The Swell Box He Never Opened Again

a daughter in Ely on how a fake AI trading platform took her father's retirement and the organ he was restoring for the cathedral

Ely, Cambridgeshire: Her father, Edmund, is sixty-eight years old. He spent thirty-seven years as an organ builder, working out of a workshop in a converted barn where the light came through tall windows and the smell of pine and hide glue never quite left the benches. He voiced pipes by ear, restored instruments for parish churches across the Fens, and could tell by the speech of a flute stop whether the toe hole needed easing before he touched the tuning slide. When his wife died of cancer seven years ago, he did what he always did. He kept going. He kept working. He kept the workshop open through two recessions and one winter when the roof leaked over the voicing room.

He retired three years ago and moved into a small cottage on the edge of the city, close to his daughter, close to the cathedral he had walked past every morning since he was a boy. The first months were harder than he expected. He had spent nearly four decades with his hands in wood and metal, and suddenly the bench was clear. He kept his routine. Tea at six. A walk along the river and back. He joined a organists' guild and taught a Saturday morning class for people who wanted to learn how to tune a reed. But the afternoons were long, and his wife was not there to fill them, and the phone did not ring as often as he had hoped.

He was not looking for a fortune. He was looking for something to do with the quiet.

Then a woman who called herself Marguerite added him to a Telegram group in the spring. The group was called something like Helm Wealth Circle, and the description said it was a private community of retirees sharing strategies and celebrating wins. Marguerite sent him a private welcome message the same night. She said she had seen Edmund's name in a heritage crafts newsletter and thought he might be interested in learning how the group worked. She said there was no pressure and no cost to join the conversation.

The group was warm. Members posted good morning messages and screenshots of their gains. They thanked the administrators for their guidance and said things like "another green day." A man named Philip posted longer messages every morning about market conditions and the importance of patience. A woman named Judith posted pictures of her grandchildren and said she had finally been able to help them with a deposit on a flat. Everyone seemed to be doing well. Everyone seemed to be happy.

Edmund read the group every day for two weeks before he said anything. When he finally commented that he was new and had spent his career building organs, three people replied within minutes to welcome him. Marguerite sent him a voice message. She sounded kind. She sounded like someone Edmund might have known at the guild.

Then Marguerite told him about a platform called Investhelm. She said it was an AI trading platform built for people who had spent their lives in precision work, and that it was now open to a limited number of retirees. She said it was the platform the group used. She sent him a link to investhelm.com.

The site was polished. It had live charts, a client dashboard, a support chat that answered within seconds, and a page describing an AI trading system. It listed no address he could find. It named no licensed entity. What Edmund saw was a legitimate investment platform.

What he did not know was that on 14 July 2026, the British Columbia Securities Commission had published an investment caution stating that Investhelm was not registered with the BC Securities Commission, and that anyone approached by or referred to the entity should proceed with extreme caution and be aware of the risk before handing over any money. The caution named investhelm.com as the website used.

He did not know that on 15 July 2026, the Canadian Securities Administrators had recorded the same alert in its investor alert database under a CSA impersonation warning. The CSA stated that false documentation bearing its branding was circulating as part of a scheme that promised to provide investors with funds, and listed Investhelm with investhelm.com as the last website used.

He did not know that the IOSCO I-SCAN network had carried the BCSC alert on 20 July 2026, attributed to the British Columbia regulator.

Nor did he know that ScamAdviser had assessed the site and recorded a trust score of 1, describing a very low trust score and a strong likelihood that the website was a scam. The review noted that the site had a low Tranco rank, that a high number of suspicious websites were hosted on the same server, that it offered high-risk cryptocurrency services and high-risk financial services, and that it was very young. Gridinsoft had independently rated the domain 1 out of 100, classifying it as a suspicious website and blocking it on that basis. Nobody had told him.

He believed he was making a smart decision. He was being fattened for slaughter.

The Grooming

Within hours of his registration, Marguerite called him. She had a calm, warm voice and a way of speaking that made Edmund feel like she was his only client. She asked about the workshop. She asked about the voicing room. She asked about Edmund's daughter by name after Edmund mentioned her once. She asked about the river walks and the Saturday class.

