Cryptocurrency fraud continues to evolve, with criminals using increasingly convincing tactics to target investors, businesses and previous victims of financial crime.

While some cryptocurrency scams begin with a fraudulent investment opportunity, others involve impersonation, fake trading platforms, compromised wallets or promises to recover money that has already been lost.

At ESA Risk, we have recently been made aware of an individual falsely claiming to represent our business and contacting a previous victim of cryptocurrency fraud. The caller claimed that ESA Risk was working with the Financial Conduct Authority (FCA) to return misappropriated funds and directed the individual towards a cryptocurrency website, where they were told that recovered funds were being held in an account in their name.

The approach was fraudulent. ESA Risk was not involved in the call or the purported recovery scheme.

Unfortunately, this type of approach demonstrates an important characteristic of modern cryptocurrency fraud: the initial scam is not always the end of the matter. Victims can be targeted repeatedly, sometimes by criminals who already hold information about their previous losses.

Understanding the different types of cryptocurrency scams and their warning signs can help individuals and businesses identify suspicious approaches before further losses occur.

Cryptocurrency investment scams

Investment scams are among the most common forms of cryptocurrency fraud.

Victims may be introduced to an apparent investment opportunity through social media, online advertising, messaging applications, dating platforms or unsolicited telephone calls. The opportunity may appear to be associated with a professional trading company, investment adviser or cryptocurrency exchange.

In many cases, the victim is directed to a convincing website or trading platform showing apparent investment growth. Early withdrawals may even be permitted to build confidence in the scheme.

Once trust has been established, the victim may be encouraged to invest increasingly large amounts. When they attempt to withdraw their money, they may be told that additional payments are required for taxes, fees, commissions or account verification.

The profits displayed on the platform may never have existed.

Common warning signs include guaranteed or unusually high returns, pressure to invest quickly, unsolicited investment advice and requests to transfer cryptocurrency directly to a wallet controlled by another party.

Cryptocurrency recovery scams

Recovery scams specifically target people who have already lost money through fraud.

A fraudster may claim to be an investigator, lawyer, regulator, government representative or specialist asset recovery company. They may tell the victim that their stolen cryptocurrency has been located or that funds are being held in an account awaiting release.

The victim may then be asked to pay an upfront fee, tax, commission or administrative charge. Alternatively, they may be directed to a fraudulent website, asked to provide wallet credentials or persuaded to install software that gives the criminal access to their device.

These approaches can be particularly convincing because the caller may already know that the individual has previously been a victim of fraud. They may also possess personal information such as the victim’s name, telephone number, email address or details relating to the original scam.

Previous victims should therefore be particularly cautious about unsolicited offers to recover lost cryptocurrency.

Impersonation scams

Fraudsters frequently impersonate legitimate organisations and professionals to establish credibility.

This may include cryptocurrency exchanges, banks, law firms, investigation companies, regulators or law enforcement agencies.

The fraudster may use the name of a genuine employee or company, create convincing email addresses and websites, or manipulate the telephone number displayed during a call. Publicly available information can also be used to make an approach appear more credible.

A genuine company name does not necessarily mean that the person making contact genuinely represents that organisation.

Anyone receiving an unexpected approach should independently verify the identity of the person contacting them. Contact details supplied by the caller should not be relied upon. Instead, use contact information obtained independently from the organisation’s official website or another trusted source.

Fake cryptocurrency exchanges and trading platforms

Fraudulent trading platforms can be highly sophisticated.

A victim may be provided with login details for what appears to be a genuine investment account. The platform may show deposits, trades, account balances and significant profits.

However, the information displayed may be entirely fictitious.

When the victim attempts to withdraw funds, the supposed platform may request further payments. These can be presented as withdrawal charges, taxes, anti-money laundering checks or account release fees.

The existence of an online dashboard or account balance should never be treated as proof that cryptocurrency or other assets genuinely exist.

