Phishing sites mimicked well-known exchanges. Users registered and deposited funds, watching balances rise on-screen. Upon withdrawal request, accounts were banned and funds lost.