Criminals are posting stolen card details on Threads as bait, with a Telegram link that leads to a $200 Bitcoin payment request. Here’s how the operation works.

How the scam works

1. The bait on Threads leads you to a Telegram group

People see Threads profiles posting photos of physical credit cards with full cardholder details, framed as free gifts. When someone tries to use one, the card is declined. These cards have already been burned, and that’s by design.

But the post points to a Telegram group, a classic platform hopping move, (one example is called “CC REAL DROP,” with hundreds of members) where testimonials make it look like other people are successfully using the cards. That’s when the Telegram group starts to look credible and the invite worth trying.

2. Inside the Telegram group, everything you see is staged

The group is broadcast-only: regular members can’t post, only the admin can. The feed runs a steady stream of “success stories”: screenshots of Cash App balances around $6,000, Bitcoin withdrawal receipts, and emotional backstories about gambling losses, grieving families, or financial pressure. None of it is real.

The Bitcoin addresses shown in the screenshots fail basic validation (they aren’t valid Bitcoin addresses at all), and the transaction IDs don’t exist on the blockchain. Every layer is fabricated by the operator to manufacture trust before they ask for money. Even the “admin” who welcomes new members is a Telegram bot running a template.

3. Paying $200 in Bitcoin for a Cash App scheme that doesn’t deliver

The group admin asks members to send around $200 in Bitcoin to get instructions on the next step to get money. After they pay, they receive a PDF framed as the “Cash App Transfer Sauce,” believing they can get instructions on steps to get paid via Cash App. It doesn’t deliver what it promises. What it actually contains are instructions to access other people’s Cash App accounts, which is illegal. Following the steps can also get their own Cash App account permanently suspended.

The operator usually follows up by asking for more money: another $100 for a “One-Time Password bot” to break into other people’s account, or another $300 to have the operator run it for them. The fees keep escalating, none of the steps work, and the Bitcoin is already gone. Cryptocurrency transactions are irreversible. There’s no bank to call, no dispute process, no recovery path.

Why this scam keeps running

The route into this scam involves trying to use someone else’s credit card. To report the $200 Bitcoin loss, a victim would have to admit they attempted to commit fraud themselves. That’s the trap, and exactly why scammers set it up this way.

This activity was first documented on Threads in late 2024. As of mid-2026, similar posts are still appearing. TrendLife researchers traced the operation’s payment infrastructure to a broader fraud network with a transaction history spanning over a year, far larger than any single Telegram group.

Red flags to watch for

Here’s what to watch for if you encounter these posts:

1. Publicly posted credit card details: No one shares working card numbers as a gift. Any post framing stolen card details as “free” is bait for what follows.
   
   
2. Broadcast-only Telegram groups: When regular members can’t post, the group exists to control the narrative. It’s a scripted performance, not a community.
   
   
3. Testimonials with emotional backstories: The more vivid and desperate the story, the more likely it was written to manufacture urgency. Genuine user stories don’t come packaged with gambling losses and grieving families.
   
   
4. Bitcoin-only payment requests: Scammers ask for cryptocurrency because it’s irreversible. There is no dispute process, no bank to call, and no recovery path.
   
   
5. A paid PDF that promises insider tricks: You’re paying upfront for “knowledge” that doesn’t work. The PDF itself is the product they’re selling, not anything it teaches.
   
   
6. Operators who keep asking for more money: Once the first payment goes through, the asks don’t stop. Another “tool,” another “fee,” another “extra step.” Every one of them is the same scam looking for more.

How to stay safe

1. Don’t engage with “free credit card” posts on social media. The card data has already been flagged or canceled. These posts aren’t offers, they’re funnels into a paid scam.
   
   
2. Check whether members can post in a Telegram group. If only admins can speak, treat the whole feed as manufactured.
   
   
3. Never send cryptocurrency to a stranger. Once Bitcoin is transferred, it’s gone. There are no exceptions to this.
   
   
4. Use Trend Micro ScamCheck to scan suspicious links and screenshots before you engage. A quick check can flag known scam infrastructure in seconds.
   
   
5. Report to the FTC at ReportFraud.ftc.gov. You can file a report without sharing every detail of how you first encountered the scam.
   
   
6. If you see credit card data posted on Threads, report the account. These posts violate Threads’ own policies. Reporting them helps take them down.

You’ve got this

This scam is engineered at every step to feel real. But once you can spot the pattern, a declined credit card, a Telegram link, emotional stories, a Bitcoin request, the whole thing falls apart. That knowledge is already protecting you.