for an unverified number on a website.<\/p>\n<p>The arrangement may be a genuine loan between two victims. The friend may believe the platform is profitable because of a small withdrawal, group testimonials, or a balance that continues to rise.<\/p>\n<p>It could also be a recruitment mechanism. Some fraudulent platforms credit internal accounts without receiving an equivalent deposit, then use personal repayment to move real money among participants.<\/p>\n<p>A third possibility is account attribution. The website may later claim that a bonus, loan, or funded balance creates a debt that must be repaid before withdrawal.<\/p>\n<p>No one should repay the friend in cash until both parties identify the original funding transaction, the account that received it, and the legal entity supposedly holding the investment.<\/p>\n<p>Ask the friend to withdraw the original amount back to the same verified source. Do not accept a screenshot as proof. The funds must appear in a real bank or regulated brokerage account under the correct owner\u2019s control.<\/p>\n<p>Do not let family loyalty turn the verification request into an accusation. The friend may be trying to help and may also be at risk. Frame the pause as protection for everyone.<\/p>\n<p>If the friend resists independent checks, demands cash urgently, or insists the group administrator must approve questions, stop the arrangement.<\/p>\n<div id=\"mwtad2510931709\" class=\"mwtadheader-6-2 mwtadentity-placement\" style=\"margin-top: 50px;margin-bottom: 50px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"2830607691\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>The Fake Profit and Withdrawal Trap<\/h2>\n<p>A platform operator does not need to conduct trades to show trading profits. The displayed value can be changed by software, an administrator, or a scripted bonus.<\/p>\n<p>Real market prices on the dashboard do not validate the account balance. Public price feeds are easy to import, and familiar asset symbols help the rest of the interface feel legitimate.<\/p>\n<p>The decisive test is not whether the chart moves. It is whether the operator is identifiable, registered for the activity claimed, holds customer assets through verifiable channels, and honors withdrawals without surprise payments.<\/p>\n<p>Withdrawal fees are especially dangerous when they must be paid with new money. Legitimate service charges can normally be disclosed in advance and deducted from the available balance.<\/p>\n<p>A demand to pay \u201ctax\u201d to a private platform should be verified with the relevant tax authority and a qualified professional. Criminals use tax language because it sounds mandatory and time-sensitive.<\/p>\n<p>Do not borrow money to unlock a balance. Do not recruit others to meet a volume threshold. Do not send a second payment because the first fee was supposedly calculated incorrectly.<\/p>\n<p>Group members who celebrate profits may be fake profiles, paid promoters, early participants, or victims reading the same dashboard. A crowded chat does not create independent evidence.<\/p>\n<p>The <a href=\"https:\/\/www.investor.gov\/introduction-investing\/general-resources\/news-alerts\/alerts-bulletins\/investor-alerts\/gateway-to-investment-scams\" target=\"_blank\" rel=\"noopener\">SEC\u2019s group-chat investor alert<\/a> describes the same control problem: fake experts direct members to websites, display profits, and invent charges when withdrawal begins.<\/p>\n<p>MalwareTips documented a closely related WhatsApp pattern in its <a href=\"https:\/\/malwaretips.com\/blogs\/cathie-wood-scam-exposed\/\">Cathie Wood investment scam report<\/a>: a famous financial name lends credibility to a private group while the operator controls the pitch and payment route.<\/p>\n<p>Check the investment professional as well as the company name. Search Investor.gov and FINRA BrokerCheck, then use the phone number in the official record. A copied registration number can belong to a real person who has never heard of the group.<\/p>\n<p>Ask who legally owns the account, which entity has custody, where client money is segregated, and which regulator handles complaints. Vague references to \u201cinternational licensing\u201d are not answers.<\/p>\n<p>Inspect the deposit destination. A personal bank account, unrelated company, payment agent, crypto wallet, or cash handoff breaks the claimed relationship with a major investment firm.<\/p>\n<p>Do not accept a video call with an \u201canalyst\u201d as licensing proof. The person on screen may be another participant, a hired presenter, or an impersonator reading a script.