Encryption and cash, the fraudsters take everything

The man whose book actress Shilpa Shetty tweeted on July 7, 2017 would continue to script one of the biggest ponzi schemes India has seen. Amit Bhardwajs GainBitcoin scam, unveiled in 2018 and which has since grown to $2.7 billion, enticed people to invest by promising them high returns in a short period of time, but it did so using a little-known form of digital money at the time – cryptocurrency. Bhardwaj carried out fraud almost in full public view – his Twitter handle and promotions for his book were a big part of his selling point.

Because a large number of Indians are GainBitcoin the scheme was when they first heard about Bitcoin and cryptocurrency; for thousands, it was how they lost their savings. For the fraudsters who followed Bhardwaj, it became a case study in what not to do – draw attention to themselves – and know exactly how much money to swindle. That’s not all. If there is more awareness of cryptocurrency today, the traps being set are just as more sophisticated. Let’s see how some of them work.

The fake crypto exchange

On June 21, researchers at security firm CloudSEK revealed that a bogus crypto exchange scam had defrauded Indians of more than ₹NOK 1,000 million.

The scam began with fraudsters creating several fake domains online, impersonating a legitimate UK-based crypto trading platform called CoinEgg. The researchers found the word “CloudEgg” ​​in all of these domains and said the pages were “designed to replicate” the official website’s dashboard and user experience.

The scammers then created a fake social media profile of a woman “to approach the potential victim and establish a friendship”. She would “gift” a $100 credit to users and push them to start trading on the fake platforms. When they did, the dashboard would show that they were making remarkable returns. This encouraged victims to deposit more money.

Soon the fraudsters would freeze these accounts and stop any withdrawals. The fake CoinEgg website insisted that users pay 22% of their earnings or deposits as “tax” before they could claim their money back. If earnings exceeded $250,000, the exchanges would request additional deposits. When a user realized that they had fallen for a scam, it would be too late.

It didn’t end there. The brazen attackers would then track down these users’ complaints about fake exchanges on social media and approach them from other fake accounts, posing as investigators. They would pick out personal information, ID cards and more, which could then be used to hack other accounts.

In a report covering the period from July 2020 to June 2021 published last year, blockchain analytics platform Chainalysis identified India as the second largest market for crypto. The firm noted that the number of people visiting scam websites from India has decreased. Still, over 200,000 people in India visit such sites every month.

The CoinEgg scam might sound like something an educated person would never fall for, right? That’s what a 21-year-old business owner from Pune thought before he fell into just such a trap last month. After joining a group called ‘WazirX Discuss’ on Telegram following a friend’s recommendation, he began receiving private messages from strangers claiming they could help him invest in cryptocurrencies. That’s how he met ‘Jayant’, a member of that group.

Jayant directed him to a website and helped him create an account. As asked by the scammer, he deposited a few hundred dollars in USDT, a cryptocurrency known as Tether, which is tied to the dollar. He saw the money double in a matter of days. Excited, he deposited $3,000 (approx ₹3 lakh) on the platform. But when he tried to withdraw the earnings on this deposit, the scammers froze his account and told him he had to make an additional deposit of $5,000 (approx. ₹4 lakh). Speaking to Mint earlier this month, the Pune businessman said he has lost out ₹5 lakh to the scam.

As part of the research for this story, this reporter joined the same Telegram group, and received private messages from no fewer than 13 people, dangling similar bait. The site in question also remains active, taking notices, despite posts on Reddit etc. about its fraudulent nature.

Peer-to-peer fraud

Kashif Raza, the co-founder of a platform called CryptoKanoon, is perhaps the most famous victim of a crypto scam in India. Raza took a personal loan at a massive 21% interest to invest in GainBitcoin in 2016-17 and lost everything. To recoup his losses, he also borrowed from friends and family and invested in other projects, which also failed. To do his part, Raza launched a legal awareness and analytics platform called Crypto Kanoon back in 2018, which was acquired by crypto tax startup KoinX earlier this year.

“Even today, ponzi schemes exist, but not on the scale that used to happen in 2017,” he said. Those that do exist, says Raza, are no longer running at the national level. Fraudsters deliberately stick to specific regions or cities to remain under the radar, even though the money they make is still in lakhs.

A product manager working in a multinational firm in Delhi told Mint that his family and friends in a Haryana village have been caught in one such crypto scam. Some have even sold property to invest in the schemes being peddled by a group of scammers who often lure victims to elaborate resorts.

Raza said Ponzi scammers have moved beyond word-of-mouth marketing. Instead, they buy social media followers, buy Google ads, and even pay influencers to reach potential victims. It is a more developed version of Amit Bhardwaj’s book.

This is how it works. “A group of people go to a village or a small town. They identify people with successful businesses and invite them to a hotel or resort. They present their scheme and convince them of abnormal returns,” says Dubai-based Mohammed Danish, chief legal officer of a platform called Bitdrive Exchange.

