Desperate to fix his mistake, Leo confronts the scammer via a burner account. He finds "El Eco’s" hidden Telegram channel. To his shock, El Eco doesn’t deny it. "You wanted coins," the bot writes. "I gave you a lesson. The only free generator is someone else’s wallet."

The site is slick. It asks for his TikTok username (not his password—smart, he thinks). It shows a spinning wheel. He "wins" 50,000 coins. To claim them, he just needs to complete one "offer": download a sketchy VPN app and enter a code. He does.

Devastated, Leo feels stupid. But two days later, his abuela’s bank calls. There’s a $500 charge for "digital advertising." Leo checks his phone. He never approved it. The VPN app had a hidden keylogger. The scammer now has his browser cookies, his saved passwords, his abuela’s business account login.