Romance Scams That Run Your Crypto Wallet Dry
Scammers are using dating sites to lure victims into phony cryptocurrency investment schemes, according to Sean Gallagher at Sophos.
These types of investment scams are known as “pig butchering,” loosely translated from the Chinese phrase “sha zhu pan.” In this case, the scammers convince the victim to participate in a liquidity pool arrangement, a legitimate but risky cryptocurrency investment technique.
“Fake pools use smart contracts that give the scammers access to their targets’ wallets,” Gallagher explains. “They may deposit cryptocurrencies into wallets to give the illusion of gains, or deposit counterfeit cryptocurrencies that have deceptive names and no inherent value. The websites used to link wallets in these scams will display data promising daily payouts, and showing the victim’s mounting but fake profits.”
The scammers draw the victims in by making contact with them on dating sites and establishing trust before steering the conversation toward cryptocurrency investments.
“The first warning flag for scam operations is that they often follow the same victim recruiting techniques and pressure tactics associated with sha zhu pan operations,” Gallagher says. “Early scams we encountered used social media sites to cold-approach potential victims, but more recent ones have used the sha zhu pan-style romantic ploys, purposefully crafted ‘misdirected’ SMS messages meant to start conversations (‘Are you going to Liam’s party? Is this Sara?’), and other angles to improve their rate of success and widen their potential pool of victims.”
Gallagher notes that these scams rely solely on social engineering to steal the victims’ funds.
“These scams require no malware on the target’s device, and no ‘hacking’ of any sort other than fraudulent websites and social engineering—convincing targets to connect their wallet to an Ethereum smart contract that gives the scammers permission to empty the wallet,” Gallagher writes. “As a result, it is extremely difficult to prevent these scams through software protection. Fraudulent wallets and domains are identified and blacklisted as they are discovered, but scammers can quickly deploy new websites and wallets and continue to filch targets’ ‘risk-free’ stakes. Cryptocurrency stolen by these scammers is rarely recovered.”
New-school security awareness training can give your employees a healthy sense of suspicion so they can avoid falling for these types of scams.
Sophos has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW