The KTT Scam: Fake Downloads and Upfront Fees
The KTT scam is not a misunderstood payment method. It is an advance-fee fraud that uses banking jargon to sell a story: a huge sum is already available, a screenshot proves it, and you only need to pay a fee so the funds can be "downloaded." The catch is simple. There are no funds.
The KTT scam is not a misunderstood payment method. It is an advance-fee fraud that uses banking jargon to sell a story: a huge sum is already available, a screenshot proves it, and you only need to pay a fee so the funds can be "downloaded." The catch is simple. There are no funds.
This pattern is obvious to people who raise capital for a living. It is not obvious to first-time sponsors or project owners. That is why the same pitch still works on people who have already been turned down by real lenders.
Reviewed: 13 November 2026.
What the KTT scam actually is
A typical pitch starts with a promise of tens or hundreds of millions of dollars for an "eligible" project or trade. The person on the other side may call themselves a provider, a funder, a facilitator or an NBFC. They claim they have access to a blocked account, a tested telex, a SWIFT MT103, an MT760 or a "server" that already holds the money. They send a screenshot or a receipt. Then they pressure you to pay a large upfront fee so the funds can be released or downloaded.
The U.S. Federal Bureau of Investigation describes an advance fee scheme in plain terms: the victim pays money in anticipation of receiving something of greater value, such as a loan, contract, investment or gift, and then receives little or nothing in return. The FBI Internet Crime Complaint Center has also warned that fraud actors use counterfeit SWIFT messages or documents, such as "MT 799" or "MT 760," to make funding scams look authentic, and that victims are often asked to pay an advanced fee before funding.
FinCEN, the U.S. Financial Crimes Enforcement Network, has treated advance-fee fraud the same way. In a 2002 warning, it described a forged official letter that claimed a fee had to be paid before money could be wired. The letter was false, the fee was not required, and the signature was falsified. A KTT pitch uses cruder paper for the same purpose: make the fee look like a condition of a real transfer.
KTT, telex and the jargon used to confuse you
Key-tested telex, often shortened to KTT, is old bank-to-bank messaging language. Historically, banks used tested telexes to authenticate messages. That history is now used as decoration. In the scam, "KTT" is presented as a special rail that can move amounts no ordinary bank will touch, outside normal underwriting, and
Around that label you will hear terms that do not belong together: SWIFT MT103 downloads, MT760 downloads, "server to server," "IP/IP," "manual download," or a "compliance release key." The jargon is there to stop you asking your own bank a short question: is any payment here?
For the terminology, and why the label is not a payment system, see the KTT transfers complete guide and how banks review transactions described as KTT transfers. A shorter combined checklist is already live: KTT and IPIP transfer scams, red flags to check. This article is the longer KTT-scam piece: the download fee, the NBFC costume, and the forged receipts.
SWIFT MT103 and MT760 "downloads" are not how banks pay you
An MT103 is a customer credit-transfer instruction exchanged between banks. An MT760 is used for demand guarantees and standby letters of credit. Neither is a pile of money sitting on a server, waiting for a download charge. SWIFT describes itself as a provider of secure financial messaging services, a network for authenticated messages between users, not a public download portal. The FBI's March 2019 IC3 alert is direct: fraud actors format counterfeit SWIFT messages to give "an authentic presentation" and exploit gaps in technical knowledge. If someone emails you a copy and tells you the funds will land once you pay, you have a picture, not a payment.
The ICC Financial Investigation Bureau has warned about fake bank guarantees and standby letters of credit, including instruments in the tens or hundreds of millions of dollars, and in one reviewed case a purported one billion euro standby. It found inconsistencies and "red flag" terms, named institutions that did not exist or were unregulated, and wording that was a veiled attempt to extort funds. In the billion-euro case, the document asked for an access and PIN code to change the beneficiary, language that would not appear in a genuine instrument. Treat a KTT or MT760 "download" pack the same way: check it with your own bank. Do not wire a fee because of it.
The NBFC "provider" in the middle of nowhere
Many of these pitches are not even dressed as banks. They arrive as non-bank finance companies, often in places the recipient cannot easily visit or verify, or as private "providers" with doctored licences and letterheads. Some are simply scammers with templates. Others may be real small companies with no capacity to fund the amount they are promising.
The Reserve Bank of India has cautioned the public about this costume. In November 2014, it warned that imposters were impersonating NBFCs, including by forging a cancelled Certificate of Registration, promising loans, collecting processing charges, and vanishing with the money. Do not pay or commit without verifying the licence or registration, and inform the local police if you see this activity. In August 2024, RBI again warned against fictitious fund-transfer offers that demand processing charges, and against sites or apps that falsely claim RBI registration as an NBFC. It also stated that it does not maintain accounts to hold funds for disbursal, and that the list of entities it regulates is on rbi.org.in.
Even a genuine, authorised NBFC still has to know its customer, underwrite credit, and operate within its licence. If the story is "we can send you hundreds of millions against a telex, with no real due diligence, once you pay the download fee," you are not looking at regulated finance. You are looking at a fee collector.
Fake screenshots and transaction receipts
The evidence package is designed to end the argument: a screen that looks like a core-banking terminal, a SWIFT printout, a telex, or a stamped receipt. The amounts may be huge and oddly round. The bank names may be real, or almost real. A reference number on a PDF is not a credit to your account. The only confirmation that matters comes from the bank that would actually receive the funds, through a channel you already trust, not a number on the document.
The ICC Bureau's guidance on false instruments still applies when the document is a receipt rather than a guarantee: check the named institution, be suspicious when it does not exist or is unregulated, and treat invented terms or strange release instructions as warnings. Do not let a polished JPEG replace due diligence.
The upfront fee to "download" funds
After the screenshots come the invoice. It may be called a download fee, a server fee, a SWIFT charge, a compliance fee, a tax, an insurance premium, a bank officer incentive, or a one-time activation cost. The amount is large enough to hurt relative to the promised funds. Pay this, receive that. The ratio is the hook.
Pressure follows. The slot will close. The operator will roll the funds to another client. A bank officer is "on the screen" and waiting. You are told not to speak to your relationship manager because ordinary staff "cannot see" the transaction. You may be asked to sign a non-disclosure agreement first, which the FBI has listed among the common features of these schemes, along with intricate excuses for why the promised funds have not arrived.
There is nothing to download. In a real payment, the sending bank sends an authenticated instruction, correspondent banks settle, and the receiving bank credits an account, subject to its own compliance checks. Your bank does not need a special fee, paid to a third-party "provider," before it can see money that is actually on its way. If the money is not on its way, the fee does not change that fact.
The ICC Financial Investigation Bureau has also warned businesses to be on guard when large sums must be paid in advance for financing dressed up with standbys and unfamiliar forms. In one case it reviewed, 2.5 percent of a purported loan was to be paid up front on a "Confidential Loan Contract," together with a non-disclosure contract. That figure is from that case, not a market rate. The Bureau was warning against the structure, not endorsing a fee. The KTT download invoice is the same family of demand.
Red flags in a KTT funding pitch
| Claim you are hearing | What it usually means | What to do instead |
|---|---|---|
| Funds are already on the server, tested, or ready for download | There is no verified credit at your bank | Ask your own bank, in writing, whether any authenticated message or payment has arrived |
| An MT103, MT760 or telex screenshot is "proof" | You are being shown a file, not a bank confirmation | Refuse to treat any PDF, photo or forwarded message as settlement |
| An NBFC or offshore provider can send hundreds of millions with little underwriting | The capacity has not been verified, and the registration may be fake | Check the institution on the official regulator list, not on the pitch deck |
| Pay a download, compliance, tax or release fee and the money will land | This is the advance-fee step | Do not pay. If a real payment existed, your bank would already see it |
| Do not call your bank; ordinary officers cannot see this product | They do not want an independent check | Call your bank anyway, using a number you already have |
| Sign an NDA and move fast, or the allocation will be lost | Urgency and secrecy are there to stop verification | Slow down. Real funders can survive a due-diligence pause |
If every real lender already said no
If banks, funds and other real lenders have already rejected the deal, it is not a distant NBFC, and it is not a KTT operator, that has suddenly decided you are special enough to receive hundreds of millions without underwriting. Real capital goes through KYC, due diligence, credit analysis and a credit committee. We set that process out in what real investors and lenders actually do.
A rejection is information. The file may be thin, the leverage too high, the revenue undocumented, or the collateral weak. Fix those problems. Do not replace a declined credit process with a telex fairy tale.
What to do instead
Do not pay the fee. Do not send more identity documents to people you have not verified. Do not rent a receiving account because someone told you your own bank "cannot accept KTT." Speak to your bank first. If you already paid, contact the bank and law enforcement without delay, and file a complaint with the IC3 at www.ic3.gov.
If the underlying project or trade is real, put the file in order and work with a legitimate advisor. Financely is an advisor and arranger only, never a lender. We do not download funds or collect a fee as the price of a guaranteed disbursement. For the related IPIP and IPID pattern, read IPIP and IPID scams: fake senders and upfront fees. For private placement stories that travel with the same documents, see SBLC private placement programs are a scam. If you have a real transaction, request a free estimate.
Frequently asked questions
What is the KTT scam?
It is an advance-fee fraud dressed up as a large key-tested telex, SWIFT MT103 or MT760 transfer. A so-called provider, often described as an NBFC, claims it can deliver a very large sum, sends fake screenshots or receipts, then demands a fee to download or release funds that are not there.
Is a screenshot of an MT103 or MT760 proof that funds were sent?
No. A PDF, screenshot or emailed copy is not a bank credit. Only your own bank can confirm whether an authenticated message arrived and whether any funds were credited. The FBI has warned that fraud actors use counterfeit SWIFT messages or documents, such as MT 799 or MT 760, to make scams look real.
Why do these offers mention NBFCs?
The label is used to sound regulated and hard to check. The Reserve Bank of India has warned that imposters forge or misuse NBFC credentials and collect processing charges for loans that never arrive. A genuine, authorised NBFC still has to underwrite a borrower.
Should I pay a fee to download or release the funds?
No. There are no funds sitting on a server waiting for your payment. This is a classic advance-fee pattern: you pay in the hope of receiving something of much greater value, and you receive little or nothing. Ask your own bank first. If the bank has no incoming payment, do not pay the fee.
What should I do if I have already paid or sent documents?
Stop further payments. Tell your bank immediately and ask whether any of the funds can be recalled. Keep every email, screenshot, receipt and contract. File a complaint with the FBI Internet Crime Complaint Center at www.ic3.gov, and report the matter to local law enforcement.
Financely does not receive KTT or IPIP transfers and does not send SWIFT messages. If you have a real trade file, use the financely.io eligibility screen (USD 500). If you were asked to pay a receiving or download fee, stop and treat that as a red flag.