Speaking to Mint, an industry leader who has been among the founders of two of the country’s oldest crypto exchanges, said fraudsters are most often wealthy individuals. “You must act as if you belong to the rich class. That’s the dream you’re selling – to get rich quick and enter the upper echelons of society. You throw around big names, drive expensive cars and dress the part,” he said.

Another form of fraud is peer-to-peer (P2P) fraud, which occurs over P2P crypto trading platforms. They first appeared in India after the Reserve Bank of India’s ban on crypto back in 2017, which brought more users to these platforms, since the exchanges stopped functioning.

Such platforms as Paxful connect sellers and buyers. They are not exchanges and are quite well known in the crypto community. They allow a buyer to search for a seller (or vice versa) and hold their money in escrow until both parties have confirmed that a transaction has been completed in their desired manner.

How do fraudsters exploit such a platform? Sometimes a buyer pays the money to the seller and after a transaction is completed, they report it to the police as a fraudulent transaction. As part of the subsequent investigation, a stop payment is placed on the transaction, and the buyer withdraws the cryptocurrency he received from the seller for free.

But wouldn’t a seller contest such a transaction? Danish, who has represented fraud victims as an independent attorney since 2018 and also co-founded Crypto Kanoon with Raza, explained that the buyers keep the transactions small, usually under ₹25,000. Most people are reluctant to travel to remote areas, and spend money to get back trivial sums. The fraudster, on the other hand, wanted to get away ₹25,000 each in crypto and fiat currency.

Another trick used by fraudsters: they transfer the amount using a stolen card, or a hacked bank account. Since the seller only cares about receiving the money, they do not verify the information. Once the transaction is complete, the owner of the account contacts the bank and reports the transaction, which is then blocked by the lender. (RBI rules say customers are not liable if fraud occurs through a third party.)

“There have been various cases where the KYC documents that the exchange (P2P platform) had were actually fabricated,” Danish said. But P2P platforms are not involved in such scams. In fact, Paxful even warns users about red flags in one of its blog posts: “This includes rushing to complete trades, false proof of transactions, coin lock situations, chargebacks and phishing attempts.”

Danish says he is aware of “many” such cases from places like Lucknow, Bengaluru, Mumbai, Delhi, Hyderabad and more. “People tend to turn to a lawyer when they get to the stage where their accounts are frozen and they don’t see a solution in sight,” he said.

Take me if you can

Danish has been involved in more than 50 crypto fraud cases as a legal practitioner. The most common reason why fraud is not caught is that users do not contact the police, for fear of a backlash from the authorities. “They fear that the first question they will be asked is why did you invest in crypto?” Danish said. He also said that the police are reluctant to register an FIR (first information report), unless several people report the scam, as it is. was in the case of GainBitcoin.

It’s not that the police don’t try. The problem is often that cryptocurrency fraud is nearly impossible to track and trace, even using modern tools. “Cryptocurrency has become the de facto currency of money launderers, cybercriminals, international extortionists, etc., who use it as a mode of payment due to its perfect anonymity,” said Triveni Singh, Superintendent of Police, Cybercrime, Uttar Pradesh Police. “We cannot track many cases due to technical and legal constraints,” he added. He denied that the police are reluctant to lodge FIRs.

Singh said that crimes where money is transacted through Bitcoin use exchanges as intermediaries, and exchanges often do not retain full KYC for users. The maximum information law enforcement agencies get is wallet addresses that hold crypto, and that is not enough information to trace the final recipients of transactions. Most crypto wallets do not disclose user information.

“Since there is no regulation as such, there is clear confusion as to whether something is a legitimate crypto-coin. 99.99% do not understand blockchain technologies, how coins are minted, circulated, the algorithms, etc. That’s why we say it’s a kind of ponzi scheme. Ultimately it has to go away, if there is no regulation or regulator, and has not been accepted by many countries,” he said. Singh was among the investigating officers who broke one ₹NOK 3,000 million money laundering racket in Bareilly last year.

When the police enlist the help of specialized agencies that track crypto wallets, and use specialized tools (such as Mastercard’s CipherTrace), things go better, says Singh. However, the success rate is low, he admitted.

A major disadvantage is that most police officers are not aware of the technicalities of cryptocurrencies. When the Pune-based businessman quoted above approached the cyber cell, he said that they did not know what USDT, CoinDCX or crypto trading is. “If Cyber ​​Cell won’t understand the problem, how will it help?”

In a reply to an RTI filed by Mint, the Pune police said it has six FIRs related to crypto scams in which investigations are currently underway. They also admitted that the Cyber ​​​​Cell of the Pune Police has no personnel specialized in crypto and that the police have not closed any crypto-fraud related cases in 2021-2022.

First article