Together with the Department of Homeland Security (DHS) and the Cybersecurity and Infrastructure Security Agency (CISA), the FBI has released a warning about cybercriminals creating fraudulent cryptocurrency investment apps in order to defraud cryptocurrency investors.
The threat actors convince investors to download fraudulent mobile apps with the promise of huge opportunities and even larger gains.
And this new type of fraud turns out to be very profitable indeed, for the criminals at least—the FBI has identified 244 victims and estimates the approximate loss associated with this activity to be $42.7 million.
Mobile apps
It’s common for financial institutions to have a mobile app. These apps enhance the user experience and increase legitimate investment. Needless to say, threat actors sniffed out this opportunity to take advantage of the increased interest in mobile banking and cryptocurrency investing.
The FBI has observed threat actors using the names, logos, and other identifying information of legitimate financials in apps and websites.
Examples
While the basics are the same, there are some variants of this type of fraud which the FBI demonstrates with a few examples.
In the first one, victims were duped into downloading an app that used the name and logo of an actual US financial institution. Then the threat actors encouraged the victims to deposit cryptocurrency into wallets associated with their accounts on the app. But the app did not originate from the company the victims thought, and when they tried to withdraw funds from the app, they received an email stating they had to pay taxes on their investments before making withdrawals. After paying the supposed tax, the victims remained unable to withdraw funds.
Separately, threat actors operating under the name of a legitimate cryptocurrency exchange that closed in 2018 used the same method of having the victims pay taxes after which there was still no way to get a refund.
Then, threat actors using a name very similar to that of a currency exchange provider in Australia defrauded a victim by telling them that they had enrolled in a program requiring a minimum balance of $900,000. When the victim tried to cancel the subscription, they received instructions to deposit the requested funds or have all assets frozen.
Mitigation
To stay out of the claws of these imposters there are a few precautions you can take.
- Be wary of unsolicited requests to download investment applications, especially from unexpected sources.
- Verify the legitimacy of the app by checking out whether the company is legitimate and operates the app, and ensure that any financial disclosures or documents are tailored to the app’s purpose and the proposed financial activity.
- Treat applications with limited and/or broken functionality with skepticism.
Financial institutions should warn their customers about fake websites and apps using their logos to dupe investors.
Defrauded financial institutions and their customers are encouraged to contact the FBI via the Internet Crime Complaint Center or their local FBI field office.
Stay safe, everyone!
The post Fraudulent cryptocurrency investment apps are duping investors appeared first on Malwarebytes Labs.