<\/p>\n<p>Preserve the exact domain and app package. Fraud operators often replace one address with another after complaints appear, while keeping the same group names, dashboard code, and payment recipients.<\/p>\n<p>A regulator search should be repeated for the exact legal entity, not merely the words KKR or AXA. Large brands can have many registered affiliates, none of which automatically authorizes a private chat administrator.<\/p>\n<p>Write down every explanation before challenging it. Fraud groups frequently revise the claimed company, licence, address, or withdrawal rule after a member identifies a mismatch. The earlier screenshots help regulators and relatives see that the new explanation was not part of the original offer.<\/p>\n<div id=\"mwtad3967281240\" class=\"mwtadheader-6 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3648031192\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>Company, Address, and Fulfillment Checks<\/h2>\n<h3>KKR says it does not conduct business over chat platforms<\/h3>\n<p>KKR\u2019s <a href=\"https:\/\/www.kkr.com\/security-and-fraud-awareness\" target=\"_blank\" rel=\"noopener\">official fraud-awareness page<\/a> says communications come from official kkr.com addresses and that the company does not conduct business through chat platforms.<\/p>\n<p>A Bonchat group using the KKR name therefore needs to be treated as impersonation unless KKR verifies it through independently obtained contact details.<\/p>\n<h3>The AXA name does not match the domain<\/h3>\n<p>The site calls itself AXA Exchange, but the domain is axa1565.com rather than an official AXA property. A familiar logo is a graphic, not a corporate relationship.<\/p>\n<p>Contact AXA through its official website if the brand is being used, and do not use contact details supplied by the platform.<\/p>\n<h3>The displayed CIK points to a different filer<\/h3>\n<p>The CIK visible on the home page belongs in SEC records to Unity Growth Series Fund LLC &#8211; Fund 033. The address in the official submission data is in Reston, Virginia.<\/p>\n<p>That mismatch means the image cannot be treated as proof that AXA Exchange or the Bonchat group is registered.<\/p>\n<h3>Fulfillment requires withdrawal to a real account<\/h3>\n<p>A website balance, trade receipt, chat testimonial, or pending withdrawal is not fulfillment. Funds must reach a verified bank or regulated brokerage account without a new advance payment.<\/p>\n<p>Even a small withdrawal should not replace company, licensing, custody, and domain checks.<\/p>\n<div id=\"mwtad725143426\" class=\"mwtadheader-7 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"2944237110\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>What to Do if You Have Fallen Victim to This Scam<\/h2>\n<ol>\n<li><strong>Stop all new payments.<\/strong> Do not repay a friend in cash, add investment funds, pay withdrawal taxes, or send a compliance deposit while the platform remains unverified.<\/li>\n<li><strong>Attempt a withdrawal without paying more.<\/strong> Request the original principal back to the verified funding source. Save every response, but do not treat a pending status as success.<\/li>\n<li><strong>Document the full path.<\/strong> Capture the Bonchat group name, administrator profiles, invitation, axa1565.com pages, wallet addresses, bank recipients, transaction IDs, and promises made.<\/li>\n<li><strong>Contact the bank or payment provider.<\/strong> Explain that transfers may have gone to an impersonation investment scheme and ask about recall, fraud review, and recipient-account preservation.<\/li>\n<li><strong>Secure exposed accounts.<\/strong> Change reused passwords, revoke sessions, enable strong multi-factor authentication, and review email rules if credentials were entered on axa1565.com.<\/li>\n<li><strong>Talk to the referring friend carefully.<\/strong> Share the KKR notice, domain date, and CIK mismatch. The friend may be a victim and should also stop deposits and recruitment.<\/li>\n<li><strong>Report the brand impersonation.<\/strong> Send the domain and screenshots to KKR and AXA through their official channels. Also report the domain to its registrar and hosting provider.<\/li>\n<li><strong>Run a Malwarebytes scan.<\/strong> Scan devices that installed an app, browser extension, remote-access program, or unknown file connected to the group. A normal website visit alone does not prove malware.<\/li>\n<li><strong>Use AdGuard as preventive support.<\/strong> It can block many known phishing and malicious advertising domains, but it cannot verify a private investment group or recover a transfer.<\/li>\n<li><strong>Report financial fraud.<\/strong> Submit evidence to ReportFraud.ftc.gov, IC3.gov, the SEC complaint center, and the financial regulator in your country.<\/li>\n<li><strong>Do not pay a recovery agent.<\/strong> Anyone claiming they can unlock the dashboard, trace crypto, or retrieve funds for an upfront charge may be targeting victims again.<\/li>\n<li><strong>Warn other group members without sending threats.<\/strong> Provide verifiable facts and official links. Preserve the group before leaving, because administrators may delete messages.<\/li>\n<\/ol>\n<h2>Frequently Asked Questions<\/h2>\n<h3>Is KKR connected to the Bonchat investment group?<\/h3>\n<p>We found no evidence of a connection. KKR says it does not conduct business over chat platforms and warns that criminals create fake websites and accounts using its name.<\/p>\n<h3>Is axa1565.com an official AXA website?<\/h3>\n<p>The site uses AXA branding, but the domain does not match AXA\u2019s official corporate domains. Treat it as unverified and possible impersonation unless AXA confirms it through an independent channel.<\/p>\n<h3>Does the SEC CIK prove the exchange is registered?<\/h3>\n<p>No. The CIK displayed on the site identifies a different filer in SEC records. A genuine identifier copied into an image does not register or approve the website using it.<\/p>\n<h3>What if the friend already withdrew money?<\/h3>\n<p>A small withdrawal can be used to build confidence. It does not prove that larger balances are real or that later withdrawals will be honored without new fees.<\/p>\n<h3>Should the parents repay the friend in cash?<\/h3>\n<p>Not while the deposit, platform, and withdrawal remain unverified. First trace the original funding and require the money to return to a real account without another payment.<\/p>\n<h3>Can a balance on the site be used to pay a withdrawal fee?<\/h3>\n<p>If the operator insists on fresh money instead of deducting a disclosed charge from the balance, that is a major scam warning. Do not send more to release funds already shown.<\/p>\n<h2>The Bottom Line<\/h2>\n<p>The Bonchat KKR Investment Scam combines borrowed trust from a family friend, borrowed prestige from KKR, borrowed branding from AXA, and a borrowed SEC identifier. None of those pieces verifies axa1565.com.<\/p>\n<p>Pause the cash repayment, preserve the group, and test withdrawal without sending anything else. KKR\u2019s own warning, the young domain, and the CIK mismatch all point away from a legitimate investment channel. A balance on a screen is not money until it reaches an account you control.<\/p>\n<div id=\"mwtad1745123863\" class=\"mwtadfinal mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3077074880\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>A relative is invited into a private investment group by someone the family already trusts. A deposit is placed on the relative\u2019s behalf, and the only immediate obligation is to repay that helpful friend in &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"Bonchat KKR Investment Scam Pushes axa1565.com\" class=\"read-more button\" href=\"https:\/\/malwaretips.com\/blogs\/bonchat-kkr-investment-scam-axa1565-com\/#more-407631\" aria-label=\"Read more about Bonchat KKR Investment Scam Pushes axa1565.com\">Read more<\/a><\/p>\n","protected":false},"author":51,"featured_media":407629,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[49],"tags":[],"class_list":["post-407631","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scam-reports","masonry-post","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/407631","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/users\/51"}],"replies":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/comments?post=407631"}],"version-history":[{"count":1,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/407631\/revisions"}],"predecessor-version":[{"id":407682,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/407631\/revisions\/407682"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media\/407629"}],"wp:attachment":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media?parent=407631"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/categories?post=407631"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/tags?post=407631"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}