Protection Against Crypto-Fraud: A Look at What Steps Need to be Implemented

Ever since the launch of the first cryptocurrency, the entire industry has been embroiled in controversy. There is no denying that crypto has fueled hundreds of rags-to-riches stories, but there is also an equal number of stories about cryptocurrency fraud and how it has enabled scammers to make millions from unsuspecting investors and buyers. The profit potential of the market always draws people in, but if you truly want to real its benefits, you have to know how cryptocurrency fraud happens and how you can avoid it. If you are unable to do that, you will end up losing your hard-earned money. This session takes a look at how cryptocurrency frauds happen and how they can be avoided.

Transcription

Robert Bateman:

Hello. Thanks so much for rejoining us here at Fincrime Global day two, and a big thank you to all of our sponsors and our wonderful selection of speakers. And of course, to you, the audience, for joining us today. Next up, we have a session on protection against crypto fraud. We’re going to be looking at what steps need to be implemented there. This is a particularly hot topic at the moment for anyone anywhere near the crypto space. So I’ll hand over now to our host for this session, Cuneyt Eti, who is director at Sius consulting. Over to you, Cuneyt.

Cuneyt Eti:

Hi everyone. This is Cuneyt. I’m the director of Sius Consulting, focusing on forensic risks. And I’m also one of the co-founders of Capexmove, which is a London-based financial technologies company, focusing on creating blockchain based solutions for capital markets. Today, we are joined by two very good panelists, Robert Williams, who is a crypto/AML specialist. Thanks, additional kudos to Robert, because it’s quite early there as far as I know. Thanks being with us. And we also have Basil Manoussos, who is the manager of Cyber Academy, School of Computing at Edinburgh Napier University. Welcome, gentlemen. And so, this is a quite interesting topic. Last time we talked about crypto, we were quite bombarded by interesting questions from the listeners. Therefore, this time, I haven’t listed a lot of questions, but towards the end of the session, we’ll be welcoming the questions from the listeners. But I would like to start with the basics and ask you the most obvious question, Robert. What are the most common frauds you have recently observed in the crypto markets?

Robert Williams:

Okay. Okay. Robert Williams here. Well, I’ve put together a slide or two. I found that there’s about eight types of cryptocurrency frauds and scams. We’ve got financial crime, which I think is obvious. Scams on the initial coin offerings. The pump and dump schemes, just like stocks. Market manipulation, just like a stock. An unscrupulous promoter, which has to do with actually music. Broker-dealer fraud. Basically traditional theft, where they’re just hacking your crypto wallets. And the wonderful Ponzi scheme. So it’s like… What you’ve probably heard in the initial, a few years back, was the initial coin offerings was a lot where when the first offering of a particular crypto for sale, it’s called an ICO. Initial coin offering. And that’s where they’ll prey on the unsophisticated.

Cuneyt Eti:

Basil. Maybe you can add your comments on the same question. What’s your take on the most common frauds you’re observing in the market?

Basil Manoussos:

Yes. I think that Robert has dug into this a lot more than I have. But the one that I’ve been following, especially on, as a social engineering threat is all the websites that are offering a Bitcoin methods for making money and the Bitcoin method, the Bitcoin code, and things like that. They are not just one of criminals who are running these scams. This is organized crime. These are very well established crime. The websites are popping up that it’s the same material, the same content, the same website. They mimic BBC and other reliable websites. They register thousands of domains. I’ve actually had the last… The year before, I actually found a new domain, a new website, a new domain name that was registered the same day. And it was already advertised on Google ads in Australian news channel.

Basil Manoussos:

Okay. And when I follow that, and I check in on who is, how long that domain exist, it was registered the same day, just the time difference between the UK and Australia. And there were many domain names that when I got them, I rearranged the words. They all had hyphens between them. So I rearrange the words and the numbers, and I realized that those domain names were all registered. They existed as I imagined. And they were all registered the same day. So every one of those websites had SSL certificates. They were properly set up and they were properly advertised. So the advertisements had been updated to show the new website.

Basil Manoussos:

And what happens is that you set up this website, Google or other security companies mark it as a fraudulent website, it’s there for a few hours or a day or two, at best. And when it’s blocked by Google, you just kill it and you replace it with a new domain. So it’s the same material, the same website, probably the same hosting. You just kill the domain name and assign a new one. And as much as you know, you keep seeing those things repeated and repeated through advertisements from serious sources, like a news channel. At some point, people are starting believing that, “Well, this might actually be the real thing.” And that’s how it works.

Cuneyt Eti:

Yeah. Yeah. Definitely. Especially when the stakes are too…

Robert Williams:

A little bit scary. Because it’s professional, but it’s sort of dodgy, also, at the same time.

Basil Manoussos:

It is, but if you are researching this like I do, you see that it’s the same content, the same side articles, the same pictures, the same everything. Things that were there two years ago, they’re still there. So it is organized crime. This is not something that a kid on his bedroom is doing. This is… Because you need people to spend time, to arrange all the advertisement, to arrange the SSL certificates, to change the SSL certificates on so many copies of the websites every single day. So you need to invest money to do those things. Money and time. And they do. And that’s how organized crime is. It’s not a one of… You didn’t just find opportunity. You grabbed something, and you left.

Cuneyt Eti:

Okay. I would like to ask one follow up question to both of you before jumping to questions from the audience. What are the red flags that ordinary people should be aware of who are considering to invest in those things? Maybe you can take that, Basil.

Basil Manoussos:

Well, anything that says that it’s going to make you money is red flag by itself. And even, I’m a crypto and blockchain skeptic. But even if you go to the… How do you call it? To official websites of cryptocurrencies, they actually tell you, don’t trust any systems. There are no systems. Everything that you see outside an official channel is, by default, going to be a fraud. Anything that promises you that it’s going to make you quick money or… If there are words like guaranteed. Or making money. Or great investment. Everything like that is a flag. So it is a flag in normal investment, in normal things, so the same applies to cryptocurrencies. And all those things are flagged. Anything that comes into your inbox is a flag.

Basil Manoussos:

You should just delete it, unless you register with bitcoin.com and you are receiving any newsletter from there. Everything else is bound to be fraudulent. And then, the other flag is people’s ignorance, to be honest. People don’t do their due diligence. Just look around and see how much… Bitcoin is a finite. For example, is a finite, has a finite number of coins. Look at what percentage of that has been stolen. By definition, you don’t get so much gold or platinum or dollars stolen, and if they are, they can be replaced. You lost your Bitcoin, you lost it.

Cuneyt Eti:

Yeah. That’s correct. By the way, do you have anything to add to the same question, Robert? Like what are the things…?

Robert Williams:

Yeah, I was just going to say and add on to what Basil was talking about earlier. There are reverse email lookups, you have reverse phone lookups, social media, fingerprinting. Look at the social media account. Does it look like it’s legit? You were talking about domains. Does the email address use a disposable one? Is it new? Is their user in the location that they say they are? Like you said, due diligence. It doesn’t take a cool rocket scientist to figure out like something… The old rotten in Denmark thing. I don’t know if you have that there, but data enrichment tools you can find out right away where the digital footprint, if they’re in the right direction, just basic AML, KYC, and knowing who you’re dealing with. So it’s KYC still in the crypto world. You got to find out who you’re dealing with. And I know it sounds simple, but…

Cuneyt Eti:

Yeah, absolutely. Absolutely. My take from this thing is, I think some people like it, but I find it quite questionable when there’s a celebrity endorsement.

Robert Williams:

Yeah. That’s the promoter one.

Cuneyt Eti:

Kind of thing. Yeah. That’s my take. So I would like to close this topic with something maybe more concrete for the listeners. What are the tools or…? Do we have any tools out there we can use as everyday users to become victims of such schemes? Maybe Robert, you can take that question.

Robert Williams:

Well, besides what we’re saying, normal enhanced due diligence, there are a number. You have Chainalysis. You have Elliptic. One of the first certifications I got, it was a different tool. When I originally started researching and getting enamored with crypto, I didn’t believe it was, if it was lost right away and you’re done, that’s it. You’re not getting it back. But you found out with the people from Manhattan, that couple, that was from like four or five years ago. And you were able to retain the crypto, the gas line, the meat, where they had the fraud two months ago. Where they can find out and just had the tools. Just like a normal AML, where they’re copying an IP address, and detecting an IP address in the sanctioned country and following in the dark web and such. And they find that a lot faster. And that’s what has gotten me very interested in crypto too, because, as opposed to an AML, investigation could take years to follow the money and follow the paper, follow the documents. This is happening… Sometimes in the same amount of time and sometimes within weeks and days.