Marguerite called every few days after that, always in the late morning, always with the same easy tone. She remembered that Edmund took his tea without sugar. She remembered that his daughter was a teacher in the next town. She asked about the swell box he had been restoring and whether he still kept a garden.

This is the hallmark of a pig butchering scam. The scammers are patient because the reward is worth the wait. The FBI has documented thousands of cases where these operations begin with a simple message on a messaging app and then grow into weeks or months of deliberate emotional investment. The people on the other end are not lonely strangers looking for connection. They are employees in call centres, following scripts, working from spreadsheets, and managing dozens of victims at a time.

Edmund felt seen. He told Marguerite about his savings, his pension, and his desire to leave something behind for his daughter. He told her about the account his wife had kept, money he had not touched since she died because it felt like letting go of her to spend it. He told her about the quiet afternoons and the way the cathedral looked in the late light.

Marguerite listened. Then, carefully, she told Edmund about a limited-time opportunity in a diversified fund the group had access to through the platform. She said the minimum was modest and that Edmund could start with a little and see how it felt. "Just test the platform," she said. "See how it feels. There's no obligation."

The Bait

Edmund deposited a modest amount from his savings account. The investhelm.com dashboard showed growth within days. The number on the screen was higher than what he had sent, and there was a small green chart beside it that climbed upward. When he nervously requested a small withdrawal, the money appeared in his bank account within hours. Marguerite called to celebrate.

"See, Edmund? Your money is safe with us. This is how we build a future."

That small withdrawal was the hook. It made the platform feel real. It made Marguerite feel real. It made the whole thing feel like something Edmund could manage.

Victims of similar scams had already posted warnings online, describing how the platform's customer service was excellent until they had the deposit, after which withdrawals became impossible and fee demands began. But Edmund never saw those warnings. He was not looking for them. He was too busy trusting Marguerite.

The Persuasion

Marguerite explained that larger balances unlocked higher returns. She mentioned that the opportunity was only available for a limited time and that other members of the group were already upgrading. She never pushed. She just presented possibilities and let Edmund arrive at his own conclusions. That was the most effective part of the whole operation. Edmund did not feel pressured. He felt informed.

She asked about his wife's account. "It's just sitting there, Edmund. Earning nothing. You could move it into the platform and watch it grow. She would have wanted you to be comfortable."

She asked about his pension. "You worked so hard. You spent your whole life making instruments that lift people's hearts. You deserve to enjoy your retirement without worrying about money."

Edmund, who had spent a lifetime voicing pipes for other people's worship and never once putting his own needs first, transferred more. Then more. Then nearly everything his wife had left him. He also withdrew a portion of his retirement account, absorbing the tax penalty, because Marguerite said the platform was about to close the promotion and that she did not want Edmund to miss it.

He did not know that the testimonials were stock photographs and the addresses were mail drops. He knew only that his dashboard balance was growing, and that Marguerite called him every few days, and that for the first time in years the afternoons did not feel quite so long.

The Freeze

When Edmund finally tried to withdraw a large portion, enough to help his daughter with a deposit on a house, enough to stop worrying, the investhelm.com dashboard displayed a new message. "Withdrawal Pending. Compliance Verification Required."

He called Marguerite. Her voice was calm, apologetic. "I'm sorry, Edmund. New anti-money laundering rules. You just need to pay a verification fee. It's refundable. Standard procedure."

He paid.

A tax clearance deposit appeared the next morning. He called again. Marguerite sighed sympathetically. "One more. I promise." He paid.

A liquidity processing fee, larger this time. He hesitated. "Edmund," Marguerite said, "the system won't release your funds until this clears. You've come so far. I would not let you lose it now." He paid.

A compliance surcharge followed. He asked to speak to a supervisor. Marguerite said she was the supervisor and that she was doing everything she could on her end. He paid.

When a network validation bond appeared, the fourth fee in two weeks, Edmund told Marguerite he had no more money. Marguerite was quiet for a long moment. "Then I can't help you," she said.

The phone went dead. The voice that had been his daily comfort was gone. When Edmund tried to log in again, his account had been disabled. His credentials no longer worked. The Telegram group disappeared from his phone. He had been removed. The green numbers on the dashboard, all those months of growth, had been a picture on a screen. The money was gone.

The Aftermath

He sat at his kitchen table with a half-voiced pipe still on the shelf behind him, and called his daughter, and told her everything. It took him three tries to get through the whole story without stopping. His daughter drove over that night and stayed for a week.

They filed reports with Action Fraud, the UK's national fraud reporting centre, and with the Financial Conduct Authority. They called the bank. The bank said the transfers had already cleared and that there was nothing it could do. They called a lawyer. The lawyer said the money had left the country and that a civil suit would likely cost more than it recovered.

His daughter began searching for information about investhelm.com. The warnings were already public. The BCSC had published its investment caution on 14 July 2026, stating that Investhelm was not registered with the BC Securities Commission and that anyone approached by the entity should proceed with extreme caution. The CSA had recorded the alert in its investor alert database on 15 July 2026 under a CSA impersonation warning, stating that false documentation bearing its branding was circulating as part of a scheme promising to provide investors with funds, and naming investhelm.com as the last website used. The IOSCO I-SCAN network had carried the BCSC alert on 20 July 2026. ScamAdviser had rated the site 1 out of 100, describing a very low trust score and a strong likelihood of a scam, noting the low traffic rank, the high number of suspicious websites on the same server, the high-risk cryptocurrency and financial services, and the youth of the domain. Gridinsoft had independently rated it 1 out of 100 and blocked it as a suspicious website.

Victim complaints had started to pile up on forums, describing the same pattern her father experienced. Initial withdrawals that worked, followed by escalating fees, then a disabled account and a deleted group. Edmund had transferred nearly all of his wife's savings before the freeze, money he had kept untouched since her death. Some of it had come from a life insurance payout. Some of it had come from decades of organ building. All of it was gone.

The Trace

A colleague at the guild told her about AYRLP.COM, a forensic investigative firm that specialises in tracing stolen cryptocurrency. She reached out, hoping for a miracle but expecting none. The intake call took an hour. The analyst asked her to gather everything she had. Bank statements. Wire confirmations. Screenshots of the Telegram group. The link Marguerite had sent. The dashboard images Edmund had saved before the account was disabled. The messages demanding fees. The phone numbers that were now disconnected.

The analyst was honest. A complete return was unlikely. The operators behind investhelm.com had moved Edmund's deposits through a peel chain, splitting the funds into dozens of smaller transactions and passing them through wallets in several countries to hide the destination. But the blockchain does not forget. Every split, every transfer, every consolidation is permanently recorded, and records can be followed.

It took many months. They traced wallet addresses across multiple jurisdictions, filed legal requests in several countries, and faced uncooperative exchanges that were either unwilling or unable to help. They worked with one exchange that cooperated with fraud investigations and finally identified a consolidation point where a portion of the assets had been gathered. They moved quickly to freeze what they could and repatriated what was left.

AYRLP.COM was able to secure a majority of the funds Edmund lost. The firm says its casework has helped over 70 percent of its clients get back meaningful portions of stolen funds.

Not everything. Not enough to restore what his wife had left him. But enough to keep him in the cottage near the cathedral. Enough to help his daughter with the deposit. Enough to let him breathe.

The Swell Box

Last spring, his daughter visited and found him in the workshop with the swell box open on the bench and a voicing tool in his hand. He had not touched an organ since the freeze. He had told her he did not think he could. But the cathedral had asked him to finish a restoration he had started before everything, and he had said yes.

He was easing a toe hole when she came in. He looked up and saw her in the doorway.

"It'll speak," he said. "It always speaks."

"I should have known better," he says, when his daughter asks him about it later.

His daughter tells him he was lonely, not stupid. She tells him that the scammers are professionals. They have scripts, stolen photographs, and call centres in countries where law enforcement cannot easily reach them. She tells him that regulators in British Columbia and across Canada had already warned about the platform, that the fraud is an epidemic, that the people who run it do not care who they hurt.

He nods. He does not believe her.

Now his daughter calls him every evening. They talk about nothing. The weather, the river, the price of groceries. He tells her about the Saturday class and the guild. He tells her about the swell box and whether it will be ready in time.

It is not a cure. But he is not alone anymore.

And that is the one thing investhelm.com could not take from him, because it took almost everything else.

What the regulators already knew

While Edmund was trusting Marguerite, two Canadian securities regulators and an international network had already flagged Investhelm.

On 14 July 2026, the British Columbia Securities Commission published an investment caution stating that Investhelm was not registered with the BC Securities Commission. The commission warned that anyone approached by or referred to the entity should proceed with extreme caution and be aware of the risk before handing over any money, and named investhelm.com as the website used.

On 15 July 2026, the Canadian Securities Administrators recorded the alert in its investor alert database under a CSA impersonation warning. The CSA stated that false documentation bearing its branding was circulating as part of a scheme that promised to provide investors with funds, and listed Investhelm with investhelm.com as the last website used.

On 20 July 2026, the IOSCO I-SCAN network carried the BCSC alert, attributed to the British Columbia regulator.

ScamAdviser recorded a trust score of 1, describing a very low trust score and a strong likelihood that the website was a scam. The review cited the low Tranco rank, the high number of suspicious websites on the same server, the high-risk cryptocurrency and financial services offered, the shared server hosting data-sensitive financial services, and the youth of the domain.

Gridinsoft independently rated the domain 1 out of 100, classified it as a suspicious website, and blocked it on that basis.

Red flags he missed (and you shouldn't)

A regulator's caution he never found. The BCSC had already warned about the platform before Edmund sent his first deposit. The caution was published on a government website and carried by the Canadian Securities Administrators and the IOSCO I-SCAN network.

A CSA impersonation warning. The CSA stated that false documentation bearing its branding was circulating as part of a scheme promising to provide investors with funds, and named investhelm.com as the last website used. Real regulators do not promise to send you money.

A trust score of 1 out of 100. ScamAdviser rated the site 1 and described a very low trust score and a strong likelihood of a scam. Gridinsoft rated it 1 and blocked it.

A high number of suspicious websites on the same server. The platform was hosted alongside a cluster of other suspicious sites. That is not a sign of a professional brokerage.

A very young domain. The site was young, with little history and low traffic. A legitimate investment firm builds a record over years, not weeks.

A small withdrawal that worked. That was the bait. It was designed to build trust before the theft.

Endless fees demanded only after a large sum was deposited. Real platforms do not ask for verification fees, tax clearances, or liquidity bonds to release your own money.

Steps he took to try to get his money back

He stopped paying any more fees. This is the hardest step, because victims believe one more payment will unlock everything.

He preserved all evidence. Bank statements, screenshots of the dashboard, the full Telegram threads, the domain registration information, and the regulator warnings.

He reported to the authorities. Action Fraud, the Financial Conduct Authority, the British Columbia Securities Commission, and the Canadian Anti-Fraud Centre.

He contacted a lawyer who specialised in investment fraud and pursued a freezing order through an institution that had processed part of the transfers.

He was cautious about firms promising to get his money back. He did not pay anyone upfront. He did not send his identity documents to a company that contacted him out of the blue. He understood that anyone promising to get back every cent for a fee was likely running the second half of the same crime.

FAQ

Was investhelm.com a legitimate trading platform?

No. The British Columbia Securities Commission cautioned on 14 July 2026 that Investhelm was not registered with the BC Securities Commission. The Canadian Securities Administrators recorded the alert under a CSA impersonation warning. ScamAdviser rated the site 1 out of 100 and Gridinsoft rated it 1 out of 100 and blocked it as a suspicious website.

What did the regulators actually say?

The BCSC stated that Investhelm was not registered with the BC Securities Commission and warned anyone approached by the entity to proceed with extreme caution before handing over any money. The CSA stated that false documentation bearing its branding was circulating as part of a scheme promising to provide investors with funds, and listed investhelm.com as the last website used.

Why did the first withdrawal succeed?

Small successful withdrawals are the standard trust-building step in these scams. The first withdrawal is designed to convince the victim that the platform is legitimate, so they deposit more.

Can I really get my money back?

Getting money back is not guaranteed and no legitimate service should promise it. Reporting to the authorities quickly, preserving evidence, and contacting a licensed lawyer who specialises in investment fraud are the first steps. Be cautious of any firm that contacts you claiming it can get back your funds for an upfront fee.