1. What is happening
Victims are recruited into WhatsApp groups that promise daily income from “renting vending machines”. Inside the BV app the balance keeps growing. When a victim tries to withdraw, the app demands a fee — starting around NPR 1,290 and escalating into crores — and the withdrawal is never released. This matches the FBI/IC3-documented task-scam / forced-tax loop pattern exactly.
- The app front is bvappkf.com — registered 10 Sep 2026, i.e. days old, hosted at 47.84.69.200 (Alibaba Cloud, Hong Kong).
- Its nameservers (A11.SHARE-DNS.COM / B11.SHARE-DNS.NET) belong to Share-DNS, infrastructure documented as a “custom scam DNS network” used by Chinese pig-butchering operations.
- Money is collected into personal bank accounts of named individuals (money mules), not into any company account.
- Nepal Police Cyber Bureau has already publicly declared BV Nepal an online MLM scam (notice 2083-04-28 BS ≈ 13 Aug 2026).
2. Official warnings & independent reporting
| Source | What it says |
|---|---|
| Nepal Police Cyber Bureau — public notice | “BV Nepal” is an online MLM scam; do not invest; contact Cyber Bureau with information. |
| Ratopati (EN) | Names the product “Campus Vending Machine Asset Management Product-110 Days”. |
| TechPana forensic investigation | 99.9% of the “vending machine” images are AI-generated; no physical presence in Nepal; WhatsApp channel with 26,000+ members; impossible returns (7.7%–8%/day); mule accounts listed; 12–13 Aug “maintenance” = withdrawals suspended. |
| Artha Sarokar (23 Sep 2026) | Collected millions under “Starbox Vending Creative Marketing”; claimed office address has no office; all group admins are foreigners communicating only via WhatsApp; police confirm scam. |
| FBI/IC3 PSA — task scams | Fake interface shows earnings that can never be cashed out. |
| FBI/IC3 PSA — play-to-earn FBI/IC3 PSA 2026 — tax loop | Victims told they reclaim funds by paying taxes/fees — but never get money back. |
3. Payment evidence from this case
| Field | Value |
|---|---|
| Reference code | 381605464 |
| Amount | NPR 12,899.80 |
| Date / time | 04 Jul 2026, 12:54 PM |
| Service | NPS Transfer (NIC ASIA MoBank, Online) — status SUCCESS |
| Beneficiary account | 038###05645041 |
| Claimed beneficiary / brand | “Starbox Vending Creative Marketing Pvt Ltd” |
| Purpose demanded by app | Fake “tax verification” before any withdrawal |
The payer-side identifiers in the screenshot are masked by the bank app itself; one remaining personal number has been blacked out to protect a third party.
4. Infrastructure forensics (bvappkf.com)
| Property | Finding | Source |
|---|---|---|
| Domain created | 2026-09-10T06:54:43Z | Verisign RDAP |
| Registrar | Gransy, s.r.o. (regtons.com) — abuse abuse@regtons.com | RDAP |
| Nameservers | A11.SHARE-DNS.COM, B11.SHARE-DNS.NET | RDAP |
| DNS A record | 47.84.69.200 | Google Public DNS |
| Host | Alibaba Cloud, AS45102, Hong Kong | whois / RDAP |
| Certificates | 4 DV certs issued within hours of registration (bvappkf.com, www., api., mc.) | Cert Spotter |
| Site status | Still live — no takedown, no sinkhole (checked 25 Sep 2026) | direct fetch |
| Shares infra with | Share-DNS network: 5+ connected scam domains, 100+ active scam domains documented | ScamDOX |
Sibling branding: an older marketing site bvbzjt.com and paid press-release syndication are used for legitimacy theatre; a real Australian company (ACN 692068741) appears to be the impersonation target.
5. WhatsApp identifiers used by the operators
Report these numbers in WhatsApp (open chat → ⋮ → Report). Do not pay or argue with them, and do not send them money or documents. Numbers may be recycled/sim-swap identities — treat them as evidence, not as proof of who is behind the scam.
| Displayed name | Number |
|---|---|
| Andrew Collins | +61 416 781 216 (Australia) |
| Anjali Thapa | +977 970 409 9393 (Nepal) |
| Rabina Chaudhary | +977 982 118 5104 (Nepal) |
| (unnamed admin) | +61 403 466 807 · +61 411 712 492 · +61 422 769 574 (Australia) |
| (unnamed admin) | +44 7576 014 398 · +44 7878 790 497 (UK) |
6. Timeline
- 21 Feb 2026 — “BV Nepal Announcement Channel” created on WhatsApp; grows past 26,000 members.
- 12–13 Aug 2026 — “system maintenance” announced; withdrawals suspended while recruitment bonuses continue (exit-scam indicator).
- 13 Aug 2026 — Nepal Police Cyber Bureau publishes its BV Nepal scam notice.
- ~24 Aug 2026 — Nepali company registration issued to “Starbox Vending Creative Marketing” (Reg. 401081/83/84) — no office found by journalists.
- 10 Sep 2026 — bvappkf.com registered; certificates issued same day.
- 23 Sep 2026 — Artha Sarokar reports agents cannot identify any office; police reconfirm scam.
- 04 Jul / 2026 — payment ref 381605464 made in this case under “tax verification” pretext.
- 25 Sep 2026 — this dossier compiled; abuse/takedown reports filed; victims warned inside the group.
7. If you paid — act within 48–72 hours
- Stop paying. No fee unlocks anything.
- Go to your bank’s fraud desk today and request a transaction recall (with eSewa/Khalti/IME use their fraud report path). Always take the transaction reference number — recall only has a realistic chance inside 48–72 hours.
- Preserve everything: screenshots, chat messages, receipts, transaction IDs, the numbers you paid to — before leaving or reporting the group.
- File a complaint with Nepal Police Cyber Bureau (or your nearest police station) and ask them to freeze the beneficiary account using your transaction ID: cyber.nepalpolice.gov.np · cyberbureau@nepalpolice.gov.np · 01-5319044
- Report the app and the group: WhatsApp (report group + each admin number), Google Safe Browsing, Netcraft, urlscan.io, VirusTotal.
- Tell us what happened — name, phone number, amount, date, transaction ID. More documented victims = faster action.
Report the infrastructure (takes 2 minutes each)
- urlscan.io — submit bvappkf.com (creates a permanent public capture)
- VirusTotal · Google Safe Browsing · PhishTank · URLhaus
- Netcraft takedown report · ACCC Scamwatch (AU numbers) · FBI IC3
- Registrar abuse: abuse@regtons.com · Host: Alibaba Cloud international abuse form
8. Submit your evidence
Victims: send — your name, phone number, how much you paid, when, to which account, and the transaction ID/screenshot.
Email your evidence Join the victims’ warning groupEvidence is used to build the complaint package for the Cyber Bureau and for bank recalls. Personal details of victims are never published on this page.
9. For journalists, fact-checkers & creators
This case is ready to cover: an official police declaration, an independent forensic investigation (AI-generated machine images, mule accounts), a fresh 15-day-old domain on documented scam DNS infrastructure, a real payment receipt, and a shell company registration issued three weeks ago. The eight admin numbers (+61 / +44 / +977) are undocumented anywhere else on the internet — first publication would be an exclusive.
- Full dossier, source links and identifiers are available on request.
- Victims are available (anonymised) for accounts; ~900-member group data supports scale estimates.
- Contact: dewanimran904@gmail.com
१०. नेपालीमा संक्षिप्त जानकारी
- bvappkf.com नक्कली लगानी वेबसाइट/एप हो। यसले देखाएको “नाफा” र “ब्यालेन्स” वास्तविक होइन — केवल वेबसाइटमा देखिने अंक मात्र हो।
- रकम लिन चाहेमा “कर भुक्तानी / भेरिफिकेसन” तिर्न लगाउँछ — सुरुमा रु. १,२९० देखि रु. ६३,००,००० सम्म। त्यो पैसा फर्किँदैन।
- डोमेन २०८३/२०२६ सेप्टेम्बर १० मा मात्र दर्ता भएको हो।
- ग्रुपमा केवल एडमिनले मेसेज पठाउन पाउँछ, र ती एडमिन नै ठग हुन् (अष्ट्रेलिया +६१ र बेलायत +४४ का)।
- नेपाल प्रहरीको साइबर ब्युरोले BV नेपाललाई अनलाइन MLM स्क्याम घोषणा गरिसकेको छ: सार्वजनिक सचेतना
- पैसा तिर्नुभएको छ भने आजै बैंकको फ्रड डेस्कमा जानुहोस् र “ट्रान्जाकसन फिर्ता (recall)” माग्नुहोस् — ४८–७२ घण्टाभित्र मात्र फर्कने सम्भावना।
- सबै प्रमाण जोगाउनुहोस्: स्क्रिनसट, च्याट, रसिद, ट्रान्जाकसन आईडी।
- साइबर ब्युरो: cyber.nepalpolice.gov.np · ०१-५३१९०४४
Last updated: 25 September 2026. This page documents publicly verifiable facts and links to primary sources. Statements about named companies are based on police notices and published journalism; the Australian entity (ACN 692068741) may itself be an impersonation victim. Victim identities are withheld.