Cuneyt Eti:

Yeah, exactly. Exactly. I always tell my friends, if I’m getting into a dodgy business, actually I would be hesitant to use a blockchain base system, because that’s going to be there forever. Basil, what’s your thought on the same question? Do you the advise our listeners to take a look into specific tools?

Basil Manoussos:

I don’t know. Cause the thing with the specific tools is that you need to understand how they work and how to use them. So if you don’t have that background, it’s not necessarily going to do you any good. And it might expose you to more dangers if you use them wrongly. The other problem with cryptocurrency is that, often people who lose or have their coins stolen, they will not go to the police and they will not go to the lease because they haven’t declared any income. They will be owing tens of thousands of dollars to Inland Revenue.

Basil Manoussos:

Okay. So they will have to admit to other crimes in order to report the crime that had come upon them. So it’s all of those things that are complicated. With regards to tools, yes, there are tools. Yes, there are ways of tracing things. And if the people who stole a coin are not sophisticated enough to deal with that… We had this with WannaCry. You had this money going into that wallet, and all of law enforcement on the planet was monitoring that wallet. And the money just stayed there. On the other hand, there was another… I remember, there was a case. I remember the details now. There was a wallet with stolen Bitcoin, and one day, Bitcoins start moving to other wallets. And when that happened, the price of Bitcoin plummeted. So just by that move. It was amazing.

Cuneyt Eti:

With your response, I want to smoothly move to the next question, which is a question from the audience. I think it’s relevant to Robert. Are there any regulations out there to protect people from crypto fraud? And who’s responsible for that? Like we have a police in our daily world, but who’s policing those transactions in the blockchain world or crypto?

Robert Williams:

It’s kind of a sort of a mish-mash work in progress at the moment to connect. And they’re doing a lot. The U.S. is doing a lot. I’m very… I’m biased, maybe, because that’s where I am. But FATF. A while back, there was a thought that the UK was going to be the lead. The EU, there’s the MiCa, it’s called, markets. And I forget what the four letters signify. Just yesterday, there was a speech that the treasury secretary Yellen… There’s all sorts of FinCEN and OFAC guidance on what to do on crypto for it, and sanction evasion. And I just saw one of the questions that came up too, about a lot of people don’t realize there’s IP addresses, actually, on the SDN list, known IP addresses. So if you see that, it’s a simple one. You stop it, you block the transaction.

Robert Williams:

I think I would say within a month or two, we’ll get a clearer picture connect. It’s probably 95% there. And it’s definitely something that’s needed that people don’t realize like, “Ah, go with the same old thing. I just want to make money.” But it’s to your benefit to have these regulations in place, because the initial beginning of the crypto and the blockchain all at the market was, “Oh, this is just a scam.” Well, if you have the regulators, I guess I’m trying to say, is that the legitimacy will come. It’ll be enforced.

Cuneyt Eti:

Okay. Thank you. One other question from the audience is also something we slightly touched is about the roles of social media. I recall that back in 2017 and 18, there were cases where the advertisement of ICOs were being blocked or limited by search engines or social media websites, because of the probably perceived risks at the time. What’s your view? I would like to get your view on the ideal role of social media platforms. Should they act [inaudible 00:20:38] or should they take a more passive role? Maybe we can start with basil. What’s your view on that?

Basil Manoussos:

Yeah. I agree that they should take a more active role in controlling some of these events. You cannot always censor everything. You should not censor everything. However they should, for example, allow postings or pages from the original companies who are making initial coin offering and block other pages that are offering early registration and stuff like that. Because the chance, the risk of any page like that already postings like that, are much higher and they should give a way of assessing those things. At the same time, you’re not blocking a legitimate ICO. And the technology is there. It’s a matter of political costs for them, whether they’re going to be branded as censoring things. But for me, I think there should be a balance to all those things. You cannot just go out and let everything unchecked. And they, and the governments, have a duty of protecting their… They have a duty of protecting their users and governments have the duty of protecting their people.

Cuneyt Eti:

Okay. I will come back to that duty of the governments, but I would like to receive Robert’s comments on the same question before moving to that.

Robert Williams:

I believe it’s just simply the size of the internet, obviously, and social media. It’s like, you’re fighting… Like I’ll do an analogy with a policeman with a gun versus someone with an automatic weapon. There’s just so many people. The bad guys out there, millions and millions and millions. So are you going to have a room, say, in the FBI or MI6 filled with thousands and thousands of investigators monitoring it? I was just reading the other day that the U.S. Administration is adding more staff to FinCEN, the financial crime enforcement network where the SARs are tabulated. I don’t know why we waited this long to have more help. You would think that the government would have the people that are fighting the AML and the crime, and have the most staff behind them to detect all this and fight it and get it as quick as possible and to stop them.

Cuneyt Eti:

Okay.

Basil Manoussos:

Yeah. Sorry, if I may add. In the physical world of finance, you have the banks, and the banks are regulated. When the banks are offering a credit card or something, they abide by rules and they’re regulated. And when you go to your bank and ask for a credit card, you know what you’re doing, the bank knows who you are, there’s a transparency on what is happening there, how much money you get, how much money you owe, everything. You don’t get people who run businesses who say, “Oh, I can give you the credit cards, no matter what. Or I can give you credit cards, if you don’t have a credit score. I can give you credit cards that you cannot afford.” Those things are regulated and they’re regulated for a reason. And I don’t see why the regulation… If coins are the financial product, I don’t see why it shouldn’t be regulated the same way that things are regulated in the physical world, because there’s no protection. 16 to 21% of all Bitcoins are stolen. 16 to 21%. One in five.

Cuneyt Eti:

Okay. Yeah. That’s significant.

Basil Manoussos:

If your bank gets busted, the financial authorities are covering your savings in the bank and you don’t lose your money, at least up to a certain point. Who covers you when you lose a Bitcoin? Nobody.

Cuneyt Eti:

Yeah. I think that’s a quite interesting topic. I’m hesitant to move towards that because…

Basil Manoussos:

Fair enough.

Cuneyt Eti:

When you look at it, initially, the crypto markets promised to democratize the investment opportunities by eliminating or short cutting established rules of capital markets. And right now, we are talking about a stage free from the capital market’s rules, and that comes with its own pros and cons. So, do you think we can have a balanced level of regulation for crypto markets? Because a lot of crypto fans or blockchain fans will say that if you apply the same level of regulation to crypto markets, it’s going to kill the innovation as well.

Basil Manoussos:

Well, I don’t think that is the case. And you know what? Avoiding the banking system, for example. The finance system, the way it is. Avoiding private companies, the way they are, is one thing. Making profits out of something and not paying taxes, for example, is a totally different thing. Why should I have to pay taxes on my salary? I’m working like everybody else who is working a full time job. I’m working five days a week, at least, and I’m working a lot more in reality. And I have to pay taxes for everything I do, for the money I make, and someone who does nothing but buying, or was lucky enough to mine, some coins early, when this was all just a joke. Making hundreds of thousands of pounds of money that they use in the real life. Okay. This is not a virtual money. This is money that you cash at some point, and you don’t pay taxes. And then, we complain about… About what? About Microsoft and Starbucks, that they don’t pay taxes. Where’s the moral count on that one, the people who democratize the finance system.

Cuneyt Eti:

Yeah. It’s like democratizing tax evasion, maybe.

Basil Manoussos:

Yeah. You know what? Why is it wrong for me to smuggle drugs or anything like that and make money?

Cuneyt Eti:

Okay. One other thing. Because in the previous discussion question, you were saying the role of authorities, the responsibility to protect the people, right? And why do you think we still have these schemes in crypto world? Is it too hard for the authorities to protect people against these schemes? Maybe, Robert, you can take the microphone for this question.

Robert Williams:

I think. I hate to say it, but I think it’s just the old… There’s no such thing as a free lunch. Something doesn’t look legit and looks dodgy, you got to just question it. A Ponzi scheme is just a simple like, “Oh yeah, I’m going to keep giving money and keep giving money and keep giving money.” And the only way you’re going to keep making more… And the gentleman before that is going to get the money is to get more friends and get more banks or more people to sign up.

Robert Williams:

I did want to add something that Basil was talking about. That was the biggest problem in the beginning with crypto, blockchain, Bitcoin. Was that there’s no such thing as the FDIC, no Federal Deposit Insurance Corporation, to back up your money. So it’s like, “Oh my gosh, what am I getting myself into here?” And I haven’t heard anything about that lately, to be honest with you. This whole space moves so fast that there are so many other things that are popping up second by second, minute by minute, hour by hour. So it’s sort of gone by the wayside. I haven’t heard, and I read a lot, I haven’t heard anything about that lately.

Cuneyt Eti:

Yeah. On that end, I can make a comment. I think there’s a fundamental difference between the crypto and the financial system as we have… Whereas in the financial system, as we have, the banks or financial institutions act as a custodian for our assets. That’s why they’re responsible. But in the crypto world, you have the option to be the custodian of your own assets, like, saving, keeping your money, or whatever under your pillow, under your bed. But on the other hand, we see that some financial institutions started to move into crypto space. So for example, as far as I know, State Street is offering custodial services to their clients. And I assume, if you use their services, if use State Street as your custodian, they will have some form of responsibility for your lost assets and… Welcome back, Basil. I want to…

Robert Williams:

I thought you left.

Cuneyt Eti:

I should say that you disappeared just after making a comment about taxation. We should know that as well.

Basil Manoussos:

I thought you just blocked me out. I thought I went too far. No, no, sorry, sorry. My wifi dropped. Sorry. I apologize for this.

Cuneyt Eti:

No problem. So, looking at the last couple of years, do you think that we have a, from a perspective of crypto fraud…? Do you think we have a downward trend or upward trend? Is things getting worse and worse? Or are things getting better and better each day or each week? Maybe you can take that, Basil.

Basil Manoussos:

From the part that I investigated, which was the use of social engineering, I have to say it’s gone up. There are different estimates on how high, how more and how often we see this kind of frauds. These are just estimates, but the amount of fraudulent websites that I keep seeing popping up and the emails that I receive, or other people receive and they send me, is increasing. We need awareness. People need to understand that all those things are fraudulent, but those things will keep coming up. I don’t see any downward trend. And even if web hosting companies, and Google, the kind of companies that are behind the entire browsers, like Chrome, they do their job and they do block those things, but they need some time that… And that is not weeks or years now. It is hours or days, but if it takes you 48 hours to take down a fraudulent website, if it catches one victim, it’s job well done for the criminals.

Cuneyt Eti:

Okay. Thank you. I think next question is… Robert, that falls onto you.

Robert Williams:

I was going to say, I actually have a statistic that I found in my research. There is a thing called Action Fraud at the UK’s National Reporting Centre for Fraud and Cyber Crime. And they reported that, between June of 2020 and June of 2021, that the crypto fraud reports increased by 116%, which kind of surprised me too. I didn’t realize that it was that high.

Cuneyt Eti:

Yeah.

Basil Manoussos:

It was.

Cuneyt Eti:

So Robert, I would like to ask you one question from the audience. It says, “Regarding onboarding any crypto companies or companies using crypto, how can we mitigate risks?”

Robert Williams:

I’m sorry. I didn’t hear that. I had to turn off my speaker.

Cuneyt Eti:

Yeah. The question is, regarding onboarding any crypto companies or companies using crypto, how we can mitigate risks. Like, you know…

Robert Williams:

I don’t think it’s anything hard. It’s just, you can leverage what I’ve been doing for years in the AML world and the VSA and the Patriot Act and OFAC KYC. And just extrapolate that to the crypto world. Know your customer. Know your customer’s customer. KYCC. The EDD, who you’re dealing with. I think that was part of it too. Like, “Oh, you just have a name on a computer. Or you have numbers on a computer. And who the heck are these people? And how am I dealing with someone that I don’t really know?” It’s just, at least the old days when you had a bank, your customer came into the bank and you saw that person. I mean, those days are long gone, but now, it’s so far the other way that that’s the whole part of the initial worry. Was the unknown. And I don’t know that’s going to get much better anytime soon, the unknown part of it. And to get to know the unknown to the known, then you are going to obviously, be more comfortable, but I don’t believe that we’re there yet.

Cuneyt Eti:

Okay. I think we are entering into last five minutes of our time. So I would like to ask you a hypothetical question. Assuming that you have all the power in the world and you were asked to come up with a framework, like governance framework for the markets, what would be the things you would recommend to implement for the crypto world? Maybe, Basil, you can start with some thoughts.