Phishing and wallet theft

Phishing attacks are designed to obtain information that gives criminals access to cryptocurrency wallets or exchange accounts.

A victim may receive an email, text message or direct message that appears to come from a legitimate exchange or wallet provider. They may be told that there is a security issue with their account and directed to a fake login page.

Other attacks seek to obtain a wallet recovery phrase or private key.

A legitimate wallet provider or cryptocurrency exchange should never require an individual to disclose their private key or seed phrase. Anyone who obtains this information can potentially take control of the wallet and transfer its contents.

Romance and relationship-based cryptocurrency fraud

Some cryptocurrency scams develop over weeks or months.

A fraudster establishes an online relationship with the victim, often through a dating platform or social media, before gradually introducing the subject of cryptocurrency investment.

The victim may initially be encouraged to make a relatively small investment through a recommended platform. Apparent profits are then used to encourage larger transfers.

These scams combine financial fraud with social engineering. The personal relationship is used to build trust and reduce the victim’s suspicion of the investment opportunity.

The individual behind the profile may not be who they claim to be, and the investment platform itself may be controlled by the same criminal network.

Giveaway and social media scams

Fraudsters may impersonate well-known individuals, cryptocurrency businesses or investment professionals on social media.

Common tactics include fake giveaways, promises to multiply cryptocurrency sent to a particular wallet address and fraudulent investment opportunities promoted through compromised or cloned accounts.

Artificial intelligence and manipulated video or audio can also make impersonation attempts more convincing.

Cryptocurrency should never be transferred solely on the basis of a social media post, direct message or video without independent verification.

Pump-and-dump schemes and fraudulent tokens

Some cryptocurrency fraud involves the artificial promotion of a token or digital asset.

Individuals may be encouraged to purchase a particular cryptocurrency following aggressive promotion through social media channels, online communities or messaging groups.

As demand increases, the value of the token may rise. Those behind the promotion then sell their holdings, causing the price to collapse and leaving other investors with significant losses.

In other cases, a fraudulent token may be designed so that purchasers can buy it but are unable to sell.

The promotion of a cryptocurrency by a large online community does not, by itself, establish that the asset is legitimate.

What should you do if you suspect cryptocurrency fraud?

If you believe you are being targeted by a cryptocurrency scam, stop communicating with the suspected fraudster and do not send further funds.

Preserve as much information as possible. This may include wallet addresses, transaction hashes, email correspondence, telephone numbers, usernames, screenshots, website addresses and records of conversations.

If cryptocurrency has already been transferred, the movement of funds may be traceable through blockchain analysis. However, tracing cryptocurrency and recovering it are separate issues. The ability to identify the movement or destination of funds does not automatically mean that assets can be recovered.

The prospects of recovery can depend on several factors, including how quickly the fraud is identified, the movement of assets between wallets, the involvement of cryptocurrency exchanges, the jurisdictions involved and whether the individuals or organisations responsible can be identified.

Victims should also remain alert to subsequent recovery scams. An unsolicited promise that lost funds have already been recovered, or that they can be released following an upfront payment, should be treated with extreme caution.

The Financial Conduct Authority (FCA) also provides guidance on cryptocurrency investment scams, including common warning signs and what to do if you believe you have been targeted: FCA guidance on cryptocurrency investment scams.

Cryptocurrency fraud investigations

Cryptocurrency investigations often require more than blockchain analysis alone.

While blockchain tracing can help identify the movement of digital assets, a wider investigation may be necessary to identify the individuals, companies, websites, infrastructure and jurisdictions connected to the fraud.

This can involve combining blockchain intelligence with open-source intelligence, corporate research, asset tracing and, where appropriate, human-source intelligence enquiries to identify the people and entities behind the fraud and assess realistic options for further action.

If you are dealing with suspected cryptocurrency fraud, require intelligence to support litigation or enforcement, or need to assess the viability of tracing digital assets, contact our Client Services team at advice@esarisk.com or on +44 (0)343 515 8686, or via our contact form.