Basil Manoussos:

Me? Sorry.

Cuneyt Eti:

Yes.

Basil Manoussos:

That’s an interesting question. I think that if people want and need to use cryptocurrencies, those should be regulated. And if I had this kind of power, I would say, they will be government regulated, not government run cryptocurrency, but government regulated, like all the other financial products are, so that there is a kind of stability. There is a form of transparency and there is a relatively safety for the people who buy and use cryptocurrency, because I disagree with the word democratization that’s been used in cryptocurrency. It’s not democratization. Breaking laws and tax evasion is not democratization. And we cannot go on like that. And there are countries that are bound to actually ban cryptocurrencies soon. And as I said, I’m a blockchain skeptic. And I had two experiences recently. The one was the cybersecurity guru, Bruce Schneier, who was a guest at the university. He gave an online speech and he expressed his distrust on cryptocurrencies and blockchain.

Basil Manoussos:

And when somebody asked, “Well, what if you had to do that? And he says, “For the love of God, don’t.” And recently in another conference, down in London, Tim Burners-Lee, the inventor of the worldwide web. He didn’t go that far, but he made it clear that he wouldn’t trust putting sensitive information, financial information on a blockchain. And I’ll have to agree with them. I felt until I heard those people saying those things, I was in the minority, but at least, someone else agreed with me. So yes, that’s my take. There should be a control on that. And also, there should be a control on anything that is being put on a public blockchain, because things may look very safe on the public blockchain right now. But other forms of cryptography were safe 20, 30, 40 years ago. And they’re not now. And when you put them out there, everybody who is in that blockchain is going to have a copy of everything. And when that is going to be broken, they’re going to have all the information that they need about you.

Robert Williams:

That’s for another show.

Basil Manoussos:

Sorry.

Robert Williams:

That’s for another show. You could do a whole nother top…

Basil Manoussos:

Oh, yeah. Yeah, yeah, yeah. But with cryptocurrency, it’s more on less the same thing. There needs to be some form of regulation. And tax tax evasion is not democratization. Pablo Escobar democratized the need of the people to enjoy cocaine, in that sense. Why do we brand him a criminal? He democratized it.

Robert Williams:

Monetize it, right?

Basil Manoussos:

Monetize it and democratize. People monetize Bitcoins as well. There are people who make money.

Cuneyt Eti:

What’s your response? What would be your response to the same question, Robert?

Robert Williams:

I believe that it… I have a little bit of a different feel. Since I’m coming from the compliance world, I don’t think we’re there yet. But within a few months, maybe three, six, another couple of quarters, you might feel better in certain areas. Not that your specific topic you’re bringing up the cyber crime part, and all your data is out there. I’ve been speaking to people lately about how is that really safe? To your point, Basil. But the trading wise and stuff, and that end of it, but the cyber crime world part of it and aspect, portion is just like, I would definitely have to agree with you. That’s out of hand. But as opposed to the compliance part with the regulations and all the countries getting together, and FATF, and EU, and the U.S. has done a lot. I think we’re almost there in that respect, but the cyber crime part and… No, definitely not.

Basil Manoussos:

Nope.

Cuneyt Eti:

Okay. I should also clearly say that I’m quite [inaudible 00:42:51] on blockchain technology, because my views are obviously subjective, as someone who has been working on it for the last four, five years. But I agree with that. It’s not there yet. There are lots of things to be done from both technological perspective and from a regulator perspective. From a financial perspective, a lot of things that blockchain enables people to do is mind shifting in that there was no regulation about it up until recently. Actually right now, the regulators are trying to catch up with tech. So hopefully at some point we’ll have a good balance, so that the technology will serve to the people not to criminals. I think we have reached to the end of time that was allocated to us. I would like to thank my panelists and the opportunity to speak. And yeah, I think that’s all from us for today. It’s back to you, Robert.

Robert Bateman:

Thanks so much. And that’s a really interesting conversation there. Such a difficult area, crypto fraud. We’re seeing some very high profile incidents recently of crypto hacks, crypto fraud. I think it’s likely to get worse before it gets better, but there are things, as we’ve heard, that you can do to mitigate the impact. So we’ve got a quick break now. 13 minutes. Why not use this time to have a look around our platform and learn more about the work we do at GRC World Forums and our sponsors indeed? And our next session is on the importance of a strong AML.